- Conduid
- Marketplace
- #supply-chain-security
MCP servers tagged supply-chain-security
184 live MCP servers tagged "supply-chain-security", ranked by trust score. Tags come from package metadata and repository topics, so this list covers servers across every category that work with supply-chain-security.
Nono
agent runtime security - zero trust, zero setup, zero latency agent sandbox
Phantom
Forensic CLI for AI-era supply-chain attacks: XZ tarball diffs, prompt injection scans, MCP/CLAUDE.md/Cursor config audits. SARIF for GitHub Code Scanning.
Bumblebee
Read-only developer endpoint scanner for on-disk package, extension, and developer-tool metadata, built to check exposure to known software supply-chain compromises.
Npm Security Best Practices
Collection of npm package manager Security Best Practices
Cap
What can this MCP server actually do — and has it changed since you trusted it? Inspect its declared capabilities, seal them in a lock file, and get told when a later version can…
Glyph
🔮 MCP security scanner — find tool poisoning, credential leaks, and insecure transports in AI agent configurations
Poutine
poutine, a supply chain vulnerability scanner for build pipelines
Prismor
Runtime security for Agents. Blocks dangerous commands, prevent secret leaks, stop prompt injection, gate risky package installs and visibility and control over tool calls.
Brain0
The black box for AI-written code. Passive decision graph linking every commit to the agent prompts behind it: drift detection, DLP audit of what agents read, evidence-driven risk…
Skrun
Policy-bound runtime execution and isolation engine for immutable AI agent skill artifacts
Audit Tool
🛡️ Security audit CLI for Model Context Protocol (MCP) servers — scan AI agent configs for tool poisoning, rug pulls, hardcoded secrets, command injection & supply-chain risks. Pu…
Veritensor
The Anti-Virus for AI Artifacts & RAG Firewall. A static analysis tool scanning Models and Notebooks for RCE, Datasets and RAG docs for Data Poisoning, PII, and Prompt Injections.…
Clawseccheck
🦞 Local, read-only security scanner for OpenClaw. Finds config, prompt-injection and supply-chain risks — A–F grade.
Guardana
Open-source AI security verification — model artifacts, live endpoints, MCP servers and recorded agent traces. One rule engine for your laptop, CI and production, mapped to OWASP/…
Awesome AI Agent Attacks
A curated timeline of real AI agent security incidents, breaches, and vulnerabilities (2024-2026). Every entry sourced and dated.
agent-bom
Open security scanner and self-hosted control plane for AI, MCP, and cloud. One evidence model — run scans in your environment, centralize findings, govern in your VPC.
Ave
AVE - Agentic Vulnerability Enumeration. The open behavioral classification standard for agentic AI components.
Husk
Static security scanner for AI agent skills. Built against the bypass techniques that beat Snyk, Cisco & Vercel scanners. Offline, deterministic, zero dependencies, CI-ready. Benc…
Orca AI Incident Archive
An open database of real-world AI agent incidents.
scan-mcp
Static security scanner for MCP servers — detects tool poisoning, injection, secrets, Dockerfile and dependency issues.
Cache Commander
Cache Commander — a TUI and MCP server to explore, audit, and clean developer cache directories. Scan for CVEs, find outdated packages, reclaim disk space. Supports pip, npm, Carg…
Mpak
Open-source package registry for MCP (Model Context Protocol) servers with built-in security scanning, trust scoring (L1-L4), and CLI. Every bundle verified across 25 supply-chain…
Artguard
Open-source AI artifact scanner. Detect malicious agent skills, MCP servers, and IDE rule files before they run.
Agent Audit Kit
Static scanner for MCP-connected AI agent pipelines. 332 rules across 14 categories, 12 compliance frameworks, OWASP Agentic 10/10 + MCP 10/10, GitHub Action, SARIF, public CVE-to…
CodeOrion
MCP server for AI coding agents (Claude Code, Cursor, Cline, etc.): verify packages before installing, assess MCP servers before adding them, scan for secrets, audit agent configs…
Airom
Open-source AI Bill of Materials (AIBOM) scanner: inventories AI models, datasets, prompts, embeddings, vector DBs & RAG pipelines across code, containers & Kubernetes — with file…
AgentProvenance
Security-oriented three-axis observability for sandboxed AI agents: model intent, app context, and runtime telemetry into verifiable evidence graphs for risk, forensics, and audit.
Skillfortify
First formal security scanner for AI agent skills & plugins. Static analysis, supply chain verification, SBOM generation. 22 frameworks supported including MCP, LangChain, CrewAI.
supply-chain-mcp-server
90-tool MCP server for software supply chain security — OSV, GHSA, NVD, EPSS, CISA KEV, npm, PyPI, crates.io, RubyGems, NuGet, Packagist, Go, deps.dev, Scorecard, Rekor, ClearlyDe…
witness
Security scanner for MCP servers. Found and disclosed 6 vulnerabilities; 1 fix verified upstream (PR #4226).
Vigile Scan
Security scanner for AI agent tools — detect tool poisoning, permission abuse, and supply chain attacks in MCP servers and agent skills
Transport Firewall
Fail-closed stdio firewall for risky local MCP JSON-RPC tool calls
Kairo
Real-time cloud intelligence layer for AI coding agents: package, command, and CI risk checks.
Fabrica Star
Know what you're installing before you npx it. A security scanner for Model Context Protocol (MCP) servers and client configs.
Secure Code Skill
Install the secure-code security skills into a Claude Code project, and connect MCP servers (secure-code-mcp or any other).
Cfgaudit
Static security auditor for AI-agent configuration: Claude Code, MCP servers, Cursor, Codex, Copilot, Gemini CLI and more. 109 rules, SARIF output, OWASP LLM Top 10 mapping.
Security Agent Skills
Security-testing methodology as portable, tool-agnostic agent skills for Claude Code and any agent runtime: white-box bug hunting, AI-agent and LLM red-teaming, supply-chain risk,…
Tellur
Local-first AI code provenance: line-level attribution, PR risk reports, policy checks, and tamper-evident audit trails for AI-assisted software.
Matrixscroll
Open protocol and MCP server for signed machine-action records, offline verification, and SSX360 USB signer support.
Toolpoison
Security scanner for MCP servers. Detects tool poisoning, prompt injection hidden in tool descriptions, leaked API keys, and supply-chain risk across Claude, Cursor, VS Code, Wind…
Agentseal MCP Intel
MCP server for AI security intelligence. Check any MCP server for supply-chain threats before installing -- from Claude, Cursor, or Windsurf.
Sovereign MCP
Deterministic MCP Security Architecture. FrozenNamespace as Root of Trust for Model Context Protocol tool verification
Mcprism
Fast single-binary security scanner for MCP (Model Context Protocol) servers — config audit, live capability enumeration, tool-poisoning detection & risk grading. Zero deps, fully…
Agent Assurance
Declare what your AI agent may do. Verify it on every edit, PR and release — MCP configs, Claude Code permissions, tool definitions. Deterministic, OWASP-mapped, signed evidence.
Clauderabbit
ClaudeRabbit is a free, open-source security product protecting the open-source community from malware. We clone any public GitHub repo into an isolated sandbox, run it, and retur…
Patchwitness
Independent trust gate for AI coding agents: verify scope, protected CI, real checks, secrets, impact, and portable Change Passports.
Driftlock
The lockfile & CI drift-gate for MCP - catch tool-poisoning / rug-pulls before your agent does. Dependabot for your agent's trust boundary.
Quilzo
Immutable, content-addressed CMS with an agent interface that enforces a manifest — capabilities, content scope, budget, and the tools it may call on hosts it named first. Publish…
Mcpcustoms
MCPCustoms is the customs checkpoint for MCP tool calls: a zero-dependency TypeScript runtime semantic firewall that inspects every Massive Intelligence (IM) agent tool call befor…
Agentic AI Security
Security analysis of MCP ecosystem – threats, defenses, benchmarks, and agent interoperability.