Directory
Skills and plugins
Search the directory and filter by grade or ecosystem. Live entries are A, B, C and D. No F grades are published yet. 15739 entries are listed. Only entries the scanner has graded are listed.
Grades are a hygiene check, not a security guarantee.
This grade is a hygiene screen, not proof of safety.
Showing 351 to 400 of 3,335 Grade C entries. Page 8 of 67.
Listed A to Z by name.
No entries match that filter.
Grade C, One medium finding, Hexagon
INSTALL_REMOTE_SCRIPT
package.json:17 preparecom.theaslangroupllc.pulse/pulsenetwork (MCP server)
Compatibility: Not stated.
Pay-per-query access to 68 intelligence APIs via x402 (real USDC charges on Base or Solana per call, no API keys, no subscription, no refunds).
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_UNPINNED NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
requirements.txt:2 mcp>=1.28,<2com.vandorla/workspace-tools (MCP server)
Compatibility: Not stated.
> ## This is a research honeypot.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_UNPINNED NETWORK_NO_FIXED_HOST OBFUSCATION_ENCODED_BLOB
requirements.txt:1 Flaskcom.wallet-connectors/wallet-verifier-mcp (MCP server)
Compatibility: Not stated.
Wallet4Agent provides the **trust layer** that AI Agents need to operate safely in the real world.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
skills/git-for-research-code/SKILL.md:118 out = subprocess.run(Combinatorial Optimization Skills (Skill)
Compatibility: Not stated.
A curated set of 76 Claude Code skills covering exact methods, metaheuristics, classic problems, and research workflow for combinatorial optimization.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
src/comfy_mcp/argv.py:67 ``subprocess.Popen`` raises a bare ``ValueError: embedded null byte`` on one —Comfy Mcp (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.Comfy-Org/comfy-mcp
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +1 more
__init__.py:149 result = subprocess.run(Comfy Pilot (MCP server)
Compatibility: Not stated.
Talk to your ComfyUI workflows.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL
README.md:44 - Avoids committing files with secrets (.env, credentials.json)Commit Commands (Plugin)
Compatibility: Claude Code.
Commands for git commit workflows including commit, push, and PR creation
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
app/assets/javascripts/completion_kit/application.js:132 fetch(url, {CompletionKit (MCP server)
Compatibility: Not stated.
Prompt evals over MCP: run a prompt on your dataset, score each output 1-5 with an LLM judge.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +2 more
src/compoid_mcp/client.py:837 result = subprocess.run(Compoid MCP (MCP server)
Compatibility: Not stated.
A collaborative repository where AI agents and humans share research, images, videos and papers.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +1 more
skills/computer-repair-skill/references/playbook-setup-cuda.md:49 wget https://developer.download.nvidia.com/cComputer Repair Skill (Skill)
Compatibility: Not stated.
让 Codex、Claude Code 等 AI Agent 成为你的跨平台电脑维修助手：64 个按需加载的 Playbook，覆盖诊断、清理、性能、网络与安全维护, , C 盘爆满、电脑卡顿、流氓软件、应用迁移、数据恢复都能直接问；先取证、再计划，确认后修改。
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
examples/whack-a-mole/run.sh:23 for command_name in node npm tmux curl git claude codex; doConcord Mcp (MCP server)
Compatibility: Not stated.
Live messaging for coding agents
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:17 prepareConstruct3 Mcp (MCP server)
Compatibility: Not stated.
> An MCP server that lets Claude, Cursor and other AI assistants read, analyze and safely edit Construct 3 projects , editor-faithful writes with backups and validation.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST
package.json:6 prepareContent Stack (Plugin)
Compatibility: Not stated.
A content operations ecosystem that transforms strategy into published outcomes.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_UNCONFIRMED
src/context_diamond/repo.py:95 completed = subprocess.run(Context Diamond (MCP server)
Compatibility: Not stated.
> Stop pasting the same messy context into every LLM.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
ch01/javascript/ollama-local-basic/ollama-local-basic.js:29 const response = await fetch(`${ollamaHost}/api/geContext Engineering (MCP server)
Compatibility: Not stated.
**Context engineering** can be defined as the practice of designing systems that provide a Large Language Model (LLM) and AI agents with all the necessary information to complete a task effectively.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
package.json:19 prepareContext Kit (Skill)
Compatibility: Not stated.
> Generate AI context for your dev stack , works with Claude Code, Cursor, Windsurf, GitHub Copilot, Gemini CLI, or any LLM.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK SECRETS_PATH_DOTENV
src/git-hook-manager.ts:107 fs.unlinkSync(hookPath);Context Sync (MCP server)
Compatibility: Not stated.
Local-first project memory for AI coding tools over MCP.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED
bin/contextburn:334 r = subprocess.run(["python3", "-"] + args, input=src, capture_output=True, text=True, timcontextburn (MCP server)
Compatibility: Not stated.
Run efficiency for coding agents: share of paid tokens that became output, not context re-reading.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK
src/indexer.ts:124 fs.rmSync(lockPath, { force: true });Contextful (MCP server)
Compatibility: Not stated.
⚠️ This is in early alpha.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +2 more
packages/cli/src/commands/server.ts:125 await fs.unlink(pidFile);ContextPods (MCP server)
Compatibility: Not stated.
> _The comprehensive MCP development suite with advanced protocol features_
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_MINIFIED_PAYLOAD
inspector/web/app.js:58 const response = await fetch(path, { cache: 'no-store' });Coordinate Agents (Plugin)
Compatibility: Codex.
Coordinate multiple AI coding agents through a local-first, recoverable Agent Bus.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
.gitignore:8 id_rsaCoralSwarm Connect (MCP server)
Compatibility: Not stated.
Search and save your coding work in a CoralSwarm ocean: sessions, decisions, meetings.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
.cursor/hooks/trust_report.py:325 completed = subprocess.run(Corporate Site Harness (Plugin)
Compatibility: Not stated.
Evidence-gated Cursor delivery: digest-bound gates, corporate/site role split, factory control plane.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
plugin/mcp/countbean_mcp/hosted.py:345 with urllib.request.urlopen(req, timeout=self.cfg.timeout) as resp:Countbean Plugin (MCP server)
Compatibility: Not stated.
Hosted plain-text accounting in Claude Code: a git-backed [Beancount](https://beancount.github.io/) ledger, AI ingestion of statements and receipts into validated double-entry, and HTML/Excel reports.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
cowork-ai-os/skills/browse-skills/lib/fetch-live-catalog.md:23 ### Step 1 - Try live fetch (BOTH sources, in pCowork Ai Os (Plugin)
Compatibility: Not stated.
AI Operating System for Claude Cowork - install AI infrastructure instead of bouncing between chat tabs.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +1 more
package.json:32 postinstallCreate Chrome Extension (Plugin)
Compatibility: Not stated.
Six skills that scaffold a Chrome extension, fill the listing copy, capture screenshots, set up Chrome Web Store OAuth, and orchestrate submission.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL
plugins/creative-claw/skills/creativeclaw-render-html/references/project-packaging.md:25 4. When files change,Creative Claw (MCP server)
Compatibility: Not stated.
On-brand creative studio for AI agents: images, video, audio, and 3D.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +1 more
scripts/check-paths.py:37 tracked = subprocess.run(Creator Agent Plugin (Plugin)
Compatibility: Not stated.
Distribution metadata for the LottieFiles Creator agent plugin.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
src/creator_seo_mcp/onpage.py:35 resp = httpx.get(Creator SEO MCP (MCP server)
Compatibility: Not stated.
An MCP server for content creators that connects Google Search Console to your page content and ranks every SEO opportunity by estimated revenue, not vanity clicks.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK
package.json:17 prepareCred 1 (MCP server)
Compatibility: Not stated.
Look up domain credibility scores using the CRED-1 open dataset.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES SECRETS_PATH_DOTENV
harness/codex_runtime.py:186 completed = subprocess.run(crucible (Plugin)
Compatibility: Not stated.
<p align="center"> <picture> <img src="assets/logo.png" width="160" alt="Crucible logo" style="border-radius: 28px;" /> </picture> </p>
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:39 prepareCrystallize MCP (MCP server)
Compatibility: Not stated.
MCP server for [Crystallize](https://crystallize.com) headless commerce.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
scripts/validate-cursor-commands.py:275 if subprocess.run([sys.executable, str(check_script)], check=False).reCursor Commands (Skill)
Compatibility: Not stated.
Production-grade Cursor slash commands with paired skill contracts, behavioral evals, and ship-gate CI
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES SECRETS_PATH_CREDENTIAL
cursor_notebook_mcp/sftp_manager.py:668 os.remove(op_path)Cursor Notebook Mcp (MCP server)
Compatibility: Not stated.
This directory contains a Model Context Protocol (MCP) server designed to allow AI agents **within Cursor** to interact with Jupyter Notebook (`.ipynb`) files.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_DOTENV
mcp/tools/runtime.py:57 completed = subprocess.run(Cursor Odoo Plugin (Plugin)
Compatibility: Not stated.
Cursor Odoo Developer Plugin
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
scripts/install-local.mjs:81 fs.rmSync(LINK_PATH, { recursive: true, force: true });Cursor Plugin (Plugin)
Compatibility: Not stated.
AgentStack for Cursor: full backend ecosystem (8DNA, Rules Engine, Buffs, Payments) and 700+ MCP tools.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
.gitignore:8 id_rsaCursor Plugin (Plugin)
Compatibility: Not stated.
The shared memory and data layer for AI agents.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL +1 more
skills/rightbrain-tasks/SKILL.md:123 curl -s -X GET "https://app.rightbrain.ai/api/v1/org" \Cursor Plugin (Plugin)
Compatibility: Not stated.
Cursor plugin for managing Rightbrain AI tasks , browse, run, create, update, and export task configurations directly from your editor.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:30 prepareCursor Usage (Plugin)
Compatibility: Portable across standard formats.
Ask your AI agent about your team's Cursor spending.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
package.json:30 prepareCursor Usage Plugin (Plugin)
Compatibility: Not stated.
MCP server and Cursor plugin for querying Cursor Enterprise usage, spending, and analytics.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
Benchmarks/stream_gaps.py:99 response = urllib.request.urlopen(request, timeout=600)Daisy App (MCP server)
Compatibility: Not stated.
A Mac app that records your meetings and transcribes them on-device, with a local MCP server so Claude can read your calls.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED OBFUSCATION_ENCODED_BLOB
scripts/marketplace.py:110 runner: Callable[..., subprocess.CompletedProcess[str]] = subprocess.run,Damascus Ink Plugins (Plugin)
Compatibility: Not stated.
Ясность: три открытых MIT-скилла для юриста , грамматика · логика · риторика.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
infra/aws_runner/batch_deploy.py:265 subprocess.run(Darwin Agentic Cloud (MCP server)
Compatibility: Not stated.
**Paper:** [Bounded Execution and the Containment of Agent Traps](docs/bounded-execution.pdf) (preprint, SSRN under review)
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES INSTALL_UNPINNED NETWORK_NO_FIXED_HOST +2 more
.agents/hooks/telemetry_hook.js:16 ;if(d)return d}throw s}finally{try{this.fs.unlinkSync(l)}catch{}}}catch(t){Data Agent Kit (Plugin)
Compatibility: Not stated.
This plugin provides a specialized suite of skills for data engineers and database practitioners working on Google Cloud.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
src/datasentry/client.py:394 shutil.rmtree(target)DataSentry (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.Jackxiaozhiren/datasentry -->
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV
internal/cli/auth.go:72 c = exec.Command("open", url)DATPAQ (MCP server)
Compatibility: Not stated.
34 production API tools over one hosted MCP endpoint.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
dazzle_claude_config/aideep.py:85 return subprocess.run(["git", "-C", str(cwd), *args], capture_output=True, tDazzle Claude Config Sync (Skill)
Compatibility: Not stated.
**Git-backed sync for your Claude Code configuration (skills, commands, agents, hooks, and `CLAUDE.md`) across every machine you work on, with credential protection on the way in and backups on every write.**
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV +1 more
crates/mysql/src/tools/list_functions.rs:251 .fetch(dbmcp (MCP server)
Compatibility: Not stated.
A single-binary [MCP](https://modelcontextprotocol.io/) server for SQL databases.
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB
README.md:182 cp .env.example .envDebate Engine Synthesis (Plugin)
Compatibility: Not stated.
Ultimate AI Debate Panel Generator 2026 - Auto-Document Decision Synthesis
This grade is a hygiene screen, not proof of safety.
Grade C, One medium finding, Hexagon
SECRETS_PATH_CREDENTIAL
plugins/release-please/skills/setup/references/gotchas.md:49 necessarily the account you want. Use the matchinDeckHand (Plugin)
Compatibility: Not stated.
[English](README.md) | [中文](README.zh-CN.md)
This grade is a hygiene screen, not proof of safety.
