Security plugins

Give coding agents your databases, APIs, and env vars without the values landing in the transcript. The agent loads a credential into the environment of the command it runs, and never sees the value.

1 skill

Fail-closed gate for untrusted AI coding agents. A pure function decides allow, deny, or ask at the PreToolUse choke point, and every decision signs a re-runnable proof of what was blocked.

hooks

Static security review skill for AI agents. Reviews code for vulnerabilities (OWASP top 10, secrets, injection, auth issues) without ever running it.

1 skill

Claude Code plugin that connects to the Checkmarx security-mcp server. Exposes SAST, SCA, KICS, container, and secret-detection workflows: list projects/applications, trigger and monitor scans, inspect findings, and generate AI-driven remediation.

1 MCP server

Local pre-action trust boundary for skills, tools, MCP servers, repository helpers, x402-style resources, and other agent dependencies.

1 skill

Audits Supabase and Postgres Row Level Security, then writes the exact policy to fix what it finds. Catches the USING (true) policy that looks secured but grants access to everyone, missing WITH CHECK clauses, and service role keys leaking into client code.

1 skill

Analyze-first application security: threat modeling, risk-ranked findings, and build-time controls that fit the app's actual risk instead of a generic checklist.

1 skill

Determine whether ZCode packed and uploaded this machine's workspaces (including full Git history), with a confidence-rated verdict, falsifiers and a single-file HTML report.

1 skill

Teach your coding agent to run a Casefile static scan over a skill, plugin, or marketplace directory before installing it. Reads the text or JSON report, ties every finding to a file and line, explains findings as review signals rather than verdicts, and offers lock/verify for drift on reviewed artifacts. Never executes the artifact and never installs anything without asking.

1 skill

Read an agent skill, plugin, or MCP server before installing it. Reports lethal-trifecta reach, injection wording aimed at the agent, provenance, and drift after approval.

1 skill

Microsoft Entra ID sign-in and audit-log triage MCP for Claude Code. Investigate why a sign-in failed (AADSTS-annotated), tenant-wide failure trends and password-spray suspects, accounts that were probably taken over (plus Microsoft's risky users when the tenant has Entra ID P2), who changed what in the directory, what an account did afterwards in OneDrive/SharePoint, Exchange and Entra (Microsoft Purview audit log search), whether MFA is registered for an account, whether your Azure VMs are backed up (Azure Resource Manager, Reader role) and whether a Microsoft 365 service is degraded, plus a one-shot daily_brief. Read-only by default; the one write tool (revoke_sign_in_sessions) is registered only when ENTRAADM_ENABLE_REVOKE_SESSIONS=1. Needs either app-only credentials (ENTRAADM_TENANT_ID/_CLIENT_ID/_CLIENT_SECRET) or an existing `az login` session already present on the machine; the plugin cannot create or supply those for you.

1 MCP server

Security advisory for CISOs, CTOs, and Security Architects. Threat modelling, risk assessment, compliance mapping (NIST 800-53, ISO 27001), and document generation (threat models, security policies, risk assessments).

1 skill

Security and enterprise architecture advisory for CISOs, CTOs, CPOs, Security Architects, Security Engineers, and Enterprise Architects. Threat modeling, compliance mapping, code review, maturity assessments, and tabletop simulations.

1 skill

Audit a codebase's JWT, refresh token, session cookie, risk-based authentication, and OIDC implementation against RFC 8725, RFC 9700, OWASP cheat sheets, and NIST SP 800-63B-4. Produces a tiered scorecard with evidence-backed findings and concrete fixes.

1 skill

Engineered compliance infrastructure for GDPR and the EU AI Act: source-traced requirements, applicability scoping, implementation checklists, and evidence-signal workflows. Connects Claude to the hosted RuleMesh server over OAuth; only humans verify.

1 MCP server

Mandatory writing rules and a pre-launch security/production checklist for vibe-coded apps. Always in effect in every session and project.

1 skill

Full-stack CosmWasm smart contract architect for Cosmos-based chains. Default: ZIGChain.

1 skill

Full-stack Solidity/EVM smart contract architect. Default: Ethereum mainnet/Sepolia.

1 skill

Full-stack Solana program (Anchor) architect. Default: devnet.

1 skill

Triage Codex Security findings with explicit approval waves.

1 skill

Fix Trivy CVE findings from SARIF files across all relevant files in the codebase.

1 skill

Rigorous whole-project security review. Report only, no edits.

1 command

Blocks dangerous commands (rm, kubectl delete, terraform destroy)

hooks

Blocks access to .env files, preventing accidental secret exposure

hooks

Warns on large files and large reads

hooks

Securely work with 1Password through the op CLI. Manage vaults, items, and secrets without exposing plaintext values to Claude.

1 MCP server

Security tooling for YaleSites projects — currently supply-chain auditing (malicious-package detection via live OSV.dev and GitHub malware advisories), distinct from ordinary CVE scanning.

1 skill

Runs a prompt against a production cloud account under a read-only guard that lasts for the rest of the conversation

1 skill

Blocks access to sensitive files, scans commits for leaked secrets, and provides circuit breaker utility

hooks

Security auditing for secrets, dependencies, and insecure configuration

1 agent