- Conduid
- Marketplace
- #sarif
MCP servers tagged sarif
173 live MCP servers tagged "sarif", ranked by trust score. Tags come from package metadata and repository topics, so this list covers servers across every category that work with sarif.
Eval
🧐 Privacy-preserving MCP server evaluation: deterministic CI probe battery (18 probe kinds, readiness score, SARIF) plus production friction capture with findings that verify and…
Warden
CI-first MCP supply-chain integrity gate + runtime tool-result inspection. Pin an MCP server's tool surface, fail CI on drift, and block poisoned tool results (ANSI/secret-echo/ex…
Agentguard
agentguard
MCPWarden
Offline static auditor for MCP server configs: unpinned npx/uvx, inline secrets, home-dir filesystem roots, privileged Docker, shadowed servers. SARIF output.
Mcpconform
Provider- and language-agnostic static linter for MCP tool definitions, server.json, and client config.
PROJECT ARGUS
Local-first security evaluation and runtime policy gateway for AI agents, MCP servers, skills, and LLM deployments
Managed MCP Doctor
Audit Claude Code MCP governance drift, catch when allowedMcpServers no longer covers managedMcpServers (2.1.259+). CLI + JSON/SARIF for CI.
Agentic Workflow Guard
Static analysis for AI automation workflows. Find prompt-injection paths, overpowered tools, and write-capable agent jobs before they run.
Claude Linter
Lints Claude Code config, CLAUDE.md, hooks, MCP, settings, permissions for silent conflicts, dead references, and token bloat. Offline by default.
Correctover Scan Action
GitHub Action: scan MCP (Model Context Protocol) configuration files for credential leaks, SSRF and missing auth in CI — SARIF output, fails builds on critical findings.
Guardskill
Read-only scanner for what lets a repository run code in a coding agent (Claude Code, Codex, Cursor, Copilot): git settings, hooks, and committed MCP server definitions and agent…
TorusGuard
Autonomous Security Guardrails & Governed Remediation for AI-Built Apps. Tri-Mode Parity (CLI, Chat Slash Commands, Native MCP Server), First-Principles Security Suite, Multi-Moda…
Supply Guard
Offline supply chain security scanner. Detects malicious packages, typosquatting, compromised dependencies, and unsafe CI configurations across npm, pip, Cargo, NuGet, and Maven.…
Regrails
Policy-as-code for FERPA + Title IV: a deterministic guardrail that decides before any LLM speaks. Risk-tiered, citation-faithful, with an MCP server, OSCAL/SARIF exports, a GitHu…
Skil
Vendor-neutral security, verification, and enforcement framework for AI agent skills
Octopus Inspect
Catch governance holes before production does. A static governance linter for AI agent workspaces.
AI Plan
Review capability drift in AI agent skills, plugins, and MCP configurations.
Sitelemetry Audit Action
Run Sitelemetry website audits (security, SEO, AI visibility, accessibility, performance, integrations) in GitHub Actions with SARIF output, a job summary and a pull request comme…
Scrutiny
Static and semantic security scanner for MCP servers: unpinned packages, rug pulls, tool poisoning, shadowing and toxic flows. Trained model, SARIF output, zero dependencies, full…
Security Auditor
It's a Python-based CLI security scanner built specifically to audit MCP (Model Context Protocol) servers — the integration layer that connects AI assistants like Claude to extern…
Security Scanner
The npm-audit for MCP servers: scan AI agent tools for dangerous permissions, prompt injection, and data exfiltration risks.
Trust
Preflight security scanner for MCP servers — map capabilities, scan install command, code, dependencies & metadata, and get an evidence-based APPROVE/BLOCK decision. CLI + GitHub…
Vet
Scan MCP server source for patterns that break under the 2026-07-28 Model Context Protocol spec.
Warden
Security scanner for MCP server configs. Finds leaked API keys, unpinned npx/uvx/docker servers, typosquats, malicious packages and tool poisoning in Claude, Cursor, VS Code, Wind…
Scanner
Security scanner for Model Context Protocol (MCP) server configurations
Security Scanner
Security scanner for Model Context Protocol (MCP) servers. Static + dynamic checks for path traversal, auth gaps, prompt injection surfaces. Produces SARIF output for GitHub code…
Lint
Lint and grade Model Context Protocol (MCP) servers before an agent ever calls them.
Sentinel
A stateless MCP 2026-07-28 server and the conformance harness that grades it. Scans any MCP server against the normative spec, says which MUSTs it cannot verify black-box instead…
Nsauditor AI
NSAuditor AI — Open-source, AI-powered network security scanner. 27 plugins, CVE matching, MITRE ATT&CK mapping, verified vulnerabilities, continuous monitoring, MCP integration.…
Patient Zero
Supply-chain attack scanner for the agent era. Triage in 30s with `npx patient-zero`, block malicious installs before postinstall runs, or drop into CI as a GitHub Action. Covers…
Rust Doctor
Scan, score, and fix your Rust code — clippy + cargo-audit + cargo-deny + 19 custom rules unified into one 0–100 health score. CLI · MCP server · GitHub Action.
gavelcode/gavel
quality gate for Bazel monorepos: runs lint, coverage and architecture checks off the build graph and returns a pass/fail verdict an agent can request before finishing a change.
Marlo
Fixes accessibility violations and proves it. Multi-engine WCAG detection routed by measured accuracy, verified minimal-diff repairs, and a published error rate.
Enterprise AI Accelerator
AI-native unified cloud governance platform — multi-cloud discovery, 6R migration planning, IaC security, FinOps, compliance audit, and executive AI chat. Built on Claude Opus 4.7…
Assay Agent Gate Demo
Runnable demo: a CI gate that denies an agent's undeclared privileged tool action before it runs, with evidence in the Security tab. Built on assay.
Mcp4rs Open Earth
Open Earth remote-sensing MCP server that lets AI agents discover geospatial data and run tools for STAC, Sentinel-2, nightlights, water mapping, spectral indices, and SAR metadat…
1c Hbk Bsl
Open-source toolkit for 1C:Enterprise/BSL: 180 diagnostics, formatter, LSP, CLI, VS Code/Cursor extension, SARIF, MCP server, and RU/EN documentation.
Overstep
Authorization testing for REST APIs and MCP servers. Declare who may do what as a matrix, and overstep turns it into positive and negative tests that catch BOLA, BFLA, BOPLA and p…
SkillGate
Pre-merge and pre-install trust checks for AI-agent skills and MCP configurations. Scan capabilities, detect risky changes, and block unapproved agent behavior in CI.
Nightward
Local-first TUI for auditing AI agent state, MCP config, and dotfiles backup safety
Scan Action
The first GitHub Action that scans MCP servers, AI agents & LLM pipelines for security vulnerabilities. 24 checks: tool poisoning, SSRF, prompt injection, DataFlow taint. Results…
Bastyn Scan
Static analysis for AI and agent code: Python, TypeScript, JavaScript, MCP manifests, and dependency CVEs.
Plimsoll Action
Review what an AI agent release changed at runtime (files, network, MCP tools), gate the PR, and report findings in code scanning. For AI platform and security teams.
Surface Audit
Deterministic security smoke tests for preview, staging, and pre-deploy web URLs.
CatalogLock
Security gate and deterministic lockfile for Agentic Resource Discovery (ARD) catalogs. Protect AI agents from SSRF, authority drift, poisoned discovery metadata and agentic suppl…
Skillmd
Lint, search, and install Agent Skills (SKILL.md) — CLI + MCP server + lint engine
Mcpcanary
Local-first MCP trust scanner and semantic drift canary for AI agent tool configs
Trustlint
Security contract testing, tool-poisoning detection, and drift gates for Model Context Protocol servers.
Hexis MCP Guard
Security scanner for MCP (Model Context Protocol) servers. Static analysis + 14 security rules + SARIF output for GitHub Security tab.
Websec Validator
Local-first security recon that briefs your AI coding agent: facts + tailored probes, code-in / artifacts-out. No LLM, no server, no running app.