I want to audit my code for security problems
Skills and servers that inspect codebases, packages, and running systems. Your agent flags vulnerabilities and provides remediation steps.
MCP servers for this
- MCP server
REA
Reverse engineer anything from your terminal or agent with one CLI and MCP server.
398kActive- Runs locally
- No auth
Setup documented for Claude Code, Codex, Cursor, Gemini CLI- MCP server
jshookmcp
Search-first MCP server for JavaScript reverse engineering: 735 tools across 36 domains.
2.1kActive- Runs locally
- No auth
Setup documented for Cursor, Claude Desktop- MCP server
OpenOSINT
AI-powered OSINT agent & MCP server. 21 tools: email, breach, IP, WHOIS, DNS, Shodan, GitHub & more.
1.8kActive- Runs locally
- API key
- Free
Setup documented for Claude Code, Cursor, Claude Desktop- MCP server
- Official
semgrep
Semgrep
Semgrep Guardian integrates natively with AI coding agents like Claude Code and Cursor to catch security issues before they ship. It bundles the Semgrep MCP server, Hooks, and Skills into a single install, and scans every file an agent generates using Semgrep Code, Supply Chain, and Secrets.
17kActive- Remote
- API key
Setup documented for VS Code (GitHub Copilot), Cursor, Claude Desktop, Windsurf- MCP server
- Official
SafeDep Vet MCP
SafeDep
Protect your AI agents and IDEs from malicious open-source packages.
1.1kActive- Runs locally
- No auth
Setup documented for Claude Code- MCP server
HOL Guard
Local-first AI agent security evidence and approval workflows through HOL Guard's stdio MCP server.
1kActive- Runs locally
Setup documented for Claude Code, Gemini CLI, OpenCode- MCP server
SSH — policy-gated remote access
Policy-gated, audited SSH for Linux and Windows hosts: roles, approvals, and an audit log.
838Active- Runs locally
- API key
Setup documented for Claude Code- MCP server
agent-safe-pipeline
Authorize consequential AI agent actions before execution
672Active- Runs locally
- Remote
- API key
- MCP server
skylos
Dead code, security, secrets detection and code quality for Python, TypeScript, Go.
857Active- Runs locally
- API key
Setup documented for Claude Code- MCP server
GhidraMCP
Ghidra
https://github.com/user-attachments/assets/36080514-f227-44bd-af84-78e29ee1d7f9
12kActive- Runs locally
- No auth
Setup documented for Claude Code, VS Code (GitHub Copilot)- MCP server
Attestix
AI agent identity, signed credentials, delegated authority and governance evidence.
840Active- Runs locally
Setup documented for Claude Code- MCP server
ida-pro-mcp
Hex-Rays
Simple MCP Server to allow vibe reversing in IDA Pro.
13kActive- Runs locally
- No auth
- Paid
Setup documented for Claude Code, VS Code (GitHub Copilot), Codex, Cursor and 1 more- MCP server
Vestige
Causal Proof Engine for AI agents: signed log, zero vectors, failures traced to their cause.
658Active- Runs locally
- MCP server
jadx-ai-mcp
JADX-AI-MCP is a plugin for the JADX decompiler that integrates directly with Model Context Protocol (MCP) to provide live reverse engineering support with LLMs like Claude.
2.9kActive- Runs locally
- No auth
Setup documented for Claude Desktop- MCP server
Emilia Protocol
Exact-action approval for consequential agent actions: request, track, and verify signed receipts.
599Active- Runs locally
- API key
- MCP server
CrowdStrike Falcon MCP Server
Connects AI agents with CrowdStrike Falcon for security analysis and automation.
273Active- Runs locally
- API key
- MCP server
dashclaw
Policy checks, approvals, records, and governed HTTP capabilities for unattended agents.
313Active- Runs locally
- API key
Setup documented for Claude Code, Claude Desktop- MCP server
squirrelscan
Website QA for your coding agent: audit SEO, performance, security, accessibility over MCP.
298Active- Remote
Setup documented for Claude Code, Codex, Cursor, OpenCode- MCP server
EVMole
Local structured analysis of deployed EVM runtime bytecode
475Active- Runs locally
- MCP server
SonarQube MCP Server
Analyze code quality and security with SonarQube Server or Cloud directly in AI assistants.
675Active- Runs locally
- API key
Setup documented for Claude Code, VS Code (GitHub Copilot), GitHub Copilot CLI, Codex and 2 more- MCP server
wireshark-mcp
Professional network analysis with tshark. Security audits, deep-dives, and threat detection.
360Active- Runs locally
Setup documented for Claude Code- MCP server
Tracekit MCP gateway
MCP gateway you deploy: a Tracekit signer decides and signs each call; agents send each run's token.
260Active- Remote
- API key
- MCP server
- Official
vet (docs)
Protect against malicious open source packages 🤖
1.1kActive- Remote
- MCP server
- Official
studio-mcp
Easily find and fix security issues in your applications leveraging Snyk platform capabilities.
58Active- Runs locally
Skills for this
- Skill
reverse-engineer-anything
Reverse engineer native, managed, Electron/JavaScript, packaged, firmware, and browser targets with REA, and build agent environments (AgentEnv bundles) of web applications from a live instance or a capture. Use shipped-artifact or requested runtime evidence to explain features, compare versions…
398kActive- No scripts
- Works offline
Setup documented for Claude Code, Codex- Skill
- Official
security-audit-skill
Cloudflare
A coding-agent skill that turns your agent into a security auditor. It orchestrates isolated agents through reconnaissance, coverage-led hunting, candidate validation, structured output, independent record verification, and target-neutral reporting.
50kActive- No scripts
- Works offline
- Skill
- Official
google-cloud-recipe-auth
Google Cloud
Provides expert guidance on Identity and Access Management (IAM) and authenticating and authorizing to Google Cloud services and APIs, covering human users, service identities, Application Default Credentials (ADC), and best practices for secure access.
22kActive- No scripts
- Needs network
- Skill
- Official
google-cloud-waf-security
Google Cloud
Generates security-focused guidance for Google Cloud workloads based on the design principles and recommendations in the Google Cloud Well-Architected Framework (WAF). Use this skill to evaluate workloads, identify security requirements, and provide actionable recommendations for IAM, network…
22kActive- No scripts
- Works offline
- Skill
Anthropic-Cybersecurity-Skills
A junior analyst knows which Volatility3 plugin to run on a suspicious memory dump, which Sigma rules catch Kerberoasting, and how to scope a cloud breach across three providers. Your AI agent doesn't — unless you give it these skills.
35kActive- No scripts
- Needs network
Setup documented for Claude Code, VS Code (GitHub Copilot), GitHub Copilot CLI, Cursor and 1 more- Skill
aig-agent-redteam
Tencent Zhuque Lab
当用户要求 AI/Agent 安全评估、蓝军演习、AI 安全审查、提示词注入测试、MCP/Skill/插件/代码包审计、Agent 工具链滥用测试，或需要生成类似渗透测试报告的 Markdown/HTML 时，必须使用本 skill。本 skill 让 Agent 以授权蓝军视角成为 AI 安全专家，面向 AI 产品、Agent、MCP Server、Skill、代码仓库和 AI 基础设施进行安全演习。优先使用第一性原理推理和真实证据，而不是机械跑 payload 库；脚本只用于 HTTP 指纹识别、证据聚合、报告渲染等确定性辅助任务。
7.2kActive- Bundles scripts
- Needs network
- Skill
clawsec
Prompt Security
ClawSec is an AGPL collection of security skills and signed advisory intelligence for AI agent runtimes. It helps operators verify skill artifacts, detect configuration drift, audit agent environments, and approval-gate risky installs across OpenClaw, NanoClaw, Hermes, and Picoclaw.
1.1kActive- Bundles scripts
- Needs network
- Skill
app-store-preflight-skills
Apple
Scan an iOS/macOS Xcode project for common App Store rejection patterns before submission. Use when preparing an app for App Store review, after receiving a rejection from Apple, or when auditing metadata, subscriptions, privacy manifests, entitlements, or design compliance. Integrates with the…
1.4kActive- No scripts
- Needs network