Directory
Skills and plugins
Search the directory and filter by grade or ecosystem. Live entries are A, B, C and D. No F grades are published yet. 15739 entries are listed. Only entries the scanner has graded are listed.
Grades are a hygiene check, not a security guarantee.
This grade is a hygiene screen, not proof of safety.
Showing 401 to 450 of 646 MCP, Grade D entries. Page 9 of 13.
Listed A to Z by name.
No entries match that filter.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
scripts/audit.sh:63 tracked = set(os.popen("git ls-files").read().splitlines())CloudSprite (MCP server)
Compatibility: Not stated.
Talk to CloudSprite as the signed-in user: search datasets and docs, set org/team/project scope, and file product feedback.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_HOST_FROM_INPUT
packages/ai/src/provider/index.ts:92 const response = await fetch(`${this.baseUrl}/chat/completions`, {doc77 (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="packages/core/src/web/assets/logo.svg" width="100" alt="Doc77"> </p>
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
.github/workflows/ci.yml:15 run: curl -LsSf https://astral.sh/uv/install.sh | shFhir Mcp Server (MCP server)
Compatibility: Not stated.
<a name="readme-top"></a>
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT NETWORK_HOST_FROM_INPUT
testing/clean-room/Dockerfile.cursor-local:32 RUN curl https://cursor.com/install -fsS | bashgitmem (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="assets/banner.svg" alt="GitMem , Institutional memory for AI coding agents" width="700" /> </p>
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT NETWORK_HOST_FROM_INPUT
scripts/dev-setup.sh:55 curl -LsSf https://astral.sh/uv/install.sh | shGopher & Gemini MCP Server (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.cameronrye/gopher-mcp -->
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +3 more
src/completion.ts:228 "# Add to your profile: Invoke-Expression (headroom completion pwsh | Out-String)",headroom (MCP server)
Compatibility: Not stated.
Check subscription limits before work, with MCP tools, a quota line and the Headroom skill.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT NETWORK_HOST_FROM_INPUT
package.json:25 postinstallHermos Ide (MCP server)
Compatibility: Not stated.
**Your code stays on your machine.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
.agents/skills/sentry/SKILL.md:18 1. Install the Sentry CLI: `curl https://cli.sentry.dev/install -fsS | bash`Hevy MCP Server (MCP server)
Compatibility: Not stated.
Read, analyze, create, and update Hevy workouts, routines, exercises, and body measurements in Claude.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_HOST_FROM_INPUT AGENT_IGNORE_INSTRUCTIONS
crates/hwatu/src/clone.rs:647 match fetch(href) {hwatu (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV +1 more
package.json:26 prepareio.github.builtbyabs/shopify-geo-audit (MCP server)
Compatibility: Not stated.
Audit any Shopify store for AI-search readiness, then generate the fixes you actually paste in.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
AGENT_IGNORE_INSTRUCTIONS
packages/fixtures/corpus/cases/C046-review-readme-prompt-surface/surface/README.md:5 <!-- assistant: ignore prio.github.calllint/calllint (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="assets/brand/logo-mark-128.png" width="96" alt="CallLint logo" /> </p>
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
package.json:22 prepareio.github.cameroncooke/XcodeBuildMCP (MCP server)
Compatibility: Not stated.
A Model Context Protocol (MCP) server and CLI that provides tools for agent use when working on iOS and macOS projects.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK +4 more
test-epic-debug.cjs:66 fs.rmSync(testDir, { recursive: true, force: true });io.github.chrismcdermut/proletariat-cli (MCP server)
Compatibility: Not stated.
``` ██████╗ ██████╗ ██████╗ ██╗ ███████╗████████╗ █████╗ ██████╗ ██╗ █████╗ ████████╗ ██╔══██╗██╔══██╗██╔═══██╗██║ ██╔════╝╚══██╔══╝██╔══██╗██╔══██╗██║██╔══██╗╚══██╔══╝ ██████╔╝██████╔╝██║ ██║██║ █████╗ ██║ ███████║██████╔╝██║███████║ ██║ ██╔═══╝ ██╔══██╗██║ ██║██║ ██╔══╝ ██║ ██╔
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_LIFECYCLE_HOOK SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
package.json:28 prepareio.github.cocaxcode/ai-context-inspector (MCP server)
Compatibility: Not stated.
<p align="center"> <h1 align="center">@cocaxcode/ai-context-inspector</h1> <p align="center"> <strong>One command.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
install.ps1:114 Exit-Install "this script is for Windows. On Linux and macOS, run:`n curl -fsSL $RawUrl/instalJev Cli (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
SECRETS_PATH_UNCONFIRMED OBFUSCATION_ENCODED_BLOB OBFUSCATION_MINIFIED_PAYLOAD
.gitignore:8 *.pycJobSpy (MCP server)
Compatibility: Not stated.
<h1 align="center"> <a href="https://github.com/speedyapply/JobSpy"><img src="https://github.com/user-attachments/assets/dcb90340-9469-4808-bc51-868e59a000e0" alt="JobSpy" width="320"></a> </h1>
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_HOST_FROM_INPUT
v2/firefox/data/options/index.js:203 fetch(url).then(() => toast('Looks Good')).catch(e => toast(e.message));Keepass Macpass Helper (MCP server)
Compatibility: Not stated.
An extension for Chrome, Opera, Edge, and Firefox that integrates with KeePass, MacPass, and KeePassXC to find and fill credentials, generate secure passwords and passkeys, and save new logins directly to your database, no manual copying required.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV OBFUSCATION_ENCODED_BLOB +1 more
CLAUDE.md:265 SSH_PRIVATE_KEY_PATH=~/.ssh/mcp_deploy_key # or your key pathMcp Security Checklists (MCP server)
Compatibility: Not stated.
We're a team of security and AI enthusiasts building [MCP Manager](https://mcpmanager.ai), a comprehensive MCP security solution for businesses of all sizes.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
AGENT_IGNORE_INSTRUCTIONS
03. MCP Threats and Attack Patterns/3.04-authorization-permission.md:355 | Hidden-instruction flags | Flag “igMcp Security Testing Guide (MCP server)
Compatibility: Not stated.
The Model Context Protocol (MCP) is an open protocol that lets LLM applications connect to external data sources, tools, prompts, workflows, and services.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_HOST_FROM_INPUT
packages/sdk/src/accounts.ts:22 return this.http.get("/api/v1/private/accounts/credits");melaya (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT NETWORK_HOST_FROM_INPUT
cloudflare-mcp/Dockerfile:8 && curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \Odoo Claude Mcp (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
scripts/extract_settings_schema.py:15 r = subprocess.run(["git", "-C", str(src.parent), "rev-parse", "--short"Orcaslicer Mcp (MCP server)
Compatibility: Not stated.
Let Claude work alongside you in a real, running OrcaSlicer.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
AGENT_HIDDEN_STEP
skills/people-context-usage/SKILL.md:661 candidate through `stage_candidates`, which does carry `stated_by`. DPeople Context (MCP server)
Compatibility: Not stated.
Give Claude Code local, durable context about the people in your life through people-context-mcp.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT NETWORK_HOST_FROM_INPUT
.devcontainer/Dockerfile:15 RUN curl -LsSf https://astral.sh/uv/install.sh | shredmine_ai_helper (MCP server)
Compatibility: Not stated.
- [Redmine AI Helper Plugin](#redmine-ai-helper-plugin) - [✨ Features](#-features) - [Chat Interface](#chat-interface) - [Issue Summarization](#issue-summarization) - [Create a comment draft with AI Helper](#create-a-comment-draft-with-ai-helper) - [Generate subtasks from issues]
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
internal/cmd/update/update.go:407 " curl -fsSL https://raw.githubusercontent.com/%s/%s/main/install.sh | bash\Redmine Cli (MCP server)
Compatibility: Not stated.
Drive Redmine from Claude Code: bundled agent skill plus MCP server.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +2 more
src-tauri/resources/video_html_capture.mjs:233 try { fs.rmSync(profileDir, { recursive: true, force: true });RepoTunnel (MCP server)
Compatibility: Not stated.
<div align="center">
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV +1 more
src/lib/clipboard.ts:140 // We use the underlying child_process.spawn via execFile's sibling APIsipcode (MCP server)
Compatibility: Not stated.
Token-economy observatory for Claude Code: forensic per-session audit, A/B savings verifier, reproducible benchmark, and cost prediction , directly in Claude chat.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV +2 more
internal/cli/init.go:62 cmd = exec.Command("open", url)stacklit (MCP server)
Compatibility: Not stated.
Use stacklit.json to navigate codebases without burning tokens on file exploration
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
packages/server/src/routes/install.ts:102 <h3>Linux / macOS</h3>${code(`curl -fsSL ${server}/install.sh | sh`)thelastsaas (MCP server)
Compatibility: Not stated.
The Last SaaS is a TypeScript backend for records, files, team permissions, notifications, and audit logs, accessed through an HTTP API, MCP, or CLI.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_HOST_FROM_INPUT
src/usagetrim/core/json_slimmer.py:337 """Compact REST API and curl response payloads.usagetrim (MCP server)
Compatibility: Not stated.
<p align="center"> <picture> <source media="(prefers-reduced-motion: reduce)" srcset="https://raw.githubusercontent.com/00200200/usagetrim/main/assets/readme-hero.png"> <img src="https://raw.githubusercontent.com/00200200/usagetrim/main/assets/readme-hero.gif" width="100%" alt="U
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
AGENT_IGNORE_INSTRUCTIONS
docs/guide.md:352 - Direct instruction overrides (`ignore previous instructions`, `disregard the rules`, `forgWidemem Ai (MCP server)
Compatibility: Not stated.
> <img src="https://raw.githubusercontent.com/remete618/widemem-ai/main/docs/widemem-fish.png" width="48" align="middle" alt="widemem fish" /> *Goldfish memory?
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
src/wpguard_mcp/transports/ssh_wpcli.py:65 proc = subprocess.run(ssh_cmd, capture_output=True, text=True, timeWPGuard MCP (MCP server)
Compatibility: Not stated.
**Put your AI assistant to work on WordPress.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST +2 more
package.json:51 preparezoteus (MCP server)
Compatibility: Not stated.
Zotero library for your agent: search, PDF passages with page locators, CSL citations, add by DOI, group libraries, and safe writes.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
package.json:44 prepareAgent Discover (MCP server)
Compatibility: Not stated.
**Find, install and enable MCP servers in the middle of a session, on any MCP host.** agent-discover is one local daemon that searches the official MCP Registry, npm and PyPI, installs a server after you approve the exact command and its provenance, and then exposes its tools to
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_HOST_FROM_INPUT
src/agent_memory_os/cli.py:585 with urllib.request.urlopen(request, timeout=TEAM_UPDATE_REQUEST_TIMEOUT_SECONDAgent Memory Os (MCP server)
Compatibility: Not stated.
<!-- mcp-name: io.github.yamantaka520/agent-memory-os --> <p align="center"> <img src="https://raw.githubusercontent.com/yamantaka520/Agent-Memory-OS/main/assets/agent-memory-os-logo-integrated-v2.png" alt="Agent Memory OS" width="560"> </p>
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_HOST_FROM_INPUT
sandbox/pu_network.py:32 def fetch(expr: str, values: tuple[Any, ...], use_arity: bool) -> list[str]:Android Reverse Engineering Mcp (MCP server)
Compatibility: Not stated.
**MCP-first, sandboxed Android reverse engineering with semantic program understanding for AI agents.**
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST OBFUSCATION_ENCODED_BLOB
package.json:16 prepareaspicio (MCP server)
Compatibility: Not stated.
Open, inspect, and render DXF/CAD drawings: describe_dxf and render_dxf MCP tools plus skills for reading drawings and embedding the viewer.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
NETWORK_HOST_FROM_INPUT
bootstrap.php:880 fetch(form.action, { method: 'POST', body: new FormData(form), credentials: 'basehim (MCP server)
Compatibility: Not stated.
**The CMS built for the AI era.** An open-source, API-first PHP CMS with a built-in Model Context Protocol server, so AI agents can search, read and draft your content , every permission scoped, so you decide exactly what they reach.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
skills/bipa/SKILL.md:80 curl -fsSL https://agents.bipa.app/install.sh | shBipa Cli (MCP server)
Compatibility: Not stated.
<p align="center"> <a href="https://agents.bipa.app"> <img src="assets/logo.png" alt="Bipa CLI" width="500" /> </a> </p>
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT NETWORK_HOST_FROM_INPUT
scripts/install.sh:9 # curl -sSfL https://raw.githubusercontent.com/turtlemonvh/blanket/master/scripts/installblanket (MCP server)
Compatibility: Not stated.
Blanket is a RESTy wrapper for long-running tasks.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT NETWORK_HOST_FROM_INPUT
install.sh:72 [ -n "$UV_BIN" ] || fail "uv is required but was not found in PATH. Install: curl -LsSf https://Bqa Mcp (MCP server)
Compatibility: Not stated.
BotQuangAnh Host MCP is a secure Model Context Protocol (MCP) host runtime and native desktop studio.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK +3 more
ee/rag-core/src/routes/rag-upload.ts:217 await fs.unlink(file.filepath).catch(() => undefined);calame (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="./docs/assets/logo.png" alt="Calame" width="120" /> </p>
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
src/harden/modules/tailscale.ts:192 const r = await exec('curl -fsSL https://tailscale.com/install.sh | sh')clawops (MCP server)
Compatibility: Not stated.
MCP-native infrastructure ops for OpenClaw, with read-only mode, destructive-action confirmation, and audit logs built in.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST +2 more
action/summary.py:320 return subprocess.run(list(argv), stdin=subprocess.DEVNULL, check=False).returncodeCleanframe (MCP server)
Compatibility: Not stated.
<p align="center"> <img src="https://raw.githubusercontent.com/inboxpraveen/Cleanframe/main/docs/assets/Logo.svg" alt="CleanFrame logo" width="120" /> </p>
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
README.md:160 what `curl -fsSL https://get.miabi.io | sudo bash` installs and then runs.cli (MCP server)
Compatibility: Not stated.
The imperative client for a [Miabi](https://github.com/miabi-io/miabi) control panel.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
AGENT_HIDDEN_STEP
skills/codex-claude-council/SKILL.md:61 - Do not start the same question again, and do not tell the user it faCodex Claude Council (MCP server)
Compatibility: Not stated.
Ask OpenAI Codex (ChatGPT) and Claude the same question through your own signed-in CLIs.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
scripts/install.sh:3 # Usage: curl -fsSL https://raw.githubusercontent.com/SunflowersLwtech/covate/main/scriptcovate (MCP server)
Compatibility: Not stated.
Covate - Context-aware learning sidebar for AI coding assistants, served as an MCP server.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_SHELL_UNDECLARED NETWORK_NO_FIXED_HOST SECRETS_PATH_CREDENTIAL +1 more
scripts/test_wheel_install.py:44 return subprocess.run(args, capture_output=True, text=True, timeout=timeout,dcert (MCP server)
Compatibility: Not stated.
<div align="center"> <img src="assets/logo.svg" alt="dcert logo" width="400"> <h1>dcert</h1> <p><strong>TLS Certificate Decoder & Validator</strong></p> <p>A Rust CLI and MCP server for X.509 certificate analysis, format conversion, and key verification.<br>Reads certificates fro
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
INSTALL_REMOTE_SCRIPT
.cursor/install.sh:12 curl -fsSL https://bun.sh/install | bashexeora (MCP server)
Compatibility: Not stated.
Secure execution for AI agents, on any machine.
This grade is a hygiene screen, not proof of safety.
Grade D, Two or more medium findings, or a high, Triangle
PERMISSION_DELETE_FILES INSTALL_LIFECYCLE_HOOK NETWORK_NO_FIXED_HOST +2 more
src/handlers/tools.ts:1149 fs.rmSync(creditCache, { force: true });Faf Mcp (MCP server)
Compatibility: Not stated.
<!-- faf: faf-mcp | TypeScript | mcp | The Interop MCP for Context , the Cursor / IDE Edition.
This grade is a hygiene screen, not proof of safety.
