Check before you install, audit before you ship

Scan skills and MCP servers before they run with your permissions, then audit your own code.

1. 1

   Scan a skill before installing it

   Scans skills, MCP configs and rule files for threats, privacy leaks and hidden instructions before they run.

   Recommended

   Cursor ruleSafe

   artguard

   spiffy-oss

   This CLI scans AI agent skills, MCP server configs, and IDE rule files to detect security threats, privacy violations, and instruction-level attacks.

   32MIT

   Alternatives

   • skill-scannercisco-ai-defense 2.6kCaution
   • SkillSpectorNVIDIA 21kCaution
2. 2

   Run MCP servers in isolation

   Runs each MCP server in its own container with access policies, so one bad server cannot reach the rest of your machine.

   Recommended

   MCP serverSafe

   toolhive

   stacklok

   An enterprise platform for securely running and managing MCP servers in isolated containers with identity and access policies.

   2.3kApache-2.0
3. 3

   Audit your code

   Security-analysis skills from an audit firm, used the way their engineers use them.

   Recommended

   PluginSafe

   skills

   trailofbits

   A Claude Code plugin marketplace from Trail of Bits, offering skills to enhance AI-assisted security analysis, vulnerability detection, and audit workflows.

   7.8kCC-BY-SA-4.0

   Alternatives

   • open-code-reviewalibaba 48kCaution

Picks reviewed by hand: a recommended resource is rated Safe with a quality score of 85 or more and updated in the last 90 days. Alternatives marked Caution are worth reading about first.