The request names "capacitor", so the answer centres on Capawesome, which offers MCP servers specifically for Capacitor 5. Its Capacitor-focused MCP server and Capacitor plugin skills cover Capacitor development and security-related workflows, while the broader security-scanning platforms below are general-purpose alternatives.
- 1
Capawesomecapawesome.ioverified and signed
Provides a Capacitor-specific MCP server (io.capawesome/capacitor-mcp) and Capacitor plugin skills for installing, developing and upgrading Capacitor plugins 5.
official:MCP server · io.capawesome/mcpMCP server · io.capawesome/capacitor-mcpMCP server · io.capawesome/ionic-framework-mcp
for agents: capacitor-plugins · capacitor-plugin-development · capacitor-plugin-upgrades
- 2
Semgrep App Security Platformsemgrep.devverified and signed
Scans source code for security vulnerabilities with SAST, SCA and secrets detection, which can be applied to a Capacitor codebase 9.
+4 community tools built for it
for agents: semgrep · code-security · llm-security
- 3
GitHubgithub.comverified and signed
Hosts code and offers a security-review skill and an MCP security audit skill for reviewing code and MCP configurations 1.
official:MCP server · @github/mcp-registrySDK · @github/copilot-sdklibrary · CodeQL: StubCLI · specifyrepository · copilot-engine-sdk+2,577 community tools built for it
for agents: mcp-security-audit · security-review · typespec-create-api-plugin
- 4
Sentrysentry.ioverified and signed
Provides a security-review skill and a skill scanner for finding vulnerabilities in code and agent skills 4.
official:MCP server · @sentry/mcp-serverSDK · @sentry/nodelibrary · debugidCLI · sentry-clipackage · @sentry/junior-amplitude+49 community tools built for it
for agents: skill-scanner · GetSentry · security-review
Sources
- 1GitHub · Change is constant. GitHub keeps you ahead. · GitHub · GitHubgithub.com · read 2026-10-29
- 4Sentry Docs | Application Performance Monitoring & Error Tracking Softwaredocs.sentry.io · read 2026-10-29
- 5The Mobile App Platform for Modern Teams - Capawesomecapawesome.io · read 2026-10-29
- 9Semgrep App Security Platform | AI-assisted SAST, SCA and Secrets Detectionsemgrep.dev · read 2026-10-29
For agents: the 10 actions behind this answer
mcp-security-audit · mcp-security-audit verified and signed
Audit MCP (Model Context Protocol) server configurations for security issues. Use this skill when: - Reviewing .mcp.json files for security risks - Checking MCP server args for hardcoded secrets or shell injection patterns - Validating that MCP package-runner dependencies use exact reviewed versions
run_check · AWS SRA Verify MCP Server found in code, not yet checked
Run a security check and return results.
capsem_stats_detail · capsem found in code, not yet checked
Read typed security, network, file, process, tool, and model events for a VM.
skill-scanner · skill-scanner verified and signed
Scan agent skills for security issues. Use when asked to "scan a skill", "audit a skill", "review skill security", "check skill for injection", "validate SKILL.md", or assess whether an agent skill is safe to install. Checks for prompt injection, malicious scripts, excessive permissions, secret expo
capacitor-plugins · capacitor-plugins verified and signed
Guides the agent through installing, configuring, and using Capacitor plugins from six sources — official Capacitor plugins, Capawesome plugins, Capacitor Community plugins, Capacitor Firebase plugins, Capacitor MLKit plugins, and RevenueCat plugins. Covers installation, platform-specific configurat
claude-security/skill/claude-security · claude-security verified and signed
Skill claude-security (in the claude-security plugin)
radar-get-email-security-summary · Cloudflare API verified and signed
Get email security summary by dimension
describe_capability · agent-auth found in code, not yet checked
OPTIONAL. Get input schema for a capability. Skip if you already know the arguments — just call execute_capability directly. The server will validate arguments.
semgrep · semgrep verified and signed
Semgrep catches security vulnerabilities in real-time and guides Claude to write secure code from the start.
run_assertion · promptfoo found in code, not yet checked
Labels are the instruments' verdict and are never changed by ranking. Agents and robots get this same answer as JSON at /api/v1/find?q=…&answer=1 and through the MCP server.