Security

App: OneCLI

Featured

Open-source, sandboxed AI agents for every employee, fronted by a gateway that injects scoped credentials so the agent never holds a password.

Skill: Trail of Bits Static Analysis

by Trail of Bits

New

CodeQL, Semgrep and SARIF static-analysis toolkit from Trail of Bits: taint tracking, fast pattern scans and merged, deduplicated security findings for coding agents.

Skill: gcloud CLI Guardrails

by Google Cloud

Featured

Google's official skill for driving the gcloud CLI safely from an agent: validate every command against its own help text, cap the output, and refuse the operations that should never run unattended.

Skill: Auth0 Agent Skill

by Auth0

Featured

Auth0's official agent skill: a router that detects your framework and intent, then loads the right Auth0 guidance for login, MFA, Organizations, tenant audits, debugging or provider migration.

Skill: Differential Security Review

by Trail of Bits

Featured

Trail of Bits' security review skill for PRs, commits, and diffs: risk-first analysis with git history, blast radius, and honest coverage limits.

Skill: Better Auth: Two-Factor Auth

by Better Auth

New

Adds real 2FA to a Better Auth app — TOTP, email/SMS OTP, backup codes, trusted devices — including the sign-in interrupt and the encryption-at-rest details.

Skill: Better Auth: Email & Password

by Better Auth

New

Credential auth done to spec in Better Auth: verification email, reset flow, token and session handling, password policy and custom hashing.

Skill: Better Auth: Integration Guide

by Better Auth

New

The reference an agent needs to configure Better Auth correctly: adapters, session strategy, hooks, plugins, type safety and the gotchas that bite in production.

Skill: OpenAI security-best-practices

by OpenAI

New

OpenAI's skill for language- and framework-specific secure coding: detect the stack, load the matching reference guidance, then write secure-by-default code, flag critical issues passively, or produce a prioritised vulnerability report with fixes.

Skill: OpenAI security-threat-model

by OpenAI

New

OpenAI's skill for repository-grounded threat modelling: derive trust boundaries, assets and attacker capabilities from the actual code, rank abuse paths by likelihood and impact, and write a reviewable Markdown threat model.

Skill: Workers Best Practices

by Cloudflare

New

Production review rules for Cloudflare Workers — compatibility dates, observability wiring, and the runtime anti-patterns that only bite at the edge.

Skill: Turnstile Spin

by Cloudflare

New

Turns “set up Turnstile” into a working end-to-end bot check — widget, frontend snippets, canonical server-side siteverify, and a real validation pass before it reports success.

Skill: Power Pages Site Builder

by Microsoft

Microsoft's official agent plugin for building, securing and deploying Power Pages code sites, with 34 skills covering the whole site lifecycle.

Skill: SAIL — Secure AI Lifecycle

by Pillar Security

Pillar Security's SAIL V2 framework as an agent skill: a 91-risk catalogue across seven lifecycle phases, for AI security gap assessments, roadmaps, and ISO 42001 / EU AI Act compliance checklists.

Skill: Zeroize Audit

by Trail of Bits

Finds secrets left in memory in C, C++ and Rust — including wipes the compiler deleted — and requires IR or assembly evidence before calling one optimized away.

Skill: Supply Chain Risk Auditor

by Trail of Bits

Audits npm, PyPI and Go dependencies for advisories, abandoned upstreams, publisher concentration and install-time scripts — measured by scripts, not estimated.

Skill: Constant-Time Analysis

by Trail of Bits

Compiles cryptographic code and reads the emitted assembly for variable-time instructions, then triages which flagged operations actually touch secrets.

Skill: PlanetScale Change Gates

by PlanetScale

PlanetScale's approval contract for agents: five operation classes that decide what a database agent may do freely, what needs a named approval, and what it must never do alone.

Skill: Snowflake Cortex Code Router

by Snowflake

Snowflake's official skill that routes Snowflake work from Claude Code to the Cortex Code CLI, with semantic routing, approval modes and audit logging.

Skill: Supabase Postgres Best Practices

by Supabase

Supabase's official Postgres skill — eight rule categories ranked by impact, each with wrong-vs-right SQL and EXPLAIN output, for schema, RLS, indexing and query work on Postgres anywhere.

Skill: Cloudflare One Zero Trust

by Cloudflare

Cloudflare's official skill for designing, configuring and troubleshooting Cloudflare One — Access, Gateway, WARP, Tunnel, DLP, CASB, device posture and identity — with retrieval over recalled docs.

Skill: CodeQL Security Analysis

by Trail of Bits

Trail of Bits' CodeQL skill: build databases, run taint-tracking and data-flow queries across eight languages, and model project-specific sources and sinks.

Skill: Semgrep Rule Creator

by Trail of Bits

Trail of Bits' skill for writing production-quality Semgrep rules — pattern design, taint mode for data-flow bugs, and mandatory test-driven validation.

Skill: Well-Architected Framework: Security Pillar

by Google

Google's official Well-Architected Framework skill for the security pillar — turns an architecture review into a structured interview, gap analysis and prioritised recommendations.

Skill: AlloyDB Basics

by Google

Google's official AlloyDB for PostgreSQL skill — cluster and instance lifecycle from gcloud, plus hard rules on private connectivity, IAM database auth and backup behaviour.

Skill: Twilio Security Hardening

by Twilio

Harden a Twilio integration against credential leaks and fraud — API keys instead of auth tokens, webhook signature validation, geo-permissions, SMS pumping prevention and zero-downtime credential rotation.

Skill: Datadog Audit Trail

by Datadog

Answer "who changed what" from Datadog Audit Trail — configuration-change forensics, API key compromise, cost-spike root cause, SOC 2/PCI evidence and AI activity audits.

Skill: Firebase Security Rules Auditor

by Firebase

Firebase's official red-team skill for auditing Firestore and Cloud Storage security rules — hunting privilege escalation, create/update bypasses and resource-exhaustion holes.

Skill: Microsoft Entra Agent ID

by Microsoft

Microsoft's official skill for giving AI agents real OAuth2 identities in Entra — blueprints, agent identities, sponsors, workload identity federation and the auth sidecar.

Skill: Authenticating to Google Cloud

by Google Cloud

Google's official skill for getting Google Cloud authentication right — human identities, service accounts, Application Default Credentials, and the failure modes agents usually hit.

Skill: GitHub Actions Security Review

by Sentry

Audit GitHub Actions workflows for the exploitation patterns that leak secrets or allow code execution from a fork.

Skill: Find Bugs in Branch Changes

by Sentry

Audit the changes on your current branch for bugs, security vulnerabilities, and quality problems before you push.

Skill: Engineering Code Review

by Sentry

Review pull requests against a real engineering practice — security, performance, testing, and design, in that order.

Skill: Deno Sandbox

by Deno

Run untrusted or model-generated code in an isolated environment using the @deno/sandbox SDK.

Skill: Cloudflare Sandbox SDK

by Cloudflare

Build secure code-execution features on Cloudflare — sandboxes for AI-generated code, interpreters, and CI systems.

MCP: Vanta

by Vanta

Featured

Vanta's official remote MCP server — query controls, tests, vendors, vulnerabilities and policies across SOC 2 and ISO 27001, and remediate failing tests from your agent.

MCP: HackerOne

by HackerOne

Featured

Official read-only MCP server for HackerOne bug bounty reports, programs, and remediation data.

MCP: E2B

by E2B

Featured

Run AI-generated code safely in an isolated cloud sandbox, with results returned as data rather than text.

MCP: x64dbg MCP Server

by duty1g

New

A native x64dbg plugin exposing 84 debugging tools and 22 event callbacks over HTTP, so an AI assistant can drive breakpoints, memory and disassembly directly.

MCP: JFrog MCP Server

by JFrog

JFrog's official remote MCP server: 100+ tools across Artifactory, Xray and Curation, hosted on JFrog Cloud with OAuth and no client install.

MCP: Aikido Security MCP Server

by Aikido Security

Runs Aikido's code and secrets scan as a tool inside your coding agent, returning machine-readable findings the agent can triage, fix or ignore in place.

MCP: CVE MCP Server

by mukul975

Vulnerability triage for AI agents: 28 security tools across 24 free intelligence sources — NVD, EPSS, CISA KEV, MITRE ATT&CK, Shodan and VirusTotal — behind a single triage_cve call.

MCP: Cloudsmith MCP

by Cloudsmith

Cloudsmith's official MCP server, built into its CLI: manage artifact repositories, packages and policies through an agent, with write operations off by default.

MCP: Splunk MCP Server

by Splunk

Splunk's own MCP server, hosted inside your Splunk deployment, letting agents write SPL from natural language and run searches under existing RBAC.

MCP: Burp Suite MCP Server

by PortSwigger

PortSwigger's official Burp Suite extension exposing proxy history, Repeater and scanning to AI agents over MCP.

MCP: Doppler

by Doppler

Doppler's official MCP server — let an agent list projects, read and write secrets, manage configs and review activity logs, scoped by the token you give it.

MCP: Secure MCP Tunnel Client

by OpenAI

OpenAI's customer-run tunnel client: reach a localhost or private-network MCP server from ChatGPT, Codex, the Responses API and AgentKit without opening an inbound firewall rule.

MCP: Automox MCP Server

by Automox

Automox's official MCP server for endpoint management — 130+ tools over devices, patches, policies, groups and audit data, self-hosted or on Automox's hosted endpoint.

MCP: 1Password Environments

by 1Password

1Password's official local MCP server for dev secrets: the agent manages Environments and .env mounts by name, and never sees a secret value.

MCP: HashiCorp Vault MCP Server

by HashiCorp

HashiCorp's official MCP server for Vault: manage secret engine mounts, read and write KV secrets, and drive the PKI engine — issuers, roles and certificates — from an agent.

MCP: Okta MCP Server

by Okta

Okta's official open-source MCP server: manage users, groups, apps, policies and branding in your Okta org from an AI agent, with scope-gated tools and confirmation on destructive actions.

MCP: Bitwarden MCP Server

by Bitwarden

Bitwarden's official MCP server — unlock the vault, read and edit items, generate passwords and TOTP codes, and run organisation administration. Local use only.

MCP: Semgrep MCP

by Semgrep

Semgrep's official MCP server — scan code for security vulnerabilities, write and test custom rules, and pull findings from Semgrep Cloud, from inside an agent session.

MCP: Snyk MCP Server

by Snyk

Snyk's official MCP server, shipped inside the Snyk CLI: scan code, dependencies, containers and IaC for vulnerabilities, generate SBOMs and monitor projects from your agent.

MCP: SonarQube MCP Server

by SonarSource

Official SonarSource MCP server — pull code-quality issues, security hotspots, quality gates and rule explanations from SonarQube Cloud or Server into your agent.

MCP: Docker MCP Gateway

by Docker

Docker's official CLI plugin that runs MCP servers in isolated containers behind one gateway — secrets management, OAuth flows and a single config every client shares.