Defensive baseline

Harden Claude Code

Reduce immediate risk, strengthen a workstation, and establish repeatable controls for a development team.

Threat DB v2.29.0Updated September 12, 2026

Start the checklist Compare tools

Choose a hardening depth

Start with the shortest path you can finish now, then continue without repeating the same checks.

5 minutes

Stop immediate exposure

Run the local AgentSec check.
Review hooks, skills, rules, and MCP configuration.
Remove unpinned or unexplained dependencies.

30 minutes

Harden the workstation

Restrict permissions and sandbox boundaries.
Block credential paths and environment variables.
Check permission glob patterns before testing network and filesystem denials at runtime.

Team controls

Make the baseline repeatable

Assign owners and review paths.
Pin versions and validate upgrades.
Automate checks without auto-approving findings.

Run AgentSec locally

The page does not inspect your repository. Install AgentSec, run it in the repository, and review its bounded findings.

AgentSec 0.1.0a0 (alpha)

agentsec scan /path/to/repository --format json --redact

A clean result is not a security guarantee. The scanner does not inspect every host-level, historical, or runtime surface.

Defense tools

Choose by coverage and limits, not by logo count. Each record keeps its stated capabilities and limitations.

cli

mcp-scan

Invariant / Snyk

Scans MCP server configurations for vulnerabilities
Detects known vulnerable MCP servers and versions
Scans SKILL.md for prompt injection, malicious code, secrets

Limits

413 error on large configs (~/.claude/ too big)
Unknown MCP config on some VSCode setups
Does not scan .claude/skills/ native Claude Code skills
Requires network access to Snyk vulnerability DB
Cannot detect runtime-only payloads fetched from benign-looking URLs

Open tool →

mcp-server

Ferrok

rfounds

Scans MCP server configurations for security misconfigurations
Maps findings to OWASP MCP Top 10 (2026) framework
Detects tool poisoning and malicious configurations

Limits

Newer tool — smaller detection database than mcp-scan
MCP server format — requires compatible agent to invoke

Open tool →

cli

skills-ref validate

agentskills.io

Validates skill spec compliance (SKILL.md structure, frontmatter, naming)
Parse metadata to JSON (skills-ref read-properties)
Generate agent prompts (skills-ref to-prompt)

Limits

Spec compliance only — does NOT detect malware or analyze code
Reduces slopsquatting via naming rules but no security scanning

Open tool →

cli

Garak

NVIDIA

37+ probe modules for LLM vulnerabilities
Prompt injection detection
Jailbreak testing

Limits

LLM-focused, not MCP/skill-specific
Does not parse SKILL.md or MCP configs

Open tool →

mcp-server + dashboard

MCP Fortress

mcp-fortress

Scans npm/PyPI dependencies of MCP servers
Queries CVE databases for risk scores
Runtime protection — quarantines suspicious servers

Limits

Newer project — smaller detection database than mcp-scan

Open tool →

mcp-server

SafeDep vet MCP

SafeDep

Software composition analysis integrated with agents
Detects slopsquatting, vulnerable and malicious packages
Screens package suggestions before pip/npm install

Limits

Package-focused — does not scan SKILL.md or agent configs

Open tool →

clawhub-skill

Koi Clawdex

Koi Security

ClawHub security addon / MCP
Checks skills against Koi malicious skill database
Pre-install and retroactive scan support

Limits

ClawHub/OpenClaw specific

cli

Mcpwn

community

Dedicated MCP vulnerability scanner
Detects RCE via command injection in MCP servers
Path traversal weakness detection

Limits

Newer/community tool — smaller detection database than mcp-scan
Less coverage of skills.sh / ClawHub skill scanning

Open tool →

cli

Proximity

community (open-source)

Open-source MCP security scanner
Identifies prompts, tools, and resources exposed by MCP servers
Evaluates security risks via NOVA rule engine

Limits

Early-stage open-source project — smaller detection database than commercial tools
Does not scan SKILL.md or agent config files

Open tool →

cloud-saas

Enkrypt AI MCP Scanner

Enkrypt AI

Agentic static analysis for MCP servers
Detects command injection, path traversal, prompt injection, code injection
Identifies LLM-driven exploits and authorization gaps between docs and code

Limits

Commercial/SaaS — not open-source
Does not scan SKILL.md or ClawHub skills directly

Open tool →

cli

Cisco MCP Scanner

Cisco

Interprocedural dataflow analysis across MCP server functions
Behavioral code threat analysis — compares documented intent vs actual behavior
Detects hidden operations (undocumented network calls, file operations)

Limits

Cisco-maintained — may require Cisco toolchain integration
Does not scan skills.sh / ClawHub ecosystem

Open tool →

cloud-saas

NeuralTrust MCP Scanner

NeuralTrust

Detects poisoned or redefined tools and unsafe endpoint exposures
Analyzes dependencies and integration risks
Policy validation for MCP manifests

Limits

Commercial/SaaS platform

Open tool →

claude-code-skill

Verify Security Scanner

Verify (mcpmarket.com)

Claude Code skill integrating Ultimate Bug Scanner (UBS) directly in agent workflow
Detects 1000+ bug patterns across multiple programming languages
SARIF and JSON output formats for CI/CD pipeline integration

Limits

Claude Code specific — not usable outside OpenClaw/Claude Code skill ecosystem
Requires Claude Code with skill support

Open tool →

cloud-saas

MCPScan.ai

mcpscan.ai

Cloud platform with specialized LLM classifiers for poisoning detection
Advanced Tool Metadata Scanner for MCP servers
Detects shell command patterns, code injection, resource exhaustion risks

Limits

Cloud-based — requires sending server metadata to external platform
Not open-source

Open tool →

cli

GitHub Security Lab Taskflow Agent

GitHub Security Lab

Open-source AI-powered vulnerability scanner for codebases
Effective at Auth Bypasses, IDORs, Token Leaks, and high-impact vulnerabilities
Filters ~50% of low-severity findings while retaining high-impact ones

Limits

Code-focused security scanner — does not scan SKILL.md or MCP configs
Does not scan ClawHub / skills.sh ecosystems

Open tool →

cloud-saas

OpenAI Codex Security

OpenAI

AI application security agent combining agentic reasoning with automated validation
Detects and patches complex vulnerabilities with 50%+ false positive reduction
Over 90% reduction in over-reported severity vs traditional tools

Limits

Research preview — not generally available
Code scanning focus — does not scan SKILL.md or agent configurations

Open tool →

runtime

Jozu Agent Guard

Jozu

Zero-trust AI runtime — executes agents, models, and MCP servers in secure environments
Non-disableable policy enforcement (guardrails cannot be bypassed by agent reasoning)
Artifact verification via tamper-evident attestations (prevents impersonation attacks like Postmark MCP squatter)

Limits

Newer product — limited community adoption data
Focus on runtime enforcement — does not scan SKILL.md or ClawHub ecosystem

Open tool →

ide-extension

Cisco AI Agent Security Scanner for IDEs

Cisco

MCP Server Scanning: inspects tool descriptions, configurations, and endpoints for hidden instructions, exfiltration patterns, and cross-tool attack chains
Agent Skill Scanning: detects command injection, obfuscation, privilege escalation, and supply chain indicators in Claude Code, Cursor, Codex, and Antigravity skills without executing them
AI-Generated Code Analysis: checks code produced during development for security vulnerabilities

Limits

VS Code Marketplace extension — not available outside VS Code ecosystem
Cisco-maintained — may lag on coverage of smaller or community skill ecosystems

Open tool →

cli

MCP Sentinel

George Gerchow / Bedrock Data (RSAC 2026)

Intercepts data movement between clipboard and AI agents
Scans requests and tool arguments for partial and transformed sensitive content
Blocks unsafe data transfers with local audit trails

Limits

Research/demo tool from RSAC 2026 — production readiness unclear
Clipboard-focused — does not scan MCP configs or SKILL.md

Open tool →

cli + saas

AquilaX AI Agent Configuration Scanner

AquilaX

Scans AI agent configurations and MCP server definitions for security misconfigurations
Detects overpermissive access and unsafe tool grants in agent configs
Identifies shadow MCP deployments and unvetted AI agent tools

Limits

Does not scan SKILL.md content for embedded malware
Newer product — limited community adoption data

Open tool →

mcp-server

Mend SAST MCP

Mend.io

Commercial SAST with MCP server integration
Real-time static analysis on AI-generated code via IDE
Software composition analysis (SCA) for dependencies

Limits

Commercial product — requires Mend.io subscription
Code scanning focus — does not scan SKILL.md or MCP configs directly

Open tool →

cli + runtime

Cisco DefenseClaw

Cisco

Open-source secure agent framework (available 2026-03-27)
Pre-deployment scanning: every skill/tool/plugin scanned and sandboxed before deployment
Skills Scanner: checks against block/allow lists, generates manifest

Limits

New project — community adoption data limited
Focused on pre-deployment + runtime; does not cover ClawHub marketplace scanning

Open tool →

cli

hackmyagent

opena2a-org (community)

Security scanner and red-team toolkit for AI agent environments
Supports Claude Code, Cursor, VS Code, and any MCP server setup
Identifies vulnerabilities before attackers do

Limits

Community/open-source — database coverage and update cadence unclear
Red-team focus — not a replace for dedicated skill/marketplace scanners

Open tool →

openclaw-plugin

ClawNet

Silverfort (open-source)

Open-source security plugin for OpenClaw/ClawHub skill installations
Intercepts skill installations before execution
Uses the agent's LLM to scan skill content for malicious patterns

Limits

OpenClaw specific — not usable outside ClawHub ecosystem
LLM-based detection — may miss highly obfuscated payloads

Open tool →

cloud-saas

ESET AI Skills Checker

ESET

Scans AI skills for malicious activity and risky behavior before installation
Multilayered behavioral analysis
Real-time threat detection

Limits

Commercial/SaaS product
Scope and coverage of skill ecosystems not fully documented publicly

Open tool →

cli + cloud

SandyClaw

Permiso

First dynamic sandbox for AI agent skills — detonates skills in a controlled environment
Records every system call, network request, and file operation during runtime
Detects malicious behavior that only manifests at runtime (bypasses static code analysis)

Limits

Newer tool — ecosystem coverage may be limited initially
Dynamic analysis requires actual execution — review reports before deploying to production

Open tool →

mcp-server

Semgrep MCP

Semgrep

MCP server integrating Semgrep security scanning directly into AI coding agent workflows
Scans every file generated or modified by the agent using Semgrep Code (SAST)
Supply chain scanning via Semgrep Supply Chain (SCA)

Limits

Code scanning focus — does not scan SKILL.md content or ClawHub marketplace
Requires Semgrep account for full rule set

Open tool →

runtime-protection

ClawArmor

AccuKnox

Runtime protection layer for OpenClaw instances
Addresses 15 default-configuration risk vectors
Monitors skill execution for anomalous behavior

Limits

OpenClaw-specific — does not protect other AI agent platforms
New tool with limited public documentation at launch

Open tool →

skill-suite

ClawSec

prompt-security

Complete security skill suite for AI agent platforms
Unified security monitoring across skill executions
Integrity verification for installed skills

Limits

Relies on skills installing correctly — does not protect against install-time attacks
Effectiveness depends on threat intelligence freshness

Open tool →

cli

Snyk Agent Scan

Snyk

Security scanner for AI agents and MCP server configurations
Detects vulnerable, malicious, and misconfigured MCP servers
Scans agent skill definitions for suspicious patterns and embedded payloads

Limits

Newer tool — coverage of skills.sh / ClawHub ecosystem being expanded
Requires Snyk account for full vulnerability database access

Open tool →

cloud-saas

Straiker MCP Security Platform

Straiker

Discover AI: inventories internal and external MCP servers, scores each for hygiene risks
Ascend AI: continuous red-teaming of MCP connections (tool poisoning, rug pulls, privilege escalation)
Defend AI: runtime guardrails on tool calls, blocks unauthorized actions and data exfiltration at 98%+ accuracy

Limits

Commercial SaaS platform — not open-source
Runtime enforcement focus — does not scan ClawHub/skills.sh skill marketplace directly

Open tool →

cli

Aguara

garagon (open-source)

189 detection rules across 14 categories: prompt injection, data exfiltration, credential leaks, supply-chain attacks, MCP threats, command execution, SSRF, unicode attacks, and more
4-layer analysis engine: pattern matching, NLP analysis, taint tracking, and rug-pull detection
Runs 100% locally with no API keys, no cloud, no LLM dependency

Limits

Static analysis only — cannot detect runtime-only payloads (complement with SandyClaw)
No central vulnerability DB updates; rules are versioned in the repo

Open tool →

browser

SkillRisk

SkillRisk (community)

Free AI agent skill security scanner running 100% in the browser — no data leaves the device
Detects ClawHavoc malware patterns, SSRF vulnerabilities, and supply chain attacks
Supports OpenClaw, Claude Code, Cursor, and Windsurf skill formats

Limits

Browser-based only — no CLI or CI/CD integration
Coverage depth not independently verified; newer community tool
No API or programmable interface for automation

Open tool →

cli

Golf Scanner

golf-mcp (open-source)

Discovers MCP server configurations across 7 IDEs: Claude Code, Cursor, VS Code, Windsurf, Gemini CLI, Kiro, Antigravity
Runs 20 security checks — 9 offline (no network) and 11 online (queries OSV, GitHub, npm, PyPI, OCI registries, MCP Registry)
Produces a 0-100 risk score per server with severity-weighted scoring

Limits

Does not scan SKILL.md or agent config content for embedded payloads
Discovery-focused — does not provide runtime enforcement or behavioral analysis
Online checks require network access to external registries

Open tool →

cloud-saas

Microsoft MDASH

Microsoft

Multi-model agentic scanning harness orchestrating 100+ specialized AI agents
Discovers, debates, and proves exploitable bugs end-to-end
Found 16 new vulnerabilities in Windows networking and authentication stack (4 Critical RCE)

Limits

Microsoft-internal platform — not publicly available as standalone tool
Focused on general vulnerability discovery, not MCP/skill-specific scanning

Open tool →

cli

NVIDIA SkillSpector

NVIDIA

64 vulnerability detection patterns across 16 risk categories
Categories include MCP least privilege, MCP tool poisoning, credential leakage, command injection, path traversal
Part of NVIDIA Verified Agent Skills (VAS) framework — assigns trust scores to skills

Limits

Static analysis only — cannot detect runtime-only or obfuscated payloads that fetch from external sources
Zero-width Unicode injection (T032) not yet in initial release patterns
Requires manual runs — no CI/CD integration in initial release

Open tool →

research-framework

VIPER-MCP

Academic (arXiv 2605.21392)

Automated static analysis + dynamic sandboxed execution for MCP server vulnerability detection
Scanned 39,884 public MCP server repositories
Found 106 zero-day vulnerabilities, resulting in 67 CVE assignments

Limits

Academic research framework — not available as production CLI tool yet
Requires container sandbox infrastructure for dynamic analysis
67 CVEs from single scan batch — ongoing maintenance unclear

Open tool →

cli

SkillScan Security

kurtpayne (community, open-source)

Security scanner for AI agent skills and MCP tool bundles
121 static detection rules + 17 multilanguage rules + 15 chain rules
Malware and instruction-abuse pattern detection (prompt injection, IOC matching)

Limits

Static + ML pattern matching — cannot catch runtime-only payloads fetched from benign-looking URLs or DNS (see T036)
Community project — detection ruleset freshness depends on maintainer updates

Open tool →

cli

AI-Infra-Guard (A.I.G)

Tencent Zhuque Lab

Full-stack AI red-teaming platform layered by attack surface: infrastructure, protocol/tool, agent behavior, and model
Deterministic rule matching over 75+ AI components and 1,400+ vulnerability rules
LLM-driven agentic auditing of MCP servers and agent-skill packages (14 major risk categories)

Limits

Broad platform — heavier to run than a single-purpose skill scanner
LLM-driven auditing layers require model access/compute

Open tool →

cli

mcp-spec-check

open-source (community)

Tests a live MCP server address (no code access needed) for readiness against the 2026-07-28 MCP spec release, plus baseline security hygiene
Completes in ~30 seconds; exit codes 0/1/2 (ready/failed/unable-to-test) suitable for CI/CD gates

Limits

Spec-readiness scanner, not a deep vulnerability scanner — pair with a semantic/behavioral scanner for actual threat detection
In the July 12, 2026 scan of 7,850 MCP servers, only 1 of 4,356 reachable servers passed all three readiness checks — treat a fail as expected, not alarming, but track remediation

Open tool →

sandbox

SkillDetonate

research / community

Behavioral scanner: executes a suspicious skill in a sandbox and monitors actual syscall behavior instead of static bytes or text
Reported ~97% detection of synthetic attacks and ~87% of real malicious skills in evaluation

Limits

~2.5 minutes per check vs. seconds for static scanners — a latency trade-off, not a drop-in replacement for pre-install static scanning

Open tool →

sandbox

AI Total

Zenity Labs

Hands a submitted skill to a LIVE agent inside a contained sandbox and activates it the way a real user would, instead of reading its text
Seeds the sandbox with realistic bait: fake credentials and sensitive files, so exfiltration behaviour actually triggers
Records domains reached, packages pulled, files touched, and every command, tool call and agent action taken on the skill's behalf

Limits

Submission-based service rather than a local CLI, so the skill under test leaves your environment
Dynamic analysis only catches behaviour that fires under the conditions the sandbox happens to present

Open tool →

runtime EDR for agents

Numbat

Perplexity AI

Single static Go binary, no cgo, for macOS, Linux and Windows on amd64 and arm64
Cross-harness by design: normalises saved session artifacts, live lifecycle hooks and OTLP/HTTP log streams into one event model. Supports Claude Code, Codex, OpenCode and Perplexity's internal Pi agent.
Local CEL rule engine with multi-step sequence evaluation and custom YAML rules; 52 built-in rules across 11 behaviour categories including privilege escalation, exfiltration and lateral movement

Limits

Enforcement is opt-in, so a default install observes without blocking
Rule quality is the whole game: the 52 shipped rules are a starting set, not coverage

Open tool →

runtime guardrail

agent-jackstop

Tenet Security

Denies outbound network access by default
Requires human approval for any command
Instructs the agent to treat all tool output as untrusted

Limits

Targets Cursor and Claude Code specifically
Per-command approval is deliberately high-friction; that friction is the control, not a bug to tune away

Open tool →

Built-in security commands

Use a quick check for known configuration risks, then a broader audit when you need permissions, hooks, secrets, and supply-chain coverage.

Quick configuration scan

/security-check

Full six-phase assessment

/security-audit

Explore the threat database with jq

bash: threat-db.json

Loading bash sandbox…

Complete hardening checklist

Progress is stored locally when browser storage is available. The checklist remains usable when storage is blocked.

Repository Review CLAUDE.md, rules, hooks, skills, and MCP configuration before trusting the project. Run AgentSec locally and inspect every finding before changing the repository. Keep credentials outside tracked files and rotate any secret that may have been exposed.

Runtime Start with restricted permissions and grant tools only for the current task. Use sandboxing as one control, not as the only boundary around untrusted input. Keep network access, filesystem writes, and shell execution separately reviewable.

Team controls Pin reviewed dependencies and define an owner for agent configuration changes. Require human review for security-sensitive changes and generated workflows. Re-run checks after upgrades, new MCP servers, and changes to hooks or skills.