AI code security scanner MCP server — detects invisible Unicode, Trojan Source, homoglyphs, Glassworm steganography, rules file backdoors, and dependency attacks in AI-generated code. Static analysis + CodeBERT deep learning. Runs locally.

"MCP server for fetching and exploring NPM package source code. Built with TypeScript, supports package browsing, file extraction, and code analysis."

Open-source, local code intelligence and dependency graph for cross-repository impact analysis. Map APIs, events, schemas, packages, databases, and ownership for AI coding agents via MCP.

Cross-repo code knowledge graph for Java/Kotlin/JS/TS — MCP server, taint analysis, call graph, OWASP reports. 95% fewer tokens than source-reading.

Roslyn MCP server for C#/.NET AI coding agents. Compiler-aware analysis, code fixes, refactoring and safe, reviewable source changes.

Local codebase intelligence for AI coding agents: structural repo map, change-safety gates, MCP security receipts, and tamper-evident ChangeEvidence packets. Local analysis, zero API keys, no source-code egress.

Local-first code and project-text retrieval, source-backed symbol analysis, caller-controlled web discovery, and MCP for SDK clients

codegraph is a local-first code context engine and MCP server for repositories. It incrementally indexes source code into a lightweight SQLite graph, then exposes high-signal tools for symbol lookup, call graph traversal, impact analysis, related test discovery, and semantic search. Built in Go with a single-binary workflow, it is designed to work

A sub-harness (both an MCP server and an MCP client). Delegates documentation and source code analysis, as well as interactions with related context-providing MCP servers, to a local or inexpensive OpenAI-compatible LLM. Drastically reduces token usage and context size for coding agents on the top-tier LLM.

IAM Policy Autopilot is an open source static code analysis tool that helps you quickly create baseline AWS IAM policies that you can refine as your application evolves. This tool is available as a command-line utility and MCP server for use within AI coding assistants for quickly building IAM policies.

Local-first static analysis that turns source code into deterministic, source-grounded workflow maps for coding agents via MCP.

Modular, open-source MCP server providing comprehensive security analysis for AI coding agents.

Open-source AI research assistant for VS Code + GitHub Copilot. Connects to PubMed, OpenAlex, Semantic Scholar, Europe PMC, CrossRef, and Zotero via MCP servers. Custom agents guide systematic reviews, academic writing, data analysis, and project management — all ICMJE-compliant with full audit trails.

A modular, open-source Model Context Protocol server that provides comprehensive security analysis for AI coding agents

A powerful, open-source Model Context Protocol (MCP) server for automated, multi-language code feedback, validation, and project analysis. Designed for developers, teams, and LLM-powered workflows to ensure code quality, correctness, and maintainability across diverse languages and build systems.

aicaudit — AI-powered code audit for Python: taint-path static analysis + evidence-grounded AI verdicts. Every result ships with a machine-checkable source-to-sink path.

Free, open-source MCP server for SEO auditing with real-time web monitoring via Firehose (Ahrefs). 28 rules, site crawling, deep analysis — works with Claude Desktop, Claude Code, and Cursor.

MCP server for PhishClean security analysis tools — check URLs, passwords, emails, headers, JWTs, and source code for security issues

Free AI Web Search & Grounding for VS Code. Open-source Perplexity alternative powered by Gemini, Google Search, and Deep Page Analysis (MCP Server).

Automated web application penetration testing framework: OWASP Top 10 + advanced attacks, an autonomous AI agent (Ollama/Claude/OpenAI), SAST source-code analysis, and an MCP server, with professional CVSS-scored reports.

SAP ABAP MCP is a local-first Model Context Protocol server that enables AI coding agents to develop, test, analyze, and operate SAP ABAP systems through the official ABAP Development Tools HTTP services. It supports repository search and source editing, structured DDIC workflows, enhancement inspection, paged package navigation, source-backed object creation, semantic services, activation, ABAP Unit and ATC, transports, abapGit, RAP generation, debugging, bounded class and executable-program profiling, runtime dumps, traces and feeds, cross-system comparison, dependency analysis, guarded refactoring, and an opt-in same-origin Screen/GUI Status bridge. Curated compact, development, and assurance presets reduce tool-schema token use without removing capabilities from the default surface. The default local stdio mode can be extended with governed self-hosted Streamable HTTP, API-key roles, OIDC/JWT authentication, request-scoped SAP bearer forwarding, per-session isolation, rate limits, structured audit logs, or a side-effect-free embeddable Node.js API. It also includes browser OAuth Authorization Code with PKCE, a read-only transport assurance CLI and GitHub Action, BTP service-key profile import, and live-SAP evidence tooling. SAP profiles and credentials remain on the user's computer, with passwords and OAuth credentials protected by macOS Keychain or Windows DPAPI. SAP-dependent capabilities are validated against the user's own SAP release, configuration, and authorizations.

Scans AI-generated code for invisible Unicode, Trojan Source, and supply-chain threats.

Agent-facing MCP infrastructure for automated Rust migration of multi-language programs and dependency ecosystems, including large systems and frameworks. Early prototype.

Source code graph RAG (graphRAG) for Java/Kotlin development based on jQAssistant

Mermaid to assets. Source code to maps. MCP for agents.

Local-first MCP server that detects potential PHI flows into LLM, logging, and analytics calls in source code.

An open-source, AI-powered data engineering workspace for automated SQL/SAS lineage discovery, dependency visualization, column usage analysis, impact assessment, and developer productivity.

Open source (AGPL-3.0) evidence-grounded repository audit CLI - deterministic scanner, MCP server, live dashboard, and a GitHub Action that posts PR diffs.

Open-source AI reverse-engineering workspace with a desktop app, red / blue / both analysis, parallel Goals, a security knowledge base, and MCP tools for Ghidra, Frida, x64dbg and Rizin.

Extensible MCP server for semantic code search with plugin architecture supporting multiple embedding providers, vector databases, and data sources.

A runtime-free MCP server that converts source code into AST🌲, regardless of language.

DSM for developers — orchestrate, audit, and analyze your entire dev stack. MCP server with 27 tools for Claude & Cursor. Built in Rust.

Local code architecture graph for Python and TypeScript: trace events, contracts, dependencies, and change impact with source evidence.

Euthynos — deterministic repository intelligence for AI coding agents (MCP server): exact source spans, call graphs, clone detection, honest evidence boundaries.

Know what breaks before you change Salesforce. Ask your AI about your org: where a field is used, what runs on save, which Apex is dead, who can see what. Offline, read-only, cited. Open source (MIT).

MCP server for sentinel-ir: lets AI agents (Claude Desktop, Cursor, Windsurf, ...) read a compact structural IR of JavaScript, TypeScript, Python and Rust files instead of the raw source. Read-only, sandboxed to allowed folders.

Open-source MCP server for Claude AI with Stripe and Supabase integration for SaaS analytics, churn analysis, subscription tracking, and revenue insights using natural language

Your engineering standards, taught to every coding agent and checked on every PR. Open-source CLI, checks, packs, MCP server and hooks.

MCP security scanner — source code audit with 25+ Semgrep rules, config health checks, SARIF output for CI/CD

MCP server: gives your AI agent the real sources, public API and KDoc of any Maven/Gradle-published Kotlin or Java library

CLI, MCP and TS library that turns source code into a map of files, symbols, references, and dependencies using tree-sitter.

Open-source Software Intelligence Platform. Deterministic verification, structural PR reviews, interactive graph explorer, and proactive intelligence — powered by the Software Graph. 41 node types · 32 relationships · 120+ checks.

The cross-repo context your coding agent can't grep for: a service graph for microservices, derived from source and served over MCP.

CodeMap is a Roslyn-powered MCP server that lets AI agents navigate C# codebases by symbol, call graph, and architectural fact — instead of brute-reading thousands of lines of source code. One tool call. Precise answer. No context flood.

Free, open-source Arabic + English requirements document generator (SRS): process model or live e-service to PDF and DOCX. By Nader Alzghoul (NJ-Burrito)

Extract public API surface from source files as compact JSON: signatures, types, interfaces, no bodies. Supports Go, TypeScript, C#. MCP server + CLI.

Memory and workflow automation for MCP, Codex, and Claude Code — skills that learn from your corrections. GitHub is the primary source; npm package is frozen at v2.3.1.

Check a backend's architecture from its source. Reads TypeScript, Python and Prisma/TypeORM/Mongoose schemas, then fails the build on architecture violations.

Relay - open-source AI agent latency auditor. A local MCP server + CLI that finds, verifies, and fixes latency bottlenecks in AI agent and voice-agent codebases. No API key, no backend.

Persistent research memory for agentic harnesses (Claude Code, Claude Desktop, Codex): a local knowledge graph of companies, sourced claims and investment theses, with SEC filing alerts and research workflows (onboard, challenge, memo, review). MCP server + plugin.

Open-source docs you zoom through: a C4-style model in YAML, step-by-step flows, visualization for performance stats and FMEA creation

Understand what your codebase builds, why it is structured that way, and what a change could affect. One shared Markdown ontology for humans and coding agents—visualized for people, accessible to agents through MCP, and reviewed with Git. Local-first. Open source.

Verified AI video. Describe a video to your AI, get a real file back. Deterministic rendering, six verification gates, full read-back. Free and open source. By GOL Productions.

Turn messy input into a sourced report. 15 default tools: workflow, bidirectional sync, canonical NodeBench research bridge, discover_tools, and load_toolset.

Hosted MCP server for the APITube News API — real-time news search across 300,000+ sources, 177 countries and 59 languages, with sentiment and entities. Point Claude, Cursor, Cline or VS Code at https://mcp.apitube.io/ and pass an API key.

Free AI-powered Amazon product research & marketplace intelligence. Hidden Profit Index — Sorftime's algorithm for overlooked high-margin products. 120 MCP tools · 8 platform endpoints: Amazon, Walmart, TikTok Shop, Shopee, TEMU, 1688, Mercado + Reddit/Quora. Claude Code, Codex, Cursor, OpenClaw. Open source.

a design intelligence MCP server with 31 tools, 13 specialist agents and 7 workflows for AI-powered design analysis, recreation, accessibility and design-system generation.

Persistent codebase memory for AI coding agents — Claude Code, Codex, Cursor, Cline, Continue and any MCP client. Learns which files go together from how you work and serves compact, ranked context: the gold file on 40 of 40 public-benchmark queries to keyword ripgrep's 32 of 40, at 31-67× fewer tokens than ripgrep and 51-242× fewer than pasting every source file (a larger 150-question eval misses 10). Local-first, no telemetry by default.

An open-source MCP server that turns LLMs into condition monitoring assistants for reliability engineers. It gives your AI assistant evidence-based vibration diagnostics: machine fault detection, severity assessment and diagnostic reports, for faster predictive maintenance decisions. Also available as a Claude Code plugin.