Skip to main content
Glama

Related Servers

Alternatives to Draugr

Related Servers

  • A
    license
    Not graded
    quality
    B
    maintenance
    Real security scanners for AI coding agents — SAST (441 rules), secret detection (419+ patterns), dependency CVEs (OSV.dev), MCP/skill vetting, MITRE ATT&CK. Open-source, Rust, free
    6 npm
    Apache 2.0
  • A
    license
    Not graded
    quality
    A
    maintenance
    Enables AI agents to scan a repository or project for malware, supply-chain attacks, leaked secrets, and web, server, cloud, and CI/CD vulnerabilities, then confirm real findings with concrete attack scenarios and fixes. Exposes scan, guide, and reference tools plus a security-review prompt that runs locally.
    1
    MIT
  • A
    license
    A
    quality
    C
    maintenance
    Enables AI agents to scan code for security vulnerabilities using multiple static analysis tools, with support for filtering, deduplication, and CI/CD integration.
    27
    60 PyPI
    4
    MIT

TDQS

A4.3/5.0

Scored across 13 tools

Disambiguation5/5

Each tool targets a distinct resource and action, and the descriptions explicitly resolve the near-neighbours: diff_reports vs summarize_report vs fix_list are separated by 'ask this rather than X' guidance, as are scan vs summarize_report and propose_saga vs get_saga_schema vs validate_saga. The two descriptor-generating tools (survey from a live system, propose_saga from a local directory) are cleanly differentiated by input source.

Naming Consistency4/5

Consistent snake_case with a predominantly verb_object pattern (list_controls, validate_saga, explain_rule, check_tools, summarize_report, diff_reports, propose_saga, get_saga_schema). A few deviations exist: fix_list inverts to noun_verb, feeds_status is noun_noun, and scan/survey are bare verbs, but all remain readable and unambiguous.

Tool Count5/5

13 tools fit comfortably in the well-scoped range and each covers a real step in the lifecycle: descriptor authoring/validation, control and surveyor discovery, scanning, reporting, diffing, triage, and environment diagnostics. No tool appears redundant or filler.

Completeness4/5

The surface covers the descriptor lifecycle (schema, propose, validate, survey), the scan lifecycle (scan, summarize_report, diff_reports, fix_list, explain_rule) and diagnostics (check_tools, feeds_status, list_controls, list_surveyors) with no dead ends. Minor gaps: no way to enumerate prior reports/report directories, and feed updates and fixes are only surfaced as user-run commands rather than tools.

Maintenance

ActivityActive
ResponsivenessUsually handled