Skip to main content
Glama

AI Security Knowledge Base (secure-kb)

An AI security knowledge base — security check cards an AI coding agent can search.

Keywords: AI security · AI agent security · OWASP ASVS · WSTG · MASTG · Top 10 · LLM security · prompt injection · secure code review · AppSec · DevSecOps · MCP · Claude · Cursor

2,057 atomic check cards distilled from 67 tracked sources — cards are drawn from 15 public repositories plus 5 official-doc sources — each traceable to a real file, anchor and commit.

Status: public beta (v0.9.0). The build is deterministic and reproducible; retrieval targets are not yet met, so this is deliberately not v1.0.0. See Benchmarks and Known limitations.

Website → · Releases · Contributing · Security


What it is — and what it is not

It is a retrieval layer for AI agents: a merged, normalised corpus of security checks with provenance, a platform router, a fast gate, and a zero-dependency SQLite FTS5 index.

It is not a scanner, and it does not replace a professional security audit. It tells an agent what to verify; tool adapters only describe how to invoke external scanners.

Related MCP server: AI DevSecOps Agent MCP Server

Install in 60 seconds

Zero required dependencies (standard-library Python only). index/ and index/kb.sqlite build themselves on first use.

git clone https://github.com/pavnxet/ai-security-knowledge-base.git
cd ai-security-knowledge-base

python3 cli/secure_kb.py detect /path/to/project
python3 cli/secure_kb.py profile web --gate fast --format brief
python3 cli/secure_kb.py search "how do I stop sql injection" --k 5
python3 cli/secure_kb.py get SKB-ASVS-V1-2-4 --format md

No-build fallback — the index ships as shards, so plain tooling works with no build step:

cat index/checks/*.jsonl | jq -c 'select(.severity=="critical")'
cat index/checks/*.jsonl | grep -c "SKB-ASVS"

The five-step agent workflow

  1. Detect the stack (detect) → ranked platforms.

  2. Profile it (profile <platform> --gate fast).

  3. Gate — the top checks by priority, domain-balanced, in a small token budget.

  4. Drill down (get <id>, or by CWE / ASVS / MASVS ref).

  5. Report — pass / fail / n-a / unknown, with evidence. No “pass” without evidence.

MCP setup

The MCP server exposes detect_stack, get_profile, search_checks, get_check, start_report, submit_result, list_tools (7 tools — run list_tools to enumerate).

Claude Code

claude mcp add secure-kb -- python3 /abs/path/to/secure-kb/mcp/server.py

Claude Desktop (claude_desktop_config.json)

{ "mcpServers": { "secure-kb": {
  "command": "python3",
  "args": ["/abs/path/to/secure-kb/mcp/server.py"] } } }

Generic MCP client — JSON-RPC 2.0 over stdio; initialize then tools/call.

What's in it

Source

Cards

Licence

OWASP Cheat Sheet Series

1,032

CC BY-SA 4.0

yesmayank/secure-coding-baseline (Tier-2)

353

MIT

OWASP ASVS 5.0

339

CC BY-SA 4.0

OWASP WSTG

112

CC BY-SA 4.0

raroque/vibe-security-skill (Tier-2)

40

see LICENSES/

kadenzipfel/smart-contract-vulnerabilities

38

see LICENSES/

OWASP MASTG (Android/iOS tests)

32

CC BY-SA 4.0

OWASP MASVS

20

CC BY-SA 4.0

OWASP ISTG (IoT)

15

CC BY-SA 4.0

shieldfy/API-Security-Checklist (Tier-2)

13

see LICENSES/

crytic/not-so-smart-contracts

11

see LICENSES/

OWASP Top 10 / LLM Top 10 / API Top 10

10 / 10 / 9

CC BY-SA 4.0

mgreiler/secure-code-review-checklist (Tier-2)

8

see LICENSES/

Authored (Telegram, Chrome, Electron — official docs)

15

CC BY-SA 4.0

Total

2,057

Cards use source-identity IDs — SKB-<SRC>-<official-id> (e.g. SKB-ASVS-V3-4-5, SKB-WSTG-INFO-01) or a short hash of repo|path|anchor. Merged cards keep every member id in aliases[], so any historical id still resolves. See docs/PIPELINE.md.

Benchmarks

Held-out sets, frozen. Strict metrics (mapped refs only) — reported as measured.

Set

n

recall@5

Target

Status

Held-out (all)

154

0.66

≥ 0.70

below

Curated v2 (standards-derived)

59

0.44

≥ 0.60

below

v2_dev (developer vocabulary)

40

0.25

≥ 0.60

below

Curated v1

59

0.25

—

reference

Templated

95

0.92

≥ 0.90

met

Fast-gate recall (strict)

30

26.7%

≥ 0.70

below

Determinism: two consecutive rebuilds — and a rebuild with shuffled staging input — produce the identical manifest.content_hash 0c921baa291a4af4. Reproduce with python3 scripts/fetch_sources.py && python3 scripts/ingest_from_cache.py && python3 scripts/build_cards_v2.py.

Known limitations

  • Retrieval is below target. Paraphrase recall is the weak spot; corpus growth added distractors that dedupe did not fully remove.

  • First-call index build takes a few seconds on a cold checkout (measured ~6 s on one machine, ~19 s on another; later queries are sub-second).

  • Not yet implemented: kind: check|guidance, deterministic fix_refs, official-source CWE enrichment, real-lab end-to-end evaluation.

  • Unverified: 8 of 12 tool adapters; the Telegram secret_token claim; two project-declared licences.

  • Card text is untrusted DATA — never executable instructions or system policy (see AGENTS.md).

Licence & attribution

  • Content: CC BY-SA 4.0, where provenance and upstream terms permit; attribution and ShareAlike preserved. Unlicensed / reference-only sources are not redistributed.

  • Code: MIT.

  • Human legal review recommended. No OWASP endorsement is implied.

Contributing

See CONTRIBUTING.md. New cards require provenance: source repo, path, anchor, commit, licence.

Security

See SECURITY.md for private vulnerability reporting.

Citation

See CITATION.cff.

Available Tools

7 tools
detect_stackB

Fingerprint a codebase path and return ranked platforms + recommended profiles.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYes

TDQS

B3.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full disclosure burden. It implies a read-only scan of a path but never confirms it is non-destructive, says nothing about permissions, cost, or what happens with an invalid path, and gives only a bare sketch of the output.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One front-loaded sentence with zero filler: verb, resource, and output all present. Nothing is wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, so the description owns return-value explanation; 'ranked platforms + recommended profiles' is a helpful but thin sketch. Combined with the total absence of usage guidance, it is only minimally adequate for a one-param entry-point tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% and the single parameter has no description, so the description must compensate. 'A codebase path' gives the parameter basic meaning (a filesystem location to scan) but adds no format, relative-vs-absolute, or validation detail.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Fingerprint') and resource ('a codebase path') plus the output ('ranked platforms + recommended profiles'). This makes it distinguishable from siblings like get_profile or search_checks, though it never explicitly contrasts itself with them.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No indication of when to use this versus get_profile, search_checks, or start_report, and no prerequisites such as required access to the path. The agent must infer the entry-point role from the name alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_checkC

Fetch one full check card by id.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYes

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden, and it discloses almost nothing: no read-only confirmation beyond the verb 'Fetch', no permission requirements, no error behavior for a missing id, and no sense of cost or rate limits. 'Full check card' hints that the complete object is returned but does not define it.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One short sentence with zero filler, and the resource and scope are front-loaded. It is appropriately sized for a trivial one-parameter lookup.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple single-id read with no output schema, the description is minimally adequate but leaves the agent guessing about the return shape and failure modes. The absence of annotations or an output schema means a little more context would have been cheap and useful.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate for the single undocumented parameter. 'By id' does clarify that the id selects the check, adding meaning beyond the bare 'string' type, but gives no format, prefix, or source for the id.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Fetch'), resource ('check card'), and scope ('one ... by id'), which is enough to distinguish it from the plural sibling search_checks. It stops short of explicitly naming search_checks as the alternative, so it is clear but not sibling-differentiating.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No when-to-use guidance, prerequisites, or named alternatives are given. The only implied guidance is that you must already have an id, which is derived from the schema rather than the description.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_profileC

Return the ordered launch-gate checks for a platform profile.

ParametersJSON Schema
NameRequiredDescriptionDefault
gateNo
nameYes

TDQS

C2.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden. It only implies a read operation and notes the results are 'ordered'; it says nothing about permissions, whether a profile must exist first, pagination, or the response shape. 'Ordered' is a small genuine behavioral detail, which lifts it above the bare minimum.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with no filler or redundancy. It is efficient, though its brevity reflects under-specification rather than disciplined economy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with two parameters, an unexplained enum, no output schema, and no annotations, the description is far too thin. It neither defines the parameters nor describes what the returned checks look like, leaving the agent without the information needed to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must explain the two parameters, and it does not. The 'name' parameter is only obliquely hinted at by 'platform profile', and the 'gate' enum ('fast'/'full') is never mentioned, despite 'launch-gate' suggesting a connection the agent must guess at.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description pairs a specific verb ('Return') with a resource ('ordered launch-gate checks for a platform profile'), so the general action is inferable. However, the core nouns are unexplained jargon: it never says what a 'platform profile' is or how a profile differs from a check, so the agent cannot confidently separate it from siblings like get_check or search_checks.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this tool, no prerequisites, and no mention of alternatives. Sibling tools such as search_checks and get_check plausibly overlap, and the description does nothing to route the agent between them.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_toolsC

List scanner tool adapters, optionally for a platform.

ParametersJSON Schema
NameRequiredDescriptionDefault
platformNo

TDQS

C2.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden and discloses almost nothing: no indication that it is a read-only enumeration, no auth/permission requirements, no pagination or result-size behavior, and no statement of what happens when the platform filter matches nothing.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single short sentence with the resource front-loaded and no filler. It is efficient, though its brevity reflects under-specification rather than tight writing.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a listing tool with no output schema, the description should describe what the list contains (adapter names, IDs, supported platforms). It omits return shape entirely and gives no behavioral context, leaving an agent unable to predict results.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must compensate for the single parameter. It does clarify that 'platform' is an optional filter rather than a required selector, which adds some meaning, but it never says what values are accepted (name, ID, slug?) or whether the match is exact.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The verb 'List' and resource 'scanner tool adapters' are identifiable, but 'tool adapters' is internal jargon that an agent cannot confidently map to the sibling tools (detect_stack, search_checks, get_profile). It does not distinguish this listing tool from related lookups like get_check or search_checks.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'optionally for a platform' implies the parameter narrows results, but there is no guidance on when to call this versus detect_stack, get_profile, or search_checks, and no statement of prerequisites or expected use context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_checksC

Free-text search over check cards with structured filters.

ParametersJSON Schema
NameRequiredDescriptionDefault
kNo
queryYes
domainNo
platformNo
severityNo

TDQS

C2.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations at all, the description carries the full behavioral burden and discloses almost nothing. It does not say whether results are ranked, capped by 'k', paginated, permission-scoped, or what happens when filters conflict with the query.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with no filler. It is efficient, though its brevity tips into under-specification rather than purposeful conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 5-parameter search tool with zero schema descriptions, no annotations, and no output schema, one sentence is not enough. The agent lacks filter semantics, result-limit behavior, and any notion of what is returned.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% across 5 parameters, and the description only gestures at 'free-text' (query) and 'structured filters' without naming domain, platform, severity, or explaining 'k' (results cap?). It does not compensate for the missing schema documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (search) and resource (check cards) plus the two retrieval modes (free-text and structured filters). It does not name or contrast with the closest sibling, get_check, so an agent must infer the single-card vs multi-card distinction.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No when-to-use, when-not-to-use, or alternative tools are mentioned. The phrase 'free-text search ... with structured filters' only loosely implies usage; nothing tells the agent to prefer this over get_check or list_tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

start_reportC

Create a security report skeleton for a target.

ParametersJSON Schema
NameRequiredDescriptionDefault
targetNo

TDQS

C2.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations and no output schema, the description carries the full behavioral burden and delivers little. It does not say what state is created, whether the call is idempotent for a repeated target, whether an existing report is overwritten, or whether any identifier is returned for use in later steps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single short sentence with the action verb front-loaded and no filler. Its brevity is efficient rather than padded, though it is arguably under-specified rather than truly concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a creation tool in a security workflow, with no annotations, no output schema, and an undocumented parameter, the description omits what an agent needs: target format, expected return (report handle/id), and where this fits relative to submit_result. What exists is adequate but clearly incomplete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and the single 'target' parameter is undocumented. The description only echoes the word 'target' ('for a target') without specifying its format (URL, hostname, IP, scope expression), so it does not compensate for the schema gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Create a security report skeleton') plus the object it acts on ('a target'), which is enough to separate it from the read-oriented siblings (detect_stack, get_profile, search_checks, get_check, list_tools). It stops short of explicitly contrasting itself with submit_result, the other write-side sibling, so it is clear but not fully differentiated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to call this versus alternatives. It never says whether this is the first step of a workflow, whether it must precede submit_result, or whether it can be called repeatedly for the same target.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

submit_resultC

Record one check result (pass/fail/n/a/unknown) with evidence.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYes
statusYes
evidenceNo

TDQS

C2.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden. It implies a mutation via 'Record' but says nothing about whether results are overwritable, idempotent, session-scoped, or subject to rate limits — meaningful gaps for a write tool with zero annotation coverage.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with no filler or repetition. It is appropriately sized, though its brevity is part of why the semantics and workflow gaps above remain unaddressed.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a write tool with no annotations, no output schema, and 0% schema description coverage on three parameters, the description is under-specified. It omits prerequisites, the meaning of 'id', and what happens to previously recorded results for the same check.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It lists the status values (already enumerated in the schema) and mentions 'evidence', but never explains what 'id' refers to — presumably a check id from get_check/search_checks — nor whether evidence is required for certain statuses.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Record one check result') and enumerates the accepted status values, which is more than a tautology. It does not, however, distinguish itself from the sibling start_report or clarify the relationship between recording results and starting a report.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to call this tool versus the read-only siblings (get_check, search_checks) or start_report. Notably, it never states the prerequisite that a report must presumably be started first, leaving the agent to infer the workflow.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 7 tool updatesv0.9.0
    • First observeddetect_stack
    • First observedget_check
    • First observedget_profile
    • First observedlist_tools
    • First observedsearch_checks
    • First observedstart_report
    • First observedsubmit_result

TDQS

B3.3/5.0

Scored across 7 tools

Disambiguation5/5

Each tool targets a distinct resource and action: fingerprinting (detect_stack), profile retrieval (get_profile), discovery (search_checks, list_tools), point fetch (get_check), and report lifecycle (start_report, submit_result). get_check vs search_checks and get_profile vs get_check are clearly distinguished by resource type and lookup mode. No two tools could be reasonably confused for one another.

Naming Consistency5/5

All seven tools follow a strict snake_case verb_noun pattern (detect_stack, get_profile, search_checks, get_check, list_tools, start_report, submit_result). The convention is uniform with no camelCase or stylistic deviations, making intent predictable from names alone.

Tool Count5/5

Seven tools is well-scoped for a security knowledge-base workflow that spans detection, lookup, and reporting. Each tool covers a necessary step with no redundant or filler entries.

Completeness4/5

The surface covers the full scan workflow: detect stack, resolve a profile, search/read checks, create a report, and submit results. However, there is no way to retrieve, finalize, or export the report after start_report, which is a minor lifecycle gap an agent must work around.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    B
    maintenance
    An MCP security toolkit that integrates Burp-style HTTP proxying, AI-driven vulnerability hunting, source code auditing, and reporting into AI coding agents, enabling authorized security testing of web applications and source code.
    24
    MIT
  • F
    license
    B
    quality
    C
    maintenance
    Enables AI agents to perform comprehensive, zero-infrastructure codebase analysis through 24 MCP tools, covering security, quality, architecture, type safety, git history, and dead code detection with high precision and local privacy.
    45
    -
  • A
    license
    A
    quality
    C
    maintenance
    Enables AI coding agents to search a security corpus, scan Terraform plan JSON for cited findings, and list sources via MCP tools grounded in CIS AWS Foundations and OWASP Top 10 CI/CD risks.
    3
    Apache 2.0