- Conduid
- Marketplace
- #sarif
MCP servers tagged sarif
131 live MCP servers tagged "sarif", ranked by trust score. Tags come from package metadata and repository topics, so this list covers servers across every category that work with sarif.
safedep/vet
Protect against malicious open source packages 🤖
Lintlang
Static analysis for AI agent configs, tool descriptions, and system prompts — catches vague tool descriptions, missing stop conditions, and schema gaps before they reach runtime.…
Phantom
Forensic CLI for AI-era supply-chain attacks: XZ tarball diffs, prompt injection scans, MCP/CLAUDE.md/Cursor config audits. SARIF for GitHub Code Scanning.
Scanner
Advanced Shodan-based scanner for discovering, verifying, and enumerating Model Context Protocol (MCP) servers and AI infrastructure tools over HTTP & SSE.
PhpCodeArcheology/PhpCodeArcheology
PHP static analysis MCP server for architecture and maintainability. 11 tools exposing 60+ code quality metrics, problem detection, refactoring priorities, dependency graphs, git…
Agents Shipgate
The deterministic merge gate for AI-generated agent capability changes — a local-first, static Tool-Use Readiness review for MCP, OpenAPI, and SDK tool surfaces. Open-source CLI +…
Guardana
Open-source AI security verification — model artifacts, live endpoints, MCP servers and recorded agent traces. One rule engine for your laptop, CI and production, mapped to OWASP/…
Fence
Local-first security scanner, MCP protocol inspector, dynamic fuzzer, Docker sandbox, and report generator for Model Context Protocol servers.
SafeAI
Static analysis and attack-surface scanner for AI agents — SAST for prompts, tools, MCP servers, and agent workflows. Detects capabilities, prompt risks, tool permissions, and gov…
Security Scanner
Security scanner for Model Context Protocol (MCP) servers. Static + dynamic checks for path traversal, auth gaps, prompt injection surfaces. Produces SARIF output for GitHub code…
cli
Professional WAF security testing toolkit
OpenTrustBench
Trust & security scanner for AI agents and MCP servers — OWASP-mapped findings, Trust Cards (A–F grades), SARIF + CI gate. Free CLI, zero telemetry.
Docguard
The enforcement tool for Canonical-Driven Development (CDD). Audit, generate, and guard your project documentation. Zero dependencies.
Sentinel AI
Real-time AI safety guardrails for LLM apps. 10 scanners: prompt injection, PII, harmful content, code vulnerabilities, obfuscation detection. Sub-ms latency. Python + TypeScript…
Codeclone
Deterministic Structural Change Controller for AI-assisted Python development
Agent Audit Kit
Static scanner for MCP-connected AI agent pipelines. 332 rules across 14 categories, 12 compliance frameworks, OWASP Agentic 10/10 + MCP 10/10, GitHub Action, SARIF, public CVE-to…
Airom
Open-source AI Bill of Materials (AIBOM) scanner: inventories AI models, datasets, prompts, embeddings, vector DBs & RAG pipelines across code, containers & Kubernetes — with file…
Trustabl Cursor
Bring Trustabl's AI-agent safety & reliability scanner into Cursor — scan your agents, tools, and MCP servers, get a production-readiness score with severity-ranked findings, and…
Covenant
Contract & breaking-change detector for MCP servers — semver for your interface. Snapshot tools/resources/prompts into a lockfile, diff in CI, fail on breaking changes. Single Rus…
Mcpaudit
Zero-config security auditor and dynamic fuzzer for Model Context Protocol (MCP) servers
Decoy Scan
Security scanner for MCP server configurations. Finds risky tools, vulnerable packages, and suspicious servers across Claude Desktop, Cursor, VS Code, and more.
Meritmcp
The CI quality gate for MCP servers — functional tests + official conformance + OWASP-MCP-Top-10 security in one command, with SARIF, a 0-100 safety score, and a README badge.
Agent MCP Guard
Open-source CLI scanner for risky MCP server and AI agent tool configuration.
Toolprint
What your agent's tool surface costs, and what it can do. Offline MCP assessment: context cost, capability risk, and definition drift.
Sealpin
A supply-chain and prompt-injection scanner for MCP (Model Context Protocol) servers.
Mcpward
Black-box security & contract testing for MCP servers — rug-pull, tool-poisoning, schema-drift & protocol checks for CI (JUnit + SARIF).
Guardmcp
Security scanner for MCP (Model Context Protocol) servers and configs — tool poisoning, secret leaks, rug-pull detection, excessive permissions, insecure transport.
Cfgaudit
Static security auditor for AI-agent configuration: Claude Code, MCP servers, Cursor, Codex, Copilot, Gemini CLI and more. 109 rules, SARIF output, OWASP LLM Top 10 mapping.
Repoguard
The Architecture Guardian for AI-assisted code. Generate strict .cursorrules and audit PRs.
Toolpoison
Security scanner for MCP servers. Detects tool poisoning, prompt injection hidden in tool descriptions, leaked API keys, and supply-chain risk across Claude, Cursor, VS Code, Wind…
Agent Assurance
Declare what your AI agent may do. Verify it on every edit, PR and release — MCP configs, Claude Code permissions, tool definitions. Deterministic, OWASP-mapped, signed evidence.
Patchwitness
Independent trust gate for AI coding agents: verify scope, protected CI, real checks, secrets, impact, and portable Change Passports.
Agenticqa Scan Action
Analyze AI codebases to identify integration points, security risks, and test coverage gaps in one step with comprehensive reports.
Autohotkey Linter
AutoHotkey v1-to-v2 migration linter -- 167 patterns, AST-based, auto-fix, SARIF, MCP server for AI self-correction
Stop AI Slop
Zero-dependency linter and gate that blocks AI-generated comment slop: multi-line narrative comments, changelog markers, step-numbered filler. Write-time plugin for OpenCode, Clau…
MCPWarden
Offline static auditor for MCP server configs: unpinned npx/uvx, inline secrets, home-dir filesystem roots, privileged Docker, shadowed servers. SARIF output.
Mcpconform
Provider- and language-agnostic static linter for MCP tool definitions, server.json, and client config.
PROJECT ARGUS
Local-first security evaluation and runtime policy gateway for AI agents, MCP servers, skills, and LLM deployments
Managed MCP Doctor
Audit Claude Code MCP governance drift, catch when allowedMcpServers no longer covers managedMcpServers (2.1.259+). CLI + JSON/SARIF for CI.
Agentic Workflow Guard
Static analysis for AI automation workflows. Find prompt-injection paths, overpowered tools, and write-capable agent jobs before they run.
Claude Linter
Lints Claude Code config, CLAUDE.md, hooks, MCP, settings, permissions for silent conflicts, dead references, and token bloat. Offline by default.
Correctover Scan Action
GitHub Action: scan MCP (Model Context Protocol) configuration files for credential leaks, SSRF and missing auth in CI — SARIF output, fails builds on critical findings.
Guardskill
Read-only scanner for what lets a repository run code in a coding agent (Claude Code, Codex, Cursor, Copilot): git settings, hooks, and committed MCP server definitions and agent…
TorusGuard
Autonomous Security Guardrails & Governed Remediation for AI-Built Apps. Tri-Mode Parity (CLI, Chat Slash Commands, Native MCP Server), First-Principles Security Suite, Multi-Moda…
Supply Guard
Offline supply chain security scanner. Detects malicious packages, typosquatting, compromised dependencies, and unsafe CI configurations across npm, pip, Cargo, NuGet, and Maven.…
Regrails
Policy-as-code for FERPA + Title IV: a deterministic guardrail that decides before any LLM speaks. Risk-tiered, citation-faithful, with an MCP server, OSCAL/SARIF exports, a GitHu…
Skil
Vendor-neutral security, verification, and enforcement framework for AI agent skills
Octopus Inspect
Catch governance holes before production does. A static governance linter for AI agent workspaces.
AI Plan
Review capability drift in AI agent skills, plugins, and MCP configurations.
Sitelemetry Audit Action
Run Sitelemetry website audits (security, SEO, AI visibility, accessibility, performance, integrations) in GitHub Actions with SARIF output, a job summary and a pull request comme…