"Finding people on GitHub" matching MCP servers:

Enables safe GitHub automation by queuing write operations for admin approval before execution.

Enables AI coding agents to read GitHub issues and pull requests and to add comments only on allowlisted repositories, with every call recorded in an append-only redacted audit log.

Enables querying GitHub Security Advisories from a local cloned advisory database using tools like list_advisories and get_advisory.

A web application for securely managing GitHub tokens and providing centralized access to various development tools integrated with GitHub accounts.

Enables Claude to authenticate with GitHub OAuth and access tools for user information, calculations, and GitHub repositories.

Enables scanning GitHub Actions workflow YAML for real-world security vulnerabilities such as script injection from attacker-controlled expressions, unpinned third-party actions, missing permissions blocks, and dangerous pull_request_target checkouts. It returns each finding with its exact location, an explanation of the risk, and a concrete remediation.

A lightweight stdio-to-http relay that enables the GitHub MCP server to authenticate using a GitHub App instead of a Personal Access Token. It automatically manages fine-grained permissions and short-lived tokens for secure, organizational AI agent workflows.

An MCP server with GitHub OAuth for remote connections, providing tools for arithmetic, GitHub user info, and image generation.

Audits GitHub Actions workflow files for supply-chain risks like script injection, leaked tokens, unpinned actions, and broad permissions.

Provides redacted access to a private local knowledgebase for coding agents, allowing them to inspect files while hiding sensitive names and identifiers.

Offline MCP server that checks and scans your own AI prompts and outputs against a local compliance rule corpus. Returns rule ID, severity, citation, and remediation per finding — no API key, Apache 2.0.

Scans diffs, files, and snippets for leaked secrets like AWS keys, GitHub tokens, and private keys, returning redacted findings while running fully locally without network calls.

PCI DSS v4.0.1 compliance scanner for Go payment services, delivered as an MCP server. Every finding maps to a specific PCI DSS requirement ID. Taint-aware cardholder data flow analysis with PCI SSC FAQ semantics, designed to complement broad SAST tools like Semgrep and CodeQL - not replace them.

Anonymize technical-drawing PDFs before sharing them — company names, logos, people, addresses, phone numbers, emails and websites found automatically and masked; tamper-proof flattened, metadata-free PDF or an expiring share link. NDA- and GDPR-safe drawing exchange.

A local MCP server that lets AI agents read, create, and update end-to-end encrypted static.md notes, merging edits with people typing in the same note. Keys and plaintext stay on the user's computer, so the service only ever receives ciphertext, note ids, and titles.

Enables AI assistants to monitor GitHub repository health by calculating health scores, fetching repository metadata, analyzing Dependabot alerts, checking CI/CD status, and retrieving code scanning alerts.

Enables LLMs to access realtime CVE intelligence aggregated from NVD, CISA KEV, EPSS, GitHub advisories, PoC discovery, and Metasploit/Nuclei tooling, providing vulnerability details, exploitation signals, and prioritized triage verdicts.

Vet ClawHub skills before installing them; detects prompt-injection, exfiltration, and other security issues, outputting a risk score with per-finding evidence.

MCP server for auditing infrastructure-as-code attack paths, finding multi-hop chains from public internet to sensitive resources.

Local security layer for coding agents: keeps secret values out of what Claude Code, Codex CLI, Cursor and OpenCode send to their model, and checks untrusted text for prompt injection. MIT, runs on your machine, no account.

Enables reviewing GitHub Actions workflows for outdated actions, deprecated Node runtimes, retired runners, deprecated commands, and security risks, with file, line, and fix for each finding.

MCP security trust layer. Continuously monitors 800+ MCP packages on npm for install scripts, command injection, hardcoded secrets, capability drift, and publisher posture. Ships a GitHub Action policy gate for PR-level allow/warn/block decisions. 5 MCP tools, no API key required.

A secure email gateway MCP server that protects AI agents from prompt injection attacks by scanning emails for malicious instructions before they reach the agent.

MCP server for DefectDojo vulnerability management, exposing 24 tools for managing products, engagements, tests, findings, scan imports, and finding lifecycle through the Model Context Protocol.

Enables agents like Claude Code and Codex to statically scan .zip, .exe, .dll files and GitHub repositories for malware without executing them, explaining likely false positives and letting users dig into reports through natural language.

Bawbel MCP Server lets any agent scan MCP servers and skill files for security vulnerabilities mid-conversation. Seven tools covering server-card scanning, conformance scoring, rug pull detection, and AVE threat intelligence queries. Powered by the AVE standard with OWASP MCP Top 10 mapping on every finding. Free, Apache 2.0, no API key required.

Supply chain risk scoring for npm, PyPI, and GitHub repos

Indexes a workspace and exposes code-navigation tools to Codex, enabling symbol lookup, reference finding, dependency analysis, and security audit for local codebases.

Analyzes GitHub Pull Request diffs for security vulnerabilities and data leaks, using a deterministic filter to skip trivial changes and an AI-powered analysis for logic changes.

Read-only MCP server for cloudpin, which pins cloud accounts (Azure, AWS, gcloud, Vercel, GitHub, Kubernetes, Supabase, Cloudflare) to a repository. Its tools tell an agent which account each CLI is using and whether a command would run on the pinned one, before it acts.