Plango

Plango reads the source code of MCP servers, agent skills, agent plugins, GitHub repos and npm packages, and tells you how safe they are to install.

Ask "is this safe?" with a GitHub link, an npm package name or an install command. If Plango has already reviewed the project, you get its report: a grade from A+ (best) to F, what the code can reach on your computer, and each finding with its file and line. If the project is new, Plango can download the public source, review it, and return the report. Small projects take about a minute. Plango never runs the code.

Plango also looks up CVEs: one CVE by its id, or the known vulnerabilities of a product such as an AI coding agent or an MCP server. The data comes from the US National Vulnerability Database and covers every CVE that affects AI agents and their tools, and every CVE published this year.

Limits: Plango reads public GitHub repos and public npm packages only. It cannot see your computer, your private repos or your accounts. A grade is an automated review of the source at one revision. It is evidence, not a guarantee.