MCP servers that ship as code — a repository or a package you install and run locally (usually over stdio). They have no hosted endpoint, so we cannot probe or grade them: instead each one shows its repository, install command, license, stars and when it was last updated.
Collected from GitHub repositories and npm, PyPI, Cargo, Go, Maven, NuGet and RubyGems packages tagged as MCP servers, the official MCP Registry, Docker's MCP catalog, ModelScope, Baidu MCP World, Cline and other public directories; one entry per repository. A server that also offers a hosted endpoint is listed under Remote instead. These entries are not counted in our reachability, verification or readiness statistics.
-
Policy-as-code enforcement for AI agents: MCP server, CEL policies, git hooks, SARIF, and static analysis guardrails.
AGPL-3.0 -
IAM Policy Autopilot is an open source static code analysis tool that helps you quickly create baseline AWS IAM policies that you can refine as your application evolves. This tool is available as a command-line utility and MCP server for use within AI coding assistants for quickly building IAM policies.
Apache-2.0 ★ 505 -
An open source Model Context Protocol (MCP) server and command-line tool that helps your AI coding assistants quickly create baseline IAM policies that you can refine as your application evolves, so you can build faster. IAM Policy Autopilot analyzes your application code locally to generate identity-based policies for application roles, enabling faster IAM policy creation and reducing access troubleshooting time. IAM Policy Autopilot supports applications built in Python, Go, TypeScript, and Java.
pypi Apache-2.0 -
The official Axorum MCP server — exposes the Axorum agent plane as MCP tools, so any MCP-capable agent becomes a policy-governed spender with no integration code.
npm Apache-2.0 -
coding-ethosgithub.com/paudley/coding-ethosupdated this year
Policy-as-code enforcement for AI agents with MCP, CEL, Git hooks, SARIF, and static-analysis guardrails.
pypi AGPL-3.0-only -
constraints-registrygithub.com/SureshKhemka/constraints-registryupdated this year
MCP server giving AI coding agents (Claude Code, Cursor, Codex) a queryable source of engineering constraints — policy-as-code guardrails for AI-generated code, backed by OPA, Conftest, Checkov & Semgrep.
Apache-2.0 -
policy-pulse-mcpgithub.com/raviteja-pegata/policy-pulse-mcpupdated this year
Unified OPA/Gatekeeper, Kyverno, and Azure Policy MCP server
-
Free, open-source SOC 2 policy generator: 22 policy templates rendered from a 23-question intake. CLI + templates. Apache-2.0.
npm Apache-2.0 ★ 1 -
Free, offline SOC 2 policy generator. Renders 22 governance policy templates from a YAML intake file. Apache-2.0, no LLM, no signup.
npm Apache-2.0 -
MCP server for interacting with Turbot Guardrails.
npm Apache-2.0 -
closegategithub.com/esploro-group/closegateupdated this year
The policy chokepoint for finance AI agents.
Apache-2.0 -
Check proposed agent actions against explicit policy and evidence with a local validator, GitHub Action, and MCP server.
npm Apache-2.0 ★ 1 -
constraints-registrygithub.com/sureshkhemka/constraints-registryupdated this year
Constraint Registry V0 — a queryable source of engineering constraints exposed over MCP.
pypi Apache Software License -
bouncer — static compliance-controls checker (UK Online Safety Act & ICO Children's Code) as deterministic rule packs. CLI + MCP. No LLM.
npm MIT ★ 1 -
Compare API policies and saved MCP catalogs with Gooo. Offline CLIs, service-grant MCP tools, and replayable results.
BSD-3-Clause ★ 1 -
Independent security verification for code written by humans and AI agents. Scan, repair, then prove it — Dvalin runs your project's own checks and issues a Verified Fix Record anyone can re-derive offline. Local-first, policy-bound, MIT.
npm MIT ★ 121 -
bouncer — static compliance-controls checker. Verifies the controls a regulation requires actually exist in your code (UK Online Safety Act, ICO Children's Code), as deterministic rule packs. No LLM required.
npm MIT -
liminate-mcpgithub.com/rmichaelthomas/liminate-mcpupdated this year
Help your AI agent author the Agreements that govern it.
Apache-2.0 -
Read-only Kubernetes and AWS access for AI agents, behind a deny-by-default policy gate with a JSONL audit trail and eval suites that score both per-call block rate and whole-trajectory behaviour.
MIT -
Resolver-posture checks for MCP hosts, agents, CLI and CI. Local-first, read-only and privacy-first.
NOASSERTION -
Check public ECZ-ID Resolver posture from the CLI, CI or an MCP host. Local-first, privacy-first: classifies a target, checks its public ECZ-ID Resolver posture where available, reports, explains and routes. Never inspects artifact contents, writes truth,
npm SEE LICENSE IN LICENSE.md -
The safety gate between AI agents and your servers. An MCP server for structured, policy-checked, audited infrastructure operations.
MIT ★ 1 -
GESF MCP Server - AI Compliance Assistant for GDPR, OWASP, NIST, CIS. Check compliance, generate policies, assess risks via MCP protocol.
npm MIT -
🛡️ Sovereign AI development layer for mobile. Policy-driven orchestration with SB 24-205 compliance, real-time audit visualization, and local MCP governance.
MIT ★ 1 -
Typed judgment tools for MCP agents. TypeSafe's Jev model as verify, screen, find, classify, rerank, decide, compare, extract, review, gate, and score: the model judges, policy decides auto, review, or escalate.
MIT ★ 49 -
Vet agent skills and MCP servers before they run, and give your agent the verdicts as an MCP server. Verdicts from KillerSkills, policy from your org.
npm MIT