MCP servers that ship as code — a repository or a package you install and run locally (usually over stdio). They have no hosted endpoint, so we cannot probe or grade them: instead each one shows its repository, install command, license, stars and when it was last updated.
Collected from GitHub repositories and npm, PyPI, Cargo, Go, Maven, NuGet and RubyGems packages tagged as MCP servers, the official MCP Registry, Docker's MCP catalog, ModelScope, Baidu MCP World, Cline and other public directories; one entry per repository. A server that also offers a hosted endpoint is listed under Remote instead. These entries are not counted in our reachability, verification or readiness statistics.
-
Scan open-source software packages against the Google OSV distributed vulnerability database for known CVEs. MCP Server & Python SDK.
MIT ★ 1 -
gcp-architecture-scannergithub.com/dkeeno/gcp-architecture-scannerupdated this year
MCP server: scan GCP projects and produce architecture diagrams + security posture reports
MIT -
Local MCP server for QR code and barcode image scanning, preserved payload bytes and QR scannability reports
npm AGPL-3.0-or-later -
@aiclude/security-scanner-mcpgithub.com/aiclude/asvsupdated this year
AIclude Security Vulnerability Scanner - MCP Server for scanning MCP servers and Skills for security vulnerabilities
npm MIT -
security-scanner-ai-mcpgithub.com/csoai-org/security-scanner-ai-mcpupdated this year
Security Scanner Ai automation via MCP. Includes scan dependencies, check headers, scan secrets. By MEOK AI Labs.
npm MIT -
Page Scannerno update data
Capture a web page from your own Chrome as a PDF whose text is still text.
smithery -
@mseep/axe-scanner-mcpupdated this year
Model Context Protocol server for running axe accessibility scans against URLs
npm ISC -
Scan to PDF and print from Telegram or from AI agents (MCP) with any SANE/eSCL scanner and CUPS printer. One Docker container.
MIT -
CLI & MCP server for scanning code definitions (.gitignore aware, LLM output)
GPL-3.0 ★ 2 -
An MCP Server for to analyze Ethereum Whales.
-
Benign EICAR-style diagnostic test server for calibrating MCP security scanners (Detonation Labs).
npm MIT -
scannergithub.com/hegner123/scannerupdated this year
macOS process investigation tool — inspects running processes, network connections, and code signing status. Flags suspicious activity. CLI + MCP server for Claude Code.
MIT -
mcp-security-scannergithub.com/rohitdhamija/mcp-security-scannerupdated this year
A Model Context Protocol (MCP) server for automated security scanning and live validation of LLM API keys and cloud endpoints
MIT -
mcp-job-board-keyword-signal-scannerno update data
MCP server for Job Board Keyword Signal Scanner. Scans Greenhouse, Lever, Ashby, Workday, and Rippling for roles in any category via Apify. Clay-ready output.
smithery -
rug-scanner-mcpgithub.com/lucianolupo/rug-scannerupdated this year
MCP server for on-chain token rug pull risk analysis. 7 parallel checks, deterministic scoring. $0.05 USDC per scan via x402 on Base.
npm MIT -
Vulnerability Scanning and Reconnaissance App with Gemini integrated workflow
MIT ★ 8 -
Autonomous HTTP Security Headers & RFC 9116 Vulnerability Disclosure Auditor MCP Server
MIT -
Let Claude scan nearby Wi-Fi networks: signal, channels, security and the best router channel. MCP server for macOS, Windows and Linux. Zero dependencies, 100% local.
MIT ★ 1 -
aws-architecture-scannergithub.com/dkeeno/aws-architecture-scannerupdated this year
MCP server: scan an AWS account and produce an architecture diagram (PNG/SVG) using Python Diagrams
MIT -
Prompt injection scanner for documents, web pages and RAG content: instruction overrides, spoofed chat roles, hidden text and data-exfiltration attempts, as a CLI and an MCP server
npm MIT -
stock-scanner-mcpgithub.com/yyordanov-tradu/stock-scanner-mcpupdated this year
MCP server providing Claude Code with real-time stock and crypto market data, SEC filings, insider trades, and technical analysis
npm MIT -
Catch CVEs, leaked secrets, and BTP misconfigurations in your MTA/CAP project before you deploy.
MIT -
tiamat-scanner-mcpgithub.com/toxfox69/tiamat-entityupdated this year
MCP server for supply chain package scanning — detects typosquatting, malicious install scripts, obfuscation, and dependency confusion in npm/PyPI packages. Works with Claude Code, Cline, and any MCP client.
npm MIT -
axe-scanner-mcpgithub.com/vinnyang/axe-scanner-mcpupdated this year
A standalone Model Context Protocol server that runs axe accessibility scans for a supplied URL using Playwright.
-
WCAG 2.1 AA accessibility scanner for Claude Code: Playwright + axe-core, grounded fixes, browser-verified (MIT client; hosted insights API is proprietary)
npm MIT ★ 2 -
WCAG 2.1 AA accessibility scanner (Playwright + axe-core) with grounded, browser-verified fixes. MCP server for Claude Code and any MCP client; also a Claude Code plugin.
npm MIT -
A Model Context Protocol (MCP) server for performing automated accessibility scans of web pages using Playwright and Axe-core
npm MIT -
A Model Context Protocol (MCP) server for scanning IP addresses for vulnerabilities. This server provides tools to perform security scanning on individual IPs or multiple IPs at once.
★ 6 -
GuardRails by Abscissa: VS Code extension-package security, exact-release evidence, workspace monitoring, and a read-only OAuth MCP server.
-
defi-yield-scanner-mcpgithub.com/34t34f3/defi-yield-scanner-mcpupdated this year
MCP server for DeFi yield scanning, token risk analysis, and wallet exposure checking. Real-time data from DexScreener and DeFiLlama.
MIT ★ 1 -
55-tool MCP server for security scanning of MCP servers. Runtime inspection, AST-based SAST, config audit, dependency analysis, OWASP MCP Top 10 compliance. OAuth, TLS, fuzz testing, prompt injection, tool mutation detection. 100% local, zero external API calls.
MIT ★ 5 -
Security scanner MCP server for AI coding agents. Prompt injection firewall, package hallucination detection (4.3M+ packages), 1000+ vulnerability rules with AST & taint analysis, auto-fix.
npm MIT ★ 123 -
An agentic AI–powered IaC scanner that evaluates cloud infrastructure against security and compliance benchmarks. It also delivers cost analysis and AWS Well-Architected recommendations, with support for custom policies, checks, and configurable exceptions.
Apache-2.0 ★ 4 -
mcp-semgrep-scannergithub.com/archimedes-market/mcp-semgrep-scannerupdated this year
Run Semgrep static analysis from an AI agent. OWASP top 10, secrets detection, custom rule packs. Baseline scanning to focus only on newly-introduced findings. Built for production-grade security review workflows.
MIT -
MCP server for AI agents to scan and audit smart contracts on Base for security vulnerabilities. Detect honeypots, rug pulls, hidden mints, proxy risks, and generate full audit reports.
npm MIT -
MCP security scanner: scan MCP servers and tool manifests for tool poisoning, prompt injection, tool-name shadowing, excessive-agency schemas, unpinned/remote sources, and rug-pulls - 10 OWASP-mapped heuristics, CLI + MCP server, fully offline. Also runs
npm MIT -
Network scanner written in Rust, with a CLI, terminal UI, desktop app and MCP server.
MIT ★ 19 -
Free, open-source memory scanner and debugger for Windows, for 32- and 64-bit targets: pointer scanner, find-what-writes, auto-assembler, speed hack, Lua, and an MCP server for AI agents
GPL-2.0 ★ 11 -
vibesafegithub.com/stef41/vibesafeupdated this year
AI-generated code safety scanner for the vibe coding era. Catches hallucinated imports, hardcoded secrets, security vulnerabilities, and dead code. CLI + Python API.
NOASSERTION ★ 1 -
MCP security scanner (CLI + MCP server): detects tool poisoning, prompt injection, and rug-pulls in MCP manifests. Also an OWASP LLM Top 10 prompt-injection/jailbreak CLI for LLM apps.
MIT ★ 3 -
agentauditgithub.com/agentaudit-dev/agentaudit-cliupdated this year
Security scanner for AI agent packages — CLI + MCP server
npm AGPL-3.0 -
mcp-trust-demogithub.com/SteveMonsway/mcp-trust-demoupdated this year
Intentionally-vulnerable MCP server — a live demo target for the MCP Trust scanner (GitHub Action). Do not run.
-
Dependency vulnerability scanner over OSV.dev with CISA KEV actively-exploited flags. No API key.
-
nightprismgithub.com/Ammmaze-Ltd/nightprismupdated this year
MCP-native security scanner that asks "should I ship tonight?" for AI-generated code.
Apache-2.0 -
Offline security scanning for AI-generated code: seven open-source scanners and AI-specific checks in one command.
pypi Apache-2.0 -
Scan GitHub repos and profiles for malware before you clone — CLI and MCP server for the Flagrix scanner
npm MIT -
An MCP-based security scanner and agentic AI for vulnerability detection
npm MIT -
MCP server for the Frame security scanner: scan, verify, fix, exploit, framework packs and the separation logic solver, from any MCP client.
pypi Apache-2.0 -
@mcp-guard/mcp-servergithub.com/0xrake/mcp-guardupdated this year
MCP server exposing mcp-guard scanners to Claude Desktop and other MCP clients via the Model Context Protocol.
npm MIT -
Command line and local MCP server of the Agentic Readiness Scanner, self-contained: npx @agentic-readiness/cli scan <url>.
npm GPL-3.0-or-later -
SkillSync MCP — security-gated skill management for Claude Code, OpenClaw, Cursor & Windsurf. 60+ threat pattern scanner.
MIT ★ 4 -
A fast workspace auditor, safe artifact cleaner (.venv, node_modules), and security secret scanner exposed via Model Context Protocol (MCP) and Typer CLI.
-
MCP server for SixthWall AI code security scanner. Integrates with Claude Code for automatic vulnerability detection with Fix Packs.
npm UNLICENSED -
Python dead code, security and secrets scanner with a pull-request gate; narrower checks for TypeScript, Java and more.
pypi Apache-2.0 -
MCP security scanner — source code audit with 25+ Semgrep rules, config health checks, SARIF output for CI/CD
pypi MIT -
A power tool for web security testing — scanner, repeater, intruder, and AI agent in one Rust binary. No accounts, no telemetry, no cloud.
NOASSERTION ★ 1 -
MCP server (not a Claude Code Skill) for the VibeSafe security scanner — scan code, live URLs and run a Launch Check from Claude Desktop, Claude Code, Cursor, Windsurf or any MCP client.
MIT -
AI compliance scanner and MCP server for GDPR, CCPA/CPRA, WCAG, PCI-DSS, HIPAA, EU AI Act, LGPD, COPPA, PIPEDA, privacy, accessibility, and AI governance.
NOASSERTION -
Windows network scanner that finds AI/ML services and MCP servers on your network (shadow AI discovery). Signed, self-updating detection signatures. Runs as an MCP server too.
NOASSERTION ★ 40 -
shieldnet-mcpgithub.com/hhhashexe/shieldnet-mcpupdated this year
ShieldNet Security Scanner — MCP Server for AI Agent Security Governance. Scans URLs for XSS, SQLi, SSTI, CORS misconfig, missing headers, info disclosure, and more. Returns ALLOW/WARN/BLOCK governance decisions.
npm MIT