Pricing

$20.00 / 1,000 mcp server auditeds

Repo Security Scanner — Malicious Code & Supply Chain

Run a supply chain audit on any GitHub repo before you install or depend on it. Scans for malicious code, install-time execution, credential exfiltration and prompt injection. Vet npm/PyPI package sources and MCP servers. Risk level, score and file/line evidence per repo.

Pricing

$20.00 / 1,000 mcp server auditeds

Rating

0.0

(0)

Developer

Ikko Eltociear Ashimine

Actor stats

Bookmarked

Total users

Monthly active users

5 days ago

Last modified

Configure MCP server with GitHub Supply Chain Audit: Malicious Code Scanner

The configuration above connects to the hosted Apify MCP server with the GitHub Supply Chain Audit: Malicious Code Scanner Actor already loaded. It uses OAuth, so your client opens a browser window to sign you in to Apify on first use. No API token is needed. Clients without OAuth support can authenticate with an Authorization: Bearer header carrying an API token from API & Integrations in Apify Console.

Get a ready-to-use configuration for your MCP client with the GitHub Supply Chain Audit: Malicious Code Scanner Actor preconfigured at https://mcp.apify.com/?tools=fetch-actor-details,eltociear/mcp-server-security-scanner.

You can connect to the Apify MCP Server using clients like Tester MCP Client, or any other MCP client of your choice.

If you want to learn more about our Apify MCP implementation, check out our MCP documentation. To learn more about the Model Context Protocol in general, refer to the official MCP documentation or read our blog post.

Malicious Package Watch — npm/PyPI Supply Chain Alerts

0xgollum/malicious-package-watch

Watch the open-source packages your codebase depends on and get alerted the moment a new security advisory (including typosquat/malicious package takedowns) is published for one - built on the free OSV.dev vulnerability database. Only new advisories are reported after the first baseline check.

0xGollum

Malicious Package Supply Chain Tracker Scraper

jungle_synthesizer/malicious-package-supply-chain-tracker-scraper

Cross-ecosystem feed of confirmed malicious/typosquatted packages across npm, PyPI, crates.io, Go, Maven, NuGet, Packagist and RubyGems, sourced from the OSSF malicious-packages dataset (also feeds OSV.dev). Category taxonomy plus typosquat-target linkage for CI gating. Passive read only.

BowTiedRaccoon

Dependency Supply-Chain Risk Audit

scrapeworks/dependency-risk-audit

Audit your package.json or requirements.txt for supply-chain risk: known vulnerabilities (OSV), deprecated/abandoned packages, and a project-level risk score.

Nicolas van Arkens

Repo to Claude Skill Converter

ianymu/repo-to-claude-skill-converter

Convert any GitHub repository (CLI, library, API client) into a draft Claude Code Skill package (SKILL.md + install.sh + README) so Claude Code users can install that repo's capability as a one-line invocation.

Yanlong Mu

Github Repo User Scraper

inquisitive_sarangi/github-repo-scraper

Github Repo User Scraper is simple tool to extract users of a repo(s) like contributors, stargazers & watchers. You can also export listings to JSON/CSV or any other as format.

API Master

MCP Server Risk Auditor

trovevault/mcp-server-risk-auditor

Audits MCP server manifests for tool, permission, credential, prompt-injection, exfiltration, and execution risks. Export data, run via API, schedule and monitor runs, or integrate with other tools.

Trove Vault

OSS Supply Chain Risk Report - PyPI, npm, OSV and Docker Hub

changeable_peddler/oss-supply-chain-risk-report

Software supply chain risk API and requirements.txt security scanner for Python packages, npm packages, Docker images, lockfiles, SBOMs, and Dockerfiles.

Sean J

Package Registry Intelligence — npm, PyPI, crates & more

straightforward_hydra/package-registry-intelligence

One tool over 6 package registries (npm, PyPI, crates.io, RubyGems, NuGet, Packagist): version, license, repo, maintainer, downloads & dependencies. Keyless. For supply-chain & dev intel.