- Conduid
- Marketplace
- #supply-chain-security
MCP servers tagged supply-chain-security
229 live MCP servers tagged "supply-chain-security", ranked by trust score. Tags come from package metadata and repository topics, so this list covers servers across every category that work with supply-chain-security.
Tool Trust Metadata
Working paper: provenance and trusted metadata for MCP tools (SPDX 3 / CycloneDX reuse, offline verification)
Reachable Agent Plugin Installer
Claude Code marketplace for the REACHABLE plugin (generated from the signed adapter). Not the scanner.
Scopewatch
Local-first CLI trust layer for MCP servers - shows a plain-language capability diff before every install and update
Passmcp Reporting
The passmcp attestation format for MCP servers, its JSON Schemas and offline verifier, the security graph model, and an agentgateway processor that enforces it.
Bleurs
Ground truth for AI coding agents. Blocks the APIs that don't exist, serves the ones that do — one index, both directions.
ToolAtlas
Offline-first agent supply-chain gate: scan MCP and agent context, lock content, correlate risk, and enforce drift in CI.
Surface Scan
Read an MCP client config and report what each server can actually reach — before you mount it.
Noulette
Noulette is a MCP platform that finds problems, propose fix and actually fix it (upon approvals) during app development and when running app in production.
Valvur
Offline security scanning for AI-generated code: seven open-source scanners and AI-specific checks in one command. It finds secrets, vulnerable, hallucinated and malicious depende…
Agentsift
Security scanner for AI agent plugins, skills, and MCP packages. npm audit for the AI agent ecosystem.
Agent Proof Kit
Deterministic proof gates and a raw-byte write firewall for AI agents — CLI, MCP, in-toto receipts, Codex CLI and Mistral Vibe.
Skill Audit
Проверка чужого скилла, плагина или MCP-сервера Claude до установки: сеть, ключи, персистентность, обфускация, промпт-инъекции. Сканер только читает.
Upgrade Atelier
A keyless, explainable upgrade dossier for npm dependencies with live release signals, MCP tools, and replayable audit seals.
Skill Scan Gate
CI gate for Claude Code skills and plugins: scans a skills or plugin repository for instruction-override text, exfiltration patterns, dangerous hook commands, unpinned MCP servers…
Scan MCP
Static security scanner for MCP servers — detects tool poisoning, injection, secrets, Dockerfile and dependency issues.
Mcpaudit
Security scanner for your installed MCP servers — finds plaintext secrets, unpinned supply chains, and tools that can exec/write/eval. Static or --deep. Local-only.
Glyph
🔮 MCP security scanner — find tool poisoning, credential leaks, and insecure transports in AI agent configurations
IDE Scanner Web
GuardRails by Abscissa: VS Code extension-package security, exact-release evidence, workspace monitoring, and a read-only OAuth MCP server.
Mcpguard
Local firewall, scanner, and audit logger for MCP servers. Auto-discovers Claude Desktop / Cursor / Windsurf / VS Code configs and flags risky tool servers — leaked secrets, curl|…
Audit
Python security scanner for Model Context Protocol (MCP) servers — find prompt injection, over-broad permissions, weak input validation, and credential leaks before your AI agent…
Mcpvet
MCPVet — scan MCP servers, Claude Code skills & plugins for unsafe behavior before you install them. One-step MCP server + skill. https://mcpvet.com
Mcpscan
Zero-dependency CLI: inventory MCP server configs across every AI client, detect drift, flag supply-chain risk, and measure context-token cost per server
Audit
See what your AI agents can access. Scan MCP configs for exposed secrets, shadow APIs, and AI models. Generate AI-BOMs for compliance.
Safe Skills
🛡️ Zero-trust security gate & vulnerability scanner for AI agent skills (Claude Code, Antigravity, OpenCode, Codex). Powered by NVIDIA SkillSpector.
Trust Me Bro
Every skill you install says trust me bro. This one reads it first. Pre-install audit for agent skills, plugins, and MCP servers: lethal-trifecta reach, injection wording, provena…
Agent Skills State 2026
Study of 2,999 public agent skill, plugin and MCP repositories (October 2026): missing security policies, unpinned MCP servers, unrestricted shell in skills, front matter that fai…
Agentgate
AgentGate — scan, lock, and gate your MCP servers. npm-audit + lockfile + CI drift gate for the MCP era.
Mcpguard
Find risky MCP servers before your AI agents use them: tool poisoning, rug pulls, leaked secrets, vulnerable packages.
FortressCI
No description published.