1. Conduid
  2. Security
  3. Zfuzz MCP
MCP server · Security

Zfuzz MCP

· github.com/Zfuzz-dev/zfuzz-mcp

Security copilot for AI coding agents. 10 MCP tools — SAST, SCA, secrets, MCP/skill scanning — for Claude, Cursor & co. Rust-native, local, $0, Apache-2.0.

Unclaimed ai-agentsappsecclaudecursordevsecopsmcpmodel-context-protocolrustsastscasecrets-detectionsecuritystatic-analysisvulnerability-scanner
InstallView source
34Low

Scored a month ago · breakdown

About Zfuzz MCP

Zfuzz MCP is an MCP server in the Security category: security copilot for AI coding agents. 10 MCP tools — SAST, SCA, secrets, MCP/skill scanning — for Claude, Cursor & co. Rust-native, local, $0, Apache-2.0.

Install

From source
git clone https://github.com/Zfuzz-dev/zfuzz-mcp

This server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.

Tools (10)

check_mitreMaps any finding to real-world attack techniques (MITRE ATT&CK).

Parameters not published.

explain_findingExplains any vulnerability — and the fix — in everyday language.

Parameters not published.

reconcile_permissionsCompares the tools your agents actually use against what they declared — flags capabilities used but never declared, and permissions granted but never used (least privilege, from runtime telemetry).

Parameters not published.

scan_codeFinds bugs attackers exploit — 441 rules, 7 languages (Python, JS/TS, Go, Java, Rust, Ruby, PHP).

Parameters not published.

scan_dependenciesFlags packages with known security holes (CVEs via OSV.dev).

Parameters not published.

scan_mcp_configAudits the MCP servers you install — hidden instructions, unicode tricks, wildcard permissions, unauthenticated remote servers. Returns a risk score + install verdict.

Parameters not published.

scan_secretsCatches leaked passwords & API keys — 419 patterns (AWS, GitHub, Stripe, OpenAI, Anthropic…).

Parameters not published.

scan_skillVets an agent skill (its `SKILL.md` + bundled scripts) before you install it — hidden instructions, unicode deception, over-broad triggers, wildcard tool grants, and dangerous code or leaked secrets in its scripts.

Parameters not published.

search_security_proceduresLooks up 754 security playbooks (incident response, hardening, compliance).

Parameters not published.

threat_modelAsks "how could this be attacked?" across your whole project (STRIDE + MITRE).

Parameters not published.

Ask AI

✦

Ask AI about Zfuzz MCP

Powered by Claude · Grounded in docs

I know everything about Zfuzz MCP. Ask me about installation, configuration, usage, or troubleshooting.

Security checks

6 checks have not been run yet.

Questions

About Zfuzz MCP

How do I install Zfuzz MCP?

No package has been published for this server, so install it from source: clone the repository and follow its README.

Is Zfuzz MCP safe to use with an AI agent?

Its trust score is 34 out of 100 (low). Conduid hasn't run static security checks on this repository yet, so review the source yourself before granting it credentials. It has no ConduID identity yet, so agent calls to it are not receipted.

Is Zfuzz MCP still maintained?

Conduid hasn't recorded a commit date for this repository yet. Check the repository directly for recent activity.