Skip to main content
Glama

Related Servers

Alternatives to sphior-code-mcp

No user-submitted related servers found.

    Related Servers

    • A
      license
      Not graded
      quality
      D
      maintenance
      Local-first security check for AI coding agents — finds hardcoded secrets, exposed .env files, git-history leaks and vulnerable dependencies (OSV), entirely on your machine. Ask your agent "is this safe to ship?" and get a Launch Readiness score with a fix for every finding.
      MIT
    • A
      license
      Not graded
      quality
      C
      maintenance
      Enables AI coding tools to scan projects for security vulnerabilities, hardcoded secrets, injection flaws, and privacy violations with 699 rules and 76 MCP tools, all running locally with zero telemetry.
      24 npm
      7
      MIT
    • A
      license
      Not graded
      quality
      D
      maintenance
      Enables security review of code diffs and files in Cursor/VS Code using local rule-based analysis with the same rule IDs as CI, no cloud required.
      Apache 2.0
    • A
      license
      A
      quality
      B
      maintenance
      Local-first, zero-egress security scanner for AI-generated / "vibe-coded" JS/TS. Bundles Opengrep, Gitleaks & Trivy behind one CWE-keyed schema and adds AI-code-specific checks (client-side secret exposure, Supabase RLS, prompt-injection & LLM-output XSS sinks). No account, no telemetry.
      10
      183 npm
      51
      Apache 2.0
    • A
      license
      Not graded
      quality
      Not graded
      maintenance
      Enables security scanning of code projects to identify common vulnerabilities like XSS, injections, SSRF, and path traversal issues. Provides local, offline scanning with severity-grouped results and actionable fix suggestions for improving code security.
      38 npm
      -
    • F
      license
      Not graded
      quality
      D
      maintenance
      Enables local security scanning and compliance gap analysis for code and text, detecting secrets, PII, and OWASP vulnerabilities, and assessing readiness across major frameworks like NCA, ISO 27001, NIST CSF, and SOC 2.
      -

    TDQS

    A3.9/5.0

    Scored across 8 tools

    Disambiguation4/5

    The tools mostly target distinct actions: listing findings, fetching one finding, summarizing posture, changing status, health checking, getting fix context, and verifying evidence. The main overlap is between list_findings and get_fix_context, both of which surface vulnerabilities, though the descriptions differentiate read-only listing from scan-and-remediate guidance.

    Naming Consistency4/5

    Most names follow a consistent snake_case verb_noun pattern: list_findings, get_finding, resolve_finding, mark_false_positive, get_fix_context, verify_evidence. The exception is health_check, which is a noun phrase rather than a verb-led tool name, but the overall convention is still predictable.

    Tool Count5/5

    Eight tools is well-scoped for a security findings server. Each tool maps to a meaningful operation across listing, investigation, remediation, triage, auditing, and diagnostics, without obvious filler.

    Completeness4/5

    The server covers the core vulnerability lifecycle: listing, detail inspection, summary posture, resolution and false-positive triage, remediation context, evidence verification, and health diagnostics. Minor gaps remain, such as no explicit tool to trigger or manage remote scans, no repo/monitored-repository listing beyond summary counts, and no reopening or status-history operation.

    Maintenance

    ActivityMaintained
    ResponsivenessNo recent community issues