"Checking Supabase migrations in GitHub Actions" matching MCP connectors:

Find hidden Unicode in text or files: ASCII smuggling decoded, bidi overrides, look-alike letters.

pwned.coffeeA

coffee.pwned

Live security incidents, updated hourly from CISA KEV, critical GitHub security advisories, CVE records, vendor advisories and security news. For each one: what's affected, whether a fix exists, which versions fix it, and the sources. Check a lockfile or a whole repo and get the exact upgrade. Lockfiles are read in memory and never stored. Read-only MCP server, no auth

SniffPupA

io.github.sniffpup

Free passive outside security scan of a live web app: leaked keys, exposed files, open Supabase

Find hidden Unicode (zero-width, bidi, tag payloads), homoglyphs and lookalike names in text.

TrentA

ai.trent

Security reviews, threat models over a repo or website, and remediation tracking, in your editor.

For app builders in Israel: pre-launch checks for leaked keys, Supabase RLS, exposed env vars.

Vulnerability records: CVE, GHSA, CISA KEV, EPSS and vendor fixes in one place. No key needed.

Exploit-DB: new public exploits & PoCs, daily. Be born in one call — free testnet funds.

Dependency vulns & malicious-package advisories. Be born in one call — free testnet funds.

Security checks for AI-built apps (Lovable, Supabase, Bolt): RLS, headers, monitoring, fixes.

Free security scan for AI-written GitHub repos: leaked keys, .env, eval, SQLi, CORS.

Explain a regex in plain English and detect catastrophic backtracking risk.

Scan a deployed app URL for exposed keys, open Supabase tables and missing security headers.

Scan a public GitHub repo, explain risks, get fix prompts and rescan to confirm fixes.

Detect malicious or vulnerable npm packages: registry search, OSV.dev and GitHub advisory lookups

Post-quantum cryptography (PQC) vulnerability scanner. Detects ECDSA, RSA, AES-128 and other quantum-vulnerable algorithms in GitHub/GitLab/Bitbucket repos and Ethereum smart contracts. Returns risk score 0-100, CBOM (CycloneDX 1.6), and migration paths to NIST FIPS 203/204/205. Free tier: 10 scans/day, no key required.

Verify a vuln report's file/line/function claims against a real GitHub repo.

IaC attack-path auditor: finds internet-to-crown-jewel chains in Terraform/CFN/K8s.

Free no-account URL security scan: 0-100 Launch Readiness score for any live site in ~15 seconds.

Look up hosts in the Ohey web malware feed, read CVEs and scan URLs with Ohey's scanner.

Checks a site built with AI tools for security problems and gives the fix in plain English.

Outside-in audit of a live site: leaked keys, headers, TLS, SPF/DMARC, privacy, SEO, with fixes

Security scans for AI-built apps: leaked keys, open Supabase RLS, vulnerable packages, live sites.

Odin connects your coding agent to your organisation’s security findings. Read findings and remediation, inspect pentests and assets, and link an existing fix pull request. Sign in with your Odin account; access follows your organisation role and the permissions you grant. Requires an Odin account.

Scan a GitHub repository for vulnerabilities, with proof for every finding, from your coding agent.

Ask about your Kodem Security data and act on findings in plain language, with your permissions.

CVE triage in one call: NVD, CVSS, CISA KEV, EPSS, public exploits and an explained risk score.

Defensive vulnerability intelligence search across public CVE/NVD and GitHub advisory APIs with CVSS

Query and retrieve information about various adversarial tactics and techniques used in cyber atta…