MCP servers that ship as code — a repository or a package you install and run locally (usually over stdio). They have no hosted endpoint, so we cannot probe or grade them: instead each one shows its repository, install command, license, stars and when it was last updated.
Collected from GitHub repositories and npm, PyPI, Cargo, Go, Maven, NuGet and RubyGems packages tagged as MCP servers, the official MCP Registry, Docker's MCP catalog, ModelScope, Baidu MCP World, Cline and other public directories; one entry per repository. A server that also offers a hosted endpoint is listed under Remote instead. These entries are not counted in our reachability, verification or readiness statistics.
-
Unofficial MCP server for yamory vulnerability management. Enables AI agents and assistants to query yamory vulnerability intelligence for DevSecOps workflows.
MIT -
DevSecShield-Publicgithub.com/vartulzeroshieldai/DevSecShield-Publicupdated this year
DevSecShield is a unified, AI-powered Devsecops assistant designed to provide comprehensive security analysis across multiple dimensions of modern software development. From traditional application security to cutting-edge AI/ML systems, DevSec Shield delivers automated vulnerability detection and actionable remediation guidance.
★ 2 -
CYBERDUDEBIVASH® MCP Server – Zero-Trust AI Cybersecurity Command Center (Private Development) Production-grade autonomous AI agents for SOC, pentesting, malware analysis, threat intel & DevSecOps. © 2026 CYBERDUDEBIVASH – All Rights Reserved
NOASSERTION -
Azure-Cloud-Master-MCPgithub.com/AnuV6/Azure-Cloud-Master-MCPupdated this year
MCP server that acts as your Azure cloud engineer. Plans, provisions, analyzes, and optimizes Azure resources using az CLI with security, DevSecOps, and FinOps best practices.
-
mseep-ggmcpgithub.com/gitguardian/ggmcpupdated this year
MCP server for GitGuardian
pypi MIT -
hermes-shieldgithub.com/amurlaniakea/hermes-shieldupdated this year
Input sanitizer for AI agents — anti-prompt-injection shield
AGPL-3.0 ★ 1 -
waftestergithub.com/waftester/waftesterupdated this year
Professional WAF security testing toolkit
NOASSERTION ★ 14 -
secretsweepgithub.com/cognis-digital/secretsweepupdated this year
Repo secret scanner + auto-rotator across providers
NOASSERTION -
Let coding agents use your credentials without reading them
GPL-3.0 ★ 9 -
OSS license compliance auditor — AGPL contamination + NOTICE generation
NOASSERTION ★ 1 -
Dependency risk visualizer — Scorecard + OSV + typosquat + maintainer signals
NOASSERTION -
Cursor integration for Signetry: MCP server + project rule to govern coding-agent changes. Split from signetry-plugins.
Apache-2.0 -
Open-source MCP server for querying ZeroPath security issues, patches, and scans using Claude, Cursor, Windsurf, or any AI assistant.
MIT ★ 11 -
policy-pulse-mcpgithub.com/raviteja-pegata/policy-pulse-mcpupdated this year
Unified OPA/Gatekeeper, Kyverno, and Azure Policy MCP server
-
OpenAI Codex integration for Signetry: MCP server + lifecycle-hook guard to govern coding-agent changes. Split from signetry-plugins.
Apache-2.0 -
Self-hosted security scanner, autonomous pentest & QA agent, and production-readiness gate
AGPL-3.0 -
Catch CVEs, leaked secrets, and BTP misconfigurations in your MTA/CAP project before you deploy.
MIT -
vaktgithub.com/Vaktex/vaktactive
Open-source AST aware code scanner to find your app’s vulnerabilities.
NOASSERTION ★ 1 -
Local-first repository security and configuration audits: CLI, GitHub Action and MCP server
MIT -
shield-agent-mcpgithub.com/gbvk312/shield-agent-mcpupdated this year
The Hybrid-AI Security & Quality Sentinel for the MCP Era
MIT -
Security linter for environment variables, Docker, CI, Kubernetes, and runtime configuration.
MIT ★ 4 -
MCP server for the Shipshape API: Dockerfile and Kubernetes lint for coding agents.
MIT -
Adversarial Co-Generation Engine — concurrent Builder+Breaker agents for production-grade AI code security
MIT ★ 1 -
Policy-as-code enforcement for AI agents: MCP server, CEL policies, git hooks, SARIF, and static analysis guardrails.
AGPL-3.0 -
CyberLens AI MCP server for website, repository, and CLAW/OpenClaw skill security scanning from AI assistants.
MIT ★ 1 -
gadriel-claude-pluginsgithub.com/Gadriel-ai/gadriel-claude-pluginsupdated this year
Gadriel AI Security Harness plugins for Claude Code — local SAST, SCA/SBOM, secrets & OWASP LLM security scanning via MCP.
-
taskbounty-checkgithub.com/eliottreich/taskbounty-checkupdated this year
Local-only GitHub Actions and CI maintenance check for AI-built apps.
MIT ★ 2 -
coding-ethosgithub.com/paudley/coding-ethosupdated this year
Policy-as-code enforcement for AI agents with MCP, CEL, Git hooks, SARIF, and static-analysis guardrails.
pypi AGPL-3.0-only -
mcp-security-scannergithub.com/rohitdhamija/mcp-security-scannerupdated this year
A Model Context Protocol (MCP) server for automated security scanning and live validation of LLM API keys and cloud endpoints
MIT -
CI/CD supply-chain auditor — GH Actions / GitLab CI / OWASP CI/CD Top 10
NOASSERTION -
Gadriel AI Security Harness for Claude Code — local SAST, SCA/SBOM, secrets, container, config & OWASP LLM security scanner via MCP.
Apache-2.0 -
MCP server: scan text for leaked credentials before an agent commits it. Local-only, dependency-free.
MIT -
Scan open-source software packages against the Google OSV distributed vulnerability database for known CVEs. MCP Server & Python SDK.
MIT ★ 1 -
Connect Claude Code or Cursor to PreHack, the autonomous AI pentester. Device-code login, no API key.
Apache-2.0 -
Zero-dependency security auditor for Dockerfiles, compose files and .dockerignore — three passes, evidence-first, SARIF for CI.
MIT -
blackduck-polaris-mcp-servergithub.com/easygoingcoder/blackduck-polaris-mcp-serverupdated this year
Feature-rich MCP server for Black Duck Polaris — 66 tools for scan management, findings, reports, policies, and more
MIT ★ 1 -
Progmune-AI Trust Decision Engine — verify AI-generated code before it reaches production 让 AI 生成的代码可信任、可审计、可投产
MIT ★ 3 -
A Layered MCP-Based System for Automated Production Readiness and Deployment of Vibe-Coded Projects
MIT ★ 1 -
waf_mcpgithub.com/KratosUAE/waf_mcpupdated this year
MCP server for ModSecurity WAF — monitor events, analyze attacks, tune rules & whitelist IPs via AI assistants (Claude Code, Cursor, etc.)
MIT -
MCP server for AWS security auditing — IAM role/policy analysis and S3 Public Access Block scanning via Boto3.
MIT -
Gadriel AI Security Harness for OpenAI Codex — local MCP server and hooks for SAST, SCA/SBOM, secrets & OWASP LLM security scanning.
Apache-2.0 -
Gadriel AI Security Harness for Cursor — local MCP server, rules, and edit hooks for SAST, SCA/SBOM, secrets & OWASP LLM security scanning.
Apache-2.0 -
Gadriel AI Security Harness for VS Code — local SAST, SCA/SBOM, secrets, container, config & OWASP LLM security scanner and MCP server.
Apache-2.0 -
Gadriel AI Security Harness for GitHub Copilot — local MCP server, prompts, and instructions for SAST, SCA/SBOM, secrets & OWASP LLM security scanning.
Apache-2.0 ★ 2 -
domain-security-super-auditor-mcp-apigithub.com/deepakshe/domain-security-super-auditor-mcp-apiactive
Automated DNS, SPF, DMARC, DKIM, and SSL security posture auditor. Detect email spoofing risks & open relays. MCP Server & Python SDK.
MIT -
GitHub security posture audit tools for AI agents — organization, repository, Actions, secrets, supply chain analysis via MCP
npm MIT -
Security rules for AI coding agents: 681 rules, 21 platforms, MCP server, Claude Code plugin. Web, mobile, databases, cloud, AI, banking.
MIT -
Secrets for coding agents — both seekrit MCP servers plus the skills that keep API keys out of your agent transcript. One install.
npm MIT ★ 1 -
Scan and fix vulnerabilities in Python, JavaScript, TypeScript, Go, and Java code using AI-powered analysis with 200 built-in security rules.
MIT ★ 2 -
One scored audit of everything you ship: code, sites, apps, APIs, containers, IaC, cloud and mobile. CLI, CI and MCP for AI agents.
npm MIT ★ 1 -
Android manifest security audit: zero-dependency AXML reader, 40 rules over the surface another app can reach, byte offsets as evidence, SARIF + 7 MCP tools.
MIT -
saltcodegithub.com/Secful/saltcodeupdated this year
Give your coding assistant security super powers with Salt Code. Secure code with every prompt and a much quieter security team.
MIT ★ 1 -
Atalaia watches public vulnerability feeds, filters them against the technologies you ship, and tells you which of your repositories each finding reaches
MIT -
Self-hosted application security platform: SAST, DAST and SCA with AI false-positive validation. OWASP Top 10/CWE mapping, SBOM export, CI/CD integrations and MCP server.
MIT ★ 1 -
Know what changed inside your Electron release: diff two builds for IPC, preload, windows, fuses and hosts, with file:line. CLI, CI gate, MCP server.
npm MIT ★ 10 -
MCP security scanner — source code audit with 25+ Semgrep rules, config health checks, SARIF output for CI/CD
pypi MIT -
github-security-mcpgithub.com/badchars/github-security-mcpupdated this year
GitHub security posture analysis for AI agents — 39 MCP tools, 45 checks across org, repos, Actions, secrets, supply chain, and access control
npm MIT ★ 15 -
Just Another Vulnerability Viewer - Kubernetes-runtime-native vulnerability triage, dashboards, and CSV reporting for Trivy and Grype scans, with an MCP endpoint for AI agents.
NOASSERTION ★ 10 -
leakrank-guardgithub.com/ProtoTeemo/leakrank-guardupdated this year
Scans code changes for leaked secrets and insecure config, with actionable fixes for AI agents. MCP server, docs for the leakrank-guard npm package.
MIT -
Deterministic CI/CD gate and native MCP server to block AI coding agents from slopsquatting, breaking architecture, and bypassing linters.
MIT