Directory
Skills and plugins
Search the directory and filter by grade or ecosystem. Live entries are A, B, C and D. No F grades are published yet. 15739 entries are listed. Only entries the scanner has graded are listed.
Grades are a hygiene check, not a security guarantee.
This grade is a hygiene screen, not proof of safety.
Showing 3201 to 3250 of 3,335 Grade C entries. Page 65 of 67.
Listed A to Z by name.
No entries match that filter.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
plugins/blackbox/assets/anomalies.js:499 ackboxRequest(path,method,body) : await fetch(path, {method,headers:{Blackbox Plugin (Plugin)
Compatibility: Not stated.
<p align="center"> <img src="docs/images/blackbox-mark.svg" width="72" height="72" alt="Blackbox"> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
README.en.md:67 curl -fsSL https://qoder.com/install | bashCodex To Agents (Plugin)
Compatibility: Not stated.
**让 Codex 指挥 agents 干活。**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
packages/monster/evals/runners/tier2_perception_infer.py:106 proc = subprocess.Popen(Open Game Studio (Plugin)
Compatibility: Not stated.
Local projects, immutable assets, canvases and character production for Codex.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
OBFUSCATION_MINIFIED_PAYLOAD
plugins/pages-native/native/worker.js:119 function objects(d) {var out=[];['text','shape','image','chart','linPages Native (Plugin)
Compatibility: Not stated.
Native Apple Pages documents for Codex and MCP.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
setup.sh:74 curl -LsSf https://astral.sh/uv/install.sh | shAgent Library (MCP server)
Compatibility: Not stated.
A personal knowledge library for AI agents, built on [Arcade](https://arcade.dev) for the Model Context Protocol (MCP).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
Dockerfile:9 && curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \Agentic Developer Mcp (MCP server)
Compatibility: Not stated.
This project wraps OpenAI's Codex CLI as an MCP (Model Context Protocol) server, making it accessible through the TeaBranch/open-responses-server middleware.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
apps/cli/scripts/snapshot-models.ts:48 const response = await fetch(url, { signal: controller.signal });agentmako (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="apps/web/public/agentmako.png" alt="agentmako logo" width="180" /> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK
package.json:26 prepareAgy Bridge (MCP server)
Compatibility: Not stated.
Use when analyzing large files (>200 lines), more than 3 files at once, deep git/grep searches, web lookups, or adversarial reviews - delegates to the Antigravity CLI via agy-bridge MCP tools to save context.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
opencode/run_opencode_docker.py:38 bytes = subprocess.check_output(cmd, shell=True)Ai Suite (MCP server)
Compatibility: Not stated.
**AI-Suite** is intended to provide an **end-to-end path from zero to working AI workflows and agents** for developers and those who want to enable a local, private **AI solution**.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
cmd/aletheia/main.go:417 return exec.Command("git", "-C", root, "check-ignore", "-q", "--", name).Run() == nilaletheia (MCP server)
Compatibility: Not stated.
<p align="center"> <picture> <source media="(prefers-color-scheme: dark)" srcset="assets/brand/aletheia-lockup-dark.svg"> <img src="assets/brand/aletheia-lockup.svg" alt="aletheia" width="300"> </picture> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
.github/ISSUE_TEMPLATE/target-request.yml:37 Install: `brew install flyctl` (or `curl -L https://fly.io/instalAll Deploy (MCP server)
Compatibility: Not stated.
>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
internal/bootstrapapply/bootstrap_test.go:210 git := exec.Command("git", "init", "-q")Aoci Code (MCP server)
Compatibility: Not stated.
**A persistent, Git-versioned map of your entire codebase , written by your coding agent, governed by a local MCP server.** Agents read it once and know the system, instead of re-reading the repo on every task.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST OBFUSCATION_ENCODED_BLOB
scripts/package-smoke.py:81 result = subprocess.run(Apple Health Ai Bridge (MCP server)
Compatibility: Not stated.
<div align="center"> <img src="assets/brand/health-bridge-mark-512.png" alt="" width="80"> <h1>Apple Health AI Bridge</h1> <p>Bring Apple Health into your AI workflow.</p> <p> <a href="https://github.com/roian6/apple-health-ai-bridge/releases"><img src="https://img.shields.io/git
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES INSTALL_UNPINNED +1 more
aseprite_mcp/core/commands.py:54 result = subprocess.run(cmd, check=True, capture_output=True, text=True)Aseprite Mcp (MCP server)
Compatibility: Not stated.
A Python MCP server that gives AI assistants full control over [Aseprite](https://www.aseprite.org/) for creating pixel art and animated sprites.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
install.sh:4 # curl -fsSL https://raw.githubusercontent.com/mgorabbani/askdb/main/install.sh | sudo bashaskdb (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="docs/site/assets/logo.png" alt="AskDB" height="48" align="middle" /><strong>AskDB</strong> — Give AI agents safe access to your database.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES
agentloop/mcp_server.py:59 proc = subprocess.run(Athena Loops (MCP server)
Compatibility: Not stated.
**agentloop** is a lightweight Python framework for multi-agent orchestration.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
crates/barbacane-control/src/api/router.rs:106 /// WebSocket (`/ws/data-plane`), which authenticates with itsbarbacane (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="assets/img/barbacane_logo_transparent_bg.png" alt="Barbacane" width="200"> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV +1 more
scripts/build-skills-vault.mjs:2123 fs.unlinkSync(dest);Basecoat Ui Mcp (MCP server)
Compatibility: Not stated.
Offline MCP server for Basecoat UI (shadcn/ui look without React): 4-Stage Intent-Driven Tooling Layer, Kanso design direction, and WCAG 2.1/APCA quality inspection.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
beemcp/bee.py:16 response = requests.get(beemcp (MCP server)
Compatibility: Not stated.
**Unofficial** Model Context Protocol (MCP) server for interacting with your [Bee wearable](https://bee.computer/) lifelogging data.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV +1 more
package.json:39 prepareBitcoin Mcp (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
examples/notion-electron-bridge/electron-bridge.js:23 await fetch("/api/v1/clipboard/blocks");bla (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
dev.sh:121 text="$("${COMPOSE[@]}" exec -T web curl -sS -m 20 http://127.0.0.1:8000/readyz 2>/dev/null || truebrainoutside (MCP server)
Compatibility: Not stated.
**Your brain, kept outside your head , where your agents can read it.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
src/bringClient.ts:112 const res = await fetch(`https://api.getbring.com/rest/v2/bringlists/${listUuid}`, {Bring Mcp (MCP server)
Compatibility: Not stated.
This project implements a local Model Context Protocol (MCP) server in TypeScript that exposes the functionalities of the Bring!
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +1 more
linux/android-app/setup-toolchain.sh:19 curl -fsSL -o "$tmp/bt.zip" https://dl.google.com/android/repository/bBuddy Android (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="docs/banner.png" alt="Buddy: Claude Code, Codex, OpenCode, Antigravity and Grok in a bubble on your Android phone" width="100%"> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +1 more
cli/src/api.ts:41 const res = await fetch(new URL(path, baseUrl), {Callsign Server (MCP server)
Compatibility: Not stated.
<a href="https://devhunt.org/tool/callsign" target="_blank" title="callsign on DevHunt"><img src="https://devhunt.org/badge/callsign.svg" alt="callsign - Featured on DevHunt" width="220" height="54" /></a>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_UNCONFIRMED
package.json:35 prepareCap Mcp Plugin (MCP server)
Compatibility: Not stated.
> This implementation is based on the Model Context Protocol (MCP) put forward by Anthropic.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL
README.md:358 `~/.grok/mcp_credentials.json`. Then try: "List my 5 most recent unresolved Chatway conversationChatway Mcp Server (MCP server)
Compatibility: Not stated.
Manage Chatway live chat conversations, reply to customers, triage your support inbox, and search your knowledge base from Claude.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_DOTENV
package.json:14 prepareCline Mcp Memory Bank (MCP server)
Compatibility: Not stated.
Inspired by [roo-code-memory-bank](https://github.com/GreatScottyMac/roo-code-memory-bank)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
scripts/mcp_smoke_test.py:135 proc = subprocess.Popen(Cn Scraper Mcp (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="https://raw.githubusercontent.com/goesByhc/cn-scraper-mcp/master/assets/cn-scraper-mcp-icon.png" alt="CN Scraper MCP 图标" width="220"> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK INSTALL_UNPINNED SECRETS_PATH_DOTENV
package.json:28 prepareCode Screenshot Mcp (MCP server)
Compatibility: Not stated.
> MCP server for generating beautiful code screenshots directly from Claude
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES SECRETS_PATH_DOTENV
src/codedebrief/cli.py:948 shutil.rmtree(action.path, ignore_errors=True)CodeDebrief (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="docs/assets/codedebrief-wordmark.svg" alt="CodeDebrief" width="420"> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
detection-db/opengrep-rules/security-baseline/ssrf.yaml:17 - pattern: fetch($U + ..., ...)codeinspectus (MCP server)
Compatibility: Not stated.
**A local-first, privacy-preserving security MCP server and CLI.** Any AI coding agent (Claude Code, Cursor, Codex, Windsurf, Cline, Aider) can invoke CodeInspectus to scan AI-generated / "vibe-coded" code for real vulnerabilities, map findings to compliance frameworks as honest
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
.planning/phases/01-critical-safety/01-02-PLAN.md:313 "/root/.ssh/id_rsa",codeTree (MCP server)
Compatibility: Not stated.
**Stop feeding entire files to your AI agent.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
scripts/ingest/url-fetcher.ts:30 const response = await fetch(url, {Company Docs Mcp (MCP server)
Compatibility: Not stated.
Turn any documentation into an AI-searchable knowledge base.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
src/mcp-server.js:497 const screenshotResponse = await fetch(result.data.screenshot_url);Crawlbase Mcp (MCP server)
Compatibility: Not stated.
Crawlbase MCP is a Model Context Protocol (MCP) server that bridges AI agents and the live web.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
scripts/install.mjs:206 spawnSync("sh", ["-c", "curl -LsSf https://astral.sh/uv/install.sh | sh"], { stdio: "icrowbar (MCP server)
Compatibility: Not stated.
Retrieve CVEs and index them inside your codebase: a local SQLite index of CVEs, exploits and advisories that any tool in your repo can query.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
CLAUDE.md:137 curl http://localhost:8000/health # Control planedeepsecure (MCP server)
Compatibility: Not stated.
<!-- # DeepSecure: Zero-Trust Security Control Plane for AI Agents -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
package.json:22 preparedevcontext (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="https://i.postimg.cc/sghKLKf6/Dev-Context-banner.png" alt="DevContext Banner" width="100%" /> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK INSTALL_UNPINNED NETWORK_NO_FIXED_HOST +1 more
package.json:36 prepareDevWebUI (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL
.github/workflows/release.yml:51 printf '%s\n' "$DEPLOY_KEY" > ~/.ssh/id_ed25519Dexsql Release (MCP server)
Compatibility: Not stated.
English | [简体中文](README.zh-CN.md)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
sandbox/python/wrong_import_order.py:13 response = requests.get(url)dictator (MCP server)
Compatibility: Not stated.
**Fast structural enforcement, before the linters.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
src/digikala_mcp/catalog.py:105 data = (await fetch("/v1/search/", params))["data"]Digikala Mcp (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.sepehr071/digikala-mcp -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_HOST_FROM_INPUT
distill_kura/mcp.py:106 with urllib.request.urlopen(req, timeout=timeout) as r:Distill Kura (MCP server)
Compatibility: Not stated.
**A long-term memory for agents that is distilled, not accumulated.** Recall works by *meaning*, writing is gated by *evidence*, and one server can hold several separate memories , one per agent mode , so switching mode switches what the agent remembers.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_DOTENV
package.json:35 prepareDiy Tools Mcp (MCP server)
Compatibility: Not stated.
A Model Context Protocol (MCP) server that allows you to create custom tools/functions at runtime in any programming language and expose them to Claude or other MCP clients.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES INSTALL_UNPINNED +1 more
dna.py:127 result = subprocess.run(Dna Memory (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +1 more
scripts/benchmark-logger.mjs:132 fs.unlinkSync(logFile);Fast Filesystem Mcp (MCP server)
Compatibility: Not stated.
<!-- # fast-filesystem-mcp --> <!-- <img width="1460" height="82" alt="image" src="https://github.com/user-attachments/assets/d77b4f8a-2d21-4645-9584-39ae9c7a2c26" /> --> <img width="860" height="92" alt="image" src="https://github.com/user-attachments/assets/f4a8dfea-e922-4306-b
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
clients/gemini.md:116 "GOOGLE_APPLICATION_CREDENTIALS": "/path/to/credentials.json"Finops Mcp Resources (MCP server)
Compatibility: Not stated.
> Open-source **Model Context Protocol (MCP)** resources for **Cloud FinOps**: cloud cost optimization, AI cost management, FinOps automation, tagging governance, cost anomaly detection, and budget monitoring , across AWS, Azure, and GCP.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
README.md:141 pd download --identity ~/.ssh/id_ed25519 https://pixeldrain.com/u/xxxxxxGo Pixeldrain (MCP server)
Compatibility: Not stated.
`pd` is a command-line interface, Model Context Protocol (MCP) server, and Go SDK for [Pixeldrain](https://pixeldrain.com/).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
package.json:44 prepareHelp Scout Mcp Server (MCP server)
Compatibility: Not stated.
An [MCP server](https://modelcontextprotocol.io) that gives AI assistants direct access to your Help Scout inboxes, conversations, customers, organizations, threads, and Docs knowledge base.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
benchmarks/run_comparison.py:281 proc = subprocess.run(hersona (MCP server)
Compatibility: Not stated.
[**English**](./README.md) · [日本語](./README.ja.md)
This grade is a hygiene screen, not proof of safety.
