"Checking Supabase migrations in GitHub Actions" matching MCP servers:

Enables auditing a Supabase project's security beyond the dashboard's Security Advisor, checking anonymous access, RLS policies, and cross-tenant data leaks via read-only probes and a two-account test.

This MCP server enables users to sign in with GitHub and use AI agents to scan entire repositories for leaked secrets such as API keys, passwords, and tokens, delivering a report with the exact file and line plus remediation guidance.

Enables authorized web/API security analysis as a stateful, multi-stage workflow with persistent session state, human-controlled validation, candidate versus confirmed finding tracking, and stop conditions.

Enables AI clients to audit GitHub repositories for Dependabot, code scanning, and secret scanning alerts, generate conservative remediation plans, and execute verified fixes through MCP tools with fail-closed mutation controls.

Enables local, deterministic review of GitHub and GitLab pull request diffs for secret leaks, OWASP injection issues, WCAG 2.2 AA/EU EAA accessibility gaps, EU AI Act transparency, and database RLS risks, producing risk scores, merge decisions, committable suggestions, and SARIF exports.

Lets an agent inspect and audit MCP servers before connecting to them, checking their exposed tools, prompts and resources for tool poisoning, shadowing, excessive permissions, leaked secrets and unsafe transports against 24 deterministic rules. Results are returned as findings with evidence, remediation and CWE/OWASP references, and can fail CI with SARIF, Markdown or standalone HTML reports.

Enables static security scanning of MCP servers, AI agent skills, and plugins by detecting attack patterns across severity levels and producing SARIF output for GitHub Code Scanning.

This server enables AI agents to delegate GitHub pull request diffs for automated security auditing, returning structured vulnerability and architecture feedback while routing requests through a resilient multi-provider fallback pipeline.

Provides security audit primitives for MCP servers, agent tool schemas, and system prompts, along with pentest utilities like JWT inspection and HTTP diffing.

Enables active, authorized security testing of remote MCP servers' OAuth authorization flows, reporting results as JSON, SARIF, and Markdown. It runs checks for refresh token rotation, redirect URI strictness, PKCE enforcement, token audience, throttling, and consent CSRF.

Static analysis scanner for multi-tenant SaaS and MCP server code that catches cross-tenant data leakage with 57 deterministic rules, including an MCP server for Claude Desktop and Cursor integration.

Enables agents to vet MCP servers and agent configurations before trusting them, using local static analysis to detect injection, dangerous capabilities, exfiltration paths, and CVEs, with policy-based gating for CI.

Enables AI agents to perform passive security scans on domains, checking email spoofing (DMARC/SPF/DKIM), TLS weaknesses, security headers, exposed files, and subdomain-takeover risk without needing an API key.

Enables LLMs to access realtime CVE intelligence aggregated from NVD, CISA KEV, EPSS, GitHub advisories, PoC discovery, and Metasploit/Nuclei tooling, providing vulnerability details, exploitation signals, and prioritized triage verdicts.

Enables AI coding assistants to scan projects for security issues such as leaked API keys, missing Supabase RLS, open Firebase rules, unauthenticated routes, and hallucinated packages, then fix and verify the results.

GhostHunt is an MCP server that scans your development machine for API keys, tokens, and credentials hiding in places you forgot to check.

Enables any MCP client (Claude Code, Claude Desktop, Codex, or a custom agent) to fetch the latest CVEs at query time from live sources — NVD, CVE List V5, GitHub Advisory Database, CISA KEV and FIRST EPSS — without a separate API key. Exposes search, filtering (severity, RCE, PoC, KEV, keyword, CPE), per-CVE detail and risk-scored patch prioritization as JSON tools, so answers are grounded in live data rather than model memory.

Static security scanner for AI-generated (vibe-coded) Supabase and Next.js apps. Runs as an MCP server so an LLM can scan, explain findings, and produce fixes while it writes code, all locally and offline.

Scan a deployed site for an exposed Supabase service_role key and audit Row Level Security from your AI coding agent.

Enables AI agents to drive live Hack The Box labs through the real HTB Labs API — spawning, resetting and extending machines, submitting user and root flags with difficulty ratings, browsing challenges, and switching or downloading VPN configurations for the authenticated account. Every call hits the live API rather than cached content, with destructive actions annotated so hosts can gate them behind consent.

Reduces thousands of security findings to the smallest set of high-impact remediation actions, with fail-closed safety gates, typed execution plans, and verification that refuses false all-cleans.

Enables agents and CI pipelines to audit MCP servers and agent tool-chains by statically scanning repositories, local checkouts, tools/list exports, or live endpoints for risks such as destructive actions without confirmation, mismatched safety annotations, injection surfaces, credential or PII exposure, and unguarded command, path, or URL sinks. All checks are read-only and never execute the scanned code or call tools/call.

Converts Claude into a cybersecurity assistant by exposing 17 tools for network reconnaissance, cryptography, and security analysis, enabling users to perform tasks like SSL certificate checking, port scanning, and JWT analysis directly within conversations.

MCP server for checking packages against an AI-aware vulnerability database, including CVEs, slopsquatting, CISA KEV, and MCP-server trust profiles.

Free deterministic security scan of a public git repository (GitHub, GitLab, Codeberg, Bitbucket): vulnerable dependencies via OSV.dev, secret patterns, and config lint, returned as structured JSON. Tools: scan_repository(url), audit_pricing(). Runs locally over stdio (python3 web/mcp_stdio.py or the Dockerfile) and is also hosted at https://project-feldspar.com/mcp. MIT licence, stdlib-only. Buil

Security scanning for MCP servers from the inside out. Provides runtime inspection, AST-based static analysis, config audit, dependency analysis, and OWASP MCP Top 10 compliance in a single MCP server.

Enables AI assistants to run Kali Linux security tools in an isolated Docker container for tasks like network scanning, port checking, and service enumeration.

Exposes an OSINT investigation toolkit to any MCP-compatible AI client, which can drive passive checks such as DNS, WHOIS/RDAP, breach, IP reputation, GitHub and news-geo lookups and chain findings across them. The server lists 20 tools by default (16 passive plus 4 graph and batch helpers) and 25 when active checks are explicitly allowed, running via uvx with no separate install.

Keeps bug-hunting AI agents within an authorized scope by checking every target against declarative allow/deny rules, refusing out-of-scope findings, and scrubbing secrets from evidence. It also computes CVSS v3.1 base scores and records findings in an append-only ledger.

Adds security capabilities like port scanning, TLS inspection, DNS enumeration, process monitoring, secrets scanning, HTTP header auditing, and CVE checking to Claude Code and Cursor.

Enables an AI agent to statically triage local binaries and APKs by extracting and classifying strings, flagging hardcoded secrets, detecting file types, checking exploit-mitigation flags, and auditing Android manifests. Results from all tools can be merged into a single structured report with a summary findings list.

Enables asynchronous OWASP Dependency-Check vulnerability scanning of allowlisted repositories via three narrow tools for starting scans, checking status, and retrieving structured findings.

Connects Claude Code to a Latent Defense deployment to map GitHub repositories into an infrastructure graph, discover attack paths using the JEPA energy model, and triage findings from the terminal.

Enables MCP-capable LLM agents to control YADS queues, manage tags, and trigger scans through YADS's API-authenticated /api/v1 interface without dashboard access. All actions respect tenant isolation and scan limits.

Provides AI agents with structured access to the OWASP Bug Logging Tool (BLT) ecosystem for logging bugs, triaging issues, and managing security workflows. It enables actions like submitting vulnerabilities, tracking contributor leaderboards, and awarding gamified bacon points through a unified interface.

Enables deterministic security testing of AI agents that use tools by serving synthetic MCP environments with poisoned data, fake secrets, and privileged actions. Records agent tool calls and evaluates security invariants (e.g., canary leaks, forbidden access, approval binding) without an LLM judge or real systems.

Enables AI agents to query and act on Microsoft Defender XDR incidents, alerts, advanced hunting data, Entra ID logs, threat indicators, device response actions, and vulnerability management via Microsoft Graph and Defender for Endpoint APIs.

Read-only security audit for Supabase. Surfaces RLS gaps, permissive policies, exposed functions and grants, and returns scored findings with fix SQL that is never executed.

Enables read-only, evidence-led security audits of GitHub-hosted source code through explicit workflow primitives: repository reconnaissance, coverage-ledger planning, heuristic candidate leads, structured findings validation, independent verification gates, and JSON/Markdown report generation. It never clones, executes, or probes the target code, and marks runs incomplete until coverage and reviewer-verification gates pass.

Enables AI agents to inspect APKs and resources, analyze native libraries, trace runtime behavior with Frida, and connect app screen actions to code through ADB.