MCP server

Verifies AI agent claims and documentation promises by checking them against the actual codebase with evidence-based proof.

Inspects AI agents and MCP configurations for security risks, permissions, and tool access through static analysis.

Creates a local, signed, and tamper-evident log of AI agent actions while providing a human-in-the-loop approval gate for consequential tasks.

Wraps database MCP servers to require supervisor approval for data-modifying or schema-changing operations via push notifications.

Scans GitHub repositories and shell commands for malware-delivery patterns and suspicious installation steps before an AI agent executes them.

Provides manifest-verified GitHub repository discovery and architectural decomposition while protecting AI agents with a prompt-injection firewall.

Provides a local-first trust and provenance gate to evaluate and filter MCP servers, skills, and plugins for AI agents.

Allows coding agents to run tests into Sigstore-signed receipts and retrieve redacted failure packets for verifiable test results.

Reviews GitHub Actions workflows for outdated actions, deprecated runtimes, insecure script injections, and retired runner labels.

Protects sensitive API keys by allowing AI agents to check registration status and manage deployments without ever seeing the actual secret values.

Provides multi-model review tools and local pre-commit gates to audit risky AI-generated code changes before they are committed or shipped.

Evaluates the security and trust scores of MCP servers, AI skills, and npm packages using safety scanning and multi-dimensional signals.

Scans text for leaked credentials like API keys and private keys locally before an agent writes or commits data.

Scans GitHub Actions and CI workflows locally to identify maintenance hygiene issues like unpinned actions and broad token permissions.

Audits GitHub Actions workflow YAML files for script injection, unpinned actions, missing permissions, and supply-chain vulnerabilities.

Audits environment security, detects secret leaks, and validates parity between .env and .env.example files.

Enables AI coding agents to manage secrets by generating .env files from a private Git-backed vault without pasting keys into prompts.

Provides a collection of specialized MCP servers for developer tools, security, science, and productivity tasks.

Audits Model Context Protocol configurations and tool manifests to detect security risks like unpinned packages, exposed credentials, and instruction injection.

Scans MCP servers, configurations, and agent rule files to detect poisoned tools, hidden prompts, leaked tokens, and risky permissions.