Security plugins

EDAMAME Security for Claude Desktop. EDAMAME's host-side observer runs two-plane divergence detection automatically -- no plugin required; this plugin adds off-host coverage plus in-agent posture and divergence verdicts, safety-floor guardrails, and turnkey MCP onboarding.

2 skills · 2 commands · 1 agent · 1 MCP server

Scan your Claude Code setup for vulnerable or malicious agent components. Inventories MCP servers, plugins, skills, and hooks, matches them against OpenACA's OSV-compatible advisory corpus plus configuration-hygiene posture rules, generates an Agent BOM, and triages results into ranked exposure reports.

6 skills

Stops AI-assisted edits from silently weakening an app's security controls (auth guards, Supabase RLS, CORS, security headers).

1 skill · 4 commands · hooks

Local pseudonymization for Claude Code & Cowork: Claude reads Word/Excel/PowerPoint/PDF/CSV/e-mail files only as consistent pseudonyms, prompts with personal data are stopped before they leave, and real names are restored locally into the finished document.

2 skills · 2 commands · 1 MCP server · hooks

The Vanta plugin connects Claude to Vanta's security and compliance platform through the Vanta MCP server. List failing compliance tests, get test-specific remediation context, and fix failing tests with code changes — directly from your Claude session.

3 skills · 3 MCP servers

One adapter per supported platform, each stating what it checks and what it cannot see: Cloudflare Pages and Workers (headers on every path, no secrets in [vars], previews off production data, edge hardening), Next.js on OpenNext (server actions, NEXT_PUBLIC_ secrets, static-export headers), Fly and Supabase (RLS, service-role key, [env] secrets, exposed ports), Google Apps Script (web app access, scopes, keys in code), Railway (environment dumps, count-only variable reads), and the Cloudflare account itself through the API or a snapshot (zone SSL, TLS, HTTPS, HSTS, DNSSEC; dangling pages.dev CNAMEs; members without 2FA; preview secrets; orphan KV; data Workers exposed on workers.dev). Requires secure-core.

6 skills

Local pseudonymization for Claude Code & Cowork: Claude reads Word/Excel/PowerPoint/PDF/CSV/e-mail files only as consistent pseudonyms, prompts with personal data are stopped before they leave, and real names are restored locally into the finished document.

2 skills · 2 commands · 1 MCP server · hooks

Claude Code plugin that blocks unsafe npm/yarn/pnpm installs and provides supply-chain hardening commands.

4 commands · hooks

A turnkey, self-hosted Splunk lab with nine hands-on labs and a coach that grades your SPL on measured figures.

1 skill · 4 commands

Secure implementation, diff review, and repository audit workflows.

4 skills · hooks

Install, configure, and safely operate sccfm-cli and the cisco.sccfm Ansible collection.

4 skills · hooks

Context safety + guardrails for AI agents on Kubernetes: per-context policies, safe switching, temporary leases, and allow/ask/deny on every kubectl/helm command.

1 skill · 3 commands · hooks

Supply-chain malware protection: blocks installs of known-malicious npm/PyPI packages and audits npm, PyPI and Rust (Cargo) dependency manifests after edits.

1 skill · 3 commands · hooks

Makes Claude Code generate more secure code. A Stop hook re-wakes the agent to review and fix its own changes against LeoTrace's security rules before the developer sees "done".

5 commands

Exabeam Agentic SOC — an agentic SOC analyst for Exabeam New-Scale, as a plugin for Claude Code, OpenAI Codex and Google Antigravity. It does the work, not just the chat: hand it an alert or a case and it pulls the events, pivots on the entities, baselines them against what is normal for them, tests the benign explanation and writes the verdict — then acts in the SIEM: opens and annotates the case, updates it, dismisses the alert, closes the case, so you don't have to. You stay in control: containment is recommended and never executed on any host, dismiss and close ask you first (on Google Antigravity, in attended sessions only), and every call is on an audit trail. Three skills over one guarded Exabeam MCP connection: soc-investigate takes one alert or case from first look to verdict and outcome; triage-cases sweeps the open queue into a ranked “start here” list; rule-tuning finds the detection rules wasting analyst attention and proposes the fix. Built for hostile data: SIEM content is evidence, never instructions — hidden-character smuggling is screened out of what it reads, active content and secrets are neutralized in what it writes back, and the human-in-the-loop gate ships on, enforced by the host, not the model. Red-teamed and behavior-scanned before every release.

3 skills · 1 MCP server · hooks

Production-readiness and security-scanning checks: a categorized deterministic scan, summarized external scanners, and an auditor agent, ordered by observed impact.

3 skills · 2 agents

Security best practices with XSS prevention, authentication, and OWASP compliance

2 skills · 2 commands · 1 agent

Supply-chain (SLSA, SBOM), secret/PII detection, redaction, sandbox isolation, audit, breach checks, credential storage

5 skills

SAST analysis, dependency vulnerability scanning, OWASP Top 10 compliance, container security scanning, and automated security hardening

1 skill · 3 commands · 1 agent

Automate API security directly in Claude Code with 42Crunch - automatically audit OpenAPI specs, detect vulnerabilities aligned with OWASP API Security risks (including BOLA/BFLA), and apply AI-powered fixes. Designed for AI-assisted development workflows, it provides continuous guardrails through an audit->scan->remediate->validate loop, ensuring APIs meet enterprise security standards before deployment.

5 skills

SAST analysis, dependency vulnerability scanning, OWASP Top 10 compliance, container security scanning, and automated security hardening

1 skill · 3 commands · 1 agent

Automate API security directly in Claude Code with 42Crunch - automatically audit OpenAPI specs, detect vulnerabilities aligned with OWASP API Security risks (including BOLA/BFLA), and apply AI-powered fixes. Designed for AI-assisted development workflows, it provides continuous guardrails through an audit->scan->remediate->validate loop, ensuring APIs meet enterprise security standards before deployment.

5 skills

Automate API security directly in Claude Code with 42Crunch - automatically audit OpenAPI specs, detect vulnerabilities aligned with OWASP API Security risks (including BOLA/BFLA), and apply AI-powered fixes. Designed for AI-assisted development workflows, it provides continuous guardrails through an audit->scan->remediate->validate loop, ensuring APIs meet enterprise security standards before deployment.

5 skills

Automate API security directly in Claude Code with 42Crunch - automatically audit OpenAPI specs, detect vulnerabilities aligned with OWASP API Security risks (including BOLA/BFLA), and apply AI-powered fixes. Designed for AI-assisted development workflows, it provides continuous guardrails through an audit->scan->remediate->validate loop, ensuring APIs meet enterprise security standards before deployment.

5 skills

Catch API security issues during development: audit, scan, remediate, validate with AI guardrails in Codex.

5 skills

Five review skills (tools: Read, Grep, Glob): supabase-rls-review, supabase-grants-check, stripe-webhook-review, launch-security-check and unthrottled-route-check, for Supabase migrations and grants, client code, Stripe webhook handlers, and AI or checkout routes with no rate limiter.

5 skills

OWASP Top 10 security verification methodology with detection patterns

3 skills · 1 command · 1 agent

Automate API security directly in Claude Code with 42Crunch - automatically audit OpenAPI specs, detect vulnerabilities aligned with OWASP API Security risks (including BOLA/BFLA), and apply AI-powered fixes. Designed for AI-assisted development workflows, it provides continuous guardrails through an audit->scan->remediate->validate loop, ensuring APIs meet enterprise security standards before deployment.

5 skills

Canonical governance hooks — entity type validation, ChittyID accountability, deploy gates, PR workflow enforcement, and unified Neon integration governance (schema drift, Neon Auth, OAuth/OIDC, branch ops, project/role/connection management, migration governance, canonical token lifecycle)

3 skills · 1 agent · hooks

Check your lockfiles against every published advisory (/agentprime:check, /agentprime:watch, /agentprime:cve), and find out whether an Advisory affects your App: resolves a CVE, GHSA, advisory link or pasted post, analyses it, and ends in a Verdict with file:line evidence.

1 skill · 3 commands · 1 agent