The request names OWASP, so the answer is the OWASP Foundation itself 1, the nonprofit behind the Top 10, ASVS and ZAP. Its indexed actions include web-security-review for the OWASP Top 10 for web applications and api-security-review for the OWASP API Security Top 10 111. Alternatives that do related security review work are Semgrep 414, Sentry's security-review 212, and GitHub's AI security scanner 313.
- 1
OWASP Foundationowasp.orgfound in code, not yet checked
Nonprofit publishing free application security projects including the Top 10, ASVS and ZAP; its indexed web-security-review action audits web apps against the OWASP Top 10 for Web Applications (2021) 111.
+16 community tools built for it
for agents: osv_get_vuln · web-security-review · api-security-review
- 2
Semgrep App Security Platformsemgrep.devverified and signed
Scans source code for security vulnerabilities with AI-assisted SAST, SCA and secrets detection, and its indexed code-security and llm-security actions give OWASP-based secure coding and LLM security guidance 414.
+4 community tools built for it
for agents: semgrep · code-security · llm-security
- 3
Sentry Docssentry.ioverified and signed
Its indexed security-review action performs a security code review for vulnerabilities in code 212.
official:MCP server · @sentry/mcp-serverSDK · @sentry/nodeCLI · sentry-clirepository · sentry-pythonskill · sentry-cli+49 community tools built for it
for agents: security-review · gha-security-review · find-bugs
- 4
GitHubgithub.comverified and signed
Its indexed security-review action is an AI-powered codebase security scanner that traces data flows and component interactions 313.
official:CLI · github-mcp-serverskill · add-community-extensionskill · git-commitskill · acquire-codebase-knowledge+2,563 community tools built for it
for agents: security-review · microsoft-agent-framework · microsoft-code-reference
Sources
- 1OWASP Foundation - The Open Source Foundation for Application Securityowasp.org · read 2026-10-29
- 2Sentry Docs | Application Performance Monitoring & Error Tracking Softwaredocs.sentry.io · read 2026-10-29
- 3GitHub · Change is constant. GitHub keeps you ahead. · GitHub · GitHubgithub.com · read 2026-10-29
- 4Semgrep App Security Platform | AI-assisted SAST, SCA and Secrets Detectionsemgrep.dev · read 2026-10-29
- 11xpsd: declares "osv_get_vuln" (the record we read)github.com · read 2026-10-24
- 12security-review: declares "security-review" (the record we read and signed)unfragile.ai · read 2026-10-24
- 13security-review: declares "security-review" (the record we read and signed)unfragile.ai · read 2026-10-24
- 14semgrep: declares "semgrep" (the record we read and signed)unfragile.ai · read 2026-10-24
For agents: the 10 actions behind this answer
osv_get_vuln · xpsd found in code, not yet checked
Fetch the full OSV.dev record for a known vulnerability id (e.g. a CVE,
security-review · security-review verified and signed
Security code review for vulnerabilities. Use when asked to "security review", "find vulnerabilities", "check for security issues", "audit security", "OWASP review", or review code for injection, XSS, authentication, authorization, cryptography issues. Provides systematic review with confidence-base
security-review · security-review verified and signed
AI-powered codebase security scanner that reasons about code like a security researcher — tracing data flows, understanding component interactions, and catching vulnerabilities that pattern-matching tools miss. Use this skill when asked to scan code for security vulnerabilities, find bugs, check for
semgrep · semgrep verified and signed
Semgrep catches security vulnerabilities in real-time and guides Claude to write secure code from the start.
get_reference · implementation-skills found in code, not yet checked
A single reference document belonging to a skill — the deeper material a skill
OWASP · cyclonedx-python-lib verified and signed
· Docker Toolkit website read, tools not yet checked
Run AI agents and containers safely, anywhere. Docker gives builders trusted sandboxes, governance, and a secure supply chain for modern software.
pypa/gh-action-pip-audit · gh-action-pip-audit verified and signed
Use pip-audit to scan Python dependencies for known vulnerabilities
scan_owasp_2021 · Security Scanner AI MCP found in code, not yet checked
Full OWASP Top 10 2021 vulnerability scanner.
vulnerabilities · safety verified and signed
Labels are the instruments' verdict and are never changed by ranking. Agents and robots get this same answer as JSON at /api/v1/find?q=…&answer=1 and through the MCP server.