# What to use for security review

> 'AppSec' — reviewing systems and code for exploitable weakness.

Source: https://tashan.sh/task/security-review.html
Ranked by fit for the task, then how well it documents itself, then the tashan score
  (upkeep and freshness, gated by real adoption). Public evidence only — nothing paid can
  change a rank. Method: https://tashan.sh/methodology.html

## Ranked

| # | Capability | tashan score | Adoption evidence | Activity |
|---|---|---|---|---|
| 1 | [Zscaler](https://tashan.sh/capability/plugin-zscaler-zscaler-mcp-server-zscaler.html) | 63 | 41 ★ | active |
| 2 | [GitHub Autopilot](https://tashan.sh/capability/plugin-shweta-mishra-ai-github-autopilot-github-autopilot.html) | 55 | 23 ★ | active |
| 3 | [Agentic Security](https://tashan.sh/capability/plugin-clear-capabilities-agentic-security-agentic-security.html) | 50 | 73 ★ | active |
| 4 | [Jfrog](https://tashan.sh/capability/plugin-jfrog-claude-plugin-jfrog.html) | 47 | 4 ★ | active |
| 5 | [Shieldcortex](https://tashan.sh/capability/pkg-shieldcortex.html) | 69 | 2k/wk | active |
| 6 | [Js Reverse](https://tashan.sh/capability/pkg-js-reverse-mcp.html) | 69 | 1k/wk | active |
| 7 | [Sonarqube](https://tashan.sh/capability/plugin-sonarsource-sonarqube-agent-plugins-sonarqube.html) | 65 | 98 ★ | active |
| 8 | [Qodo](https://tashan.sh/capability/plugin-qodo-ai-qodo-skills-qodo.html) | 64 | 44 ★ | active |
| 9 | [Offensive Claude](https://tashan.sh/capability/plugin-hypnguyen1209-offensive-claude-offensive-claude.html) | 62 | 326 ★ | active |
| 10 | [NPM Sentinel](https://tashan.sh/capability/pkg-nekzus-mcp-server.html) | 62 | 924/wk | active |
| 11 | [Crowdstrike Falcon Foundry](https://tashan.sh/capability/plugin-crowdstrike-foundry-skills-crowdstrike-falcon-foundry.html) | 60 | 22 ★ | active |
| 12 | [Armorclaude](https://tashan.sh/capability/plugin-armoriq-armorclaude-armorclaude.html) | 60 | 44 ★ | active |
| 13 | [AI Agent Firewall](https://tashan.sh/capability/pkg-fidacy-mcp.html) | 60 | 454/wk | active |
| 14 | [Nist Nvd](https://tashan.sh/capability/pkg-cyanheads-nist-nvd-mcp-server.html) | 59 | 728/wk | active |
| 15 | [Crowdsec](https://tashan.sh/capability/plugin-crowdsecurity-crowdsec-skill-crowdsec.html) | 55 | 21 ★ | active |
| 16 | [Healthclaw Guardrails](https://tashan.sh/capability/plugin-aks129-healthclawguardrails-healthclaw-guardrails.html) | 55 | 27 ★ | active |
| 17 | [Malchela](https://tashan.sh/capability/plugin-dwmetz-malchela-malchela.html) | 55 | 114 ★ | active |
| 18 | [Descope Skills](https://tashan.sh/capability/plugin-descope-skills-descope-skills.html) | 49 | 12 ★ | active |
| 19 | [Onepassword Agent](https://tashan.sh/capability/pkg-onepassword-agent-mcp.html) | 49 | 90/wk | active |
| 20 | [Fort](https://tashan.sh/capability/plugin-djadmin-fort-fort.html) | 45 | 73 ★ | active |
| 21 | [Nightvision](https://tashan.sh/capability/plugin-nvsecurity-nightvision-skills-nightvision.html) | 44 | 2 ★ | active |
| 22 | [Usap Skills](https://tashan.sh/capability/plugin-jaskaranhundal-usap-skills-usap-skills.html) | 44 | 3 ★ | active |
| 23 | [Kernel Vuln Analyzer](https://tashan.sh/capability/plugin-winmin-kernel-vuln-analyzer-kernel-vuln-analyzer.html) | 44 | 39 ★ | active |
| 24 | [Dotsecenv](https://tashan.sh/capability/plugin-dotsecenv-dotsecenv-dotsecenv.html) | 43 | 5 ★ | active |
| 25 | [Dreamforge Audit](https://tashan.sh/capability/plugin-brainit-consulting-dreamforgesoftwareagentskills-dreamforge-audit.html) | 43 | 6 ★ | active |
| 26 | [Secure Sdlc Agents](https://tashan.sh/capability/plugin-kaademos-secure-sdlc-agents-secure-sdlc-agents.html) | 41 | 12 ★ | active |
| 27 | [Rugproof](https://tashan.sh/capability/plugin-omermaksutii-rugproof-rugproof.html) | 38 | 9 ★ | active |
| 28 | [Prodsec Skills Ge Core](https://tashan.sh/capability/plugin-redhatproductsecurity-prodsec-skills-prodsec-skills-ge-core.html) | 55 | 43 ★ | active |
| 29 | [Stackhawk Skills For Claude](https://tashan.sh/capability/plugin-stackhawk-claude-skills-stackhawk-skills-for-claude.html) | 51 | 12 ★ | active |
| 30 | [Clawvet Guard](https://tashan.sh/capability/plugin-mohibshaikh-clawvet-clawvet-guard.html) | 51 | 11 ★ | active |
| 31 | [Vanta MCP Plugin](https://tashan.sh/capability/plugin-vantainc-vanta-mcp-plugin-vanta-mcp-plugin.html) | 50 | 4 marketplaces | — |
| 32 | [42crunch API Security Testing](https://tashan.sh/capability/plugin-42crunch-ai-claude-plugins-42crunch-api-security-testing.html) | 47 | 1 ★ | active |
| 33 | [Claude Security](https://tashan.sh/capability/plugin-anthropics-claude-plugins-official-claude-security.html) | 46 | 2 marketplaces | — |
| 34 | [Security Guidance](https://tashan.sh/capability/plugin-anthropics-claude-plugins-official-security-guidance.html) | 46 | 2 marketplaces | — |
| 35 | [Stackhawk Hawkscan](https://tashan.sh/capability/plugin-stackhawk-agent-skills-stackhawk-hawkscan.html) | 45 | 3 marketplaces | active |
| 36 | [Stackhawk API](https://tashan.sh/capability/plugin-stackhawk-agent-skills-stackhawk-api.html) | 45 | 3 marketplaces | active |
| 37 | [Gomboc AI Community](https://tashan.sh/capability/plugin-gomboc-ai-gomboc-community-skills-gomboc-ai-community.html) | 43 | 6 ★ | active |
| 38 | [Fresh Eyes Review](https://tashan.sh/capability/plugin-2389-research-claude-plugins-fresh-eyes-review.html) | 42 | 1 marketplaces | — |
| 39 | [Clover](https://tashan.sh/capability/plugin-clover-security-clover-claude-plugin-clover.html) | 40 | 0 ★ | active |
| 40 | [Optibot · Optimal-AI](https://tashan.sh/capability/plugin-optimal-ai-optibot-skill-optibot.html) | 40 | 1 ★ | active |

Showing the top 40 of 117. The full ranked shelf is at https://tashan.sh/task/security-review.html.

## What these numbers are not

- The tashan score measures upkeep, freshness and adoption. It is **not** a security
  verdict and **not** a measure of whether the capability works well.
- `not scored` means too little public evidence to rank, never that something is bad.
- The security audit is separate and free per capability, on each page above.