Skip to content
Cognivators
Open source

Tools I maintain and fixes that shipped in other people's code.

mcp-safeguard is the engine behind Agent Surface. The patches below were written for, and merged by, the projects named.

  1. mcp-safeguard

    Open source security scanner for MCP servers: prompt injection, credential exposure, SSRF, tool poisoning and source-level credential handling flaws. Install with pip install mcp-safeguard.

    MIT licence. Eight releases from 0.1.0 (2026-05-06) to 0.9.3 (2026-09-07). Over a thousand downloads.

    View on GitHub

  2. cve-credits-attribution

    Replication package for the Never Emitted paper: four datasets captured on 2026-08-26.

    Public repository, archived on Zenodo.

    View on GitHub

  3. github/github-mcp-server

    PR #3056: attach the GitHub token only to configured GitHub hosts.

    Merged 2026-08-18.

    View on GitHub

  4. googleapis/mcp-toolbox

    SSRF in the HTTP source reported by him. Google's fix, PR #3448, credits him.

    Fix merged 2026-06-18. CVE-2026-14540.

    View on GitHub