Sekura

ai.sekuraPublished by sekura.aiOfficial publisherv1.0.0Updated Oct 26, 2026

Scan a GitHub repository for vulnerabilities, with proof for every finding, from your coding agent.

VerifiedStreamable HTTPWeb executableDeveloper Tools Security & Monitoring

Server details

Identifier: ai.sekura/sekura
Transport: Streamable HTTP
Runtime: Web executable
Trust: Verified
Published: Oct 20, 2026

Security note

MCP servers receive tool arguments from a conversation and may perform external actions. Review what a server can do before you enable it, and give it only the access it needs.

The registry verified that this server's namespace belongs to sekura.ai, which also runs its endpoint. That identifies the publisher; it does not make the server's tools safe.

SourceWeft's checks cover whether the listing is complete and the endpoint answered; they do not review the server's code or what its tools do.

Add a badge to your README

Show readers this MCP server is listed on SourceWeft. The badge links to this page.

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/ai.sekura%2Fsekura.svg)](https://sourceweft.com/mcp/ai.sekura%2Fsekura?utm_source=readme&utm_medium=badge)

Overview

AI-generated overview

Sekura scans GitHub repositories for vulnerabilities and returns findings with proof, letting a coding agent list repos, start approved scans, read results…

What you can do: List and view the user's GitHub repositories connected to Sekura
Start a vulnerability scan on a repository, after a preview and confirmation
Read scan findings, each backed by proof
Create and manage recurring scan plans, run a plan now, or cancel it
When to use it: Useful when a coding agent should check a GitHub repository for security vulnerabilities and report proven findings, or keep scans running on a schedule, without leaving the chat.
Requirements: Remote MCP endpoint at sekura.ai/mcp; nothing runs locally. Sign-in is OAuth 2.1 (PKCE, dynamic client registration), so no API key is copied. A Sekura account with access to the GitHub repositories to scan is needed, and scans are paid.

Before you install

Scans cost money: write tools first return a preview naming the repository, authorization wording and price, and a card is charged only after the user approves the quoted amount, otherwise a Stripe Checkout link is returned. Write actions (start scan, start plan, run plan, cancel) change state on the account. Repository data is sent to Sekura's service.

Installation

In SourceWeft

Open Sekura in the dashboard and add it to a workspace.
Connect the required credentials. They are stored privately and never shown on public pages.
Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/ai.sekura%2Fsekura/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config. The client completes OAuth sign-in on first connect.

{
  "mcpServers": {
    "sekura": {
      "type": "http",
      "url": "https://sekura.ai/mcp"
    }
  }
}

README

Sekura plugins

Manifests that connect AI coding tools to the Sekura MCP server at https://sekura.ai/mcp.

Sekura scans a GitHub repository for vulnerabilities and delivers a report with proof for every finding; from your agent you can see your repositories, start a scan you have approved, read the findings, and manage a schedule.

This repository holds manifests only. Every one of them points at the same server, and nothing here runs on your machine: sign-in is OAuth 2.1 at the server (PKCE, Dynamic Client Registration, Client ID Metadata Documents), so no key is copied anywhere. The full guide for every tool, with the exact snippet or one-click link, is at https://sekura.ai/connect/.

Install

Tool	How
Claude Code	`/plugin marketplace add sekuraai/sekura-plugins`, then `/plugin install sekura@sekura`. Or without the plugin: `claude mcp add --transport http sekura https://sekura.ai/mcp` then `/mcp` to sign in
Claude (app and web)	Settings, Connectors, Add custom connector, address `https://sekura.ai/mcp`
Cursor	The one-click link on https://sekura.ai/connect/, or clone this repository into `~/.cursor/plugins/local/` (the plugin is this repository's root)
Kiro	Add Custom Power, Import power from GitHub, this repository
Antigravity	`antigravity/`: the manifest and `mcp_config.json`; or add `https://sekura.ai/mcp` as a custom server
VS Code, Copilot CLI, JetBrains, Zed, Codex, Devin, Replit, Lovable, Bolt, v0 and the rest	https://sekura.ai/connect/

What is where

Path	Venue
`.claude-plugin/marketplace.json`, `plugins/sekura/`	Claude Code plugin marketplace; the plugin's skill teaches the quote-then-confirm flow
`plugin.json`, `mcp.json`	Agent Plugins standard manifest at the root: Kiro Powers, Cursor
`.cursor-plugin/plugin.json`	Cursor Marketplace and cursor.directory
`registry/server.json`	The official MCP Registry entry, `ai.sekura/sekura`, published with `mcp-publisher`
`docker/servers/sekura/`	The Docker MCP Catalog entry, submitted as a pull request to docker/mcp-registry
`cline/`	The Cline marketplace listing: README, `llms-install.md`, 400 by 400 logo
`antigravity/`	Google Antigravity plugin manifest and MCP configuration
`gemini/gemini-extension.json`	Gemini CLI extension (legacy gallery)
`logo.png`	The Sekura owl, 512 by 512

How the server behaves

Read tools are free and need no confirmation. Every write tool (start a scan, start a recurring plan, run a plan now, cancel) answers first with a preview that names the repository, the authorization wording and the price, and runs only when called again with the arguments the preview names, after the user has agreed in the conversation. A card is charged only after the user approves the quoted amount; otherwise the answer carries a Stripe Checkout link.

Privacy: https://sekura.ai/privacy/. Terms: https://sekura.ai/terms/. Support: [email protected].

Source: README.md at commit 86640a9

Tools

This server asks you to sign in, so SourceWeft could not read its tools without an account and has not indexed them. What a connected account sees can depend on that account and its permissions.

Version history

v1.0.0LatestOct 20, 2026

Score

85% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

Reached in the last 30 daysRequired25 pts
Auth declaredRequired10 pts
Tools listed15 pts
Answer tools/list without a credential, or ship a package that starts in a sandbox without one.
DescriptionRequired15 pts
Logo10 pts
Documentation15 pts
License10 pts