Skip to content
plugmcp
DirectorySkillsCategoriesBlog
EN/中文
Sign inSign up
Home/Servers/Gadriel AI Security Harness

Gadriel AI Security Harness

by io.github.Gadriel-ai

AI Security Harness: SAST, secrets, deps, containers, config & OWASP LLM. Scans locally.

Power your agent

Add this server

The publisher's own command. Not a PlugMCP endpoint.

Local command
npx -y [email protected]
Credentials from the publisher
  • GADRIEL_NO_ANONYMOUS_AUTH — Set to 1 to skip anonymous device registration with app.gadriel.ai.
Provider
Claude Code
GADRIEL_NO_ANONYMOUS_AUTH=<value> claude mcp add io.github.gadriel-ai-gadriel -- npx -y [email protected]

Run in a terminal.

Claude Desktop
{
  "mcpServers": {
    "io.github.gadriel-ai-gadriel": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "GADRIEL_NO_ANONYMOUS_AUTH": "<value>"
      }
    }
  }
}

claude_desktop_config.json

Step-by-step: add this in Claude

Remote URL or a command on your machine? How the two installs differ

Run on PlugMCP

Host a copy with our keys and logs.

A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.

Launch

Related MCP

View more
  • Firecrawl🔥 Official Firecrawl MCP Server - Adds powerful web scraping and search to Cursor, Claude and any other LLM clients.
  • N
    NotionToken-auth Notion MCP: pages, databases, blocks, comments, files. Runs headless in CI and agents.
  • Context7Context7 Platform -- Up-to-date code documentation for LLMs and AI code editors

Related skills

View all
  • reaReverse engineer anything with agents, from app behavior down to native binaries.
  • rea-changelog-updatePrepare or rewrite REA release changelogs and GitHub release notes from pinned Git history, with verified contributor thanks and Release Please synchronization.
  • rea-tool-designDesign or change REA investigation tools, CLI/MCP contracts, provider capabilities, and Evidence semantics.

AI Security Harness: SAST, secrets, deps, containers, config & OWASP LLM. Scans locally.

Gadriel — AI Security Harness for GitHub Copilot

Security scanning for the code Copilot writes: SAST, secrets, dependencies (SCA/SBOM), containers and configuration, including AI-specific risks like prompt injection and the OWASP LLM Top 10 — 3,000+ rules, scanned on your machine. Gadriel plugs into Copilot as an MCP server plus repository instructions, prompts, and reviewer agents.

Part of the Gadriel AI Security Harness, alongside VS Code, Claude Code, Codex, and Cursor.

Get it

Easiest — the VS Code extension. Install Gadriel AI Security Harness from the Marketplace. It registers the gadriel MCP server for Copilot automatically and adds a Gadriel: Scan Repository command — no config to edit.

Or add the MCP server yourself. The server is published to the GitHub MCP Registry as io.github.Gadriel-ai/gadriel, so it shows up in VS Code's MCP: Browse Servers and Copilot Chat's @mcp search — add it in a click. To wire it per-repo instead, drop this .vscode/mcp.json into your project (needs Node for npx, or npm install -g gadriel):

{ "servers": { "gadriel": { "type": "stdio", "command": "npx", "args": ["-y", "[email protected]", "code", "mcp"] } } }

Add the Copilot guidance (optional). Copy the .github/ directory into your repo so Copilot knows how to use Gadriel:

PathWhat
.github/copilot-instructions.mdrepo-wide guidance, auto-applied
.github/instructions/*.instructions.md17 topic rules, scoped by applyTo
.github/prompts/*.prompt.md/gadriel-scan, /gadriel-fix, /gadriel-status, …
.github/agents/*.agent.md8 reviewer agents

Use

In Copilot Chat (agent mode), just ask: "Run a Gadriel security scan on this repo and summarize the findings," or invoke a prompt like /gadriel-scan. The gadriel MCP tools — validate_file, findings_for_path, fix_finding, validate_buffer, and more — are available to Copilot directly.

Good to know

  • No automatic edit guardrail here. Copilot/VS Code has no edit-time hook (Cursor and Codex do), so scanning runs on request via the MCP tools and prompts rather than blocking each edit.
  • Enterprise: Copilot Business/Enterprise can allowlist the gadriel MCP server through managed MCP policy.
  • Privacy: code is scanned locally and never uploaded. First run registers an anonymous device credential with app.gadriel.ai (a random device id — no hostname, username, or keys); set GADRIEL_NO_ANONYMOUS_AUTH=1 to skip. See the privacy policy.

Maintainers

The registry listing is (re)published by .github/workflows/publish-mcp.yml (GitHub OIDC — an org namespace can only be published from CI in a Gadriel-ai repo). After a new gadriel npm release, bump server.json and the .vscode/mcp.json pin, then re-run that workflow.

License

This repository is Apache-2.0. The gadriel scanner it runs is proprietary, under the Gadriel terms.

How do I install Gadriel AI Security Harness?
Copy the stdio config for Cursor, Claude Desktop, Claude Code, or VS Code on this page. It uses the publisher's install, not a PlugMCP proxy.
Does Gadriel AI Security Harness need an API key?
The publisher lists these environment variables: GADRIEL_NO_ANONYMOUS_AUTH.
What transport does Gadriel AI Security Harness use?
Gadriel AI Security Harness runs locally over stdio.
When was Gadriel AI Security Harness last checked?
Last checked 2026-10-16. AI Security Harness: SAST, secrets, deps, containers, config & OWASP LLM. Scans locally.

No tool list yet. Remote servers get one after the first health check.

plugmcp

Plug any tool into any agent. MCP servers for people who do not write servers. Gateway for volume, n8n for apps.

  • github.com/TODO
  • x.com/TODO
  • linkedin.com/company/TODO

PlugMCP, 2026

Product
  • Browse
  • Install
  • Host your own
  • Voice mode
  • Browser
Directory
  • All MCP servers
  • Agent skills
  • Categories
  • New
  • Voice
  • Submit a server
Developers
  • Docs
  • Blog
  • What is MCP
  • What is WebMCP
  • Status
Company
  • About
  • Contact
  • Terms
  • Privacy
  • DPA