- Conduid
- Marketplace
- #sarif
MCP servers tagged sarif
173 live MCP servers tagged "sarif", ranked by trust score. Tags come from package metadata and repository topics, so this list covers servers across every category that work with sarif.
Agent Reliability Kit
Verify, harden, and ship AI-agent-assisted codebases in one command.
CodeSkeptic
Precision-first C/C++ static analyzer on Clang LibTooling — catches the null-derefs, leaks and overflows your compiler waves through, each with a dataflow trace. MCP-ready for the…
Agentrisk
Zero-execution preflight scanner for untrusted AI-agent and MCP artifacts
Rulesentry
Catches hidden and invisible-unicode instructions smuggled into AI coding-agent config and skill files. Zero-config CI check.
Agent Rules Audit
Offline scanner for AI agent instruction files (AGENTS.md, CLAUDE.md, .cursorrules, skills, MCP configs) — flags prompt-injection payloads, hidden Unicode, encoded blobs, exfiltra…
Sinon
AI agent pentest kit: a methodology and 54-probe corpus for prompt injection, tool abuse and over-permissioned agent actions. Verdicts rest on observed facts, not a judge model.
Riskmap
Local-first static auditor for risky MCP and agent-tool repository patterns.
Codedistill
CodeDistill Community Edition — open-core (AGPL-3.0). The full scratchpad→classify→verify→provenance loop; commercial editions add MCP write tools, code anchors, and more.
Agentcapdiff
AI agent security policy-as-code for detecting capability, permission, and least-privilege changes across MCP, OpenAI, Claude, LangChain, LangGraph, and CrewAI tools.
Trifecta
Find and block the lethal trifecta that forms across your MCP servers.
Malwar
Static analysis engine for detecting malware in agentic AI skill files
Skillledger
Supply-chain security for AI agent skills — build, sign, verify, and runtime-protect skills across every major agent ecosystem.
Rigscore
Configuration hygiene checker for AI dev environments. Scans locally, no external calls.
Agentward
Audit what your AI agents can actually do to your machine. Scans installed MCP servers, skills, hooks and agent configs for leaked credentials, hidden prompt injection, exfiltrati…
Mincode Vuln Arch
Minimal code generator + vuln auditor + architecture miner with a tamper-evident hash-chain vault. Zero deps. Agent-agnostic (CLI / pip / pyz / MCP / AgentSkills).
Clipboard MCP Server
Access and manage the system clipboard across macOS, Linux, and Windows using the Model Context Protocol.
Mcphound
Independent security scanner and reputation layer for MCP servers and agent skills
Purplegate
purplegate — Red/blue-team CI gate for agentic-AI apps. Prompt-injection, secrets, SAST, deps, IaC/RLS, workflow injection, MCP checks. One signed GitHub Action, mapped to OWASP L…
Perimeter
Security and cost audit for your AI agent toolchain: MCP servers, hooks, skills
Config Linter
Keyless, offline linter for MCP (Model Context Protocol) client config files - catches hardcoded secrets, unpinned npx packages, shell-injection args and transport/hygiene issues.…
Agentops Watchtower
Local-first AgentOps flight recorder and capability firewall for MCP-based coding agents with OpenTelemetry traces.
Pretrust
Map every code-execution path that fires when you open or clone a repo — before you run anything
Apm Demo App 003
APM Security Demo App 003 — ASP.NET with MCP configuration violations
Agent Permission Graph
Map, score, and explain what local AI agents and MCP servers are allowed to touch.
Permission Inspector
Local-first static security scanner for MCP client configurations.
Permission Linter
CLI and GitHub Action-ready linter for MCP permissions, secrets, destructive tools, and least-privilege policy.
Pastewatch
Detects and obfuscates sensitive data before it reaches AI systems — clipboard, CLI, and MCP server
Sitepulse
Rust CLI and MCP server for technical SEO, sitemap audits, broken link detection, and AI agent readiness.
Pluginscope
Static audits for Minecraft server plugins: packaging and shading hygiene, API compatibility against a target version, whole plugins-directory checks and resource pack validation.…
Glassport
Wire-level observability and enforcement for MCP servers: passive stdio tap, behavioral detectors, drift watch, and static audit — with SARIF for the GitHub Security tab. Zero dep…
Aisec
Security scanning for MCP servers and agent applications — Claude Code plugin and CLI
Saferico CLI
Solidity security scanning with 201 detectors that run on your machine. CLI + local MCP server.
Defensive MCP Audit
Defensive security audit tool for AI Agent and MCP (Model Context Protocol) environments. Detects risky localhost exposure, weak bindings, and confused-deputy risks. Lightweight,…
SprintLoop Assurance Kit
Independent release assurance for AI-built code. Model-neutral CLI, GitHub Actions, and read-only MCP bind evidence and finite human authority to an exact Git candidate.
Vetmcp
Security scanner for MCP servers — npm audit for the Model Context Protocol
Agent Sbom
Capability-aware SBOM and SARIF scanner for agent skills, MCP manifests, prompts, and scripts.
Agent Skill Supply Chain Auditor
Static supply-chain auditor for Agent Skill bundles and MCP configurations with SARIF, Agent-SBOM, and deterministic evaluation.
Agent Skill Aegis
中文 Agent Skill 与 MCP 配置供应链安全扫描器，支持终端、JSON、HTML 与 SARIF 报告。
Tracefact
Evidence-first reliability reports and reproducible replay for coding and browser agents.
Poison Scan
CLI scanner for MCP server tool-poisoning & rug-pull signatures (hidden instructions, invisible-Unicode, multilingual/Turkish-casefold evasions). SARIF + rug-pull diff. Extends mc…
Scopecheck
Static security auditing for Python MCP servers, trace reachable capabilities and incomplete analysis without executing target code.
Agent Permit Office
Pre-flight security checks for AI coding agents before tools, secrets, memory, MCP, or CI write access.
Objauthz Lab
Vulnerable-by-design MCP server for learning object-level / cross-tenant authorization (BOLA/IDOR) bugs, plus Semgrep rules that find the same shapes in JavaScript/TypeScript, Pyt…
Endpointsweep
Find every MCP server and AI agent on your endpoint fleet. Dependency-free collectors for macOS, Linux and Windows run under EDR/MDM, and a central analyzer audits them against a…
Drift Check
Zero-execution MCP security preflight + GitHub Action. Detect mutable package references before AI agents run them. Try any public repo in the browser.
Agenstral
Local preflight and audit tool for AI coding agents: scan repo risk, enforce tool-call policy, and record tamper-evident audit logs. Local-first, zero telemetry.
Llmsafe
Static security scanner for Python AI agents, LLM apps, and MCP servers.
Divergence
Precision-first security analyzer for MCP servers and agent skills. 0% false positives on traps, 96% recall.
Codelytra
Open-source, local-first AI security scanner for JavaScript and TypeScript LLM, agent, RAG, tool-calling, and MCP applications.
Burling Action
GitHub Action: run burling AIP conformance checks and upload SARIF to code scanning