{
  "slug": "scan-for-vulnerabilities",
  "label": "scan code for vulnerabilities",
  "blurb": "Find vulnerabilities, leaked secrets and security holes in code, servers and apps.",
  "keywords": [
    "vulnerability",
    "security scan",
    "sast",
    "secrets",
    "pentest"
  ],
  "categories": [
    "security"
  ],
  "access": [
    "cli",
    "mcp"
  ],
  "count": 15,
  "official": 5,
  "url": "https://agentswitchboard.dev/tasks/scan-for-vulnerabilities",
  "browseUrl": "https://agentswitchboard.dev/browse?task=scan-for-vulnerabilities",
  "agentsUrl": "https://agentswitchboard.dev/api/agents?task=scan-for-vulnerabilities",
  "agents": [
    {
      "name": "SafeWeave",
      "slug": "safeweave",
      "url": "https://agentswitchboard.dev/agents/safeweave",
      "iconUrl": "https://agentswitchboard.dev/icons/safeweave.png?v=cb5ec314",
      "description": "MCP server with 8 parallel security scanners — SAST, secrets, dependencies, IaC, container, DAST, license, and posture. Integrates into Cursor, Claude Code, VS Code in seconds.",
      "provider": "SafeWeave",
      "categories": [
        "security"
      ],
      "accessMethods": [
        "mcp"
      ],
      "verified": true,
      "official": false,
      "featured": false,
      "authType": "apiKey",
      "why": "SAST Scan: Run static analysis security testing on source code and surface vulnerabilities by severity level"
    },
    {
      "name": "HexStrike AI",
      "slug": "hexstrike-ai",
      "url": "https://agentswitchboard.dev/agents/hexstrike-ai",
      "iconUrl": "https://agentswitchboard.dev/icons/hexstrike-ai.png?v=06396df9",
      "description": "Drive 150+ offensive security tools from an AI agent through one MCP server — reconnaissance, vulnerability scanning, exploitation workflows, and bug bounty automation.",
      "provider": "HexStrike",
      "categories": [
        "security"
      ],
      "accessMethods": [
        "mcp",
        "cli"
      ],
      "verified": true,
      "official": false,
      "featured": false,
      "authType": "none",
      "why": "Vulnerability Scanning: Runs web, network, and binary scanners against a scoped target and normalizes findings into structured results."
    },
    {
      "name": "Semgrep",
      "slug": "semgrep",
      "url": "https://agentswitchboard.dev/agents/semgrep",
      "iconUrl": "https://agentswitchboard.dev/icons/semgrep.png?v=9675f0c7",
      "description": "Scans source code with AI-assisted SAST, SCA, and secrets detection, finding 8x more true positives with 50% less noise than standalone foundation models.",
      "provider": "Semgrep",
      "categories": [
        "security"
      ],
      "accessMethods": [
        "api",
        "cli"
      ],
      "verified": true,
      "official": false,
      "featured": false,
      "authType": "apiKey",
      "why": null
    },
    {
      "name": "ToolHive",
      "slug": "toolhive",
      "url": "https://agentswitchboard.dev/agents/toolhive",
      "iconUrl": "https://agentswitchboard.dev/icons/toolhive.png?v=18528df4",
      "description": "Runs MCP servers in isolated containers locally or on Kubernetes, with a CLI, desktop UI, operator, registry, and gateway that apply secrets, auth policy, and telemetry for teams.",
      "provider": "Stacklok",
      "categories": [
        "infrastructure",
        "security"
      ],
      "accessMethods": [
        "cli",
        "api",
        "mcp"
      ],
      "verified": true,
      "official": false,
      "featured": false,
      "authType": "none",
      "why": "Secrets Management: Stores encrypted secrets with `thv secret` and injects them into MCP server containers without exposing local credentials."
    },
    {
      "name": "Snyk Agent Scan",
      "slug": "snyk-agent-scan",
      "url": "https://agentswitchboard.dev/agents/snyk-agent-scan",
      "iconUrl": "https://agentswitchboard.dev/icons/snyk-agent-scan.png?v=46cc8e2d",
      "description": "Security scanner for MCP servers and agent skills. Detects prompt injections, tool poisoning, and sensitive data risks across Claude, Cursor, Windsurf, and 10+ other agents.",
      "provider": "Snyk",
      "categories": [
        "security"
      ],
      "accessMethods": [
        "cli"
      ],
      "verified": true,
      "official": true,
      "featured": false,
      "authType": "apiKey",
      "why": null
    },
    {
      "name": "Nightcrawler",
      "slug": "nightcrawler",
      "url": "https://agentswitchboard.dev/agents/nightcrawler",
      "iconUrl": "https://agentswitchboard.dev/icons/nightcrawler.png?v=ab045b31",
      "description": "Local AI pentesting agent that runs reconnaissance and vulnerability probing from your own hardware without sending scope data to a cloud service.",
      "provider": "Garage HQ",
      "categories": [
        "security"
      ],
      "accessMethods": [
        "cli"
      ],
      "verified": true,
      "official": false,
      "featured": false,
      "authType": "none",
      "why": null
    },
    {
      "name": "Shannon",
      "slug": "shannon",
      "url": "https://agentswitchboard.dev/agents/shannon",
      "iconUrl": "https://agentswitchboard.dev/icons/shannon.png?v=9928eb05",
      "description": "Pentests web apps and APIs you are authorized to test by reading their source, running real exploits, and reporting only findings with a working proof of concept.",
      "provider": "Keygraph",
      "categories": [
        "security"
      ],
      "accessMethods": [
        "cli"
      ],
      "verified": true,
      "official": false,
      "featured": false,
      "authType": "none",
      "why": null
    },
    {
      "name": "PentAGI",
      "slug": "pentagi",
      "url": "https://agentswitchboard.dev/agents/pentagi",
      "iconUrl": "https://agentswitchboard.dev/icons/pentagi.png?v=b821acbb",
      "description": "Executes penetration-testing workflows with autonomous agent teams that chain reconnaissance, exploitation, and reporting across established security tooling.",
      "provider": "VXControl",
      "categories": [
        "security"
      ],
      "accessMethods": [
        "api",
        "cli"
      ],
      "verified": true,
      "official": false,
      "featured": false,
      "authType": "apiKey",
      "why": "Pentest Reporting: Compiles findings, evidence, and remediation guidance into a structured report at the end of an engagement."
    },
    {
      "name": "Agent Vault",
      "slug": "agent-vault",
      "url": "https://agentswitchboard.dev/agents/agent-vault",
      "iconUrl": "https://agentswitchboard.dev/icons/agent-vault.png?v=ca96501f",
      "description": "Open-source credential proxy for AI agents by Infisical. Agents call APIs without ever seeing secrets — credentials injected at the network layer via HTTPS_PROXY.",
      "provider": "Infisical",
      "categories": [
        "security"
      ],
      "accessMethods": [
        "cli"
      ],
      "verified": true,
      "official": false,
      "featured": false,
      "authType": "none",
      "why": "Credential Injection: Inject API keys and secrets at the network layer so agents never handle credentials directly"
    },
    {
      "name": "JFrog MCP Server",
      "slug": "jfrog-mcp",
      "url": "https://agentswitchboard.dev/agents/jfrog-mcp",
      "iconUrl": "https://agentswitchboard.dev/icons/jfrog-mcp.png?v=870061d5",
      "description": "Connects AI coding assistants to the JFrog Platform to manage projects and Artifactory repositories and to check package vulnerability and curation status.",
      "provider": "JFrog",
      "categories": [
        "code-devtools",
        "security"
      ],
      "accessMethods": [
        "mcp",
        "cli"
      ],
      "verified": true,
      "official": true,
      "featured": false,
      "authType": "oauth2",
      "why": "Check Package Vulnerabilities: Looks up package versions and their vulnerability status, and returns Xray security summaries and violations for…"
    },
    {
      "name": "HOL Guard",
      "slug": "hol-guard",
      "url": "https://agentswitchboard.dev/agents/hol-guard",
      "iconUrl": "https://agentswitchboard.dev/icons/hol-guard.png?v=289253f3",
      "description": "Blocks risky AI coding agent actions at runtime on your machine — shell commands, secret access, MCP servers, plugins and package installs — against local policy. Apache-2.0 CLI, free on one machine.",
      "provider": "Hashgraph Online",
      "categories": [
        "security",
        "code-devtools"
      ],
      "accessMethods": [
        "cli"
      ],
      "verified": true,
      "official": false,
      "featured": false,
      "authType": "none",
      "why": "Secret Scan: Scans for secret exposure in agent workflows via the separate hol-guard-secrets console entry point."
    },
    {
      "name": "SkaleAgents",
      "slug": "skaleagents",
      "url": "https://agentswitchboard.dev/agents/skaleagents",
      "iconUrl": "https://agentswitchboard.dev/icons/skaleagents.png?v=7d252398",
      "description": "Scans Terraform, CloudFormation, Kubernetes and Pulumi IaC plus CI files and Dockerfiles for misconfigurations and committed secrets, and reviews app architecture, from an MCP server or offline CLI.",
      "provider": "Binary Labs LLC",
      "categories": [
        "code-devtools",
        "security",
        "infrastructure"
      ],
      "accessMethods": [
        "mcp",
        "cli"
      ],
      "verified": true,
      "official": false,
      "featured": false,
      "authType": "oauth2",
      "why": null
    },
    {
      "name": "Snyk",
      "slug": "snyk",
      "url": "https://agentswitchboard.dev/agents/snyk",
      "iconUrl": "https://agentswitchboard.dev/icons/snyk.png?v=46cc8e2d",
      "description": "Developer security platform with AI-powered vulnerability detection, fix suggestions, and automated security testing across code, dependencies, and containers.",
      "provider": "Snyk",
      "categories": [
        "security",
        "code-devtools"
      ],
      "accessMethods": [
        "api",
        "mcp",
        "cli"
      ],
      "verified": true,
      "official": true,
      "featured": false,
      "authType": "apiKey",
      "why": null
    },
    {
      "name": "NVIDIA SkillSpector",
      "slug": "nvidia-skillspector",
      "url": "https://agentswitchboard.dev/agents/nvidia-skillspector",
      "iconUrl": "https://agentswitchboard.dev/icons/nvidia-skillspector.png?v=9c3baa54",
      "description": "Scan agent skills, plugins, and MCP servers before installing them — detects prompt injection, data exfiltration, malicious patterns, and supply-chain risk in Claude Code and Codex skills.",
      "provider": "NVIDIA",
      "categories": [
        "security",
        "code-devtools"
      ],
      "accessMethods": [
        "cli"
      ],
      "verified": true,
      "official": true,
      "featured": true,
      "authType": "none",
      "why": null
    },
    {
      "name": "OpenCodeReview",
      "slug": "open-code-review",
      "url": "https://agentswitchboard.dev/agents/open-code-review",
      "iconUrl": "https://agentswitchboard.dev/icons/open-code-review.png?v=163f757b",
      "description": "Reviews pull requests with deterministic static analysis plus an LLM agent, posting line-level comments backed by rulesets for null-pointer, thread-safety, XSS, and SQL injection defects.",
      "provider": "Alibaba",
      "categories": [
        "code-devtools",
        "security"
      ],
      "accessMethods": [
        "cli",
        "api"
      ],
      "verified": true,
      "official": true,
      "featured": true,
      "authType": "apiKey",
      "why": null
    }
  ],
  "relatedTasks": [
    "review-contracts",
    "review-code",
    "work-with-github"
  ],
  "stacks": []
}