{"id":12122,"external_id":"plugin_asdk_app_6aea7be482bc8191a19ee6b24968802c","name":"vulkill-security-mcp","display_name":"VulKill Security","developer":"GOKCE BARAN KARAKAMIS","category":"Developer Tools","listing_language":"en","listing_language_details":{"method":"cld-0.13.0/listing-v1","reliable":true,"detected_at":"2026-11-10T12:07:55Z","input_sha256":"be301d0eea2ca470d9a101a6a47ad4a34153bb6a3ced37d6c2866ec7d09a7ed7","source_fields":["release.description","release.interface.short_description","release.interface.long_description"]},"version":"1.2.4","skill_count":1,"first_seen_at":"2026-11-10T12:00:30.695Z","last_seen_at":"2026-11-10T18:00:00.269Z","last_changed_at":"2026-11-10T12:00:30.695Z","install_count":null,"search_matches":[],"research_summary":null,"research_reviewed_at":null,"metadata":{"canonical_app_id":"asdk_app_6aea7be482bc8191a19ee6b24968802c","connector_id":"asdk_app_6aea7be482bc8191a19ee6b24968802c","created_at":"2026-11-04T02:07:42.894401Z","discoverability":"LISTED","id":"plugin_asdk_app_6aea7be482bc8191a19ee6b24968802c","is_template":false,"is_template_instance":false,"name":"vulkill-security-mcp","release":{"app_ids":["asdk_app_6aea7be482bc8191a19ee6b24968802c"],"app_manifest":{"apps":{"vulkill":{"id":"asdk_app_6aea7be482bc8191a19ee6b24968802c","required":true}}},"app_templates":[],"description":"Scan web applications, APIs, and codebases across 12 security domains with 3-Layer Impact Triage.","display_name":"VulKill Security","id":"pluginrel_787ed3de0ef88191af586898c73468ef","interface":{"brand_color":"#0B192C","capabilities":["Inspect 12 security domains (260+ controls)","Run authorized source-code and live website scans","Check credits and estimate scan coverage","Search capabilities and retrieve account scan reports"],"category":"Developer Tools","composer_icon_dark_url":"https://files.openai.com/content?id=file_0000000090bc820a82d31e99fdd53b48","composer_icon_url":"https://files.openai.com/content?id=file_00000000f1f0820ab9a5b6bbc8797bd1","default_prompt":null,"default_prompts":null,"developer_name":"GOKCE BARAN KARAKAMIS","logo_url":"https://files.openai.com/content?id=file_000000003378820abacdfdef1f60e4ce","logo_url_dark":"https://files.openai.com/content?id=file_000000002c58820aa95e505c8870025f","long_description":"VulKill inspects source codebases and verified live websites across 12 comprehensive security domains (260+ security controls): (1) Auth, Session & Access Control (IDOR/BOLA/BFLA/JWT/OAuth2/Multi-Tenant), (2) Business Logic, Payment/Wallet & Race Conditions (Double-Spend/TOCTOU), (3) Code Injection & RCE (SQLi, NoSQLi, Command Injection, XSS, SSTI, XXE), (4) Network, SSRF & File System (CSRF, CORS, Path Traversal, ZipSlip), (5) Leaked Secrets, API Keys & Git History, (6) Supply Chain, SCA/CVE & SBOM, (7) AI, LLM & MCP Agent Security (Prompt Injection, Tool Abuse), (8) Web3, Smart Contracts, Wallet Blind Signing & Cryptography, (9) Containers, Kubernetes, Cloud & IaC, (10) Mobile (APK/IPA) & Desktop (Electron/Tauri), (11) Deep AST Taint Tracking, Z3 Symbolic Proof & Binary Hardening, and (12) Live Website Security Testing + 3-Layer Real-World Impact Triage (False-Positive Elimination, Exploitability Proof & Copy-Paste Remediation Patch).\n\nConnect your own VulKill account, review the requested permissions, and inspect your credits before scanning. New members can complete membership and grant MCP access on one consent screen after signing in. Scan coverage depends on the supplied files, verified target, and selected mode; the completed report identifies the checks actually performed. Source-code scans require file contents, not a local path or repository URL alone. Live website scans require verified ownership and explicit authorization. Read-only planning and report tools do not start scans or spend credits.","plugin_category_id":"developer tools","privacy_policy_url":"https://vulkill.com/privacy","screenshot_urls":[],"short_description":"AI pentest&mobile&web&code","terms_of_service_url":"https://vulkill.com/terms","website_url":"https://vulkill.com"},"keywords":["security","appsec","dast","sast","vulnerability-scanner","devsecops"],"onboarding_skill_name":"get-started","requires_local_executor":false,"skills":[{"description":"Connect a VulKill account, inspect the security catalog and credits, and prepare authorized source-code or live website scans.","interface":{"brand_color":null,"default_prompt":null,"display_name":"get-started","icon_large_url":null,"icon_small_url":null,"iconography":"radar","short_description":"Connect a VulKill account, inspect the security catalog and credits, and prepare authorized source-code or live website scans."},"name":"get-started","plugin_release_skill_id":"pluginrsk_6aed47bb613c8191b4675b3c38603256"}],"version":"1.2.4"},"scope":"GLOBAL","status":"ENABLED"},"research":null,"package_metadata":{"name":"vulkill-security-mcp","author":{"url":"https://vulkill.com","name":"VulKill Security"},"license":"SEE LICENSE IN LICENSE.txt","sources":[{"path":"plugin.json","sha256":"a3126dabe5d995ee9172cf47b20c6b3d8261d9e3da8729676c4c3969d311f2af"}],"version":"1.2.4","commerce":true,"homepage":"https://vulkill.com","keywords":["security","appsec","dast","sast","vulnerability-scanner","devsecops"],"artifact_id":201407,"observed_at":"2026-11-10T12:10:02Z","support_url":"https://vulkill.com/#iletisim","capabilities":["Inspect 12 security domains (260+ controls)","Run authorized source-code and live website scans","Check credits and estimate scan coverage","Search capabilities and retrieve account scan reports"],"translations":{"tr-TR":{"subtitle":"AI pentest&mobile&web&code","description":"VulKill; kaynak kodlarını ve sahipliği doğrulanmış canlı web sitelerini 12 güvenlik alanında, 260’tan fazla kontrol kapsamında inceler: (1) kimlik doğrulama, oturum ve erişim; (2) iş mantığı, ödeme/cüzdan ve yarış koşulları; (3) kod enjeksiyonu ve uzaktan kod yürütme; (4) ağ, SSRF ve dosya sistemi; (5) sızan sırlar, API anahtarları ve Git geçmişi; (6) tedarik zinciri, SCA/CVE ve SBOM; (7) AI, LLM ve MCP ajan güvenliği; (8) Web3, akıllı sözleşmeler, cüzdan imzalama ve kriptografi; (9) konteyner, Kubernetes, bulut ve IaC; (10) mobil APK/IPA ve Electron/Tauri masaüstü uygulamaları; (11) AST veri akışı, Z3 sembolik kanıt ve ikili dosya güvenliği; (12) canlı web sitesi testi ve üç katmanlı gerçek etki değerlendirmesi. Tarama kapsamını gönderilen dosyalar, doğrulanmış hedef ve seçilen mod belirler; çalıştırılan kontroller raporda gösterilir. Yeni üyeler girişten sonra üyeliklerini ve MCP erişim iznini tek ekranda tamamlayabilir."}},"field_sources":{"name":0,"author":0,"license":0,"version":0,"commerce":0,"homepage":0,"keywords":0,"support_url":0,"capabilities":0,"translations":0,"release_notes":0,"onboarding_skill":0,"review_case_counts":0,"commerce_description":0},"release_notes":"Version 1.2.4: combines new VulKill membership and MCP consent after sign-in in all 21 site languages; refreshes the consent screen to match the app; adds the 12-domain Claude listing description; corrects review expectations for catalog queries, read-only estimates, authorized scanning, usage and search/fetch. Renames the read-only planning tool to vulkill_estimate_scan while preserving the previous name as a compatibility alias. OAuth endpoints and requested scopes are unchanged. Clarifies the existing commercial license for this SaaS client connector; the Community edition keeps its separate license.","onboarding_skill":"./skills/get-started/SKILL.md","extraction_version":1,"review_case_counts":{"negative":3,"positive":5},"conflicts_or_errors":[],"commerce_description":"VulKill is a subscription security-scanning service with prepaid scan credits. Customers purchase plans or additional credits through the external VulKill website and its Paddle checkout. This MCP plugin reads the connected account balance and consumes available credits only when an authorized scan is started. It does not expose checkout, fund-transfer or card-processing tools and does not collect payment-card details in ChatGPT."}}