27,008 mods in this category, of every kind an agent can take. Each one carries what it costs per session, what the scan found, and whether it is the original.
BlackBoxEngineering/agent-envelope-mcp
MCP server Claude CodeCodexCursor +2
Neutral MCP server for AgentEnvelope authority: sovereign verify + vault verify/lookup/mint. Runs locally from the agent-envelope-mcp npm package. Needs 1 environment variable to run.
Skill Claude CodeCodex
Vet MCP tools/list and local AI-agent tool configuration before attachment. Use to check tool poisoning, forced invocation, confusable tool names, unconstrained shell or code inputs, risky fetch-plus-privilege combinations, delegation exposure, or elevated-permission requests with a pinned offline static gate.
MCP server Claude CodeCodexCursor +2
MCP server "ocultar-pii" as configured in Edu963/ocultar. Launched with ocultar-claude-mcp. Needs 3 environment variables to run.
Skill Claude CodeCodex
Govern how AI agents access data through your organisation's Sealgate gateway. Use when you need to list governed MCP servers, review agent session and audit status, or check whether a tool call is allowed by policy.
MCP server Claude CodeCodexCursor +2
Webhook signature-verification audit. Stripe, GitHub, Shopify, Twilio +23. Local. Deterministic. Runs locally from the @hookwarden/mcp npm package.
MCP server Claude CodeCodexCursor +2
Pre-execution policy gate for consequential agent actions with durable trust receipts. Remote server at api.interailabs.dev.
MCP server Claude CodeCodexCursor +2
MCP server exposing the SaferAgenticAI safety framework (canonical criteria + Implementation Patterns layer) to coding assistants. Runs locally from the saferagenticai-mcp Python package.
MCP server Claude CodeCodexCursor +2
ARGUS-3 stdio MCP with WARDEN firewall: argusask, argusstatus, arguscapabilities. Runs locally from the @alexar76/argus3 npm package.
MCP server Claude CodeCodexCursor +2
MCP server for ALTR data security — tag-based masking, access governance, and classification, with structured responses, middleware, and multi-transport support. Runs locally from the altr-mcp Python package. Needs 3 environment variables to run.
MCP server Claude CodeCodexCursor +2
Prompt-injection firewall for AI agents — scan untrusted text before LLM calls. Runs locally from the @injectshield/mcp npm package. Needs 2 environment variables to run.
MCP server Claude CodeCodexCursor +2
One of 2 in server.json
BlackDome MCP Server — AI agent access to live honeypot threat intelligence, attacker IPs, IOCs, and credential intel. Runs locally from the blackdome-mcp Python package. Needs 3 environment variables to run.
Skill Claude CodeCodex
MCP server exposing pcapy-ng packet capture functionality.
Skill Claude CodeCodex
MCP server exposing full recon-ng OSINT framework functionality.
Skill Claude CodeCodex
Verify AI-generated code before shipping. Run Umbra's Trust Score scan before committing or finishing any coding task, treat findings as blocking issues, and re-scan until clean. Use when finishing a task, before a commit, or when reviewing code written by an agent.
MCP server Claude CodeCodexCursor +2
MCP server for DefectDojo vulnerability management — 24 tools with RBAC, HMAC audit chain, and SIEM forwarding. Runs locally from the mcp-defectdojo Python package. Needs 6 environment variables to run.
MCP server Claude CodeCodexCursor +2
Minimal, honest RAG-over-a-corpus MCP retrieval tool: searchknowledge(query, k) -> cited chunks. Local embeddings + embedded vector store. Auth-scoped, fail-soft, version-pinned. Runs locally from the jaimenbell-rag-mcp Python package.
MCP server Claude CodeCodexCursor +2
Action firewall for AI agents: blocks the wrong action before it runs, every verdict Ed25519-signed. Runs locally from the @fidacy/mcp npm package.
MCP server Claude CodeCodexCursor +2
MCP server "lockvet" as configured in matteo-sung/lockvet. Runs in Docker (ghcr.io/matteo-sung/lockvet:0.6.9). Needs 5 environment variables to run.
Plugin Claude Code
Bundles 1 skill, 2 hooks · 72 tokens together
Deterministic security checks in Claude Code's path: package names before an install, secrets and code rules on what was just written, injection and Unicode-obfuscation patterns in fetched pages. No network call in any hook, no model in any check.
MCP server Claude CodeCodexCursor +2
One of 2 in server.json
Scan any website or MCP server for agent-trust-readiness; returns a signed, verifiable scorecard. Remote server at api.isittrustready.ai.
MCP server Claude CodeCodexCursor +2
Static compliance-controls checker for UK Online Safety Act & ICO Children's Code. CLI + MCP. Runs locally from the @nugehs/bouncer npm package.
Skill Claude CodeCodex
Use this skill when an AI agent needs to act safely through oakallow, the runtime permission, approval, and audit layer for AI agent tool execution. Trigger it whenever you are about to take a tool action that could be risky, irreversible, or that touches another system, and you need to know whether it is allowed…
Skill Claude CodeCodex
Research npm packages with bundle size, vulnerability scanning, and download trends via MCP. Use when comparing or auditing packages.
MCP server Claude CodeCodexCursor +2
MCP server for Sophos Central — endpoint security, XDR/MDR, and MSSP multi-tenant ops. Runs locally from the @rijul170/sophos-mcp npm package.
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: