"Rewriting or modifying Debian packages" matching MCP servers:

An MCP server that lets an agent verify a skill, tool, or package before it installs it.

Enables AI coding agents and CI to vet npm dependencies before they reach the lockfile, flagging hallucinated, slopsquatted, or otherwise risky packages with evidence-backed verdicts.

Local stdio MCP server (in packages/opsecforge-mcp, built on @modelcontextprotocol/sdk) that keeps secrets out of coding-agent context: redact_file returns only redacted file content, scan_secrets checks staged changes before commit, plus offline webhook signature verification and JWT inspection. No network calls.

Verifies npm packages for security risks before installation, checking advisories, install scripts, typosquatting, and other factors, providing safe/block verdicts.

Security scanner for AI agent packages that enables AI agents to audit MCP servers and packages for vulnerabilities, prompt injection, and supply chain attacks.

Pre-install risk gate for npm packages. Stops AI coding agents from running malicious or lifecycle scripts run.

Read-only MCP server that surfaces external file sharing risks from Box enterprise event logs, enabling early-warning leakage detection without modifying any data.

Read-only safety checks before an agent acts: scan untrusted text for prompt injection and phishing (locally), check npm packages for malware, hijacked releases and typosquats, scan crypto addresses and tokens, and compare two addresses to catch address poisoning. Zero dependencies.

Enables AI agents and developers to score npm packages, PyPI packages, and GitHub repositories for maintenance health, producing A–F grades, per-signal details, and plain-language risk lists before adoption. It supports checking individual packages, scanning manifests or lock files for transitive dependencies, and comparing alternatives.

Pre-install trust scoring & safety scanning for MCP servers, AI skills & npm packages — 15 signals incl. OSV/KEV/EPSS vuln intel and an auto-gate go/no-go.

Blocks AI coding assistants from installing non-existent packages and accessing non-existent files.

Enables AI agents to scan MCP servers and AI packages for vulnerabilities, prompt injection, and supply chain attacks.

MCP server that integrates the Phylax verification API, enabling AI assistants to verify packages, repositories, and other MCP servers before use. It exposes tools for verifying artifacts, checking policies, and fetching attestations.

Checks a code repository without running it: Safe, Works and Complete scores with an A-F grade, catching leaked keys, dangerous calls, invented or lookalike packages, broken imports and missing project files. Standard-library Python; MCP tools scan, orphans and explain.

Verify-before-act safety tools for AI coding agents, providing MCP tools to check packages, lockfiles, manifests, and CI workflows for supply chain risks.

MCP security trust layer. Continuously monitors 800+ MCP packages on npm for install scripts, command injection, hardcoded secrets, capability drift, and publisher posture. Ships a GitHub Action policy gate for PR-level allow/warn/block decisions. 5 MCP tools, no API key required.

The dependency bloodhound for AI coding agents. Hound is a free, open-source MCP server that gives AI coding agents a nose for supply chain security. It scans packages for vulnerabilities, checks licenses, inspects dependency trees, and detects typosquatting — with zero API keys, zero config, and zero cost.

Verifies npm package names for safety, detecting typosquats and nonexistent packages before your coding agent installs them.

Package intelligence MCP server. Stops AI agents from installing hallucinated/malicious packages across 17 ecosystems. 22 tools, free, no auth.

MCP server for checking packages against an AI-aware vulnerability database, including CVEs, slopsquatting, CISA KEV, and MCP-server trust profiles.