MCP servers that ship as code — a repository or a package you install and run locally (usually over stdio). They have no hosted endpoint, so we cannot probe or grade them: instead each one shows its repository, install command, license, stars and when it was last updated.
Collected from GitHub repositories and npm, PyPI, Cargo, Go, Maven, NuGet and RubyGems packages tagged as MCP servers, the official MCP Registry, Docker's MCP catalog, ModelScope, Baidu MCP World, Cline and other public directories; one entry per repository. A server that also offers a hosted endpoint is listed under Remote instead. These entries are not counted in our reachability, verification or readiness statistics.
-
Evidence-first reverse engineering workbench with bounded binary analysis, extensible static adapters, MCP and reproducible local investigations.
MIT -
ariadnegithub.com/simonrueba/ariadneupdated this year
Semantic code index and gatekeeper for AI coding agents. No LLMs — just static analysis.
MIT -
sheriff-mcpgithub.com/ryansmith4/sheriff-mcpupdated this year
AI-powered static analysis issue fixer - MCP server for SARIF reports
Apache-2.0 -
aethvion-project-mappergithub.com/aethvion/aethvion-projectmapperupdated this year
Static code analysis + knowledge-graph for AI coding agents — 12 MCP tools, 13 languages, cut token costs by 87–92 %
pypi AGPL-3.0-or-later -
MCPDebuggergithub.com/Fatmike-GH/MCPDebuggerupdated this year
A MCP Debugger Server for Windows executables (x86 and x64). Exposes debugger functionality as MCP Tools for static / dynamic analysis of the debuggee and memory inspection through a clean interface.
MIT ★ 14 -
Policy-as-code enforcement for AI agents: MCP server, CEL policies, git hooks, SARIF, and static analysis guardrails.
AGPL-3.0 -
cleaner-codegithub.com/goldmembrane/cleaner-codeupdated this year
AI code security scanner MCP server — detects invisible Unicode, Trojan Source, homoglyphs, Glassworm steganography, rules file backdoors, and dependency attacks in AI-generated code. Static analysis + CodeBERT deep learning. Runs locally.
npm MIT ★ 1 -
Evidence-bound reverse-engineering harness for AI agents, served over MCP. Ghidra or IDA static analysis, a claim verifier that rejects claims without quoted evidence, Windows Sandbox runs for behaviour claims. Core edition, Apache-2.0.
Apache-2.0 -
面向 Android 应用包(APK)的静态安全分析、反编译源码检索与 MCP 代码审计平台 · Android Static Security Analysis & Code Audit Platform
MIT ★ 4 -
MCP server that scans a Python 2 / Django codebase and turns it into a prioritized, phased Python 3 migration plan. 52 rules, read-only static analysis.
MIT -
mcp-semgrep-scannergithub.com/archimedes-market/mcp-semgrep-scannerupdated this year
Run Semgrep static analysis from an AI agent. OWASP top 10, secrets detection, custom rule packs. Baseline scanning to focus only on newly-introduced findings. Built for production-grade security review workflows.
MIT -
@hayasaka7/go-arch-xraygithub.com/hayasaka7/go-arch-xrayupdated this year
Model Context Protocol server for static analysis of Go codebases with shadow SQLite indexing, background sync, call graphs, import graphs, interface topology, struct lifecycle, endpoints, maintainability metrics, and repo-aware config.
npm MIT -
Static analysis scanner for multi-tenant SaaS and MCP server code. 57 deterministic rules for cross-tenant data leakage, IDOR, RLS, and MCP-specific risks. Includes MCP server, SARIF output, and GitHub Action.
npm MIT ★ 5 -
Static analysis scanner for MCP server code and multi-tenant SaaS applications. 57 deterministic rules covering tenant isolation, tool visibility, cache key scoping, RLS, IDOR, and credential vault isolation. MCP server for AI agent integration.
npm MIT -
Original open-source static software analysis toolkit: identify, hash & inspect PE/ELF/Mach-O, WebAssembly, archives (APK/JAR) and JavaScript. CLI, pluggable providers, evidence model & MCP server. Static-only, no cloud.
MIT ★ 2 -
Is this codebase safe to run, will it work, and is it complete? Deterministic Safe, Works and Complete scores with an A-F grade, from static analysis only, plus a verify loop for AI-assisted changes: baseline, repair plan, before/after diff. The code is never run.
pypi MIT -
Release gate for public GitHub repositories. Give it a repo URL and it returns a ship-or-block verdict with file-and-line evidence, the fixes that clear the gate, and the deployment plan and launch copy you ship with. HTTP + MCP. Static analysis only; no code execution.
MIT ★ 4 -
MCP server that lets AI coding agents actually test C++ code: sanitizers, static analysis, and a profiler behind eight tools.
MIT -
Multi-language static analysis for agents, editors, and large repositories.
Apache-2.0 ★ 23 -
documcpgithub.com/tosin2013/documcpupdated this year
DocuMCP is an intelligent Model Context Protocol (MCP) server that revolutionizes documentation deployment for open-source projects. It provides deep repository analysis, intelligent static site generator recommendations, and automated GitHub Pages deployment workflows.
MIT ★ 10 -
High-throughput agent context router and deterministic static analysis engine.
Apache-2.0 ★ 3 -
Local, model-neutral electronics MCP for CRUMB static analysis and Logisim-evolution project inspection, truth tables, and test vectors.
Apache-2.0 ★ 1 -
Knowledge graph of PHP codebases for AI coding agents (Claude Code, Codex, Cursor) over MCP. Static analysis, no LLM.
MIT ★ 3 -
development-tools-mcp-Servergithub.com/code-alchemist01/development-tools-mcp-Serverupdated this year
Comprehensive MCP (Model Context Protocol) server for code analysis and web scraping. Supports code quality analysis, linting, dependency analysis, static/dynamic web scraping, and API discovery.
MIT ★ 1 -
Local-only Go static analysis engine with a built-in MCP server. Gives AI coding agents deterministic structural awareness: call graphs, impact analysis, symbol search, and more.
MIT ★ 231 -
Software_Testing_Agentgithub.com/cazaresb/Software_Testing_Agentupdated this year
Software Testing Agent for Java codebases. Static code analysis, automatic standardized test generation, Jacoco report analysis
-
Analyze software: memory scanner, debugger and static analysis of executables, .NET and Electron apps, from the desktop, the command line, or an AI agent through MCP.
MIT ★ 35 -
AST-based code navigation for AI agents: static analysis and call graphs instead of vector search. Includes an MCP server (cdd-mcp).
MIT -
Static-analysis MRI for codebases — a Tree-Sitter dossier engine + deterministic PreToolUse safety gate for AI coding agents. Zero LLM calls, zero API keys.
MIT -
CodeRadargithub.com/officialCodeWork/CodeRadarupdated this year
React & TypeScript static analysis that maps every UI component to the APIs, state, and events behind it — and serves that context to AI coding agents over MCP. Screenshot or ticket in; component, data lineage, user journeys, and blast radius out. Deterministic, no LLM in the core.
MIT -
AIContextBuilder (AICB): semantic code intelligence for AI coding agents on C#/.NET (dotnet). Roslyn MCP server and CLI: change impact, static analysis, code navigation (callers, implementations, dependency injection, tests, side effects, dead code) and context engineering. For Claude Code, Codex, OpenCode, Cursor; Windows desktop app included.
NOASSERTION ★ 12 -
MCP servers for Android and iOS reverse engineering: static APK/IPA analysis (npm) and dynamic analysis with adb, Frida and mitmproxy (pip)
MIT ★ 1 -
Modular Python coding and agent platform — LLM agents, graph RAG, static analysis, git ops, cloud and container deployment, all exposed as Model Context Protocol tools. uv-managed, with a zero-mock test suite.
MIT ★ 10 -
Static decompiler, deobfuscator, and unpacker for reverse engineering and malware analysis: Python decompiler (3.8-3.15), PyInstaller extractor, PyArmor unpacker, JavaScript deobfuscator (obfuscator.io, JS-Confuser, webpack), Android APK and Java decompiler, .NET deobfuscator, UPX unpacker, Lua, PHP, WASM, PowerShell. MCP server.
NOASSERTION ★ 172 -
mysqlmcpgithub.com/phpgao/mysqlmcpupdated this year
MySQL MCP server — multi-instance MySQL access for AI assistants. SQL static analysis, read-only enforcement, dual transport.
-
IAM Policy Autopilot is an open source static code analysis tool that helps you quickly create baseline AWS IAM policies that you can refine as your application evolves. This tool is available as a command-line utility and MCP server for use within AI coding assistants for quickly building IAM policies.
Apache-2.0 ★ 505 -
Model Context Protocol (MCP) server for static analysis, syntax checking, and state leakage detection in AutoCAD AutoLISP (.lsp) files.
MIT ★ 2 -
coding-ethosgithub.com/paudley/coding-ethosupdated this year
Policy-as-code enforcement for AI agents with MCP, CEL, Git hooks, SARIF, and static-analysis guardrails.
pypi AGPL-3.0-only -
mustelgithub.com/mustel-py/mustelupdated this year
Non-AI static analysis layer for AI IDEs and coding agents - bug detection, security scanning, and CVE checking via MCP
pypi MIT License -
Lint and explain Dockerfiles and compose files over MCP, statically (no Docker daemon): 47 rules with line numbers and concrete fixes, layer-cache analysis, .dockerignore checks, fix previews. Secrets redacted.
MIT -
CodeDebriefgithub.com/ferdinandobons/CodeDebriefupdated this year
Local-first static analysis that turns source code into deterministic, source-grounded workflow maps for coding agents via MCP.
Apache-2.0 ★ 42 -
Android Pentest AI Assistant (APAIA) is an MCP server for Claude AI that was specifically created for Android pentesting/bug bounty purposes and aims to provide assistance for recon, static code analysis and exploits using ADB and JADX.
-
aicaudit — AI-powered code audit for Python: taint-path static analysis + evidence-grounded AI verdicts. Every result ships with a machine-checkable source-to-sink path.
MIT -
sqlikeno update data
Deterministic SQL static analysis and query-equivalence checking for Postgres, MySQL, SQLite, and SQL Server. analyze returns validity, anti-patterns, auto-rewrites, and schema/index advice for a query; diff checks whether two queries are equivalent (result-preserving) - a verdict LLMs cannot reliably self-grade. Queries are tokenized locally before leaving your machine.
smithery -
ER diagrams, N+1 detection, schema drift & migration-risk linting for Django and SQLAlchemy (Alembic) — VS Code, CLI and MCP server. Static analysis: no database, no app boot. Free & MIT. Formerly django-orm-lens.
pypi MIT ★ 111 -
High-performance zero-dependency static analysis tool enforcing NASA Power of Ten rules across 20 programming languages, plus AI agent skill, MCP server config, prompt template, and LLM model security auditing.
npm MIT -
Ontology-driven codebase indexer and query service. Parses C#, TypeScript/JS, Go, Python, and SQL into an embedded graph database. Exposes Model Context Protocol (MCP) tools for AI agents to perform deep static analysis, cross-project call-graph tracing, and data lineage mapping.
MIT ★ 18 -
Fashion E-Commerce Intelligencegithub.com/alexgenovese/ecommerce-fashion-market-analysisno update data
# Fashion E-Commerce Intelligence MCP Server Empower your AI agents, copilots, and assistants with vertical domain-specific fashion intelligence. Built by [alexgenovese.com](https://alexgenovese.com), this Model Context Protocol (MCP) server provides automated **SEO auditing, category trend research, DTC demand forecasting, CRM segment enrichment, and campaign creative generation**—designed natively for Cursor, Claude Desktop, Claude Code, and any MCP-compatible environment. --- ## ⚡ What It Does | Capability | Without this server | With Fashion MCP | |---|---|---| | **SEO Auditing** | Manual checklists, generic advice | Automated **0-100 score** across 5 dimensions with fashion-specific validation (fit, material, color, season, schema, OG, Twitter Cards). | | **Trend Research** | Generic search queries | Deep category-level trend intelligence (trending keywords, colors, silhouettes, price tiers, market fit, confidence). | | **Demand Forecasting** | Spreadsheets & gut feel | Explainable weighted-rule forecast model: `baseline × trend × media × retention × inventory × seasonality` with backtesting. | | **CRM Segment Enrichment** | Static email lists | Customer segments enriched with trending colors/silhouettes/keywords, audience clusters, and ready-to-send targeted messaging. | | **Campaign Creative** | Standard copywriters per channel | Platform-specific campaign themes, hooks, value propositions, and ready-to-use creative briefs grounded in real-time trend data. | --- ## 🔧 Exposed Tools - `product_seo_audit`: Audit any fashion product listing for SEO best practices, structured schema, meta tags, and fashion relevance (fit, size, material). - `fashion_trend_analysis`: Analyze fashion trend data mapped from search engine and social media queries. *(Receives search data input seamlessly, no API key required)*. - `fashion_category_demand_outlook`: Get a rapid, light demand pulse check for a specific product category in a target market and season. - `fashion_dtc_forecast_analysis`: Generate complete DTC demand forecasts with scenario planning (base/upside/downside) and stock-out/overstock risk analysis. - `fashion_customer_trend_enrichment`: Map trending keywords, colors, and silhouettes onto existing CRM customer segments for targeted email/SMS campaigns. - `fashion_campaign_theme_recommendation`: Recommend conversion-optimized ad campaign themes, hooks, and creative briefs for Meta, Google, TikTok, or Email. --- ## 🔐 Privacy & Technical Features - **No API Keys Required:** All analysis, SEO audits, demand forecasts, and CRM enrichment tools run locally with the data you supply. Upstream search data for `fashion_trend_analysis` uses your existing Tavily MCP server. - **Explainable Outputs:** Every tool returns explicit `assumptions[]`, `dataGaps[]`, and `confidence` scores, so your agent always understands the reasoning behind recommendations. - **Zero-Config Local Cache:** Uses a local SQLite persistence layer (`~/.fashion-mcp/store.db`) to cache snapshots, feature stores, and forecast actuals for backtesting. ## 💻 Local Installation To install this stdio-based server locally via Smithery: ```bash npx smithery install alexgenovese/ecommerce-fashion-market-analysis ```
smithery -
個人開発の技術記事と再現コード。ローカルMCP・Git・Python・RSSを、手元で試せる例と検証結果で共有。Zenn連携。
-
BinaryAnalysis-MCPgithub.com/Ap3x/BinaryAnalysis-MCPupdated this year
MCP server for analyzing PE, ELF, and Mach-O binaries using LIEF
GPL-3.0 ★ 26 -
Local-first, deterministic repository structure and data lineage analysis
pypi Apache-2.0 -
jcgraphgithub.com/xuelin25/jcgraphupdated this year
Java代码知识图谱构建工具 - 基于语义分析的 Java 项目理解和查询工具,支持 MCP Server
pypi MIT -
Multi-language architectural and idiomatic code analysis via CLI and MCP server.
pypi MIT License -
Extensible Python code intelligence MCP server for semantic analysis and navigation
pypi MIT -
Static, reverse-engineering-assisted vulnerability triage for AI agents -- CLI + MCP server, no Ghidra required. For files you own or are authorized to test.
MIT ★ 1 -
The AI X-ray for any file: what is it, what does it hide, what changed. Static reverse-engineering intelligence via CLI and MCP. Built on REA.
npm MIT -
mulle-roam-codegithub.com/mulle-cc/roam-codeupdated this year
Instant codebase comprehension for AI coding agents
pypi MIT -
Integrates Lineai's powerful codebase knowledge graphs with a Model Context Protocol (MCP) server
pypi MPL-2.0 -
tielinegithub.com/nugehs/tielineupdated this year
Static frontend↔backend contract-drift checker. Pact without writing a single contract test.
MIT -
MCP server for Python, JavaScript, and TypeScript code analysis with Ruff, ty, Vulture, and Biome
pypi MIT