MCP servers that ship as code — a repository or a package you install and run locally (usually over stdio). They have no hosted endpoint, so we cannot probe or grade them: instead each one shows its repository, install command, license, stars and when it was last updated.
Collected from GitHub repositories and npm, PyPI, Cargo, Go, Maven, NuGet and RubyGems packages tagged as MCP servers, the official MCP Registry, Docker's MCP catalog, ModelScope, Baidu MCP World, Cline and other public directories; one entry per repository. A server that also offers a hosted endpoint is listed under Remote instead. These entries are not counted in our reachability, verification or readiness statistics.
-
Analyze and score HTTP security headers (CSP, HSTS, CORS, cookies) with actionable fix recommendations. Free MCP server — A+ to F grading for any URL. Built by Shakil Ahamed.
-
Autonomous HTTP Security Headers & RFC 9116 Vulnerability Disclosure Auditor MCP Server
MIT -
MCP server for Website Security Snapshot API — scan HTTP security headers from Claude and AI agents
npm MIT -
HTTP security headers scanner API + MCP server: HSTS, CSP, framing, COOP/CORP and cookies, with a score and fix snippets.
MIT -
posturecheck-mcpgithub.com/mvg777/posturecheck-mcpupdated this year
MCP server for domain security checks — SPF, DKIM, DMARC, MTA-STS, TLS certificates and protocol support, and HTTP security headers.
npm MIT -
Free passive security scanning for AI agents. Check any domain for email spoofing (DMARC/SPF/DKIM), TLS, security headers, exposed files, and subdomain takeover risk — using public information only, no intrusive probing.
npm MIT -
Security help for defenders: grade your site's security headers (fixes + README badge) and read logs/code to find what happened. Claude Code plugin, MCP server, no install.
MIT ★ 1 -
site-doctorgithub.com/subhro-kar/site-doctorupdated this year
Audit rendered websites for broken links, images, accessibility, SEO, security headers, and more. CLI + MCP server for AI agents.
npm MIT -
Free MCP server for security operations: CVSS 3.1 scoring, IOC extraction and defanging, email header triage, hash and JWT decoding, timestamps, layered decoding, CISA KEV lookup. No account, no telemetry.
MIT -
security-scanner-ai-mcpgithub.com/csoai-org/security-scanner-ai-mcpupdated this year
Security Scanner Ai automation via MCP. Includes scan dependencies, check headers, scan secrets. By MEOK AI Labs.
npm MIT -
Check a site is ready before you share the link. Link previews for LinkedIn, X, Slack, iMessage and Discord, SPA refresh 404s, security headers, favicons, noindex left on. MCP server and CLI, no API key.
npm MIT -
MCP server for local security work — secrets, CVEs, Wi‑Fi/ARP/USB, header audits.
MIT -
sentinel-mcpgithub.com/kareew/sentinel-mcpupdated this year
Security Operations MCP Server — turns AI agents into security analysts. HTTP headers, SSL/TLS, DNS, port scanning, tech fingerprinting, and full reports with MITRE ATT&CK mapping.
★ 1 -
headerscangithub.com/cognis-digital/headerscanupdated this year
Grade HTTP security headers (CSP/HSTS/XFO) A-F from a response dump
NOASSERTION -
MCP server for PhishClean security analysis tools — check URLs, passwords, emails, headers, JWTs, and source code for security issues
npm MIT -
posturecheck-mcpgithub.com/mvg777/posturecheck-mcpupdated this year
posturecheck-mcp — Domain security checks: SPF, DKIM, DMARC, MTA-STS, TLS certificates and protocol support, and HTTP security headers. No API key.
-
shieldnet-mcpgithub.com/hhhashexe/shieldnet-mcpupdated this year
ShieldNet Security Scanner — MCP Server for AI Agent Security Governance. Scans URLs for XSS, SQLi, SSTI, CORS misconfig, missing headers, info disclosure, and more. Returns ALLOW/WARN/BLOCK governance decisions.
npm MIT -
MCP server for PhishClean security tools — check URLs for phishing, analyse email headers, decode JWTs, scan code for leaked secrets. Works with Claude Desktop, Claude Code, Cursor.
MIT -
mcp-api-toolsgithub.com/rog0x/mcp-api-toolsupdated this year
MCP server for API testing: HTTP requests, endpoint health checks, JWT decode, URL parsing, security header analysis Install: npx @rog0x/mcp-api-tools
MIT -
A sovereign, local-first MCP server for Technical SEO DNS record auditing, SOA health checks, SSL/TLS inspection, and HTTP security header analysis.
MIT -
Local-first MCP server for web auditing — axe-core, Playwright, security headers
AGPL-3.0 -
@mbeato/apimesh-mcp-servergithub.com/mbeato/conwayupdated this year
MCP server for APIMesh — 76 x402-payable tools for AI agents (74 APIs + wallet usage + spend caps). Covers web vitals, security headers, SEO audits, email security and verification, tech-stack detection, brand assets, redirect chains, indexability, brand
npm MIT -
cybersecurity-ai-mcpgithub.com/csoai-org/cybersecurity-ai-mcpupdated this year
Cybersecurity Ai MCP server. Tools: classify vulnerability, lookup cve, check security headers. Built by MEOK AI Labs.
pypi MIT License -
seosiri-dns-sec-audit-mcpgithub.com/seosiri-official/dns-sec-audit-mcpupdated this year
A sovereign, local-first MCP server for Technical SEO DNS record auditing, SOA health checks, SSL/TLS inspection, and HTTP security header analysis.
pypi MIT -
Check a domain's DNS and propagation, email security (SPF, DMARC, DKIM, MTA-STS), RDAP registration, TLS certificate and HTTP headers
Apache-2.0 -
MCP servers for everyday development and security checks: OSV vulnerability lookup, security header grading, JWT decoding and verification, regex testing with ReDoS detection, cron explanation, JSON Schema validation, OpenAPI and Dockerfile linting, read-only git insights and llms.txt generation. TypeScript, stdio, zod-validated, no telemetry.
MIT ★ 1 -
Is my site healthy? TLS, DNS, HTTP, security headers, ports and email DNS (SPF/DMARC) checks over MCP, with an SSRF guard that refuses internal addresses. Hand-written DNS resolver, stdlib only.
MIT -
@leviai/netrecon-mcpgithub.com/levi-labs/netrecon-mcpupdated this year
Network reconnaissance MCP server — DNS, WHOIS, port scanning, subdomain enumeration, TLS inspection, HTTP security headers, IP geolocation, and Shodan InternetDB. Zero API keys required.
npm MIT -
network-mcpgithub.com/patrikx3/network-mcpupdated this year
Free AI-powered network analysis MCP server — DNS, SSL, security headers, email auth, WHOIS, monitoring & status pages. Works with Claude Code, Codex, and any MCP client.
MIT ★ 1 -
Free, local SEO + GEO (AI-search-citation) analysis for AI assistants - audits GEO/AI-crawler access, Core Web Vitals, structured data, security headers, mobile, and images with no signup or API key.
npm FSL-1.1-MIT -
MCP server for MOJOMO: a marketplace where AI agents find complementary agents, form teams, and complete real work. Includes a free, read-only PHP security audit (leaked .env/.git, phpinfo, verbose errors, EOL versions, missing headers).
npm MIT -
AI-native web tools for domains and websites that run inside Claude, ChatGPT and Gemini via one MCP connector and a REST API. 12 free tools: domain availability, WHOIS, DNS, SSL, SPF/DMARC email auth, hosting lookup, subdomains, security headers, redirects, expiry monitor, homograph. Stdlib Python, no signup, MIT.
MIT -
Check a website's security in plain English from the terminal, or give your AI agent the tool. Free, no key.
npm MIT -
everthread on npm: a plain-English website security check for the terminal, plus an MCP server for agents
MIT -
drheaderplus-mcpgithub.com/garootman/drheaderplus-mcpupdated this year
MCP sever for drHeaderPlus library
MIT -
Checks a site before you share the link.
MIT -
Technical SEO, Broken Link, Schema.org & Security Auditor ($0.80/1k) — Includes 1-Click n8n Workflow, Make.com Blueprint & Claude MCP Server (https://apify.com/lucacelli/seo-technical-audit-broken-link-schema-analyzer)
-
MCP server that checks a working copy and a customer's proven site: vulnerable packages, secrets, insecure config and code, TLS, headers, exposure and open services, each finding mapped to ENS and NIS2. Native AOT, scanners run in Nomad.
MIT -
corsauditgithub.com/cognis-digital/corsauditupdated this year
Detect permissive/misconfigured CORS from headers or a config
NOASSERTION -
Claude Code plugin for site audits you can re-run and trust: scripted SEO, Core Web Vitals, links, signs of a hacked site, images and video, with evidence for every finding, repeatable scores, a client-ready report and fixes verified by a second audit.
MIT -
Kagami 鏡 · a native macOS packet and flow viewer on Wireshark's dissectors: live capture, RFC header anatomy, NetFlow/IPFIX and nfdump, follow streams, a CLI and an MCP server.
AGPL-3.0 ★ 1