security MCP Server
Agentic security skills for cloud and AI — 76 production-grade skill bundles. OCSF 1.8 on the wire, native where state and audit matter. MCP-ready. HITL-audited writes. MITRE ATT&CK / ATLAS, OWASP Top 10 / LLM Top 10. Same bundle on CLI, CI, MCP, and persistent runners.
Discovered via github-topic:mcp and last synced 3mo ago.
Install instructions not detected yet
Check the source repository for the latest setup steps.
interoperable output with native context preserved
deterministic attack-pattern findings
scheduled checks, PR gates, SARIF generation, benchmark snapshots
guarded write path with HITL and audit
dry-run plan or audited action log
Shipped today
What it means
IAM departures with HITL and audit
OCSF JSONL pinned to the repo's OCSF contract
raw source to stable event stream
internal-only normalization model
inventory, graph context, evidence
Best fit
benchmark and posture checks
Claude, Codex, Cursor, Windsurf, Cortex Code CLI
export into downstream formats
inventory · graph · AI BOM · evidence · IAM-departure planning
131 posture and benchmark checks across CIS / NIST / NIST AI RMF / SOC 2
any `detect-*` / `view-*` / `discover-control-evidence`
Skill
guarded write paths — IAM departures × 3 clouds, network revoke × 3, session/credential kill × 4, K8s × 2, MCP tool quarantine
`sink-clickhouse-jsonl` → findings / evidence / audit
append-only sinks
Default
normalize raw cloud / identity / K8s / MCP / SaaS signal
[`sink-clickhouse-jsonl`](skills/output/sink-clickhouse-jsonl/SKILL.md)
Sinks write whatever the producer emitted
findings → review formats
Doc
warehouse query adapters
deterministic rules tagged with MITRE ATT&CK / ATLAS / OWASP
[`source-clickhouse-query`](skills/ingestion/source-clickhouse-query/SKILL.md)
[`packs/clickhouse/`](packs/clickhouse/)
A state change with an operator-owned audit trail
真实性验证技能。分析用户提供的信息、消息、图片或内容，判断其真实性和可信度，识别虚假信息、AI生成内容或伪造内容。
Container escape is a critical attack technique where an adversary breaks out of container isolation to access the host system or other containers. Detection involves monitoring for escape indicators
Pod Security Standards (PSS) define three levels of security policies -- Privileged, Baseline, and Restricted -- enforced by the Pod Security Admission (PSA) controller built into Kubernetes 1.25+. PS
Implements eBPF-based security monitoring using Cilium Tetragon for real-time process execution tracking, network connection observability, file access auditing, and runtime enforcement. Covers TracingPolicy CRD authoring with kprobe/tracepoint hooks, in-kernel filtering via matchArgs/matchBinaries selectors, JSON event export, and integration with SIEM pipelines. Use when building kernel-level runtime security observability for Linux hosts or Kubernetes clusters.
AI Agent Governance Toolkit — Policy enforcement, zero-trust identity, execution sandboxing, and reliability engineering for autonomous AI agents. Covers 10/10 OWASP Agentic Top 10.
Open-source sandboxed agent harness for teams. Giving every employee a secured personal agent.
AI agent security scanner. Detect vulnerabilities in agent configurations, MCP servers, and tool permissions. Available as CLI, GitHub Action, ECC plugin, and GitHub App integration. 🛡️
A secure* runtime for autonomous AI agents. Policy from plain-English constitutions. (*https://ironcurtain.dev)
Learn how to use the absolute-audit Claude skill. Complete guide with installation instructions and examples.
Learn how to use the token-scam-analysis Claude skill. Complete guide with installation instructions and examples.
Learn how to use the absolute-upgrade Claude skill. Complete guide with installation instructions and examples.