From 490fb3f389e97b15ef98e1d6bbcc6c7ef435786b Mon Sep 17 00:00:00 2001
From: askalf <263217947+askalf@users.noreply.github.com>
Date: Fri, 17 Jul 2026 18:26:21 -0400
Subject: [PATCH 1/2] Add truecopy (agent skills & MCP supply-chain gate) to
Security
---
README.md | 1 +
1 file changed, 1 insertion(+)
diff --git a/README.md b/README.md
index 86fbc144e..c51d9230d 100644
--- a/README.md
+++ b/README.md
@@ -2972,6 +2972,7 @@ Tools for conducting research, surveys, interviews, and data collection.
### 🔒 Security
- [moxno/privacyscrubber-mcp](https://github.com/moxno/privacyscrubber-mcp) [](https://glama.ai/mcp/servers/moxno/privacyscrubber-mcp) 📇 🏠 - Zero-trust local PII and secrets masking server for Cursor, Windsurf, and Claude Desktop. `npx pii-masking-run`
+- [askalf/truecopy](https://github.com/askalf/truecopy) 📇 🏠 🍎 🪟 🐧 - Supply-chain gate for agent skills and MCP servers — scans tool definitions for poisoned instructions, pins vetted servers by content hash in a committed lock, and verifies drift in CI; the bundled truecopy-mcp proxy exposes only pinned, unmodified tools from a live server.
- [RoscoNL/intodns-mcp-server](https://github.com/RoscoNL/intodns-mcp-server) [](https://glama.ai/mcp/servers/RoscoNL/intodns-mcp-server) 📇 ☁️ 🏠 🍎 🪟 🐧 - Free DNS and email security scanner for AI assistants. DNS, SPF, DKIM, DMARC, DNSSEC, MTA-STS, BIMI, TLS/STARTTLS, FCrDNS, CAA, TLSA/DANE, blacklist and full-deliverability checks, plus security-header/CSP analysis and bookmarkable report snapshots, via the IntoDNS.ai API. No signup or API key. `npx intodns-mcp`
- [astafford8488/agentaegis-mcp](https://github.com/astafford8488/agentaegis-mcp) [](https://glama.ai/mcp/servers/astafford8488/agentaegis-mcp) 📇 ☁️ - Security & trust layer for AI agents. Scan an MCP server or skill *before* you install it (`scan_mcp_plugin`, `scan_skill`) — flags exfiltration, prompt-injection sinks, dangerous capabilities, install hooks and obfuscation → PROCEED/CAUTION/BLOCK. Plus `vet_endpoint` (endpoint safety verdict before an agent calls or pays it) and 25 more tools: vuln scans, threat intel, compliance (SOC 2/ISO 27001/HIPAA), code security (SAST/secret/dependency), identity — 28 total. Per-call billing via API key or x402 USDC on Base; free discovery tier.
- [hernaninverso/eleion-scanner-mcp](https://github.com/hernaninverso/eleion-scanner-mcp) [](https://glama.ai/mcp/servers/hernaninverso/eleion-scanner-mcp) 📇 ☁️ - Register/verify your domains, queue security scans (headers, TLS, DNS, ports, CVEs + AI-specific checks) and read findings, for AI agents. Install with `npx -y eleion-scanner-mcp`.
From 3c59b477f5009b8ddfc84e25e91ed846a24bebb4 Mon Sep 17 00:00:00 2001
From: askalf <263217947+askalf@users.noreply.github.com>
Date: Mon, 20 Jul 2026 12:22:54 -0400
Subject: [PATCH 2/2] Add Glama score badge to truecopy entry
---
README.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/README.md b/README.md
index c51d9230d..033b67770 100644
--- a/README.md
+++ b/README.md
@@ -2972,7 +2972,7 @@ Tools for conducting research, surveys, interviews, and data collection.
### 🔒 Security
- [moxno/privacyscrubber-mcp](https://github.com/moxno/privacyscrubber-mcp) [](https://glama.ai/mcp/servers/moxno/privacyscrubber-mcp) 📇 🏠 - Zero-trust local PII and secrets masking server for Cursor, Windsurf, and Claude Desktop. `npx pii-masking-run`
-- [askalf/truecopy](https://github.com/askalf/truecopy) 📇 🏠 🍎 🪟 🐧 - Supply-chain gate for agent skills and MCP servers — scans tool definitions for poisoned instructions, pins vetted servers by content hash in a committed lock, and verifies drift in CI; the bundled truecopy-mcp proxy exposes only pinned, unmodified tools from a live server.
+- [askalf/truecopy](https://github.com/askalf/truecopy) [](https://glama.ai/mcp/servers/askalf/truecopy) 📇 🏠 🍎 🪟 🐧 - Supply-chain gate for agent skills and MCP servers — scans tool definitions for poisoned instructions, pins vetted servers by content hash in a committed lock, and verifies drift in CI; the bundled truecopy-mcp proxy exposes only pinned, unmodified tools from a live server.
- [RoscoNL/intodns-mcp-server](https://github.com/RoscoNL/intodns-mcp-server) [](https://glama.ai/mcp/servers/RoscoNL/intodns-mcp-server) 📇 ☁️ 🏠 🍎 🪟 🐧 - Free DNS and email security scanner for AI assistants. DNS, SPF, DKIM, DMARC, DNSSEC, MTA-STS, BIMI, TLS/STARTTLS, FCrDNS, CAA, TLSA/DANE, blacklist and full-deliverability checks, plus security-header/CSP analysis and bookmarkable report snapshots, via the IntoDNS.ai API. No signup or API key. `npx intodns-mcp`
- [astafford8488/agentaegis-mcp](https://github.com/astafford8488/agentaegis-mcp) [](https://glama.ai/mcp/servers/astafford8488/agentaegis-mcp) 📇 ☁️ - Security & trust layer for AI agents. Scan an MCP server or skill *before* you install it (`scan_mcp_plugin`, `scan_skill`) — flags exfiltration, prompt-injection sinks, dangerous capabilities, install hooks and obfuscation → PROCEED/CAUTION/BLOCK. Plus `vet_endpoint` (endpoint safety verdict before an agent calls or pays it) and 25 more tools: vuln scans, threat intel, compliance (SOC 2/ISO 27001/HIPAA), code security (SAST/secret/dependency), identity — 28 total. Per-call billing via API key or x402 USDC on Base; free discovery tier.
- [hernaninverso/eleion-scanner-mcp](https://github.com/hernaninverso/eleion-scanner-mcp) [](https://glama.ai/mcp/servers/hernaninverso/eleion-scanner-mcp) 📇 ☁️ - Register/verify your domains, queue security scans (headers, TLS, DNS, ports, CVEs + AI-specific checks) and read findings, for AI agents. Install with `npx -y eleion-scanner-mcp`.