#security
8 skills & prompts · 1 tools · 6 MCP servers · 15 articles
Skills & prompts
Security-review skill for Claude
A structured security pass over a diff — checks the OWASP-relevant classes, ranks by exploitability, and shows a repro.
ai-engineering-toolkit
6 production-ready AI engineering workflows: prompt evaluation (8-dimension scoring), context budget planning, RAG pipeline design, agent security audit (65-point checklist), eval harness building, and product sense coaching.
cyber-audit
Run read-only exposure checks for security advisories and write a structured local audit report.
audit-skills
Expert security auditor for AI Skills and Bundles. Performs non-intrusive static analysis to identify malicious patterns, data leaks, system stability risks, and obfuscated payloads across Windows, macOS, Linux/Unix, and Mobile (Android/iOS).
geo-technical
Technical SEO audit with GEO-specific checks — crawlability, indexability, security, performance, SSR, and AI crawler access
skill-audit
Pre-install security scanner for AI agent skills. 7.5% of 14,706 skills are malicious. Audit before you trust.
varlock
Secure environment variable management with Varlock. Use when handling secrets, API keys, credentials, or any sensitive configuration. Ensures secrets are never exposed in terminals, logs, traces, or Claude's context. Trigger phrases include "environment variables", "secrets", ".
binary-analysis
Analyze unknown binary files through a deterministic CLI that wraps Ghidra's static-analysis engine. Use when you need to inspect a PE, ELF, or Mach-O file — triage suspicious binaries, map imported APIs, decompile functions, trace call paths, or produce structured evidence repor
Tools
MCP servers
Governance runtime for compliance: verified, human-approved writes to a tamper-evident record.
Free deterministic security scan of public git repos: OSV.dev vulnerable deps, secrets, config lint.
Runtime verification for agent tool calls: Ed25519 signed receipts, fail-closed RCE/SSRF checks.
Your whole business as one MCP server: analytics, CRM, SEO, ads, revenue. Scoped per data class.
Solana token/wallet rug-risk scoring. Free scan; $2 SOL unlocks full wallet report. No signup.
Articles
See all 15
Those are the other app's keys
Twenty minutes recovering secrets that never existed, and the one sentence from a human that ended it
How to use remote MCP servers with the OpenAI Responses API
An API request routing a model's tool call through an approval gate to a remote MCP server
The coverage audit before you delete the safety net
31 config keys, two audits, and why the first one was wrong in both directions
How to publish an MCP server to the official MCP Registry
The official MCP Registry stores standardized server metadata rather than package code. Publishers verify a namespace, describe installation or remote access, and submit immutable versions.
Rotating a leaked credential, in the right order
Everyone looks at the Dockerfile. The file that actually leaked the key was the project file.
MCP authentication explained: OAuth, scopes, and safe token handling
Remote MCP authorization uses established OAuth standards, but secure integration still requires issuer validation, least-privilege scopes, protected token handling, and server-side enforcement.
Byte-identical or bust
"Copy it over and switch the reference" is two steps, and the outage lives in the one nobody checks
MCP stdio vs. Streamable HTTP: which transport should you use?
stdio fits local processes and prototypes. Streamable HTTP fits hosted services and shared integrations. The right choice follows where the capability runs and who must reach it.
Never let the AI print a secret
The most important rule wasn't about what I could change. It was about what I was allowed to display.
MCP tools vs. resources vs. prompts: when to use each
Tools perform operations, resources expose readable context, and prompts provide reusable templates. Choosing the correct primitive makes an MCP server easier to understand and govern.
How to test an MCP server with MCP Inspector
Use MCP Inspector to connect to local or remote servers, inspect capabilities, call tools, read resources, test prompts, and diagnose failures before release.
How to build an MCP server in TypeScript: step-by-step
Build an MCP server in TypeScript with focused tools, validated schemas, local and remote transports, Inspector tests, and production security controls.