MCP servers that ship as code — a repository or a package you install and run locally (usually over stdio). They have no hosted endpoint, so we cannot probe or grade them: instead each one shows its repository, install command, license, stars and when it was last updated.
Collected from GitHub repositories and npm, PyPI, Cargo, Go, Maven, NuGet and RubyGems packages tagged as MCP servers, the official MCP Registry, Docker's MCP catalog, ModelScope, Baidu MCP World, Cline and other public directories; one entry per repository. A server that also offers a hosted endpoint is listed under Remote instead. These entries are not counted in our reachability, verification or readiness statistics.
-
—
MIT -
mcp-server-security-auditgithub.com/joepangallo/agent-auditupdated this year
MCP server for MetalTorque Security Audit — gives AI agents the ability to scan websites for security vulnerabilities.
npm MIT -
agent-security-lensgithub.com/professor2k8/agent-security-lensupdated this year
MCP security trust-check server for autonomous agents: safe install decisions, risk signals, controls and alternatives before installing MCPs, Skills or tools.
npm Apache-2.0 -
mcp-security-toolkitgithub.com/x0base/mcp-security-toolkitupdated this year
Atomic MCP tools for AppSec and AI Security engineers
pypi MIT -
Security scanner MCP server for AI coding agents. Prompt injection firewall, package hallucination detection (4.3M+ packages), 1000+ vulnerability rules with AST & taint analysis, auto-fix.
npm MIT ★ 123 -
An MCP-based security scanner and agentic AI for vulnerability detection
npm MIT -
Autonomous HTTP Security Headers & RFC 9116 Vulnerability Disclosure Auditor MCP Server
MIT -
Secure MCP Server with NGINX + Supergateway + Render
MIT -
mcp-security-toolkitgithub.com/x0base/mcp-security-toolkitupdated this year
13 atomic MCP tools for AppSec and AI Security: recon, MCP audit, prompt-injection audit, OWASP LLM Top 10
MIT -
AWS Security MCP Server – GuardDuty/SecurityHub/Inspector findings, security service status checks, and S3/EBS encryption audits for security investigations
npm Apache-2.0 -
MCP server for security analysis of NextJS/React TypeScript codebases
npm MIT -
Security-first MCP server for SendGrid — recipient allowlists, send caps, review-mode, audit log, no silent BCC. Hardened against the postmark-mcp incident class.
MIT -
Security auditor for AI agents and MCP servers — config analysis, prompt injection testing, tool probing, data flow tracing
npm MIT -
Analyze and score HTTP security headers (CSP, HSTS, CORS, cookies) with actionable fix recommendations. Free MCP server — A+ to F grading for any URL. Built by Shakil Ahamed.
-
openapi-security-contract-lintno update data
—
smithery -
Model Context Protocol (MCP) server that provides GitHub API tools for user information, security issue creation, and repository security scanning. Built with TypeScript and the MCP SDK
-
mcp-security-scannergithub.com/rohitdhamija/mcp-security-scannerupdated this year
A Model Context Protocol (MCP) server for automated security scanning and live validation of LLM API keys and cloud endpoints
MIT -
Claude Code security plugin and agentskills.io skill pack for securing LLM agents: threat modelling, config audits, prompt injection review, MCP server review, incident lookup, security evals, Semgrep rules, guard hooks and an incident-database MCP server.
MIT -
MCP server for AWS security auditing — IAM role/policy analysis and S3 Public Access Block scanning via Boto3.
MIT -
MCP server for Website Security Snapshot API — scan HTTP security headers from Claude and AI agents
npm MIT -
agent-security-mcpgithub.com/mdfifty50-boop/agent-security-mcpupdated this year
MCP server providing security scanning, prompt injection detection, secret leak detection, and agent permission auditing for AI agent workflows
npm MIT -
@aiclude/security-scanner-mcpgithub.com/aiclude/asvsupdated this year
AIclude Security Vulnerability Scanner - MCP Server for scanning MCP servers and Skills for security vulnerabilities
npm MIT -
Model Context Protocol (MCP) server that provides GitHub API tools for user information, security issue creation, and repository security scanning. Built with TypeScript and the MCP SDK
npm MIT -
Secure browser-automation MCP server with persistent sessions, domain allowlist, SSRF protection, and bearer auth.
-
Deterministic 6-phase security audit CLI, MCP server, and VS Code extension (1:1:1 parity, *os.Root confinement, SARIF 2.1.0, GHSA advisories)
MIT -
MCP Server 架構的資安週報系統 - 整合 32 個國際與台灣資安來源，自動產生繁體中文週報
MIT -
Deterministic prompt injection classification, secret entropy detection, PII redacting, and synthetic dataset bias auditing.
MIT -
55-tool MCP server for security scanning of MCP servers. Runtime inspection, AST-based SAST, config audit, dependency analysis, OWASP MCP Top 10 compliance. OAuth, TLS, fuzz testing, prompt injection, tool mutation detection. 100% local, zero external API calls.
MIT ★ 5 -
A Model Context Protocol server that connects AI assistants like Claude to AWS security services, allowing them to autonomously query, inspect, and analyze AWS infrastructure for security issues and misconfigurations.
Apache-2.0 ★ 84 -
Real-time security monitoring and fraud detection, with explainable risk scores and a voice-queryable MCP interface.
MIT ★ 1 -
Security auditor for Windows that scans the host for risky configuration, exposed services, and misconfigurations, with MCP tools for AI assistants.
MIT -
security-mcp-suitegithub.com/guanpengzhang0-spec/security-mcp-suiteupdated this year
5 MCP servers that give AI agents autonomous security scanning — nmap, nuclei, trivy, sqlmap, gitleaks
MIT -
Security memory with evidence attached. Human review, isolated client memories, and auditable recall in your own Cloudflare account. Built by Agent9.dev
MIT ★ 5 -
Full-spectrum wireless security MCP server — WiFi, Bluetooth, RF/SDR, NFC/RFID, Cellular/5G, IoT, MouseJack, air-gap, UWB, WIDS/WIPS, compliance. 34 tools, 9 knowledge bases.
MIT ★ 6 -
security-scanner-ai-mcpgithub.com/csoai-org/security-scanner-ai-mcpupdated this year
Security Scanner Ai automation via MCP. Includes scan dependencies, check headers, scan secrets. By MEOK AI Labs.
npm MIT -
Mcp Security Auditno update data
A powerful MCP (Model Context Protocol) Server that audits npm package dependencies for security vulnerabilities. Built with remote npm registry integration for real-time security checks.
smithery -
Secure MCP server for ComfyUI with workflow inspection and audit logging
pypi MIT License -
Evolve scan and policy configurations against the fleet's measured phenotype instead of its labels.
MIT -
Agentic GitHub security auditing and remediation — audit, plan, fix, verify, with before/after evidence for review. TypeScript, MCP server (stdio + streamable HTTP), Claude skills/agents/hooks, Cursor rules, GitHub Actions. Demo: parallel repo workers, conservative patch strategy, PR or direct fix.
-
domain-security-super-auditor-mcp-apigithub.com/deepakshe/domain-security-super-auditor-mcp-apiactive
Automated DNS, SPF, DMARC, DKIM, and SSL security posture auditor. Detect email spoofing risks & open relays. MCP Server & Python SDK.
MIT -
GitHub security posture audit tools for AI agents — organization, repository, Actions, secrets, supply chain analysis via MCP
npm MIT -
Catch CVEs, leaked secrets, and BTP misconfigurations in your MTA/CAP project before you deploy.
MIT -
microsoft-security-agent-toolkitgithub.com/vinayaklatthe/microsoft-security-agent-toolkitupdated this year
Action layer for Microsoft Security AI agents - MCP servers, KQL snippets, Logic Apps templates, and end-to-end demos that pair with microsoft-security-skills
MIT ★ 2 -
security-framework-mcpgithub.com/zer0-kr/security-framework-mcpupdated this year
Unified NIST + OWASP security framework MCP server — 36 tools, 3439+ records, live NVD/KEV, PDF reading, STRIDE threat modeling, compliance mapping
MIT ★ 14 -
arc-security-mcpgithub.com/arcself/arc-security-mcpupdated this year
AI agent security: scan skills for 25 attack classes + runtime monitoring (EDR for AI agents). Real-time scanning, behavioral anomaly detection, session monitoring, exfiltration alerts. 1,316+ findings from 450+ audits. OWASP Agentic AI Top 10 mapped.
npm MIT -
MCP server that lets Claude Code use secrets without seeing them.
★ 5 -
Audit your package.json dependencies
npm MIT -
Self-hosted application security platform: SAST, DAST and SCA with AI false-positive validation. OWASP Top 10/CWE mapping, SBOM export, CI/CD integrations and MCP server.
MIT ★ 1 -
github-security-mcpgithub.com/badchars/github-security-mcpupdated this year
GitHub security posture analysis for AI agents — 39 MCP tools, 45 checks across org, repos, Actions, secrets, supply chain, and access control
npm MIT ★ 15 -
agent-security-mcpgithub.com/mdfifty50-boop/agent-security-mcpupdated this year
MCP server providing security scanning, prompt injection detection, secret leak detection, and agent permission auditing for AI agent workflows
-
🛡️ Production-grade Model Context Protocol (MCP) Server for Autonomous AI Security Bug Hunting, Persistent Pentest Memory, Dynamic Checklists, Secret Redaction, and Exploit PoC Generation.
MIT ★ 1 -
Telegram MCP server: each AI client gets its own key, scoped to chosen chats. Read-only by default.
npm MIT -
secure-vault-mcpgithub.com/mdfifty50-boop/secure-vault-mcpupdated this year
MCP server for agent-native secrets management — store, rotate, and inject secrets without agents seeing raw values
npm MIT -
—
Apache-2.0 ★ 544 -
Open-source Bacen Evidence Engine for Brazilian fintechs — citable, exportable evidence pipeline for BCB 85/2021, ANPD 24h, Open Finance. Replaces consultant + spreadsheet workflows. MIT, fork of AiSOC.
MIT ★ 1 -
MCP server for AI agents to scan and audit smart contracts on Base for security vulnerabilities. Detect honeypots, rug pulls, hidden mints, proxy risks, and generate full audit reports.
npm MIT -
A Model Context Protocol (MCP) server that provides security functionality for AI agents, focusing on detecting and redacting sensitive information in text content.
★ 2 -
Telegram MCP server where each AI client gets its own key, scoped to the chats and folders you pick. Sessions are encrypted at rest.
npm MIT ★ 1 -
Deterministic AI security scanner | Prompt injection detection | x402 USDC
-
Platform-neutral security and privacy checks for AI-assisted development: a deterministic CLI, MCP server, git hooks and CI action, plus editable scaffolds mapped to NIST SSDF, ISO 27001:2022, DPDP Act 2023 and the AI Security Wiki.
Apache-2.0 ★ 4