Directory
Skills and plugins
Search the directory and filter by grade or ecosystem. Live entries are A, B, C and D. No F grades are published yet. 15739 entries are listed. Only entries the scanner has graded are listed.
Grades are a hygiene check, not a security guarantee.
This grade is a hygiene screen, not proof of safety.
Showing 3051 to 3100 of 3,335 Grade C entries. Page 62 of 67.
Listed A to Z by name.
No entries match that filter.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
bundle/ui/index.html:7 <script type="module" crossorigin>var e=Object.defineProperty,t=(e,t,n)=>()=>{if(n)throMcp Interactive Editor (MCP server)
Compatibility: Not stated.
An interactive editor in front of every file write.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_UNCONFIRMED
package.json:24 prepareMcp Isap (MCP server)
Compatibility: Not stated.
Published on npm + MCP Registry (`io.github.matematicsolutions/mcp-isap`).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_UNCONFIRMED
package.json:8 prepareMcp Krs (MCP server)
Compatibility: Not stated.
Published on npm + MCP Registry (`io.github.matematicsolutions/mcp-krs`).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL
.gitignore:14 credentials.jsonMcp Server Job Assistant (MCP server)
Compatibility: Not stated.
A **Model Context Protocol** server, built in Python with [FastMCP](https://gofastmcp.com), that gives an AI host read-only access to a personal Google Drive and Gmail account so it can do the tedious half of a job search , while the decision to actually apply stays with a human
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
src/lib/app-automate-client.ts:385 const response = await fetch(`${APP_AUTOMATE_URL}${endpoint}`, {Mcp Server (MCP server)
Compatibility: Not stated.
TestingBot's official Model Context Protocol (MCP) server implementation.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
agent-skills/post-to-hacker-news/SKILL.md:62 curl -s "https://hn.algolia.com/api/v1/search_by_date?query=<wordMcp Session Bridge (MCP server)
Compatibility: Not stated.
A free MCP (Model Context Protocol) server that exposes **authenticated browser-session automation**: `session_*` tools that run in the user's own Chrome profile and real logged-in session, which cloud browser APIs cannot do.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_ENCODED_BLOB
index.html:9 <div id="zoCnDdis0" style="display:none">j19tCvPmfbkbm+KDRawXhUYzRc1+B3u/5xB4M3qUNDO5QmEA8fY6w0LWMcp Webasyst Codex Toolkit (MCP server)
Compatibility: Not stated.
---
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
rendezvous/src/index.ts:343 async fetch(req: Request, env: Env): Promise<Response> {Mcp Windows Remote Shell (MCP server)
Compatibility: Not stated.
A small proof of concept for running shell commands on a remote Windows computer from a local MCP client.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
src/plugins/transport/browser-cdp.ts:655 export const defaultFetch: FetchLike = (url) => fetch(url);Mcpaql Adapter (MCP server)
Compatibility: Not stated.
Reference implementation for MCP-AQL (Model Context Protocol - Advanced Agent API Adapter Query Language) adapters.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
packages/bridge/skills/references/api.md:155 fetchFn?: typeof fetch; // Custom fetch (testing/custom runtimes)mcpview (MCP server)
Compatibility: Not stated.
**MCP server framework and MCP Apps view toolkit for Deno and Node.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
scripts/install-openclaw.sh:264 echo " curl -fsSL $MIGRATE_URL | bash -s -- --api-key <key>"memorycrystal (MCP server)
Compatibility: Not stated.
To get memorycrystal on Windows, visit the release page and download the latest file from there:
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_DOTENV
package.json:12 postinstallMistraldocai Mcp (MCP server)
Compatibility: Not stated.
An [MCP](https://modelcontextprotocol.io/) server that converts documents and images to Markdown using Mistral AI's OCR and vision models.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:21 prepareMixpay Mcp (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
netops_field_notes/server.py:402 with urllib.request.urlopen(req, timeout=10) as r:Netops Field Notes Mcp (MCP server)
Compatibility: Not stated.
The things I check by hand on network gear, as tools your coding agent can call: what changed between two config snapshots and how much it matters, whether a config passes the CIS/PCI basics, why a port will not pass 802.1X, which certificates are hiding inside a config and when
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV +1 more
python/neurarch-trace/scripts/dev_copy_pth.py:52 os.remove(target)Neurarch Mcp (MCP server)
Compatibility: Not stated.
Know what a GPU job needs before it takes a reservation.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
src/newsdata_mcp/formatters.py:4 `fetch()`-style envelope (`{"status": "success"|"error", ...}`) and emitnewsdata.io-mcp (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
src/reach.ts:83 return given === undefined ? globalThis.fetch(input, init) : given(input, init);Nmts Cli (MCP server)
Compatibility: Not stated.
Command-line access to [NMTS](https://nmts.me) , **NeedMoreTruthStorage**, end-to-end encrypted cloud storage on the Walrus network, built by one developer ([needmoretruth](https://github.com/needmoretruth)).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL
src/index.ts:57 // Create temp .npmrc when NPM_TOKEN is providedNpm Mcp (MCP server)
Compatibility: Not stated.
**English** | [한국어](README.ko.md) | [中文](README.zh.md) | [日本語](README.ja.md)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:14 prepareOpen Zzjilu Mcp Server (MCP server)
Compatibility: Not stated.
[English](./README_EN.md)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST
scripts/build_snapshot.py:51 subprocess.run(Orca Profiles Mcp (MCP server)
Compatibility: Not stated.
An MCP server that reads and edits OrcaSlicer profiles.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_UNPINNED NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +2 more
requirements.txt:1 agent-connector-sdk[mcp]>=0.4.1,<1.0.0Owncast Agent (MCP server)
Compatibility: Not stated.
*Version: 2.3.3*
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
.claude/skills/parselbox/SKILL.md:62 Requires Deno (`curl -fsSL https://deno.land/install.sh | sh`) and `pip iParselbox (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.thesanjeetc/parselbox -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
config/mcp-tools.json:57 "description": "Number of recent commits to fetch (default: 5, max: 20)"Pipeline Assistant (MCP server)
Compatibility: Not stated.
**Automated CI/CD failure root-cause analysis powered by GitHub Copilot via ACP (Agent Client Protocol).**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
.agents/skills/pd-extract-python/SKILL.md:253 - `requests.get/post/put/delete(url)`, `requests.Session().get(upizza_doc (MCP server)
Compatibility: Not stated.
**File-based architecture-as-code for systems that are too big to hold in your head but too small to deserve a wiki.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_UNCONFIRMED
package.json:19 preparePlunk Mcp (MCP server)
Compatibility: Not stated.
A Model Context Protocol server for [Plunk](https://useplunk.com), the open-source self-hosted email platform.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +1 more
r3call-cli/source/api.ts:27 const response = await axios.get(`${API_BASE}/memories`, {r3 (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.n3wth/r3 -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
docs/LOCAL_AI_INTEGRATION.md:266 `http_request` - likely influenced by Python's `requests.post(data=...)`.Raven Nest Mcp (MCP server)
Compatibility: Not stated.
A pentesting toolkit that runs as an [MCP](https://modelcontextprotocol.io/) server, giving AI assistants structured access to industry-standard security tools through a safety-hardened interface.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
apps/desktop/src/components/RequestPane.tsx:188 label: t('Copy as curl without secrets'),Resolvr (MCP server)
Compatibility: Not stated.
**Resolvr is a free desktop GraphQL client for macOS, Linux and Windows that never loses your state , and that an AI agent can drive through the same engine you use.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
frontend/src/lib/api.js:15 const res = await fetch(`${API_BASE}${path}`, {Revora- (MCP server)
Compatibility: Not stated.
> A failed payment is not lost revenue.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
logics/libraries-frameworks/rokit.md:51 curl -sSf https://raw.githubusercontent.com/rojo-rbx/rokit/main/scriptRoblox Logics Mcp (MCP server)
Compatibility: Not stated.
<p align="center"><img src="assets/logo.svg" width="96" alt="Brickwise logo"></p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
lib/engine.mjs:96 res = await fetch(url, {Saferico Cli (MCP server)
Compatibility: Not stated.
Solidity security scanning with **201 detectors that run on your machine**.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
sciagent/code_tracker.py:72 result = subprocess.run(sciagent (MCP server)
Compatibility: Not stated.
Welcome to SciAgent!
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
seoagent/pages_run.py:128 with urllib.request.urlopen(req, timeout=timeout) as r:Seo Agent (MCP server)
Compatibility: Not stated.
<!-- Social preview: docs/assets/img/og-seo-agent.png (1280x640).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
src/index.ts:847 fetch(request: Request, env: Env, ctx: ExecutionContext) {servereverything.dev (MCP server)
Compatibility: Not stated.
A stateless reference [Model Context Protocol](https://modelcontextprotocol.io) server running on Cloudflare Workers.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
comparer-mcp/install.sh:33 curl -LsSf https://astral.sh/uv/install.sh | shSheet Music Mcp (MCP server)
Compatibility: Not stated.
Six MCP servers that let an AI assistant work with sheet music: read a photo of a score, render it, play single voice parts, edit it as text, compare editions and follow a singer in real time.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:26 prepareshipboard (MCP server)
Compatibility: Not stated.
**Know what needs to happen next across your repositories.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:25 prepareSih Br Mcp (MCP server)
Compatibility: Not stated.
Servidor MCP (Model Context Protocol) que responde perguntas sobre as **internações hospitalares do SUS** , o SIH/SUS do DATASUS, AIH reduzida , dentro do assistente de IA, sem TabNet, sem baixar `.dbc` do FTP e sem escrever SQL.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:23 prepareSonarr Mcp (MCP server)
Compatibility: Not stated.
Connect AI agents to [Sonarr](https://sonarr.tv/).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT NETWORK_NO_FIXED_HOST
law_sync.py:53 with urllib.request.urlopen(req, timeout=30) as resp:Startup Law Mcp (MCP server)
Compatibility: Not stated.
**Claude에 URL 하나만 등록하면, 창업 법령 50개·8,191개 조문과 K-Startup 지원사업을 실제 원문을 근거로 답합니다.** LLM이 지어내는 "○○법 제N조" 환각 대신, 인덱스에서 대조한 진짜 조문만.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
backend/mcp_ops.py:611 "reason must not be empty - say what refused the fetch (a 403, a "tailored (MCP server)
Compatibility: Not stated.
Tailored is a local web app that turns job-posting URLs into customized, well-structured resumes and cover letters.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +1 more
examples/drive-claude.mjs:43 fs.rmSync(cwd, { recursive: true, force: true });termmirror (MCP server)
Compatibility: Not stated.
An MCP server that gives AI agents real interactive terminal sessions , and a live web view where a human can watch those sessions and type into them.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
scripts/fixtures-record.ts:30 * `globalThis.fetch(...)` directly and offers no per-call injection point, soTiktok Mcp (MCP server)
Compatibility: Not stated.
Drive TikTok from your AI assistant , 11 tools over the Display API and Content Posting API, with OAuth 2.0 (PKCE) and plan-then-execute write safety.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST
package.json:22 prepareTossinvest Openapi Mcp (MCP server)
Compatibility: Not stated.
> **토스증권 Open API**를 개발자와 AI 에이전트가 쉽게 탐색·연동할 수 있도록 돕는 [MCP](https://modelcontextprotocol.io)(Model Context Protocol) 서버.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST OBFUSCATION_ENCODED_BLOB
scripts/domain-sweep.ts:84 const res = await fetch("https://data.iana.org/rdap/dns.json", {veritap (MCP server)
Compatibility: Not stated.
Check whether a real-world fact can be verified before an agent acts on it.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
tools/comment-vocabulary.py:40 run = subprocess.run(vivac (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_UNPINNED NETWORK_NO_FIXED_HOST +1 more
controllers/mcp_bridge/mcp_bridge.py:532 os.remove(path)webotMCP (MCP server)
Compatibility: Not stated.
Full-access MCP server for the [Webots](https://cyberbotics.com) robot simulator.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
scripts/vendor_copy.py:14 shutil.rmtree(p)Wsl Port Unified (MCP server)
Compatibility: Not stated.
# wsl-port-unified , WSL + Internet en 1 clic
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
bin/whoami.mjs:75 const r = await fetch(url, {X402 Trinity (MCP server)
Compatibility: Not stated.
**A drop-in `fetch` replacement that lets an AI agent pay for things by itself , with hard spending limits, no hosted wallet service, and no changes to the agent's own code.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
src/youtube_pub_mcp/auth.py:114 shutil.rmtree(path)Youtube Pub Mcp (MCP server)
Compatibility: Not stated.
Servidor MCP para publicação de vídeos no YouTube, com suporte a múltiplos canais e fila de agendamento em JSON.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
memories-off-skill/scripts/install.py:28 if subprocess.call([cmd, "-c", "import sys; sys.exit(0 if sys.versionAgent Skill Memories Off (Skill)
Compatibility: Not stated.
提供一个极简、结构化的本地知识管理方案，让你的 Agent 具备长期记忆，且文档对人类阅读和编辑也足够友好。
This grade is a hygiene screen, not proof of safety.
