Security Scanner for Agent Skills and MCP
Finally a security linter for MCP configs before you accidentally execute a prompt injection payload.
AI-powered receipt scanning & bookkeeping skill for OpenClaw/Claude Code. Automates renaming and CSV logging.
I’m an indie dev, and as my tech stack grew, so did the number of SaaS subscriptions and invoices. Every month, I’d get a chaotic pile of PDFs and image receipts. I absolutely hate bookkeeping. It breaks my flow state, and honestly, the last thing I want to do on a weekend is open an Excel spreadsheet to manually input tax data.
So I built Recite. Originally, it was just a simple web app that used vision models to parse receipts into clean CSV. But I realized I didn't even want to log into my own web app.
So I pivoted and turned it into a Public APIs/agent skill and an MCP server. Now, I just download all my invoices into a single local folder and tell my agent (I use OpenClaw), "Process my receipts."
The agent hits the Recite API, reads the images/PDFs, categorizes them using standard accounting logic, renames the files by date, and generates a structured CSV for me. I literally don't look at spreadsheets anymore.
How to use it:
Public API: Because we all love APIs. Agent Skill: The easiest way to let your agent do the work in environments like OpenClaw or Claude Desktop. MCP Server: If you want more control and want to build your own custom agentic workflows.
I’m currently focused on maxing out accuracy and keeping costs as close to zero as possible. There’s a generous free tier for indie devs because I know the pain.
I would love for you to try hooking it up to your agents and see if it saves you as much time as it saves me. Any feedback on the API or the categorization logic is highly appreciated!
Website: https://recite.rivra.dev/
API Docs: https://recite.rivra.dev/docs/api
MCP Setup: https://recite.rivra.dev/help#mcp-server
GitHub Skill: https://github.com/rivradev/recite-agent-skill
Finally a security linter for MCP configs before you accidentally execute a prompt injection payload.
Makes agent configs first-class with 229 domain-specific rules, autofix, and LSP support — so a tiny syntax mistake stops being a silent failure. The cross-editor plugins and GitHub Action are the standout moves: lint in your IDE and enforce checks in CI. I want a clearer map of which rules target which toolchains, but the breadth of integrations is impressive.
Git-native prompt versioning with Crucible evaluation, but only 1 star on GitHub.
Syncs MCP configs across Cursor, Copilot, Claude—but still fragmented tool ecosystem.
Semgrep for AI agents—138 rules, offline, catches obfuscated attacks other scanners miss.
SCA for agent configs when Snyk and Dependabot can't read mcp.json files.