"GitHub Copilot" matching MCP connectors:

Detect malicious or vulnerable npm packages: registry search, OSV.dev and GitHub advisory lookups

Post-quantum cryptography (PQC) vulnerability scanner. Detects ECDSA, RSA, AES-128 and other quantum-vulnerable algorithms in GitHub/GitLab/Bitbucket repos and Ethereum smart contracts. Returns risk score 0-100, CBOM (CycloneDX 1.6), and migration paths to NIST FIPS 203/204/205. Free tier: 10 scans/day, no key required.

Verify a vuln report's file/line/function claims against a real GitHub repo.

Scan a GitHub repository for vulnerabilities, with proof for every finding, from your coding agent.