- Conduid
- Marketplace
- #supply-chain-security
MCP servers tagged supply-chain-security
228 live MCP servers tagged "supply-chain-security", ranked by trust score. Tags come from package metadata and repository topics, so this list covers servers across every category that work with supply-chain-security.
Supplyguard
Agentic software supply-chain security on Splunk — senses CI/CD dependency changes via the Splunk MCP Server, detects CVEs & typosquatting, triages with a hosted security model (f…
Cap
What can this MCP server actually do — and has it changed since you trusted it? Inspect its declared capabilities, seal them in a lock file, and get told when a later version can…
Knostic
Knostic — independent third-party profile of a public API surface, by API Evangelist. Knostic secures the AI agent supply chain inside the enterprise. Its platform discovers shado…
Mcpaudit
Audit your MCP servers for tool poisoning, credential exposure, and supply-chain risk. Zero dependencies. Nothing is executed.
Agentic AI Security
Security analysis of MCP ecosystem – threats, defenses, benchmarks, and agent interoperability.
Awesome Agent Supply Chain Security
A curated list of tools, research, standards and datasets for the security of AI agent extensions — skills, MCP servers, plugins and rules files.
Db2 MCP Server
Secure, observable Java 21 MCP server for governed read-only AI access to IBM Db2.
Trust
Preflight security scanner for MCP servers — map capabilities, scan install command, code, dependencies & metadata, and get an evidence-based APPROVE/BLOCK decision. CLI + GitHub…
Warden
Security scanner for MCP server configs. Finds leaked API keys, unpinned npx/uvx/docker servers, typosquats, malicious packages and tool poisoning in Claude, Cursor, VS Code, Wind…
Sift
Scans AI agent instruction files (CLAUDE.md, .cursorrules, mcp.json) for hidden or planted instructions
Github Security MCP
GitHub security posture analysis for AI agents — 39 MCP tools, 45 checks across org, repos, Actions, secrets, supply chain, and access control
Golf Scanner
Discover and audit MCP servers for security vulnerabilities across Claude Code, Cursor, VS Code, and more
AI Devops Actions
The CI/CD layer for AI-native development — 5 GitHub Actions for PR quality, cost tracking, MCP testing, supply chain security, and agent skill validation
cuttalo/depscope
mcp`.
Sswp MCP
Deterministic software attestation for AI-augmented development — witness, probe, and seal any repo with SHA-256. Fleet registry across 131 VERITAS nodes. Agent-native, zero cloud.
Patient Zero
Supply-chain attack scanner for the agent era. Triage in 30s with `npx patient-zero`, block malicious installs before postinstall runs, or drop into CI as a GitHub Action. Covers…
Pkgxray
Supply-chain security for AI agents, npm packages, and MCP servers. Analyze packages before you install them — zero-dep Node, runs locally, never executes untrusted code.
Mcpvessel
Cage untrusted MCP servers in containers, compose them into agents, and share them over any OCI registry. Signed, sandboxed, no Docker required.
Provenance Monitor
🔎 Monitoring supply chain provenance of local MCP servers
Ghostimport
👻 Detects ghost imports — npm packages that don't exist, hallucinated by AI coding tools like Cursor, Copilot, and Claude
Toolfence Site
MCP security scanner — Toolfence scans any Model Context Protocol server and reports the risks your AI agents inherit: tool poisoning, prompt injection, tool drift, over-broad sco…
Toolcheck
Should you actually install that? A plain-English fit check for any repo, package, API or MCP server, with sources.
Gtfs Scorecard
Daily, plain-language GTFS quality scorecards for small transit agencies: the current grade, the three things to fix, and why each one matters. More than 2,600 curated feed record…
Oss Evaluator
FastMCP server that provides comprehensive security analysis for software packages across multiple ecosystems. It integrates seamlessly with Claude Desktop to provide AI-powered s…
Skills Vault
Deterministic registry + supply-chain integrity scanner for MCP (Model Context Protocol) servers. One-line install via npx, hash-pinned 112-entry DB, 4 advisory feeds, offline-fir…
Alopeyk MCP
Self-hostable Model Context Protocol (MCP) server for Alopeyk (الوپیک), providing AI agents with secure access to on-demand delivery and Alonomic business logistics APIs. Supports…
Vaporcheck
Stops AI coding assistants from using packages, files, and functions that don't exist. A safety net against hallucinated and slop-squatted names.
Sfi Audit Toolkit
SFI security audit toolkit — audit any repo against Microsoft Secure Future Initiative (SFI) pillars. Zero Trust + NIST CSF 2.0 knowledge base, read-only scanner, MCP server, GitH…
Sunglasses
Sunglasses for AI agents. Protection layer + neighborhood watch.
Npmguard
npmguard secure AI agents auto-edits flows by screening every npm package for known-malicious code and typosquats before anything runs, in Claude Code, Cursor and Codex over MCP o…
SkillGate
Pre-merge and pre-install trust checks for AI-agent skills and MCP configurations. Scan capabilities, detect risky changes, and block unapproved agent behavior in CI.
IANUA Broker
Local-first, offline-by-default security posture scanner for MCP servers and local AI-agent setups (CLI: mcpscan).
Nightward
Local-first TUI for auditing AI agent state, MCP config, and dotfiles backup safety
Skillseal
Self-verifying agent skills. Your seal of approval. 🦭
Wordhoard
Self-hosted registry for your team's Agent Skills and prompts — fork lineage, version diffs that reveal hidden characters, content checks, pinned installs, and slash commands in e…
Bastyn Scan
Static analysis for AI and agent code: Python, TypeScript, JavaScript, MCP manifests, and dependency CVEs.
Shellockolm AI CLI MCP Scanner
Welcome to Shellockolm-ai-CLI-MCP-Scanner - 🎯 Your React app is probably vulnerable. Find out in 30 seconds 🚀
Registry Audit
Read-only reconnaissance CLI that scans public MCP registries for rug-pull and lookalike supply-chain attacks.
Plimsoll Action
Review what an AI agent release changed at runtime (files, network, MCP tools), gate the PR, and report findings in code scanning. For AI platform and security teams.
HA Codex Bridge
Run Codex privately inside Home Assistant with ChatGPT login, automations, skills, plugins, MCP, and a proxy-safe Codex-style UI.
CatalogLock
Security gate and deterministic lockfile for Agentic Resource Discovery (ARD) catalogs. Protect AI agents from SSRF, authority drift, poisoned discovery metadata and agentic suppl…
Registry Risk Scanner
Static security scanner for MCP server.json registry manifests. Flags supply-chain, transport, credential, and data-egress risks before you install a server.
Cupel
Assay every skill, plugin, and MCP server your coding agent loads. One local command grades safety, token cost, and quality.
Cancerbero
Local, offline-first GGUF and llama.cpp pre-load inspector
Trust Issues
Adversarial security review for AI skills, repos, MCP servers, and packages before you install them. A read-only scanner plus a five-persona reasoning pass, ending in a GO / GO WI…
Verification Security
Public verification, security review, and skill quality process for Agent Skill Exchange
Rulesentry
Catches hidden and invisible-unicode instructions smuggled into AI coding-agent config and skill files. Zero-config CI check.
Wardrail
Local security scanner for vibe-coded apps: stop API key leaks, Git-history secrets, and unsafe MCP or AI agent instructions before commit.
AgentactrSDK
Rust SDK and CLI for provider-neutral coding-agent orchestration with Codex, GitHub issues, quality gates, and secure run artifacts.
Supplyscan
scan JavaScript lockfiles to detect supply chain vulnerabilities and known exploits