Enables MCP clients to run local, read-only audits that detect risky GitHub workflows, undocumented environment variables, possible credentials, and conflicting dependency configuration before merging.
Enables MCP clients to run deterministic AST safety audits, secret scanning, and sandboxed test execution on codebases, with human approval required before any remediation action.
Enables MCP clients to run read-only static audits on supplied n8n, Dify, Trigger.dev, Activepieces, and OpenAPI exports, and to screen HTTPS URLs for unsafe schemes, returning structured findings and limitations.
Enables agents and CI pipelines to audit MCP servers and agent tool-chains by statically scanning repositories, local checkouts, tools/list exports, or live endpoints for risks such as destructive actions without confirmation, mismatched safety annotations, injection surfaces, credential or PII exposure, and unguarded command, path, or URL sinks. All checks are read-only and never execute the scanned code or call tools/call.
Enables agents to audit and safeguard repositories by detecting dependency pinning issues, license compliance problems, hardcoded secrets, and dead code through MCP tools.
A read-only MCP server that lets an agent audit its own environment by discovering local MCP configurations and skill folders on Windows, macOS, and Linux and running offline static checks for prompt injection, hidden instructions, hardcoded secrets, dangerous commands, unpinned packages, and excessive filesystem or transport permissions. It exposes tools to scan everything discovered, list configurations, vet a single skill, or analyze supplied text, returning text, JSON, SARIF, or HTML findings with CI-friendly severity levels.
