No user-submitted related servers found.
Scored across 13 tools
Most tools target a distinct resource+action (get_skill vs scan_code vs scan_path vs threat_model vs lookup_cve), and the two scanners are explicitly separated by snippet vs folder. However, three tools (list_skills, search_security, skills_for_task) all answer 'which skills exist,' and check_known_exploited vs lookup_cve both do CVE lookups, so an agent can plausibly misselect on those pairs. Descriptions do provide clear tie-breaking rules, keeping it above a 3.
All names are snake_case, but conventions are mixed: most are verb-first (list_skills, get_skill, scan_code, check_package_vulns) while four are noun-first (threat_model, secure_coding_checklist, skills_for_task, recent_ai_threat_sources). Verbs are also used synonymously (check vs lookup), and about_zagairot breaks the domain pattern entirely.
Thirteen tools is well within the ideal range and each one maps to a distinct step in a security workflow (discover skills, get playbook, checklist, scan, threat model, vulnerability lookup, freshness sources). No filler tools are present, and the single off-topic tool (about_zagairot) is small and clearly gated.
The surface covers discovery, guidance, static scanning, threat modeling, and vulnerability intelligence (NVD, CISA KEV, OSV) well, forming an end-to-end advisory loop. Minor gaps exist: no way to consolidate findings into a report, no remediation/fix-suggestion tool, no compliance or framework mapping, and lookup_cve appears limited to CVE ids rather than package/version-to-CVE resolution (partially offset by check_package_vulns).