ChatGPT plugins for Security
75 plugins, apps and MCP servers in Security, ranked by official status, traction and completeness. Page 1 of 2.
The Security category serves two different groups. Everyday users paste in a suspicious text, email, phone number or link and ask whether it's a scam; Malwarebytes, McAfee, Norton, Guardio and Bitdefender all have apps for that, and some also check whether your email appears in known data breaches. Developers and security teams use plugins and MCP servers to scan code, audit dependencies, find leaked secrets and administer identity systems such as Okta and Auth0.
The type matters here. Scam checkers are apps you can use in any ChatGPT chat. Code scanning is mostly a Codex job: OpenAI's Codex Security plugin bundles skills for scans, threat models and fix verification, and the Semgrep and Snyk MCP servers run on your machine through their own CLIs. Community plugins, such as Trail of Bits' auditing skills, install from a third-party marketplace and don't go through OpenAI's directory review.
Before you connect a security tool:
- Know what leaves your machine. VirusTotal says standard submissions may be available to its security community and partners, so don't upload personal documents or internal code.
- Watch admin-level write tools. The Okta server can create and deactivate users, and the Vanta app can create and delete policies.
- Read results as evidence, not a guarantee. VirusTotal and Guardio both say a clean result doesn't prove that something is safe.
Top picks for Security
OpenAI's security plugin for Codex: repository and diff scans, deep scans, threat modeling, finding triage, fix proposals with verification, and vulnerability write-ups. The most complete option for developers who already work in Codex; it can also track findings in Linear, Jira or GitHub issues.
Runs Semgrep's static analysis on code your agent writes or edits, and can scan with custom rules you describe. It is built into the
semgrepbinary (semgrep mcp) and runs locally; pulling findings from the Semgrep AppSec Platform needs authentication.Looks up supply-chain security and quality scores for packages before you install them, and reads your organization's Socket alerts. The hosted server signs in with OAuth, so there is no API key to manage.
Checks links, domains, emails and phone numbers before you click, call or reply, and returns reputation, ownership and risk details. A simple way for anyone to sanity-check a suspicious message without leaving ChatGPT.
Investigates files, URLs, domains and IP addresses against VirusTotal's threat intelligence and explains the detections. It signs in with Google through VirusTotal AI, with no API key; files and URLs you submit may be shared with VirusTotal's community, so only submit what you're allowed to share.
All 75 in Security
Security plugins: common questions
- Can ChatGPT check if a link or message is a scam?
Yes, with a security app. Malwarebytes checks links, domains, emails and phone numbers. McAfee and Norton analyze suspicious emails, texts and messages, and Guardio can check links without sending the message body to Guardio. Treat the answer as one signal: these services report known threats, and a clean result doesn't guarantee a link is safe. Never type in codes or passwords a suspicious message asks for.
- Can ChatGPT scan my code for security vulnerabilities?
Yes, mostly through Codex. OpenAI's Codex Security plugin runs repository and diff scans, builds threat models and verifies fixes. The Semgrep and Snyk MCP servers run their scanners locally; Snyk covers code, dependencies, infrastructure as code and containers. GitGuardian finds hardcoded secrets before you push. See Use plugins and MCP servers in Codex for setup.
- Can ChatGPT check if my email was in a data breach?
Some apps can. Guardio checks whether an email address or phone number appears in known breaches, without revealing leaked passwords. LeakData checks the verified email on your LeakData account and lists breach sources, dates and affected data types. Bitdefender includes a digital footprint checker. Never paste a password into the chat; LeakData's own listing warns against sharing a password or full hash.
- Are ChatGPT plugins and MCP servers safe to use?
Public plugins in the Plugin Directory go through OpenAI's review; MCP servers you add yourself and plugins from community marketplaces don't. Check the publisher, the account access each one asks for, which tools can change data, and where your data goes. Keep write actions on confirmation. Our security checklist covers each step, with red flags to watch for.
Guide updated Oct 24, 2026.