Security

OpenMetadata

OpenMetadata

Official OpenMetadata MCP: 21 read and write tools for search, lineage, data quality, governance.

• Remote
• OAuth

OpenOSINT

AI-powered OSINT agent & MCP server. 21 tools: email, breach, IP, WHOIS, DNS, Shodan, GitHub & more.

• Runs locally
• API key

mcp

Semgrep

Semgrep Guardian integrates natively with AI coding agents like Claude Code and Cursor to catch security issues before they ship. It bundles the Semgrep MCP server, Hooks, and Skills into a single install, and scans every file an agent generates using Semgrep Code, Supply Chain, and Secrets.

• Remote
• API key

MCP Server for WinDbg Crash Analysis

A Model Context Protocol server for Windows crash dump analysis using WinDbg/CDB

• Runs locally

HOL Guard

Local-first AI agent security evidence and approval workflows through HOL Guard's stdio MCP server.

• Runs locally

SafeDep Vet MCP

Protect your AI agents and IDEs from malicious open-source packages.

• Runs locally

mcp

Authorize consequential AI agent actions before execution

• Runs locally
• Remote
• API key

skylos

Dead code, security, secrets detection and code quality for Python, TypeScript, Go.

• Runs locally
• API key

GhidraMCP

Ghidra

https://github.com/user-attachments/assets/36080514-f227-44bd-af84-78e29ee1d7f9

• Runs locally
• No auth

Attestix

AI agent identity, signed credentials, delegated authority and governance evidence.

• Runs locally

ida-pro-mcp

Hex-Rays

Simple MCP Server to allow vibe reversing in IDA Pro.

• Runs locally
• No auth
• Paid

vibe-check-mcp-server

Metacognitive AI agent oversight: adaptive CPI interrupts for alignment, reflection and safety

• Runs locally
• API key

reverse-engineer-anything

Reverse engineer native, managed, Electron/JavaScript, packaged, firmware, and browser targets with REA, and build agent environments (AgentEnv bundles) of web applications from a live instance or a capture. Use shipped-artifact or requested runtime evidence to explain features, compare versions…

• No scripts
• Works offline

security-audit-skill

Cloudflare

A coding-agent skill that turns your agent into a security auditor. It orchestrates isolated agents through reconnaissance, coverage-led hunting, candidate validation, structured output, independent record verification, and target-neutral reporting.

• No scripts
• Works offline

google-cloud-recipe-auth

Google Cloud

Provides expert guidance on Identity and Access Management (IAM) and authenticating and authorizing to Google Cloud services and APIs, covering human users, service identities, Application Default Credentials (ADC), and best practices for secure access.

• No scripts
• Needs network

google-cloud-waf-security

Google Cloud

Generates security-focused guidance for Google Cloud workloads based on the design principles and recommendations in the Google Cloud Well-Architected Framework (WAF). Use this skill to evaluate workloads, identify security requirements, and provide actionable recommendations for IAM, network…

• No scripts
• Works offline

Anthropic-Cybersecurity-Skills

A junior analyst knows which Volatility3 plugin to run on a suspicious memory dump, which Sigma rules catch Kerberoasting, and how to scope a cloud breach across three providers. Your AI agent doesn't — unless you give it these skills.

• No scripts
• Needs network

aig-agent-redteam

当用户要求 AI/Agent 安全评估、蓝军演习、AI 安全审查、提示词注入测试、MCP/Skill/插件/代码包审计、Agent 工具链滥用测试，或需要生成类似渗透测试报告的 Markdown/HTML 时，必须使用本 skill。本 skill 让 Agent 以授权蓝军视角成为 AI 安全专家，面向 AI 产品、Agent、MCP Server、Skill、代码仓库和 AI 基础设施进行安全演习。优先使用第一性原理推理和真实证据，而不是机械跑 payload 库；脚本只用于 HTTP 指纹识别、证据聚合、报告渲染等确定性辅助任务。

• Bundles scripts

email-best-practices

Resend

Use when building email features, emails going to spam, high bounce rates, setting up SPF/DKIM/DMARC authentication, implementing email capture, ensuring compliance (CAN-SPAM, GDPR, CASL), handling webhooks, retry logic, making emails accessible (alt text, headings, contrast, screen readers), or…

• No scripts

clawsec

ClawSec is an AGPL collection of security skills and signed advisory intelligence for AI agent runtimes. It helps operators verify skill artifacts, detect configuration drift, audit agent environments, and approval-gate risky installs across OpenClaw, NanoClaw, Hermes, and Picoclaw.

• Bundles scripts

computer-forensics

Claude Code Skills for software engineering workflows - Git automation, testing, and code review

file-deletion

Claude Code Skills for software engineering workflows - Git automation, testing, and code review

vibesec

This skill helps Claude write secure web applications. Use this when working on any web application or when a user requests a scan or audit to ensure security best practices are followed.

• No scripts

security-bluebook-builder

Create or refine a concise, normative security policy ("Blue Book") for sensitive applications. Use when users need a threat model, data classification rules, auth/session policy, logging and audit requirements, retention/deletion expectations, incident response, or security gates for apps…

• No scripts