Browse the directory

Expert MCP capability skill for secure server authoring, tool schema discipline, authorization boundaries, and prompt-injection risk review.

Source-backed rules for reviewing AI-generated endpoints and data-access code before merge for insecure direct object reference risk, covering per-request object-level authorization checks, scoped database lookups, identifier exposure, and consistent enforcement across read, write, and admin operations.

Transform Claude into a Laravel specialist with deep knowledge of routing, Eloquent ORM, form requests, policies, queues, and production deployment patterns.

Slash command for auditing a remote MCP server authorization setup, including protected resource metadata, authorization server discovery, OAuth resource indicators, token audience validation, scopes, and token passthrough risk.

Source-backed specialist agent for reviewing remote MCP authorization boundaries, protected resource metadata, resource indicators, token audience validation, token passthrough risk, and least-privilege scopes.

Source-backed collection for reviewing OAuth-backed and remote MCP servers: protected resource metadata, token audience checks, least-privilege scopes, config privacy, local tool access, and interactive server inspection.

Source-backed rules for reviewing remote MCP server authorization boundaries: protected resource metadata, OAuth resource indicators, token audience checks, least-privilege scopes, and cross-server token isolation.

Practical guide for checking MCP protected resource metadata, authorization server discovery, resource indicators, token audience binding, and 401 challenge behavior before trusting a remote MCP server.

PreToolUse hook that blocks edits adding remote MCP server URLs unless their host appears in an explicit allowlist, reducing accidental connection to unreviewed OAuth, SSE, or Streamable HTTP MCP endpoints.

Source-backed rules for reviewing AI-generated code that binds request parameters to model/entity objects before merge for mass assignment risk, covering allowlist field binding, DTOs that exclude sensitive fields, and the framework-specific autobinding features that make this easy to introduce by default.

A source-backed guide for designing Model Context Protocol servers with explicit authorization boundaries, narrow tools, scoped resources, privacy-aware logging, and least-privilege runtime access.

Slash command that reviews a pull request diff for security regressions: authentication and authorization gaps, injection surfaces, secret exposure, unsafe deserialization, and dependency risk introduced by the change.

MIT-licensed Kubernetes gateway and management layer for MCP servers, with session-aware routing, adapter lifecycle APIs, tool registration, Entra ID role authorization, and optional agent/session preview resources.

Practical checklist for reviewing remote MCP server authorization, resource indicators, bearer-token handling, HTTPS transport, PKCE, and token passthrough risks before connecting an AI client.

A source-backed Model Context Protocol starter collection for SaaS builders: connect product code, database state, payments, deployment telemetry, issue tracking, and production errors while keeping MCP authorization and tool boundaries explicit.