TOPY.AI · AI CSO

Name: TOPY.AI · AI CSO
Author: TOPY-AI-LTD

by TOPY-AI-LTDversion 0.1.0i★ –iComputer or cloud

Registry nameai.topy/cso

Install

Overview

Description from the maker (original English)

Founders' AI CSO: vulnerabilities, dependencies, secrets, verified-site checks, threat model, fixes.

PopNx MCP’s three pillars

These three are never merged into one score: opinions, measurements and popularity are different things.

User voiceiNo reviews yetReviews open together with accounts in a later step
Our basic checksi1 of 1 passedChecked from public information; code not scanned yet
UsageiNot measured yet★ –

What you can do with it

We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.

Connection: Computer or cloud
Transport: stdio, Streamable HTTP
Category: Other
You need to fill in: TOPY_API_KEY

Install

Pick the AI app you use, then copy the settings.

Before you install

Basic checks: 1 of 1 passed
Runs on the maker’s server: what you ask it goes through their server.
You fill in yourself: TOPY_API_KEY

Values marked secret are keys to your account. Never share them or paste them into a chat.

You need

Runs in the cloudNothing to install; it connects over the internet
npmNode.js installed (for the npx command)

Which app do you use?

ClaudeClaude CodeCursorVS CodeChatGPT

Pick your app above. We remember it, so next time the button says “Install in …”.

Works in Claude on the web, desktop and mobile:

Open Settings → Connectors
Press Add custom connector
Paste the address below and press Add
If it asks you to sign in, sign in with the maker

https://topy.ai/mcp/cso

Or run it on your computer

Open Claude Desktop → Settings → Developer → Edit Config, and paste this into claude_desktop_config.json

{
  "mcpServers": {
    "cso": {
      "command": "npx",
      "args": [
        "-y",
        "@topy-ai/cso-mcp"
      ],
      "env": {
        "TOPY_API_KEY": "your-value"
      }
    }
  }
}

Run this in your terminal

claude mcp add --transport http cso https://topy.ai/mcp/cso

Or run it on your computer

claude mcp add cso --env TOPY_API_KEY=your-value -- npx -y @topy-ai/cso-mcp

Fill in the empty values before running it.

Open in Cursor

Or copy the settings yourself

Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json

{
  "mcpServers": {
    "cso": {
      "url": "https://topy.ai/mcp/cso"
    }
  }
}

Or run it on your computer

Open in Cursor

Or copy the settings yourself

Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json

{
  "mcpServers": {
    "cso": {
      "command": "npx",
      "args": [
        "-y",
        "@topy-ai/cso-mcp"
      ],
      "env": {
        "TOPY_API_KEY": "your-value"
      }
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

Open in VS Code

Or copy the settings yourself

Paste into .vscode/mcp.json in your project

{
  "servers": {
    "cso": {
      "type": "http",
      "url": "https://topy.ai/mcp/cso"
    }
  }
}

Or run it on your computer

Open in VS Code

Or copy the settings yourself

Paste into .vscode/mcp.json in your project

{
  "servers": {
    "cso": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "@topy-ai/cso-mcp"
      ],
      "env": {
        "TOPY_API_KEY": "your-value"
      }
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

ChatGPT connects only to servers on the internet:

Open ChatGPT on the web → Settings → Connectors (Apps)
Press Create or Add (some plans need Developer mode under Advanced first)
Paste the address below, give it a name and save
If it asks you to sign in, sign in with the maker

https://topy.ai/mcp/cso

Menu names can differ slightly by plan and over time.

Your choice stays on this device in a cookie; no account needed.

Values you fill in

TOPY_API_KEY secret env
A TOPY API key (Dashboard → API keys); or run `npx @topy-ai/cso-mcp login` once instead.

These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.

What it can do

We have not read this server’s tool list yet; we check endpoints in rotation.

Basic checksi

We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 6, 2026

✓ Pass
Maker matches the repo
The registry name was verified against the domain topy.ai (the registry checks domain ownership)
… Not checked yet
Still maintained
We have not read this repo from GitHub yet
… Not checked yet
Has a licence
We have not read this repo from GitHub yet
… Not checked yet
Endpoint responds
Not checked yet; we check endpoints in rotation
… Not checked yet
Sign-in with OAuth
Not checked yet; we check endpoints in rotation
… Not checked yet
No hidden instructions in tool descriptions
Not checked yet; we read the tool list when we check the endpoint

Compared with others in Otheri

More stars than 0% of the other 32464 servers in this category
Published to the registry more recently than 77% of the other 32464 servers in this category
Basic checks equal to or better than 100% of the other 32464 servers in this category

Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.

Common questions

Is TOPY.AI · AI CSO safe?

It passed 1 of 1 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.

What keys or codes does it need?

You need to fill in: TOPY_API_KEY

Does it run on my computer or in the cloud?

Either way works: install it on your computer or connect to the cloud version.

Is it still maintained?

The GitHub repo last changed –, and the latest version (0.1.0) reached the registry 10 days ago.

Which apps can use it?

Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. It connects by URL, so apps that accept remote MCP servers work too, such as ChatGPT in developer mode.

What can I use instead?

In the same category: Spec Driven Development, Remote Desktop Commander, yontu

Alternatives

Servers in the same category from other makers, sorted by stars.

Reading a card:★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi

Spec Driven Development

by formulahendry

MCP Server that facilitates spec-driven development workflows, not just Vibe Coding.

Runs on your computer★ 440MITUpdated 14 months ago

Install

Remote Desktop Commander

by desktop-commander

Remote Desktop Commander: use files, terminal and processes on your own computers from any AI app.

Runs in the cloud★ 211Updated yesterday

Install

yontu

by senrecep

Türkçe yazı denetimi: TDK kuralları, yapay zekâ izleri, metin türüne göre üslup.

Runs on your computerUpdated today

Install

README from the maker

Open the README

Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.

TOPY AI CSO Skills 19 skills that make your coding agent a small company's AI CSO: new CVEs and end-of-life dates for everything you run, no secrets in code, headers, TLS and safe scans of the domains you have verified, every skill and MCP server vetted before it is trusted, incident timelines and a weekly security report to the founder and the CEO — on the TOPY.AI CSO MCP server.

The AI CSO is goal-first. It keeps five standing goals — no open critical exposure (anything on CISA KEV or critical with a fix is fixed within days), zero secrets in code, verified-only active checks, nothing trusted unvetted (every new skill, MCP server and package checked first) and every incident with a timeline — and every skill below exists to move one of them.

Core (topy-ai-cso): connect, first setup (inventory, domain verification, host consent), the CSO's goals, the daily watch.
Vulnerabilities: are we affected by this CVE, dependencies and supply chain, end of life, vetting a package before install.
Code: secrets (rotate first, then remove), unsafe code patterns, a STRIDE threat model and the OWASP ASVS checklist.
Web: domain verification, headers and TLS, a safe scan of a verified site.
Agents: vet a skill or MCP server before it is installed (the App Factory gate), and audit your own MCP server.
Response: incident timelines, a fix plan with fix-risk tiers T1–T4, the weekly security report.

The safety model comes from Maggie Security and does not bend: the CSO never changes a server, firewall or website (fix and protection plans are for a person to review and apply), never scans a domain you have not verified, reads a server only after you grant consent yourself, by your own approval in the chat (an agent cannot), leaves checks of sites you don't control to a person (never a routine), never uses offensive techniques and never prints a secret. Changes take two calls — a preview, then your yes.

Install

npx @topy-ai/cso-skills install                  # this project, for the agents set up here

npx @topy-ai/cso-skills install -g --mcp # your user, plus the MCP server npx @topy-ai/cso-skills install --category vulnerabilities,web npx @topy-ai/cso-skills list

Claude Code plugins: /plugin marketplace add TOPY-AI-LTD/TOPY-AI-CSO-Skills, then /plugin install topy-ai-cso-all@topy-ai-cso. Codex: codex plugin marketplace add TOPY-AI-LTD/TOPY-AI-CSO-Skills. Pi: pi install npm:@topy-ai/cso-skills. See the installer README.

Connect TOPY.AI

https://topy.ai/mcp/cso — OAuth with your TOPY.AI account (the same one as the AI CEO, CFO and COO). Only the accounts that own the OneMan operation see its findings.

Client	How
Claude, ChatGPT (web, desktop)	custom connector `https://topy.ai/mcp/cso`
Claude Code	`claude mcp add --transport http topy-cso https://topy.ai/mcp/cso`
Codex	`codex mcp add topy-cso --url https://topy.ai/mcp/cso`
Clients that only start a command	`npx -y @topy-ai/cso-mcp` after `npx @topy-ai/cso-mcp login`
Terminal and scripts	`npm i -g @topy-ai/cso-cli && cso-cli login`

Server checks (host-quick, host-audit) and passive checks of sites you don't control (public-check) are not on topy.ai: they need a person on OneMan, with host consent granted by the person's own approval in the chat.

How the skills fit together

topy-cso-connect ─▶ topy-cso-setup (inventory · domain verify · consent) ─▶ topy-cso-goals

│ daily 06:17: topy-cso-daily-watch ─▶ topy-cso-cve-response ─▶ topy-cso-incident ─▶ topy-cso-fix-plan │ topy-cso-dependencies · topy-cso-end-of-life weekly Mon 07:23: topy-cso-weekly-report ─▶ the founder (email) and the CEO │ before code ships: topy-cso-secrets · topy-cso-code-scan · topy-cso-threat-model web (verified domains): topy-cso-domain-verify ─▶ topy-cso-web-checks ─▶ topy-cso-web-scan before you trust it: topy-cso-package-vet · topy-cso-vet-skill · topy-cso-mcp-audit

Try: *"Anything new I should worry about?"*, *"Are we affected by CVE-2026-…?"*, *"Did a key leak?"*, *"Is this MCP server safe to install?"*, *"Send the weekly security report"*

Packages

Package	What it is
`@topy-ai/cso-skills`	This installer (Claude Code, Codex, Pi, Cursor, Gemini CLI, …)
`@topy-ai/cso-mcp`	The CSO MCP server as a local stdio server (forwards to `https://topy.ai/mcp/cso`)
`@topy-ai/cso-cli`	The AI CSO on the command line

Repository structure

plugins/

topy-ai-cso/ core skills + .mcp.json (Claude Code) and mcp.json (Codex) topy-ai-cso-vulnerabilities/ topy-ai-cso-code/ topy-ai-cso-web/ topy-ai-cso-agents/ topy-ai-cso-response/ topy-ai-cso-all/ bundle that depends on all six .claude-plugin/marketplace.json Claude Code marketplace .agents/plugins/marketplace.json Codex marketplace skills.json machine-readable catalogue packages/skills/ the @topy-ai/cso-skills installer

The skills are generated from a source catalogue kept next to TOPY.AI's MCP server; the build checks every tool a skill names against the CSO server's tool list. Please open an issue rather than editing a SKILL.md.

License

Skills

19 skills in 6 plugins, plus the topy-ai-cso-all bundle. Generated from the source catalogue: please open an issue rather than editing a SKILL.md.

AI CSO core (MCP) · `topy-ai-cso`

Skill	Tier	What it does
`topy-cso-connect`	core	Connect the TOPY CSO MCP server and check what applies: the project's stack, verified domains, granted hosts, tools and feeds.
`topy-cso-daily-watch`	core	Every morning: new CVEs, advisories and end-of-life dates for everything the company runs, matched to the stack — quiet unless something new needs a person.
`topy-cso-goals`	core	The AI CSO's standing goals and its status report for the CEO: open critical exposure, secrets in code, verified-only checks, vetted skills and MCP servers, incident timelines.
`topy-cso-setup`	core	First run for a new company or site: inventory the stack, verify each domain you own, and explain host consent — so every later check is allowed and complete.

Vulnerabilities & supply chain · `topy-ai-cso-vulnerabilities`

Skill	Tier	What it does
`topy-cso-cve-response`	connected	A named CVE or advisory: are we affected, where, how urgent, and the response plan — with an incident timeline from start to close.
`topy-cso-dependencies`	connected	Known vulnerabilities in every lockfile ecosystem and in JavaScript copied into the site, prioritised, with the fixed versions.
`topy-cso-end-of-life`	connected	Runtimes, databases, web servers and operating systems that stopped (or will soon stop) getting security fixes, and what to upgrade to.
`topy-cso-package-vet`	connected	Before adding a package: known vulnerabilities and malicious-package reports for that exact version, and a clear install / pin / don't install.

Code & secrets · `topy-ai-cso-code`

Skill	Tier	What it does
`topy-cso-code-scan`	connected	Unsafe code patterns before they ship — injection, unsafe deserialisation, personal data in logs, weak crypto — with the safe pattern for each.
`topy-cso-secrets`	connected	Keys, tokens and passwords in the code, its git history and the build output — and the rotate-first fix for each.
`topy-cso-threat-model`	connected	A STRIDE threat model of the system and an OWASP ASVS checklist filled from the findings — what could go wrong and how far we meet the standard.

Web surface · `topy-ai-cso-web`

Skill	Tier	What it does
`topy-cso-domain-verify`	connected	Prove the company controls a domain (DNS TXT record or a token file) before any active check — the CSO never scans a site that isn't verified.
`topy-cso-web-checks`	connected	Grade a verified site's HTTP security headers and cookies (A+ to F) and its TLS (protocols, certificate trust and expiry), with the exact fix for each.
`topy-cso-web-scan`	connected	A safe, rate-limited vulnerability scan (known flaws, exposed files, misconfigurations) of a site the company has verified — never exploitation.

Agent & MCP security · `topy-ai-cso-agents`

Skill	Tier	What it does
`topy-cso-mcp-audit`	connected	OWASP MCP checks on the company's own MCP tool registry: read-only hints, destructive tools behind confirmation, scopes, audit logging and hosts it may call.
`topy-cso-vet-skill`	connected	Before a skill, plugin or MCP server is installed or published: prompt-injection, data exfiltration, over-broad permissions and risky tools — the App Factory security gate.

Response & reporting · `topy-ai-cso-response`

Skill	Tier	What it does
`topy-cso-fix-plan`	connected	Turn the findings into a reviewed runbook — each action tagged T1 (batch-safe) to T4 (stage first) — that a person reviews and runs. The CSO never applies it.
`topy-cso-incident`	connected	Record a security incident or CVE response from start to close — what happened, every step and who did it — so nothing is lost and the report writes itself.
`topy-cso-weekly-report`	connected	Every Monday: what is open by priority, what was fixed, what changed in the stack, and at most three actions — for the Founder by email and for the CEO.

TOPY.AI · AI CSO

Overview

PopNx MCP’s three pillars

What you can do with it

Install

Before you install

Or run it on your computer

Or run it on your computer

Or run it on your computer

Or run it on your computer

Values you fill in

What it can do

Basic checksi

Maker matches the repo

Still maintained

Has a licence

Endpoint responds

Sign-in with OAuth

No hidden instructions in tool descriptions

Compared with others in Otheri

Common questions

Alternatives

Spec Driven Development

Remote Desktop Commander

yontu

README from the maker

Install

Connect TOPY.AI

How the skills fit together

Packages

Repository structure

License

Skills

AI CSO core (MCP) · topy-ai-cso

Vulnerabilities & supply chain · topy-ai-cso-vulnerabilities

Code & secrets · topy-ai-cso-code

Web surface · topy-ai-cso-web

Agent & MCP security · topy-ai-cso-agents

Response & reporting · topy-ai-cso-response

AI CSO core (MCP) · `topy-ai-cso`

Vulnerabilities & supply chain · `topy-ai-cso-vulnerabilities`

Code & secrets · `topy-ai-cso-code`

Web surface · `topy-ai-cso-web`

Agent & MCP security · `topy-ai-cso-agents`

Response & reporting · `topy-ai-cso-response`