Browse the directory

Secure MCP servers with strict tool boundaries, auth controls, dependency hygiene, and abuse-resistant runtime policies.

Security scanner from Snyk for discovering local AI agent components, including MCP servers and Agent Skills, and checking them for prompt injection, tool poisoning, tool shadowing, toxic flows, malware payloads, credential handling, and hardcoded secrets.

Expert plugin marketplace authoring capability pack applying documented marketplace.json catalogs, /plugin marketplace add flows, private repo distribution, and supply-chain review from official plugin marketplace documentation.

Slash command that reviews the supply-chain risk of a project's dependencies using OpenSSF Scorecard health signals rather than CVE counts.

Source-backed rules for reviewing dependency update pull requests with supply-chain context, lockfile discipline, advisory checks, compatibility evidence, and privacy-safe metadata handling.

Security analysis and vulnerability scanning for dependencies

PostToolUse hook that flags risky package-lock.json, yarn.lock, and pnpm-lock.yaml edits: missing lockfile updates, unexpected registry hosts, and dependency count spikes before merge.

Slash command that reviews a pull request diff for security regressions: authentication and authorization gaps, injection surfaces, secret exposure, unsafe deserialization, and dependency risk introduced by the change.

Expert skill for reviewing GitHub Artifact Attestations, release artifact digests, workflow provenance, OIDC boundaries, and public release evidence before an AI agent recommends or publishes build outputs.

PreToolUse hook that reviews proposed Bash commands for package, installer, and archive downloads, then blocks curl or wget download commands that do not include an adjacent checksum or signature verification step.

PostToolUse hook that inspects an edited npm package-lock.json for supply-chain provenance risk rather than known CVEs — dependencies resolved from outside the public npm registry (git, alternate-registry, or insecure transports) and registry tarballs missing an integrity hash.

PostToolUse hook that watches dependency manifest and lockfile edits, then prompts or runs an OSS Review Toolkit dependency license analysis.

Expert SLSA provenance review skill for checking source, build, artifact, and trust evidence before accepting content or package submissions.

Verify MCP server package provenance before Claude Code installation: registry publisher match, repository ownership, release artifact checksums, maintainer history, and rollback when supply-chain signals fail review.

Pin MCP server package versions before adding them to Claude Code: registry verification, lockfile discipline, npx package pins, supply-chain review, and rollback steps aligned to MCP quickstart and registry documentation.

Source-backed agent for triaging dependency update pull requests with SemVer risk, Dependabot context, GitHub dependency review, OSV advisories, OpenSSF Scorecard signals, lockfile changes, test evidence, and privacy-safe notes.

A defense-in-depth bundle for hardening an agentic Claude Code workstation: block secrets and sensitive data before they are written, verify dependency provenance and known vulnerabilities, review supply-chain risk and run code security audits, and harden MCP tool access against prompt injection.

Expert GitHub Actions capability skill for secure workflow architecture, token minimization, supply-chain controls, and CI reliability.

AI security platform for securing machine learning and LLM supply chains, models, applications, and infrastructure.