sca plugins

by Ross Young

Agentic-Security: SAST + SCA + secrets + IaC + LLM-sec scanner with deterministic fix toolchain. Exposes a Model Context Protocol (MCP) server with 17 tools that Codex CLI can call directly.

by Sven Roth

Security scanning via Aikido API with automated remediation loop

by Matt Corbett

Fintech & payments-engineering team — agents (payments-architect, payments-integration-engineer, billing-subscriptions-engineer, payments-pci-compliance-advisor) for building payment + billing systems that don't lose or duplicate money: payment-flow architecture (PSP choice, money-as-integer, the double-entry ledger, reconciliation), payment integration (Stripe-style intents, idempotency keys, webhook verification + idempotent handling, 3DS/SCA, retries/dunning), subscription & usage billing (plans, proration, metering, invoicing, revenue events), and PCI-DSS scope minimization (tokenization, never touch raw PAN, SAQ-A posture). The ENGINEERING — accounting/GL routes to finance, financial regulation to regulatory-compliance, security verdicts to ravenclaude-core. skills, a decision-tree knowledge bank (charge-flow + PCI-scope trees + a dated 2026 map), best-practices, templates, commands, an advisory hook. Requires ravenclaude-core@>=0.7.0.

by Matt Corbett

Security-engineering (AppSec) team — agents (appsec-engineer, threat-modeler, supply-chain-security-engineer, cloud-security-engineer) for building security INTO software: threat modeling (STRIDE, data-flow diagrams, trust boundaries), application security testing (SAST/DAST/IAST/SCA in CI, OWASP Top 10 web), secrets management (detection, rotation, vaulting, no plaintext), software supply-chain integrity (SBOM consumption, dependency CVEs, SLSA verification, pinning), and cloud security posture (CSPM, IAM least-privilege, network exposure). skills, a decision-tree knowledge bank (vuln-triage + secrets-handling trees + a dated 2026 tooling map), best-practices, templates, commands, an advisory hook. **Proposes controls; every ship/no-ship security VERDICT escalates to ravenclaude-core/security-reviewer.** Seams: API OWASP -> api-engineering, identity -> auth-identity, data privacy -> data-governance-privacy. Requires ravenclaude-core@>=0.7.0.

by Endor Labs

Endor Labs security workflow skills, agents, and MCP server for GitHub Copilot. Requires only the endorctl binary: no Node, Python, or Unix tools.