"Dash" matching MCP servers:

Governance runtime for AI agents: a guard tool evaluates risky actions against policy before they execute (block / warn / require human approval), approvals route to a human queue, and every action becomes a replayable decision record with per-action spend tracking. Runs over stdio via npx @dashclaw/mcp-server; works with Claude Code, Codex, LangChain, CrewAI, or any MCP host.

Enables offline, deterministic verification that one immutable artifact followed a declared build-to-production promotion chain, using only hash-based evidence and failing closed on incomplete or nonconformant gate records.

Offers proof-only tools to inspect and verify remediation closure receipts, deterministically confirming asset coverage, fixed artifact deployment, rescanning, deadline compliance, and zero-residual closure without executing scans or touching live systems.

Enables verification of deployment-scoped model-visible DSH tool surface conformance by checking recorded tool identities and schemas against approved locks, reporting only drift categories and hashes.

Enables verifying that recorded build accesses stay within a declared closure by inspecting and verifying hash-only receipts, without executing builds or making network requests.

Enables offline verification that a supplied DSH workflow adhered to declared duty-separation constraints, producing a redacted, content-addressed JSON verdict.

Cryptographic hash generator supporting MD5, SHA1, SHA256, SHA512, and bcrypt, with pay-per-call via x402 (USDC on Base L2) – no API key or signup required.

Provides cryptographic hash and HMAC computation for text, supporting algorithms like md5, sha1, sha256, sha384, and sha512. All operations are performed locally without transmitting or storing input data.

MCP server for auditing DeepSeek Harness evidence. Enables inspection and verification of content-addressed audit manifests with fail-closed validation.

Enables offline, deterministic verification of credential retirement settlements from explicit receipts, proving that rotations activated new credentials, rejected old ones, and closed without exposing secrets.

Security Graph MCP Server

Enables DeepSeek Harness agents to natively use Burp Suite capabilities such as proxy, logger, history, repeater, rewrite, intercept, BCheck, and Bambda, with runtime configuration and controlled active operations.

MCP server that vets LLM-emitted shell commands BEFORE execution — detects rm -rf nested deep in chains, package-manager glob removal (apt remove 'nvidia'), dd/mkfs filesystem destruction, chmod 777 / chown -R privilege blast, network-exfil via curl | bash, chained shutdown/reboot, git destructive ops. 30 detection rules across 8 families. Sub-second, local, free, MCP-native.

Certification lookup for DeepSeek Harness plugins: an agent-facing interface to the dsh-plugin-certification registry, checking a plugin's five reproducible dimensions (manifest compliance, build hygiene, supply-chain Scorecard, release provenance, sandboxed install smoke) before recommending or installing it.

The MCP ecosystem is growing fast. Not every server on npm is safe. mcp-shield lets Claude audit any MCP server — local or from npm — before you trust it with your files, keys, and context.

Resolves an authenticated MCP HTTP request to an existing, enabled Frappe User, enabling downstream consumers to run request-scoped permission checks.