PYA (Protect Your Ass): security audit plugin for Claude Code. 9 specialist agents, a dated threat feed, verified findings, offline by default.

Discover and choose Cloudflare products for apps, APIs, AI agents, storage, networking, and security. Use for architecture and product selection, including when the user describes a need without naming a Cloudflare product; then find the relevant skill or documentation.

Active Directory pentest methodology for Claude Code: skills, agents and slash commands for internal AD red-team work (Kerberoasting, ADCS ESC1-17, DCSync, ACL abuse, NTLM relay, delegation), with per-technique OPSEC/telemetry notes. Drives netexec, impacket, certipy, bloodyAD, BloodHound CE.

Vendor-neutral home for portable agents: skills, MCP tools, memory, canvas, and secret proxy.

Connects AI agents to a user's mailbox with OAuth-scoped permissions, enabling email sending, inbox management, verification-email capture for tests, and migration from Resend.

Gives AI coding agents on-demand security playbooks, a code scanner they can run on their own output, and live lookups against CISA KEV, NVD and OSV so they verify threats instead of guessing. Runs locally with no API keys or accounts, exposing skills, tools and a secure-build prompt to Claude Code, Codex, Cursor or any MCP client.

Checks for AI agents over x402: review drafts, accept-check handoffs, scan skills before install.

Blocks AI agents from bypassing git hooks: --no-verify, core.hooksPath overrides, hook-manager disable env vars, and the same hidden in git aliases or shell wrappers.

Automatic provider/model fallback chains for DeepSeek Harness agents when LLM requests keep failing (retry exhausted, auth, quota, rate limit)

A multi-agent application-security review harness for Claude Code (and, later, other AI agents). One router skill dispatches to a full offensive-security pipeline that maps a codebase, hunts vulnerabilities with a per-class knowledge base, chains findings into escalations, verifies real impact, and reports to README/JSON/SARIF/doc/PDF.

Audit AI applications and agents for security risks before commit, PR, merge, or deployment. Deterministic findings with coverage and evidence receipts.

Official SonarQube MCP Server for code quality and security in AI agents

Enables AI agents and IDE assistants to run zero-config security audits, detect secrets and vulnerable dependencies, and apply adversarial verification to reduce false positives.

Enables Cursor and Codex agents to audit Agent Skill structure (frontmatter, broken links, missing files), analyze dependencies for undeclared, unused or vulnerable packages via OSV, and run 28 local bug and code-quality rules with SonarQube-style A–E ratings. It can also optionally pull issues, metrics and quality-gate status from SonarQube or SonarCloud, or scan and upload results.

Exposes JSON-RPC 2.0 tools that let AI agents scan Base L2 lending positions approaching liquidation, simulate flash-loan-backed debt rescue plans, and generate the calldata needed to repay Morpho Blue and Aave v3 debt while avoiding the 5% penalty. Agents and builders can also attach a referral wallet to collect an instant 0.05% USDC revenue share paid atomically in the same block.

Enables agents to scan course structures, play videos at real 1x speed, track document task completion, capture quiz screenshots for vision-model reading, select and submit answers, and verify scores through MCP tools.

Enables agents to analyze OpenAPI contracts for deterministic integration risks, plan auth, sync, action, and webhook candidates, and diff contract versions for likely breaking changes through read-only tools.

Enables agents to probe URLs and classify bot-wall responses with vendor and signal evidence, perform offline classification, scan for exposed key-like material, and run owner-side access audits through stdio tools.

Turns any OpenAPI 3.x spec into an MCP server that exposes one validated tool per API operation, so AI agents can discover and call a REST API over stdio or Streamable HTTP. It is read-only by default, with allow/deny lists, environment-based auth, timeouts and response truncation for safe agent access.

Enables AI agents to connect to security cameras, detect objects with YOLOv8, recognize known faces, monitor restricted intrusion zones, capture annotated snapshots, and query a persistent SQLite event history.

Enables agents to retrieve structured, pre-published readings of the current geopolitical-risk picture, with in-band freshness and staleness metadata, through a no-auth read-only endpoint.

A plugin-based gateway that orchestrates other MCPs and allows developers to build upon it enterprise-grade agents.

Australian NEM battery (BESS) data for AI agents: revenue, dispatch, FCAS, events. Free, no auth.

Public URLs for AI agents to catch webhooks, OAuth redirects, job callbacks and approval clicks.