- Conduid
- Marketplace
- #supply-chain-security
MCP servers tagged supply-chain-security
229 live MCP servers tagged "supply-chain-security", ranked by trust score. Tags come from package metadata and repository topics, so this list covers servers across every category that work with supply-chain-security.
Supplyscan
scan JavaScript lockfiles to detect supply chain vulnerabilities and known exploits
Sentinelqa
Playwright-native release-confidence engine for LLM-built and human-built web apps. Quality scoring, CI gates, MCP tools, Python SDK.
Attestroot
Local-first, tamper-evident audit and evidence layer for AI agent activity. Hash-chained capture, RFC 6962 Merkle sealing, offline-verifiable bundles.
Praetor Security
Multi-engine static security analysis for code, repos, and AI agents: SAST, secrets, SCA, AI-security, and serialized-model/pickle scanning. Reports attack CHAINS and an agent cap…
Agentward
Audit what your AI agents can actually do to your machine. Scans installed MCP servers, skills, hooks and agent configs for leaked credentials, hidden prompt injection, exfiltrati…
Magus Mcpsentinel
Deterministic, non-executing evidence and change monitoring for public npm MCP servers. Reports what changed since the version you approved. It never claims a package is safe.
Purplegate
purplegate — Red/blue-team CI gate for agentic-AI apps. Prompt-injection, secrets, SAST, deps, IaC/RLS, workflow injection, MCP checks. One signed GitHub Action, mapped to OWASP L…
Launch Postmortem
Public, transparent log of how weiseer mcp-doctor and 9 oracles got built and shipped in one day
Slopguard
Blocks AI-hallucinated and typosquatted packages before they install — npm, pip, uv, yarn, pnpm, bun
Bluetemberg
AI coding standards shipped like a dependency. Version-locked, integrity-verified, signed, and routed by role and stack version. Emits AGENTS.md, Cursor rules, and more.
Action
Vibe Code Security CI
Ctxguard
Scan a repository for prompt-injection payloads before you point an AI coding agent at it.
Blastradius
Audit the hooks, skills, permissions, MCP servers, and configuration your AI coding agents trust.
Pretrust
Map every code-execution path that fires when you open or clone a repo — before you run anything
Agent Policy Lens
A zero-dependency CLI that inventories AI agent and MCP permissions before they surprise you.
Correctover Scan
Security scanner for MCP servers and AI agents — detects credential leaks, RCE, SSRF and missing auth against OWASP AISVS 1.0; also scans published JS bundles/npm packages.
Mcpgawk
One gateway in front of every MCP server your agents can reach. A server that changes after you approved it is caught, the call is blocked before it runs, and nothing leaves your…
Contextguard
Zero-trust governance middleware for Model Context Protocol deployments
Aisec
Security scanning for MCP servers and agent applications — Claude Code plugin and CLI
Nipmod
Nipmod package intelligence, Codex plugin, MCP workflows and public agent safety tooling.
Aibom
Generate an AI bill of materials for models, MCP servers, tools, datasets, vector stores, and external APIs.
SprintLoop Assurance Kit
Independent release assurance for AI-built code. Model-neutral CLI, GitHub Actions, and read-only MCP bind evidence and finite human authority to an exact Git candidate.
Skillfrisk
Static security scanner for AI agent skills and MCP servers. No LLM, no network, no Docker: millisecond scans with a public zero-false-positive regression corpus
Plumbline
A public, append-only transparency log of MCP tool definitions. Detects post-publication changes to what agent tools claim they can do.
Agent Sec Scanners
Security scanners for AI workloads on one shared audit engine. Home of bedrock-security-mcp (AWS Bedrock auditor, MCP + CLI) and @miaggy/core. Findings map to OWASP LLM Top 10, OW…
Dsh Cert MCP
Read-only MCP server over the dsh-plugin-certification registry: get_certification, list_certified, certification_spec.
Agent Skill Supply Chain Auditor
Static supply-chain auditor for Agent Skill bundles and MCP configurations with SARIF, Agent-SBOM, and deterministic evaluation.
Agent Skill Aegis
中文 Agent Skill 与 MCP 配置供应链安全扫描器，支持终端、JSON、HTML 与 SARIF 报告。
epistemedeus/skillguard
y github:epistemedeus/skillguard mcp`
Toolproof
Trust grades, capability lockfiles, and signed evidence for the AI tool supply chain. Scan any MCP server or API before your agent connects. Paid by nobody we scan.
SkillWatch
Independent, local-only watcher for the AI-skill supply chain: flags bait-and-switch changes in the pages skills and MCP tools reference. Sends nothing anywhere. Python CLI.
Policies
78 Cedar policies and 369 rules governing AI coding agents. Every rule traces to a real incident, published CVE, or compliance framework requirement (SOC 2, NIST, ISO 27001, E…
Depscope CLI
CLI for depscope.dev — audit deps before install
Pnx MCP Audit
Security audit CLI for Model Context Protocol (MCP) servers. Zero deps, offline, cross-platform.
Auditpledge
Provenance and priced risk for the MCP tools a Compound-facing agent calls: real MCP session, Ed25519 verification, risk weighted for Compound position exposure, and a priced repo…
Vulconcern
The Nx s1ngularity attack used your own AI CLI to steal credentials via a postinstall script. Offline, read-only scanner for tampered configs, MCP endpoints, credential files, and…
Homebrew Guard
Homebrew tap for HOL Guard — local-first security for AI coding agents
gostanos/smallprint-action
mcp`.
Vetpkg
Stop AI coding agents installing packages that do not exist. MCP server + CLI for detecting hallucinated and slopsquatted npm packages. Zero dependencies.
Drift Check
Zero-execution MCP security preflight + GitHub Action. Detect mutable package references before AI agents run them. Try any public repo in the browser.
Agentic Covenants
A practitioner framework for autonomous-agent governance: six matrices mapped to NIST CSF 2.0, with working Kyverno policies, Falco rules, and kill-switch runbooks in every popula…
CapabilityEcho
Code review for AI-agent capability drift in pull requests — flags new network, subprocess, eval, lifecycle, and workflow-permission signals on the exact added diff lines. Local-o…
Damn Vulnerable Agent Asset Corpus
Damn Vulnerable Agent Asset Corpus: benchmark fixtures for agent-asset scanners and AAC release assurance.
Opsforge
Forge your DevOps workstation: TUI installer for 287 CLIs, policy-as-code shell guards, CVE-correlated SBOM + OpenVEX.
Pangenome
A prokaryotic architecture for LLM agent ecosystems: horizontal capability transfer with an immune system, dormancy that costs nothing, and epidemiological measurement of how agen…
Blastgate
A change-time security gate for the path between layers. Models dependencies, CI, and agent/MCP config as one graph and blocks any reachable route from an attacker-controllabl…
Paladin Npm
Audit an npm package before you install it: install hooks, shipped agent instruction files, hidden characters, and provenance.
Agent Supply Trust
Evaluate packages, containers, MCP servers, agent skills and plugins for provenance, permissions and runtime risk.
Gitmoru
Recover force-pushed GitHub branches and see what changed after a breach. Reads through the API, clones nothing, sends nothing anywhere.
Secretbank
🔐 The secrets manager that understands your dependency graph. Maps Issuer → Credential → Project → Deployment → URL. Detects supply-chain risk in npm/Cargo deps. Free, open source…