---
title: "secure-code-guardian"
description: "Security guardrails for AI agents: blocks destructive commands and secret access with hooks, scans for secrets and vulnerable dependencies (OSV.dev) via MCP, and adds a security-reviewer agent and threat-model skill."
canonical: https://agentpluginsdirectory.com/plugins/secure-code-guardian
last-updated: 2026-11-07
---

# secure-code-guardian
Security guardrails for AI agents: blocks destructive commands and secret access with hooks, scans for secrets and vulnerable dependencies (OSV.dev) via MCP, and adds a security-reviewer agent and threat-model skill.
- Slug: secure-code-guardian
- Publisher: sekar3s
- Repository: https://github.com/sekar3s/copilot-agent-plugins-demo
- Manifest: plugins/secure-code-guardian/plugin.json
- Version: 1.1.0
- License: MIT
- Category (editorial): other
- Skills: 1 (threat-model)
- MCP servers: 1 (guardian)
- Stars: 0
- Repository created: 2026-09-29
- Repository last pushed: 2026-09-29
- Publisher type: User
- Listing: https://agentpluginsdirectory.com/plugins/secure-code-guardian
- Schema: https://agent-plugins.org/schemas/1.0.0/plugin.schema.json

## What secure-code-guardian does, in the publisher's words

Security guardrails that travel with the developer: a hook that blocks dangerous agent actions before they happen, an MCP server that finds secrets and vulnerable dependencies, a read-only security-reviewer agent, and a threat-model skill.

From the project README, punctuation lightly normalized. Full text: https://raw.githubusercontent.com/sekar3s/copilot-agent-plugins-demo/HEAD/plugins/secure-code-guardian/README.md

## Skills

- threat-model: Produce a lightweight STRIDE threat model for an application, service or feature, data-flow diagram (Mermaid), trust boundaries, threats with risk ratings and concrete mitigations. Use when asked for a threat model, security design review, attack surface analysis, or "what could go wrong" for a sys…

Descriptions come from the frontmatter of each SKILL.md, punctuation lightly normalized.

## MCP servers

- guardian: transport: stdio; command: node ${PLUGIN_ROOT}/mcp/server.mjs

Read from the plugin's own mcp.json. Environment variable names only, never values.