- Conduid
- Marketplace
- #supply-chain-security
MCP servers tagged supply-chain-security
184 live MCP servers tagged "supply-chain-security", ranked by trust score. Tags come from package metadata and repository topics, so this list covers servers across every category that work with supply-chain-security.
Skilllock
Reproducible lockfiles, verification, diff, security audit, and contract tests for Agent Skills.
SafeInstall
Understand software before you run it — local-first static risk analysis for unfamiliar projects.
Broude
Your AI coding assistant's security watchdog. Claude Code hooks that catch supply chain attacks, exposed secrets, and obfuscated commands.
Fsck
Integrity check for MCP server configs audits Claude, Cursor, VS Code and Windsurf agent configs for secrets, injection-prone args, tool poisoning and dangerous capability combos.
Context Report
An open, signed report format for whether an agent plugin, hook, skill, or AGENTS.md actually works.
Andbo
Secure sandbox for AI coding agents — run an agent (or let your harness drive it) in an isolated, policy-controlled container with enforced network egress, secret redaction, and a…
Skillguard
Static security scanner for AI agent skills and plugins — flags prompt injection, hidden Unicode, exfiltration, and dangerous commands in SKILL.md/CLAUDE.md and scripts.
Precheck
Agent skill that checks every MCP server against the PolicyLayer registry before connecting - identity, risk grade, tool classifications and changes.
Trustline
Trusted baseline + auto-rollback for AI agent config files (.claude/, AGENTS.md, .mcp.json). Detects prompt-injection / supply-chain tampering and rolls back to a trusted snapshot…
Pkgguard API
Open-source AI package security gate that blocks slopsquatting, hallucinated dependencies, and typosquats before npm, pip, uv, or cargo install
Ctxsentry
Scan a repository for prompt-injection payloads before you point an AI coding agent at it.
Mcpwatchman
Independent security and quality audit for Model Context Protocol servers — static analysis, dependency CVE scanning, and evidence-linked scores for every server in the official M…
Skill Sentry
Scan Claude MCP skills for security threats before you install. npx skill-sentry < your skills github url> free, open source, no code executed.
Vouchq
Private trust registry for MCP tools — approve once, pin cryptographically (박제), detect rug-pulls forever. Self-hosted, AGPL.
Trustdex
Trust policy layer for AI agents, MCP servers, skills, and plugins.
Correctover Scan Action
GitHub Action: scan MCP (Model Context Protocol) configuration files for credential leaks, SSRF and missing auth in CI — SARIF output, fails builds on critical findings.
Skill Vet
Vet AI agent skills (SKILL.md, MCP bundles, Cursor rules) before your agent runs them. Prompt injection, exfil, cred harvesting — zero deps, one file.
Is This Safe
Trust in AI agent tooling is a chicken-and-egg problem. Start here — audit a skill repo before you install it.
Supply Chain Risk MCP
An MCP (Model Context Protocol) server that assesses open-source dependency risk — CVEs, license conflicts, maintenance health — for npm, PyPI, Cargo, Maven packages plus a 3-ag…
Mpak Trust Framework
MTF: An open security standard for MCP server bundles. Defines compliance levels, controls, and verification methods.
Scopediff
Review AI agent, MCP, and workflow permission changes before merge.
Supply Guard
Offline supply chain security scanner. Detects malicious packages, typosquatting, compromised dependencies, and unsafe CI configurations across npm, pip, Cargo, NuGet, and Maven.…
Agent Skill Guard
Security auditor for AI agent skills — catches hidden-Unicode prompt injection, reviewer-subversion, data exfiltration & post-install drift that markdown-only vetters miss.
ITan LIPA
⚡Stop letting unvetted Python code blow up prod. Zero-execution AST safety gate for circular imports, broken contracts, and PEP traps. Zero deps.
Claude Guard
Security scanner for your Claude Code setup — flags risky skills, hooks, MCP servers & committed secrets. Zero dependencies, offline.
Skil
Vendor-neutral security, verification, and enforcement framework for AI agent skills
AI Plan
Review capability drift in AI agent skills, plugins, and MCP configurations.
Repotify
Thousands of agent skills. The right ones for your repo. Repotify reads the skills developers and AI companies publish on GitHub, checks them for risks and installs the best ones…
Scrutiny
Static and semantic security scanner for MCP servers: unpinned packages, rug pulls, tool poisoning, shadowing and toxic flows. Trained model, SARIF output, zero dependencies, full…
Adp
A GitHub-compatible forge for AI coding agents that binds every change to signed intent, provenance, and verification evidence.
Github Security MCP
GitHub security posture analysis for AI agents — 39 MCP tools, 45 checks across org, repos, Actions, secrets, supply chain, and access control
Golf Scanner
Discover and audit MCP servers for security vulnerabilities across Claude Code, Cursor, VS Code, and more
AI Devops Actions
The CI/CD layer for AI-native development — 5 GitHub Actions for PR quality, cost tracking, MCP testing, supply chain security, and agent skill validation
cuttalo/depscope
mcp`.
Sswp MCP
Deterministic software attestation for AI-augmented development — witness, probe, and seal any repo with SHA-256. Fleet registry across 131 VERITAS nodes. Agent-native, zero cloud.
Patient Zero
Supply-chain attack scanner for the agent era. Triage in 30s with `npx patient-zero`, block malicious installs before postinstall runs, or drop into CI as a GitHub Action. Covers…
Pkgxray
Supply-chain security for AI agents, npm packages, and MCP servers. Analyze packages before you install them — zero-dep Node, runs locally, never executes untrusted code.
Mcpvessel
Cage untrusted MCP servers in containers, compose them into agents, and share them over any OCI registry. Signed, sandboxed, no Docker required.
Provenance Monitor
🔎 Monitoring supply chain provenance of local MCP servers
Ghostimport
👻 Detects ghost imports — npm packages that don't exist, hallucinated by AI coding tools like Cursor, Copilot, and Claude
Toolfence Site
MCP security scanner — Toolfence scans any Model Context Protocol server and reports the risks your AI agents inherit: tool poisoning, prompt injection, tool drift, over-broad sco…
Toolcheck
Should you actually install that? A plain-English fit check for any repo, package, API or MCP server, with sources.
Gtfs Scorecard
Daily, plain-language GTFS quality scorecards for small transit agencies: the current grade, the three things to fix, and why each one matters. More than 2,600 curated feed record…
Oss Evaluator
FastMCP server that provides comprehensive security analysis for software packages across multiple ecosystems. It integrates seamlessly with Claude Desktop to provide AI-powered s…
Skills Vault
Deterministic registry + supply-chain integrity scanner for MCP (Model Context Protocol) servers. One-line install via npx, hash-pinned 112-entry DB, 4 advisory feeds, offline-fir…
Alopeyk MCP
Self-hostable Model Context Protocol (MCP) server for Alopeyk (الوپیک), providing AI agents with secure access to on-demand delivery and Alonomic business logistics APIs. Supports…
Vaporcheck
Stops AI coding assistants from using packages, files, and functions that don't exist. A safety net against hallucinated and slop-squatted names.
Sfi Audit Toolkit
SFI security audit toolkit — audit any repo against Microsoft Secure Future Initiative (SFI) pillars. Zero Trust + NIST CSF 2.0 knowledge base, read-only scanner, MCP server, GitH…
Sunglasses
Sunglasses for AI agents. Protection layer + neighborhood watch.
Npmguard
npmguard secure AI agents auto-edits flows by screening every npm package for known-malicious code and typosquats before anything runs, in Claude Code, Cursor and Codex over MCP o…