mcp

Open-source AI agent security assessment tool that scans AI/MCP codebases with rule-based static analysis (A–F grading) and runs 3,900+ adversarial payloads for red-team testing against live agents. Also does MCP supply-chain discovery, AI-BOM generation (CycloneDX), and proxy-based runtime enforcement.

A Burp Suite extension (formerly Burp AI Agent) that integrates AI into web security testing: connects to 11 AI providers (Ollama, Claude, Gemini, OpenAI-compatible), exposes up to 59 MCP tools for external AI clients to drive Burp, includes passive/active scanners covering 62 vulnerability classes, and offers privacy modes with host anonymization and AES-256-GCM credential storage.

Apache-2.0 MCP proxy and Claude Code hooks adapter that screens an agent's tool calls before they run and tool results before it reads them against thresholds in a policy file; log-only by default, needs a TypeSafe API key.

MIT-licensed Python CLI and Claude Code/Codex skill that reviews Agent Skills, MCP config and source code for suspicious behavior before installation: offline by default, or nine-category Jev triage with a TypeSafe API key.

Apache-2.0 MCP server, now unmaintained, that semantically searches and progressively loads Anthropic Agent Skills (official and scientific sets by default) into any MCP-compatible coding assistant; not security-specific.