SABBA - Security Templates CLI & MCP Server for coding agents that prove every finding by running it
Security Templates CLI & MCP Server for coding agents that prove every finding by running it. Claude Code, Codex, OpenCode, Cursor, and Hermes call Sabba to prove a change, find and prove bugs, vet a skill, and drive the security toolchain — authorized-scope-only. If it does not run, Sabba does not report it.
Most tools that use a language model ask it "is this function vulnerable?" That is close to a coin flip, even for large models, and unverified guesses bury maintainers in false positives. Sabba takes the opposite stance: a model proposes candidates, but an execution oracle runs an exploit and decides whether a security property actually broke. Nothing is reported unless the exploit reproduces. A finding is not a score, it is a re-runnable proof.
Sabba runs as an MCP server, so Claude Code, Codex, OpenCode, Cursor, and Hermes can call it. For Codex CLI, add it to ~/.codex/config.toml:
Fourteen tools, most token-free: verifychange (prove a change works in any of 16 languages: a new test fails on the base and passes on the head, via the bundled Magga engine) and prove (the same differential, run natively for C/C++/EVM), verify / solve / hunt / scan (find and prove bugs), securityscan (vet a skill by running it under observation), rank, runsandboxed, and kalirun (drive nmap / nuclei / ffuf / sqlmap and the rest, scope-enforced and sandboxed). Install the security command templates with sabba templates install. Full catalog and per-client configs in docs/AGENTINTEGRATION.md.
From the project README.
Add the radar badge to your README — it shows your project was picked up by MCP Radar and links to this page:
[](https://mcp.liqiwa.com/s/8NobleTruths--sabba.html)
Turn scattered notes, docs and transcripts into a queryable Markdown wiki — an LLM knowledge-base compiler with MCP access, no embeddings, self-hosted.
alxgntv/substack-api-mcpMCP server for Substack posts (FastMCP + substack-api-client)
sm18lr88/STT-MCPFast, local speech-to-text MCP server
simonw/mcp-explorerCLI tool for exploring an MCP server
sandeepbazar/ocm-mcp-serverAn MCP server that lets AI agents operate a multi-cluster Kubernetes fleet through an Open Cluster Management hub, with policy, approval, and audit between the model and your clusters.
Vladimir-Human/ru-marketplace-mcpДевять российских маркетплейсов и китайский Taobao как MCP-серверы: Wildberries, Ozon, Яндекс Маркет, Детский мир, Авито, Мегамаркет, Lamoda, DNS, Ситилинк. Плюс сравнение цен по всем сразу. Только чт
The top new MCP servers of the week, every Monday. No spam, unsubscribe anytime.