Clover Security MCP - Security Teams

Plugin clover-for-security-teams from marketplace clover-security-beta in clover-security-public/clover-security-marketplace-beta. Commands read from the repo's manifest — 2 days ago.

Skills (12)

• ask-clover

  Ask Clover — a professional AppSec assistant — to review designs, model threats, discuss mitigations, and manage Clover's security resources (reviews, applications, threat models). Clover answers in natural language and asks for approval before writing anything. Trigger when the user wants a securit

• brief-application

  A one-page security briefing for a single application, written for its accountable owner: what it is, its open threats, control status, review history, threat-model coverage, and accepted risks. Use when asking where one application stands.

• plan-remediation

  Groups a review's or application's open findings (threats, security requirements, and questionnaire items) by the mitigation that closes them, so a team receives a handful of actions instead of a long list. Use when preparing remediation tickets, or asking what the actual plan is.

• publish-clover-artifact

  Publishes the result of any Clover skill as a shareable artifact styled as a Clover page. Use as the final step of any skill whose output is worth sharing. Renders what Clover already returned; it does not query Clover itself.

• rank-top-threats

  Lists the highest-risk open threats for one security review, one application, or the whole organization, ranked by Clover's threat level, with the consequence of each. Use when asking what to fix first.

• report-security-activity

  Reports what the security program did over a period: reviews created and completed, and threats surfaced, mitigated, or accepted. Use for a weekly, monthly, or quarterly update to leadership, a board, or an audit.

• send-to-developer

  Drafts the message a security engineer sends to a developer about what was just worked through in this conversation, in plain language the developer can act on, usually about findings but not only. Approves the draft with the user, then finds a connected channel (Slack, Jira, Confluence, GitHub, Tea

• show-applications-breakdown

  Breaks down the tenant's Clover applications and ranks them by maturity (repositories, collections, workflows, and frameworks attached, threat model on record) and by usage (reviews created, developer and security team engagement in them), so the program can see which applications are set up and act

• start-security-review

  Creates a Clover security review from a design doc, ticket, or pull request. Analysis takes minutes, so the user picks how to wait: sync (keep polling Clover until the findings are ready) or async (create the review, end the turn, and read the findings back on a later visit). Use when a link needs r

• summarize-review

  Reads a security review back as a short summary for people who do not open Clover: the outcome, the threats that matter, outstanding requirements, and open questions. Use when sending a review's results to a team, a ticket, or Slack.

• sync-me-up

  Briefs the current Clover user on what changed for them since they last asked: the reviews assigned to them that need action, what moved on their reviews, and what changed on their own applications, closed by a three-line tenant headline. Remembers when it last ran; the first run looks back one week

• triage-review

  Triages a security review's findings with the security team: shows what is open on the review, both the findings waiting on a security decision (dismissal or risk acceptance proposed by a developer) and the rest of the open plate, asks what new information could move them, and records the outcomes a

MCP servers (1)

• clover-for-security-teams

  connects to: ${PLUGIN_STREAMING_URL:-https://streaming.cloversec.io}/streaming/security-team/mcp

Hooks (1)

• SessionStart

  bash ${CLAUDE_PLUGIN_ROOT}/scripts/check-update.sh

Similar plugins