Semgrep — MCP

We noticed you didn’t add any tools, which makes it harder for us to provide you with information relevant to your toolchain.

Start over Maybe later Not interested

Know when your tools change

• Star Trivy, Semgrep or Falco and see what each one shipped since you last looked.
• Spot a release that changes the rest of your chain.
• Get a score card for your toolchain.
• Saved in your browser, and synced to your account when you sign in.

How do you want to add them?

Star a tool

Tap the ☆ beside a tool. It works in any table that lists tools.

1. 1 Ask your assistant

   List the cyber and AI tools I actually use, so I can paste the list into The AI Toolchain and The Cyber Toolchain. One list covers both sites; each site keeps the tools it tracks and skips the rest. Do not answer from memory. Inspect this machine first, then list only what you found evidence for: - Package managers: brew list and brew list --cask, apt/dpkg, pip/pipx/uv tool list, npm -g ls, go install binaries (~/go/bin), cargo install --list - Binaries on PATH and in ~/bin, ~/.local/bin, /usr/local/bin, /opt - Local model runners and the models they hold (ollama list, LM Studio, llama.cpp, vLLM, MLX, Hugging Face cache) - Docker/Podman images and compose files, including scanners, SIEM and log pipelines, detection and response platforms, vector databases, inference servers, and observability stacks - Agent and assistant config: ~/.claude, ~/.codex, ~/.cursor, ~/.config/opencode, ~/.gemini, and similar; their installed plugins, skills, and MCP servers - Security tool config and rule directories (nuclei templates, semgrep rules, Sigma, YARA, Suricata, Zeek, osquery, Falco) - Editor, IDE, and browser extensions that are AI or security tools (VS Code, Cursor, JetBrains, Zed, Burp) - Repo files: lockfiles, requirements, package.json, go.mod, Dockerfiles, CI workflows, IaC, and SDK imports that show which scanners, security services, model providers, frameworks, and libraries the code runs or calls - Env var names and secret-store key names that show which security or AI services I use (names only, never values) - Anything I've told you about my setup, including products my company runs that aren't installed on this machine Include every tool that does a security job or an AI job, even obscure ones. Security: scanners, SAST, DAST, SCA and SBOM tools, secret detection, EDR and XDR, SIEM and log analytics, SOAR, cloud and container security, identity and access, vulnerability management, threat intelligence, network monitoring and IDS, pentest and red-team tools, forensics and incident response, and security hardware. AI: models and model families I run or call, model providers and their APIs, coding assistants and agents, agent frameworks and SDKs, MCP servers, local runners and inference servers, vector databases and embedding tools, eval, tracing, and observability tools, prompt and guardrail tools, AI gateways and proxies, speech, image, and video generators, and AI hardware. Leave out: general-purpose utilities that aren't security or AI tools (git, curl, jq), language runtimes, my own internal scripts and project names, and anything you can't tie to evidence. Do not guess or pad. Reply with one product name per line, alphabetized, deduplicated, nothing else: no versions, no descriptions, no bullets, no headings, no cyber/AI grouping. Use the name people search for (for example "Burp Suite", not "burpsuite-pro-2024.1"; "Claude Code", not "claude-code-2.1"). Name models by family and size, not file name (for example "Llama 3.3 70B", not "llama-3.3-70b-instruct-q4_k_m.gguf"). Count a tool once even if it appears as a package, an image, and a binary. Never include hostnames, IP addresses, usernames, API keys, file paths, or anything else that isn't a product name. Do not print the contents of .env files, keychains, or secret stores while inspecting.
   Copy prompt view full prompt

2. 2 Paste what it says

3. 3 Detect your tools

   Detect my tools

List the cyber and AI tools I actually use, so I can paste the list into The AI Toolchain and The Cyber Toolchain. One list covers both sites; each site keeps the tools it tracks and skips the rest.

Do not answer from memory. Inspect this machine first, then list only what you found evidence for:
- Package managers: brew list and brew list --cask, apt/dpkg, pip/pipx/uv tool list, npm -g ls, go install binaries (~/go/bin), cargo install --list
- Binaries on PATH and in ~/bin, ~/.local/bin, /usr/local/bin, /opt
- Local model runners and the models they hold (ollama list, LM Studio, llama.cpp, vLLM, MLX, Hugging Face cache)
- Docker/Podman images and compose files, including scanners, SIEM and log pipelines, detection and response platforms, vector databases, inference servers, and observability stacks
- Agent and assistant config: ~/.claude, ~/.codex, ~/.cursor, ~/.config/opencode, ~/.gemini, and similar; their installed plugins, skills, and MCP servers
- Security tool config and rule directories (nuclei templates, semgrep rules, Sigma, YARA, Suricata, Zeek, osquery, Falco)
- Editor, IDE, and browser extensions that are AI or security tools (VS Code, Cursor, JetBrains, Zed, Burp)
- Repo files: lockfiles, requirements, package.json, go.mod, Dockerfiles, CI workflows, IaC, and SDK imports that show which scanners, security services, model providers, frameworks, and libraries the code runs or calls
- Env var names and secret-store key names that show which security or AI services I use (names only, never values)
- Anything I've told you about my setup, including products my company runs that aren't installed on this machine

Include every tool that does a security job or an AI job, even obscure ones.
Security: scanners, SAST, DAST, SCA and SBOM tools, secret detection, EDR and XDR, SIEM and log analytics, SOAR, cloud and container security, identity and access, vulnerability management, threat intelligence, network monitoring and IDS, pentest and red-team tools, forensics and incident response, and security hardware.
AI: models and model families I run or call, model providers and their APIs, coding assistants and agents, agent frameworks and SDKs, MCP servers, local runners and inference servers, vector databases and embedding tools, eval, tracing, and observability tools, prompt and guardrail tools, AI gateways and proxies, speech, image, and video generators, and AI hardware.

Leave out: general-purpose utilities that aren't security or AI tools (git, curl, jq), language runtimes, my own internal scripts and project names, and anything you can't tie to evidence. Do not guess or pad.

Reply with one product name per line, alphabetized, deduplicated, nothing else: no versions, no descriptions, no bullets, no headings, no cyber/AI grouping. Use the name people search for (for example "Burp Suite", not "burpsuite-pro-2024.1"; "Claude Code", not "claude-code-2.1"). Name models by family and size, not file name (for example "Llama 3.3 70B", not "llama-3.3-70b-instruct-q4_k_m.gguf"). Count a tool once even if it appears as a package, an image, and a binary.

Never include hostnames, IP addresses, usernames, API keys, file paths, or anything else that isn't a product name. Do not print the contents of .env files, keychains, or secret stores while inspecting.