MCP servers that ship as code — a repository or a package you install and run locally (usually over stdio). They have no hosted endpoint, so we cannot probe or grade them: instead each one shows its repository, install command, license, stars and when it was last updated.
Collected from GitHub repositories and npm, PyPI, Cargo, Go, Maven, NuGet and RubyGems packages tagged as MCP servers, the official MCP Registry, Docker's MCP catalog, ModelScope, Baidu MCP World, Cline and other public directories; one entry per repository. A server that also offers a hosted endpoint is listed under Remote instead. These entries are not counted in our reachability, verification or readiness statistics.
-
AST-based Python obfuscator with reverse stack-trace mapping — obfuscate before shipping and keep production tracebacks AI-debuggable. MCP + VS Code.
pypi Apache-2.0 ★ 11 -
sentinel-aigithub.com/MaxwellCalkin/sentinel-aiupdated this year
Real-time AI safety guardrails for LLM apps. 10 scanners: prompt injection, PII, harmful content, code vulnerabilities, obfuscation detection. Sub-ms latency. Python + TypeScript SDKs. MCP proxy. Claude Code hooks.
Apache-2.0 ★ 27 -
tiamat-scanner-mcpgithub.com/toxfox69/tiamat-entityupdated this year
MCP server for supply chain package scanning — detects typosquatting, malicious install scripts, obfuscation, and dependency confusion in npm/PyPI packages. Works with Claude Code, Cline, and any MCP client.
npm MIT -
Is this GitHub repo safe for my AI coding agent to run? Free check for iwr|iex / curl|sh one-liners, obfuscated payloads, typosquatted deps, VS Code autorun and fake stars. CLI + MCP + x402 API.
MIT -
Protect your shipped JS from AI reverse-engineering. REA can reverse-engineer your app; REAShield returns nothing. Measured against the real REA (6 → 0 on a sample app). Not unbreakable.
MIT ★ 2