PluginBench
MCP Server

Repo Security Scanner — Malicious Code & Supply Chain MCP Server

io.github.eltociear/repo-security-scanner

What is the Repo Security Scanner — Malicious Code & Supply Chain MCP server?

Audit GitHub repos for malicious and supply-chain code before you depend on them.

How to install Repo Security Scanner — Malicious Code & Supply Chain

Copy-paste configuration for popular MCP clients.

transport: http
Config generated by PluginBench — verify against the source before use.
Environment / auth
  • Authorization
    required
    secret

    Apify API token, sent as `Bearer <token>`. The endpoint answers 401 without one. Runs are billed to YOUR Apify account at this Actor's pay-per-event price — there is no free tier here and no charge to us.

Cursor
~/.cursor/mcp.json
{
  "mcpServers": {
    "repo-security-scanner": {
      "url": "https://mcp.apify.com/?actors=eltociear/mcp-server-security-scanner"
    }
  }
}
Windsurf
~/.codeium/windsurf/mcp_config.json
{
  "mcpServers": {
    "repo-security-scanner": {
      "serverUrl": "https://mcp.apify.com/?actors=eltociear/mcp-server-security-scanner"
    }
  }
}
VS Code
.vscode/mcp.json
{
  "servers": {
    "repo-security-scanner": {
      "type": "http",
      "url": "https://mcp.apify.com/?actors=eltociear/mcp-server-security-scanner"
    }
  }
}
Claude Desktop
Claude Desktop connects to remote servers via the mcp-remote bridge.
{
  "mcpServers": {
    "repo-security-scanner": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://mcp.apify.com/?actors=eltociear/mcp-server-security-scanner"
      ]
    }
  }
}
Claude Code
claude mcp add --transport http repo-security-scanner https://mcp.apify.com/?actors=eltociear/mcp-server-security-scanner

Related MCP servers

Scan agent skills and MCP servers for malicious patterns before you load them

4
Python
View repository →

EVM contract/token risk check + ERC20 approval (proxy, EIP-7702, unlimited-allowance). Zero deps.

1
Python
MIT
View repository →

Detects leaked secrets & API keys: 32+ provider rules (AWS, GitHub, Stripe, OpenAI…), zero deps.

1
Python
MIT
View repository →

Real-world data for agents: air quality, geocoding, quakes, holidays, web search

1
JavaScript
View repository →

Fetch URLs and return clean Markdown for RAG — nav, ads and boilerplate stripped.

View repository →