Directory
Skills and plugins
Search the directory and filter by grade or ecosystem. Live entries are A, B, C and D. No F grades are published yet. 15739 entries are listed. Only entries the scanner has graded are listed.
Grades are a hygiene check, not a security guarantee.
This grade is a hygiene screen, not proof of safety.
Showing 101 to 150 of 1,228 Grade D entries. Page 3 of 25.
Listed A to Z by name.
No entries match that filter.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +1 more
packages/create-gh-app/create-gh-app.mjs:207 fs.rmSync(dir, { recursive: true, force: true });janee (MCP server)
Compatibility: Not stated.
>
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
package.json:14 prepareJitsu (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="https://github.com/jitsucom/jitsu/blob/newjitsu/.readme-assets/github-hero-light-mode.png?raw=true#gh-light-mode-only" /> <img src="https://github.com/jitsucom/jitsu/blob/newjitsu/.readme-assets/github-hero-dark-mode.png?raw=true#gh-dark-mode-only" />
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +3 more
shared-infrastructure-e2e.test.ts:631 if (fs.existsSync(p)) fs.rmSync(p, { recursive: true, force: true });KIAgent (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="assets/icon.png" alt="KIAgent logo" width="112"> </p>
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES SECRETS_PATH_CREDENTIAL +1 more
plugins/knowledge-space-codex/skills/ks-codex/scripts/ks_readonly_audit_runner.py:104 result = subprocess.run(Knowledge Space Codex Toolkit (Plugin)
Compatibility: Not stated.
[Русский](#русская-версия) · [English](#english-version)
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
scripts/check-krypton-goal.py:75 result = subprocess.run(krypton (Skill)
Compatibility: Not stated.
Goal-based planning and proof gate for production-grade AI coding agent work.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +2 more
integrations/llm-latchkey/llm_latchkey.py:55 result = subprocess.run(latchkey (Skill)
Compatibility: Not stated.
Inject API credentials into agent requests.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
README.md:64 curl -fsSL https://raw.githubusercontent.com/moulwyse/lattice/main/scripts/install.sh | bashlattice (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="docs/assets/lattice-mark.png" alt="Lattice mark: a bounded repository slice ending in a verified result" width="128"> </p>
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK SECRETS_PATH_CREDENTIAL +1 more
bin/leads.js:66 if (force && fs.existsSync(dest)) fs.rmSync(dest, { recursive: true, force: true });leadcraft (Plugin)
Compatibility: Not stated.
Lead generator for freelancers and agencies.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV +1 more
package.json:10 preparelife. scored. (MCP server)
Compatibility: Not stated.
**You are already a number.**
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +2 more
mcp/server.mjs:612 if (signal?.aborted && created?.path) await fs.rm(created.path, { recursive: true, force: tlinmas (Plugin)
Compatibility: Not stated.
Proof-carrying defensive security reviews for AI-assisted software, with deterministic policy, portable evidence, and human review required.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
AGENT_HIDDEN_STEP
skills/setup-scenario/SKILL.md:49 Do not launch the test, and do not tell the user a test is running. The launLoadster (MCP server)
Compatibility: Not stated.
Loadster load testing and synthetic monitoring integration.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
parity/record.py:49 p = subprocess.run([sys.executable, "-m", "loci.cli", *args],loci (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.3M1RY33T/loci -->
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV +1 more
apps/api/src/embedding.ts:177 const response = await fetch(`${this.config.baseUrl}/v1/embeddings`, {Lore Context (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST OBFUSCATION_ENCODED_BLOB
package.json:15 prepareMaasy AI Marketing Copilot (MCP server)
Compatibility: Not stated.
**MCP server for Maasy** , connect Claude to your marketing intelligence.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_LIFECYCLE_HOOK INSTALL_UNPINNED SECRETS_PATH_CREDENTIAL +1 more
package.json:24 preparemaestro (Plugin)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV OBFUSCATION_MINIFIED_PAYLOAD
.gitignore:10 credentials.jsonMars Cost Router (Plugin)
Compatibility: Not stated.
> **An independent, instruction-driven delegation policy for Codex.** > Route by risk and effort; verify at the root.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
package.json:17 prepareMcp Bigquery Server (MCP server)
Compatibility: Not stated.
<div align="center"> <img src="assets/mcp-bigquery-server-logo.png" alt="BigQuery MCP Server Logo" width="400"/> </div>
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB +1 more
CLAUDE.md:265 SSH_PRIVATE_KEY_PATH=~/.ssh/mcp_deploy_key # or your key pathMcp Checklists (MCP server)
Compatibility: Not stated.
We're a team of security and AI enthusiasts building [MCP Manager](https://mcpmanager.ai), a comprehensive MCP security solution for businesses of all sizes.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +2 more
src/oauth.ts:155 await fs.unlink(this.tokenFile);Mcp Evernote (MCP server)
Compatibility: Not stated.
A Model Context Protocol (MCP) server that provides seamless integration with Evernote for note management, organization, and knowledge capture.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
scripts/verify_dataset.py:99 raw = subprocess.run(MCP Junction (MCP server)
Compatibility: Not stated.
Search a nightly-refreshed directory of MCP servers by keyword, category or topic.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
.github/scripts/chain_feed.py:1420 completed = subprocess.run(Mcp Plugin Dotnet (MCP server)
Compatibility: Not stated.
**MCP Plugin for .NET** is a comprehensive solution for integrating .NET applications with the [Model Context Protocol (MCP)](https://modelcontextprotocol.io/).
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_UNNAMED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV +2 more
scripts/publish-mcp-registry.mjs:89 ? await fetch(`https://registry.npmjs.org/mcp-searxng/${version}`, optionsMcp Searxng (MCP server)
Compatibility: Not stated.
Private web search for AI assistants via SearXNG , supports Claude, Cursor, and any MCP client
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK SECRETS_PATH_CREDENTIAL +2 more
scripts/benchmark.mjs:78 if (fs.existsSync(AUDIT_LOG)) fs.unlinkSync(AUDIT_LOG);Mcp Slim Guard (MCP server)
Compatibility: Not stated.
MCP Slim Guard gives a host one deliberate way to reach authorized upstream tools.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
README.md:174 > **Linux quick install:** `curl -fsSL https://install.mcpmux.com | bash`McpMux (MCP server)
Compatibility: Not stated.
**[Website](https://mcpmux.com)** · **[Download](https://mcpmux.com/download)** · **[Discover Servers](https://mcpmux.com)** · **[Features](https://mcpmux.com/features)** · **[Discord](https://discord.gg/b4RDmwAHAN)**
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_HOST_FROM_INPUT NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
docker/runner-gpu/runner.sh:21 curl -sS -m 30 -X POST -H "$AUTH" -H 'Content-Type: application/json' \MDEngine (MCP server)
Compatibility: Not stated.
MD workbench for agents: 13 analysis tools, renders, hosted GPU runs; LAMMPS + OpenMM.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +1 more
scripts/bundle.cjs:23 fs.unlinkSync(MANIFEST_DEST);Mediawiki Mcp Server (MCP server)
Compatibility: Not stated.
An MCP (Model Context Protocol) server that enables Large Language Model (LLM) clients to interact with any MediaWiki wiki.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +2 more
clients/python/scripts/check_package.py:35 subprocess.run(membrane (Skill)
Compatibility: Not stated.
<p align="center"> <img src="static/img/logo-mark.svg" width="72" height="72" alt="Membrane logo"> </p>
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
scripts/release_checks.py:163 result = subprocess.run(memdsl (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.Liyuan1992/memdsl -->
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
package.json:24 preparememex (MCP server)
Compatibility: Not stated.
Zettelkasten-based agent memory system with bidirectional links
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES SECRETS_PATH_CREDENTIAL
evals/scripts/run_mission_handoff_execution.py:171 run = subprocess.run(command, cwd=project, input=stdin, texMission Brief (Skill)
Compatibility: Not stated.
<p align="center"> <img src="./assets/readme-cover.svg" alt="Mission Brief" width="100%"> </p>
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
internal/tui/content.go:50 cmd := exec.CommandContext(m.ctx, editorCommand(), path) //nolint:gosec // the commmnemos (MCP server)
Compatibility: Not stated.
> **Local memory for AI agents.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +2 more
mcp_server/multisim_mcp/com_worker_client.py:109 self._process: subprocess.Popen[str] | None = NoneMultisim Mcp (MCP server)
Compatibility: Not stated.
[中文（当前）](README.md) | [English](README.en.md)
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +4 more
archify/explainer/check.mjs:159 } finally {fs.rmSync(directory,{recursive:true,force:true});}My Skills (Skill)
Compatibility: Not stated.
My personal AI agent skills , managed and synced with [**skillshare**](https://github.com/runkids/skillshare).
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_DELETE_FILES NETWORK_HOST_FROM_INPUT NETWORK_NO_FIXED_HOST +2 more
plugins/github/skills/github-tag/scripts/fetch_repo.py:38 out = subprocess.run(Natthasath Marketplace (Plugin)
Compatibility: Not stated.
A Claude Code plugin marketplace bundling 17 plugins, 69 skills, and 2 agents across PKM, project planning, session management, content writing, language, design, productivity, and legal/regulatory research , install with a single command and start using slash commands right awa
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
src/newswatcher/schedule.py:45 return subprocess.run( # type: ignore[call-overload, no-any-return]newswatcher (Plugin)
Compatibility: Not stated.
**English** | [한국어](README.ko.md)
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_HOST_FROM_INPUT NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
install.sh:3 # Usage: bash <(curl -fsSL https://raw.githubusercontent.com/Grenguar/node-aws-security-audit/maiNode Aws Security Audit (Skill)
Compatibility: Not stated.
Perform comprehensive security audits on Node.js, JavaScript, and TypeScript codebases.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +4 more
scripts/build-mcpb.mjs:30 fs.rmSync(trabajo, { recursive: true, force: true });Nyx5 (MCP server)
Compatibility: Not stated.
**Mail and ledger for AI agents, in a single piece.** An agent gets three things it has no other way of getting: an **address** of its own (`agent@domain`), a **mailbox** that holds while it is switched off, and a **ledger** where an agreement carries weight , payment is held un
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +2 more
assets/readme/source/render_hero.py:22 subprocess.run(Oil Skill Creator (Skill)
Compatibility: Not stated.
创建、评审、整改和发布 Skill。用户想从零创建 Skill、评审现有 Skill、检查它是否真正有用、修复触发或执行流程，或者改善首次使用、稳定性、Token 开销、文件分层、弱模型可读性与跨平台兼容性时使用。不要用于执行目标 Skill 负责的实际任务，也不要因为普通的编码、设计或写作请求触发。
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV +2 more
cmd/open-browser-use/main.go:1051 cmd := exec.CommandContext(ctx, name, args...)Open Browser Use (MCP server)
Compatibility: Not stated.
🔮 Platform-neutral Browser Use for AI agents: real Chrome automation with a CLI + SDKs, no lock-in, dead simple.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_DELETE_FILES NETWORK_HOST_FROM_INPUT NETWORK_NO_FIXED_HOST +3 more
packages/core/src/ai/v4/patterns/defect-patterns.ts:142 'os.popen("command")',Open Code Review (MCP server)
Compatibility: Not stated.
> **The first open-source CI/CD quality gate built specifically for AI-generated code.** > Detects hallucinated imports, stale APIs, over-engineering, and security anti-patterns , powered by local LLMs and any OpenAI-compatible provider.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
plugins/novel-studio-skill/skills/wawa-submission/scripts/run_page_workflow.py:103 completed = subprocess.run(Opencreator Novel (Skill)
Compatibility: Not stated.
[中文 README](README.zh-CN.md)
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL
tools.go:25 cmd := exec.CommandContext(ctx, argv[0], argv[1:]...)Openwrt Mcp (MCP server)
Compatibility: Not stated.
An MCP server that runs **on** an OpenWrt router, so Claude Code (or any MCP client) can inspect and change it over an SSH tunnel.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
package.json:15 postinstallospec (MCP server)
Compatibility: Not stated.
Spec-driven, agentic workflow framework for AI coding agents.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_HOST_FROM_INPUT
iaiops/connectors/serial/ops.py:161 self._sock = socket.create_connection(OT AIops (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.industrial-aiops/iaiops -->
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
crates/ovecc-core/src/facts.rs:797 /// OS command execution: `child_process.exec` / `execSync` / `spawn`.ovecc (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV +1 more
src/pagemap/server/robots_checker.py:88 with urllib.request.urlopen(req, timeout=_ROBOTS_FETCH_TIMEOUT) as resPageMap (MCP server)
Compatibility: Not stated.
Browse and interact with any web page at 97% fewer tokens
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +2 more
paper_search_mcp/sections.py:200 process = subprocess.Popen(_worker_command(), stdin=subprocess.PIPE, stdout=sPaper Search Mcp (MCP server)
Compatibility: Not stated.
MCP, CLI, Skills for searching and downloading academic papers from multiple sources like arXiv, PubMed, bioRxiv, etc.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV +1 more
package.json:36 preparePare (MCP server)
Compatibility: Not stated.
<h1><img src="assets/logo.png" alt="" width="80" valign="middle" /> Pare</h1>
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
scripts/validate_skill_examples.py:62 probe = subprocess.run(Pinescript Plugin (Plugin)
Compatibility: Not stated.
TradingView Pine Script v6 for coding agents, backed by a real validator rather than prose.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB +1 more
plugins/baimiao-toolbox/scripts/test-oauth.mjs:62 assert.equal((await fetch(callback)).status, 200)plugins (Plugin)
Compatibility: Not stated.
Official Baimiao plugins for Codex and AI assistants
This grade is a hygiene screen, not proof of safety.
