Open-source, sandboxed AI agents for every employee, fronted by a gateway that injects scoped credentials so the agent never holds a password.
Automation & WorkflowsSubscription
Security
Protecting systems and data — vulnerability review, secrets, access control and hardening.
1 app, 24 skills and 17 MCP servers tagged Security.
Apps
Skills
Google's official skill for driving the gcloud CLI safely from an agent: validate every command against its own help text, cap the output, and refuse the operations that should never run unattended.
7 views 1 copies
Auth0's official agent skill: a router that detects your framework and intent, then loads the right Auth0 guidance for login, MFA, Organizations, tenant audits, debugging or provider migration.
3 views
Trail of Bits' security review skill for PRs, commits, and diffs: risk-first analysis with git history, blast radius, and honest coverage limits.
3 views
Finds secrets left in memory in C, C++ and Rust — including wipes the compiler deleted — and requires IR or assembly evidence before calling one optimized away.
1 views
Audits npm, PyPI and Go dependencies for advisories, abandoned upstreams, publisher concentration and install-time scripts — measured by scripts, not estimated.
1 views
Compiles cryptographic code and reads the emitted assembly for variable-time instructions, then triages which flagged operations actually touch secrets.
1 views
PlanetScale's approval contract for agents: five operation classes that decide what a database agent may do freely, what needs a named approval, and what it must never do alone.
3 views
Snowflake's official skill that routes Snowflake work from Claude Code to the Cortex Code CLI, with semantic routing, approval modes and audit logging.
6 views
Supabase's official Postgres skill — eight rule categories ranked by impact, each with wrong-vs-right SQL and EXPLAIN output, for schema, RLS, indexing and query work on Postgres anywhere.
4 views
Skill: Cloudflare One Zero Trust
by Cloudflare
Cloudflare's official skill for designing, configuring and troubleshooting Cloudflare One — Access, Gateway, WARP, Tunnel, DLP, CASB, device posture and identity — with retrieval over recalled docs.
6 views
Skill: CodeQL Security Analysis
by Trail of Bits
Trail of Bits' CodeQL skill: build databases, run taint-tracking and data-flow queries across eight languages, and model project-specific sources and sinks.
4 views
Skill: Semgrep Rule Creator
by Trail of Bits
Trail of Bits' skill for writing production-quality Semgrep rules — pattern design, taint mode for data-flow bugs, and mandatory test-driven validation.
4 views
Google's official Well-Architected Framework skill for the security pillar — turns an architecture review into a structured interview, gap analysis and prioritised recommendations.
2 views
Skill: AlloyDB Basics
by Google
Google's official AlloyDB for PostgreSQL skill — cluster and instance lifecycle from gcloud, plus hard rules on private connectivity, IAM database auth and backup behaviour.
2 views
Skill: Twilio Security Hardening
by Twilio
Harden a Twilio integration against credential leaks and fraud — API keys instead of auth tokens, webhook signature validation, geo-permissions, SMS pumping prevention and zero-downtime credential rotation.
3 views
Skill: Datadog Audit Trail
by Datadog
Answer "who changed what" from Datadog Audit Trail — configuration-change forensics, API key compromise, cost-spike root cause, SOC 2/PCI evidence and AI activity audits.
3 views
Skill: Firebase Security Rules Auditor
by Firebase
Firebase's official red-team skill for auditing Firestore and Cloud Storage security rules — hunting privilege escalation, create/update bypasses and resource-exhaustion holes.
6 views
Skill: Microsoft Entra Agent ID
by Microsoft
Microsoft's official skill for giving AI agents real OAuth2 identities in Entra — blueprints, agent identities, sponsors, workload identity federation and the auth sidecar.
3 views
Skill: Authenticating to Google Cloud
by Google Cloud
Google's official skill for getting Google Cloud authentication right — human identities, service accounts, Application Default Credentials, and the failure modes agents usually hit.
6 views
Skill: GitHub Actions Security Review
by Sentry
Audit GitHub Actions workflows for the exploitation patterns that leak secrets or allow code execution from a fork.
2 views
Skill: Find Bugs in Branch Changes
by Sentry
Audit the changes on your current branch for bugs, security vulnerabilities, and quality problems before you push.
2 views
Skill: Engineering Code Review
by Sentry
Review pull requests against a real engineering practice — security, performance, testing, and design, in that order.
3 views
Skill: Deno Sandbox
by Deno
Run untrusted or model-generated code in an isolated environment using the @deno/sandbox SDK.
12 views
Skill: Cloudflare Sandbox SDK
by Cloudflare
Build secure code-execution features on Cloudflare — sandboxes for AI-generated code, interpreters, and CI systems.
4 views
MCP servers
Vanta's official remote MCP server — query controls, tests, vendors, vulnerabilities and policies across SOC 2 and ISO 27001, and remediate failing tests from your agent.
Official read-only MCP server for HackerOne bug bounty reports, programs, and remediation data.
11 views
Run AI-generated code safely in an isolated cloud sandbox, with results returned as data rather than text.
6 views
Cloudsmith's official MCP server, built into its CLI: manage artifact repositories, packages and policies through an agent, with write operations off by default.
Splunk's own MCP server, hosted inside your Splunk deployment, letting agents write SPL from natural language and run searches under existing RBAC.
1 views
PortSwigger's official Burp Suite extension exposing proxy history, Repeater and scanning to AI agents over MCP.
1 views
Doppler's official MCP server — let an agent list projects, read and write secrets, manage configs and review activity logs, scoped by the token you give it.
OpenAI's customer-run tunnel client: reach a localhost or private-network MCP server from ChatGPT, Codex, the Responses API and AgentKit without opening an inbound firewall rule.
MCP: Automox MCP Server
by Automox
Automox's official MCP server for endpoint management — 130+ tools over devices, patches, policies, groups and audit data, self-hosted or on Automox's hosted endpoint.
3 views
MCP: 1Password Environments
by 1Password
1Password's official local MCP server for dev secrets: the agent manages Environments and .env mounts by name, and never sees a secret value.
3 views
MCP: HashiCorp Vault MCP Server
by HashiCorp
HashiCorp's official MCP server for Vault: manage secret engine mounts, read and write KV secrets, and drive the PKI engine — issuers, roles and certificates — from an agent.
MCP: Okta MCP Server
by Okta
Okta's official open-source MCP server: manage users, groups, apps, policies and branding in your Okta org from an AI agent, with scope-gated tools and confirmation on destructive actions.
MCP: Bitwarden MCP Server
by Bitwarden
Bitwarden's official MCP server — unlock the vault, read and edit items, generate passwords and TOTP codes, and run organisation administration. Local use only.
5 views
MCP: Semgrep MCP
by Semgrep
Semgrep's official MCP server — scan code for security vulnerabilities, write and test custom rules, and pull findings from Semgrep Cloud, from inside an agent session.
2 views
MCP: Snyk MCP Server
by Snyk
Snyk's official MCP server, shipped inside the Snyk CLI: scan code, dependencies, containers and IaC for vulnerabilities, generate SBOMs and monitor projects from your agent.
3 views
MCP: SonarQube MCP Server
by SonarSource
Official SonarSource MCP server — pull code-quality issues, security hotspots, quality gates and rule explanations from SonarQube Cloud or Server into your agent.
3 views
MCP: Docker MCP Gateway
by Docker
Docker's official CLI plugin that runs MCP servers in isolated containers behind one gateway — secrets management, OAuth flows and a single config every client shares.
5 views
Related tags
Tags that appear alongside this one, ranked by how often.