The request "rc-security" is ambiguous: it names no product, platform, or specific operation, so the best fit depends on what security task is meant. Several candidates cover code and dependency scanning, but which one to pick hinges on the target (source code, dependencies, secrets, container/IaC, or AI-agent/MCP configs).
A question back: What do you want to secure, and where does it run: your source code, dependency lockfiles, leaked secrets, container or IaC configs, or AI agents/MCP servers, and do you need it as a local CLI, an MCP
For agents: the 10 actions behind this answer
ghost-scan-deps · ghost-scan-deps verified and signed
Ghost Security - Software Composition Analysis (SCA) scanner. Scans dependency lockfiles for known vulnerabilities, identifies CVEs, and generates findings with severity levels and remediation guidance. Use when the user asks about dependency vulnerabilities, vulnerable packages, CVE checks, securit
snyk/actions · Snyk verified and signed
Check your applications for vulnerabilities using Snyk
· Trivy website read, tools not yet checked
Trivy is the most popular open source security scanner for Vulnerability &, IaC, SBOM discovery, cloud scanning and Kubernetes security
aikido · aikido verified and signed
Aikido Security scanning for Claude Code — SAST, secrets, and IaC vulnerability detection powered by the Aikido MCP server.
scan_repo · ship-safe verified and signed
Run a full multi-agent security scan on a repository or directory. Runs all 20+ ship-safe security agents (injection, auth bypass, secrets, supply chain, LLM security, etc.) and returns a structured findings report with severity ratings and remediation advice. Use this when the user asks to audit, s
semgrep · semgrep verified and signed
Semgrep catches security vulnerabilities in real-time and guides Claude to write secure code from the start.
codeql · codeql verified and signed
Scans a codebase for security vulnerabilities using CodeQL's interprocedural data flow and taint tracking analysis. Triggers on "run codeql", "codeql scan", "build codeql database", "SAST scan", "taint analysis", "dataflow analysis", or "find vulnerabilities in this repo". Covers Python, JavaScript/
· Black Duck website read, tools not yet checked
Black Duck delivers True Scale Application Security — SAST, SCA, DAST, and AI-powered AppSec — to help security and development teams detect vulnerabilities, manage open source license risk, and secure the software supply chain. Trusted by 4,000+ organizations.
· Vibgrate website read, tools not yet checked
Vibgrate scans your repository on your machine. It shows how far your stack has fallen behind, finds dependencies with known vulnerabilities, and gives your coding agent focused context from the code you actually run. Free, no account, raw source is not uploaded.
· GuardVibe website read, tools not yet checked
Security infrastructure your AI can't be — deterministic, post-cutoff-current, whole-repo, author-independent. Security MCP for vibe coding. 624 rules, 39 tools, zero config. Works with Claude Code, Cursor, Gemini CLI, and more.
Labels are the instruments' verdict and are never changed by ranking. Agents and robots get this same answer as JSON at /api/v1/find?q=…&answer=1 and through the MCP server.