MCP server Claude CodeCodexCursor +2
One of 2 in .mcp.json
MCP server "github-mcp", hosted remotely at mcp.github.com, as configured in apisec-inc/AI-Surface.
MCP server Claude CodeCodexCursor +2
One of 2 in .mcp.json
MCP server "stripe-mcp" as configured in apisec-inc/AI-Surface. Runs locally from the @stripe/mcp-server npm package.
Cursor rule Cursor
Requires explicit role assertion before executing admin-scoped operations. Prevents privilege escalation and BFLA vulnerabilities.
Cursor rule Cursor
Enforces authentication middleware on all API route handlers. Applies to Express, FastAPI, Django, Spring, Go Gin.
Cursor rule Cursor
Prevents leaking internal error details, stack traces, or database error messages in API responses.
Cursor rule Cursor
Requires validation of all user-supplied input before use. Prevents injection, unexpected types, and missing required fields.
Cursor rule Cursor
Requires ownership validation on any endpoint that accesses database records by user-supplied ID. Prevents BOLA/IDOR vulnerabilities.
Plugin Claude Code
Bundles 6 skills · 641 tokens together
OWASP API Security Top 10 skills for AI coding agents: BOLA detection, auth and RBAC scaffolding, injection checks, security test generation, full API security review, and OpenAPI schema hardening.
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: