Search: security
Search MCP servers and agent skills by name, description, category or topic — 292 results.
airblackbox/air-blackbox-mcp
EU AI Act compliance scanner for Python AI agents. Scans, analyzes, and remediates LangChain/CrewAI/AutoGen/OpenAI code across 6 articles with 10 tools including prompt injection detection, risk classification, and trust layer integration. The only MCP compliance server that generates fix code, not just findings.
Declade/lucairn-sdks
Privacy-preserving AI gateway. Sanitises PII (German + English; Microsoft Presidio + custom recognisers) before prompts reach Anthropic / OpenAI / your LLM, then emits a signed cryptographic certificate per call (Ed25519 + RFC 3161 timestamp + Sigstore Rekor anchoring). EU GDPR + AI Act ready. Free tier 500 calls/month, BYOK. Install: `npx -y @lucairn/mcp-server`. Docs: https://lucairn.eu/develope
zw008/VMware-Harden
VMware vSphere compliance and hardening — read-only baseline scanning plus drift detection across CIS, vSphere SCG, China DJCP 2.0, and PCI-DSS frameworks. 6 read-only tools with LLM-powered remediation suggestions (apply-side gated through vmware-pilot approval workflow).
WRG-11/wrg-sigma-rules
Sigma detection rule writing, validation, and conversion (Splunk/Elastic/Kibana/Wazuh) via 3 MCP tools (`draft_rule`, `validate_rule`, `convert_rule`) backed by a 61-rule production corpus across 11 MITRE ATT&CK tactic categories. Standalone server + Claude Code plugin distribution.
calllint/calllint
Pre-flight security linter for MCP servers, agent tools, and skills. Scans a config *before* it runs — offline, deterministic, evidence-backed — and returns SAFE / REVIEW / BLOCK / UNKNOWN verdicts without executing the server it judges. CLI (`npx calllint scan`), MCP server (`npx calllint-mcp`), SARIF + CI gate. UNKNOWN is never SAFE.
shieldly-io/mcp
Official [Shieldly](https://www.shieldly.io) MCP server: `analyze_iam_policy` and `analyze_cloudformation_template` tools flag AWS IAM privilege-escalation paths, wildcards, and over-permissive access. Free demo mode, no signup or API key needed. `npx -y @shieldly/mcp`.
trustscoreagent/trustscoreagent
Check the reputation of an AI microservice or public API *before* calling it, and submit ratings afterward — from a free, open trust registry (no account or API key). Scores combine Bayesian reputation and EigenTrust, strengthened by cryptographically signed service receipts and a Merkle audit trail. Install: `npx -y @trustscoreagent/mcp-server`.
fosdickio/binary_ninja_mcp
A Binary Ninja plugin, MCP server, and bridge that seamlessly integrates [Binary Ninja](https://binary.ninja) with your favorite MCP client. It enables you to automate the process of performing binary analysis and reverse engineering.
kimwwk/repocrunch
MCP server that gives AI agents structured, ground-truth GitHub repository intelligence. Analyze tech stack, dependencies, architecture, health metrics, and security indicators with deterministic JSON output.
drolosoft/go-docs-mcp
Multi-format document MCP server — read, search, OCR, and extract from PDF, TXT, MD, DOCX, CSV, and images. Single Go binary, 12 tools, smart mtime-based caching, directory-locked security.
rafapra3008/cervellaswarm
Verify AI agent communication protocols using session types. Formal specification with Lean 4 proofs, linter, formatter, and LSP. Catches deadlocks and role violations before deployment.
takleb3rry/zitadel-mcp
MCP server for Zitadel identity management — manage users, projects, OIDC apps, roles, and service accounts through natural language.
gjenkins20/webmin-mcp-server
MCP server for Webmin with 61 tools for Linux system administration: services, users, storage, security, databases, and more.
sentien-labs/verdictswarm-mcp
Multi-AI crypto token scanner. 6 AI agents independently analyze and debate token risk on Solana, Base, and Ethereum. Detects rug pulls, honeypots, holder concentration, and wash trading through adversarial consensus.
sailorpepe/undesirables-mcp-server
TCG collectibles + AI agent intelligence. 35+ tools: Vision AI card grading (PSA/Beckett prediction), Monte Carlo price simulation (Heston/Merton/Kou), AI music generation, local image generation (FLUX), TTS, RAG memory, SAST security auditing, and x402 Oracle API. 370K+ indexed products across 25 games. Install via `pip install undesirables-mcp-server`.
chasdaddy/basescope
The read-only safety layer for onchain AI agents. 13 read-only tools on Base + EVM: token/contract safety (honeypot & rug-pull checks cross-referenced across GoPlus + honeypot.is), risky-approval detection, verified-source lookup, balances, ENS + Basenames, gas, and prices. No private keys, no required API keys. `npx -y basescope`
askalf/truecopy
Supply-chain gate for agent skills and MCP servers — scans tool definitions for poisoned instructions, pins vetted servers by content hash in a committed lock, and verifies drift in CI; the bundled truecopy-mcp proxy exposes only pinned, unmodified tools from a live server.
AgentValet/AgentValet
Identity and credential governance broker for MCP servers. Issues scoped, short-lived credentials per agent to stop credential inheritance. Audit log, human approval gates, AIMS-aligned.
chrbailey/promptspeak-mcp-server
Pre-execution governance for AI agents. Intercepts and validates every agent tool call through an 8-stage pipeline before execution — risk classification, behavioral drift detection, hold queue for dangerous operations, and complete audit trail. 45 tools, 658 tests.
infai-tech/vulnfeed-mcp
Dependency vulnerability scanner with EPSS exploit probability scoring. Scans lockfiles (npm, pip, Go, Cargo, Ruby, Composer, Gradle, NuGet, Mix), prioritizes by real-world exploit likelihood, recommends fix versions. 9 MCP tools for scanning, monitoring, and alerting. Free tier + x402 micropayments. `pip install vulnfeed-mcp`
joergmichno/clawguard-mcp
Security scanner for AI agents that detects prompt injections using 42+ regex patterns
mrz1880/mcp-keycloak-admin
Administer Keycloak through its Admin REST API — users, roles, clients, groups, identity providers, federation and events. Safe by default: read-only mode, realm allow-list, and confirmation for destructive actions. `npx -y mcp-keycloak-admin`
rob925/mcp-shield
Static security scanner and MCP server for MCP servers and AI agent tools. Detects secrets, shell execution, risky tool descriptions, environment access, and prompt-injection phrases. `mcp-shield-server`
Pentagonal-ai/pentagonal
AI-powered smart contract security forge with 8-agent adversarial pen test. Generate, audit, fix, and compile contracts across 8 chains (Ethereum, Solana, Polygon, Base, Arbitrum, Optimism, BSC, Avalanche). Token intelligence with honeypot detection. x402 USDC payments for autonomous agents.
drzamarian/n8n-mcp-community
Security-focused MCP server for self-hosted n8n Community Edition: 44 bounded tools for workflows, executions, credentials, tags, and diagnostics, read-only by default, with no external AI calls.
gbrigandi/mcp-server-wazuh
A Rust-based MCP server bridging Wazuh SIEM with AI assistants, providing real-time security alerts and event data for enhanced contextual understanding.
layervai/qurl-mcp
Mint, resolve, audit, and rotate expiring scope-limited access links (qURLs) for AI agents — secure URL gateway for the qURL API. 9 tools (create / resolve / list / get / delete / extend / update / mint-link / batch-create), 3 resources, 3 guided prompts. stdio transport, OIDC-attested npm provenance.
82ch/MCP-Dandan
Real-time security framework for MCP servers that detects and blocks malicious AI agent behavior by analyzing tool call patterns and intent across multiple threat detection engines.
MARUCIE/authbox
Zero-knowledge password manager with MCP credential gateway. BIP-39 seed phrase recovery, deterministic passwords, policy-gated AI agent access (scope, rate limits, time windows, step-up approval), 70+ API key providers, and hash-chain audit trail. Go + Next.js + TypeScript.
agentgraph-co/agentgraph
Trust verification and security scanning for AI agents. Checks security posture of third-party MCP servers and tools with signed attestations (Ed25519/JWS) before interaction.
datanexusmcp/mcp-server
55 tools for verified public data lookups — CVE/SBOM security audits, licence compliance, patents, federal contracts, NPI provider lookups, nonprofit 990 filings, and domain intelligence. No API key required.
MoltyCel/moltrust-mcp-server
Trust infrastructure for AI agents — register DIDs, verify identities, query reputation scores, rate agents, manage W3C Verifiable Credentials, and handle USDC credit deposits on Base.
shyshlakov/pci-dss-mcp
PCI DSS v4.0.1 static-analysis MCP server for Go payment codebases. 12 scanners detect PAN/CVV exposure, weak crypto, missing audit logs, vulnerable deps, TLS misconfig, auth weaknesses, plus CycloneDX 1.6 SBOM generation - each finding mapped to the exact PCI requirement. AI-assisted triage via triage_findings. Keyless-signed multi-arch Docker image on ghcr.io.
ajipurn/fida
Local-first MCP gateway for coding agents that redacts detected secrets from file reads and command output before they reach model context.
cyntrisec/cyntrisec-cli
Local-first AWS security analyzer that discovers attack paths and generates remediations using graph theory.
toan203/osv-ui
Visual CVE audit dashboard for npm, Python, Go, and Rust. Scan from Claude/Cursor, opens a browser UI for human review (human-in-the-loop), applies fixes with explicit confirmation. Powered by OSV.dev.
willianpinho/mcp-gateway-scan
Read-only static scanner for MCP / agent-gateway production-readiness. The `scan_gateway` tool scores a repo across 7 security dimensions (RBAC, fail-closed, supply chain, observability, cost, secrets, prod-readiness). Never executes code or prints secret values.
honeylabshq/honeylabs-mcp
Honeypot threat intelligence for AI agents: 90 days of probe data from a sensor network for IP reputation, scanner classification, CVE probing trends, and JA4/JA4H/HASSH fingerprints. Remote MCP, free tier.
jamjet-labs/jamjet-policy
MCP stdio interceptor (`@jamjet/mcp-shim`) that applies one YAML policy file (block / require_approval / audit / budget cap) to `tools/call` requests before they reach the real MCP server. The same policy also runs in Claude Code PreToolUse hooks (`@jamjet/claude-code-hook`), OpenAI Agents SDK guardrails (`@jamjet/openai-guardrail`), and JamJet's Python/TS SDKs — `jamjet audit show` tails every de
daedalusdevelopmentgroup/ddg-agent-payable-services
Pay-per-call x402 gateway: one MCP server for 90+ agent tools (utilities, DNS/WHOIS, blockchain RPC, market data, prediction markets, DEX data, security audits) plus an OpenAI-compatible LLM gateway. USDC on Base, free-trial calls per agent. `pip install ddg-agent-services-mcp` or remote `https://mcp.daedalusdevelopmentgroup.com/mcp`.
Alepha188838884/context-firewall
Local proxy that collapses N downstream MCP servers into 4 meta-tools with progressive tool discovery (measured: 122 tools → 4, ~28.6K tokens of definitions saved), compresses large tool outputs (HTML→Markdown, JSON structure summarization, base64 stripping — 60–95% measured on real pages/APIs) with full-output retrieval via `read_more`, and prints a per-session token-savings report. Security-rele
moxno/privacyscrubber-mcp
Zero-trust local PII and secrets masking server for Cursor, Windsurf, and Claude Desktop. `npx pii-masking-run`
jamesdfinance-dev/lazaretto-mcp
Check whether anything you depend on is known malware, before an agent installs it. `check_lockfile` takes a package-lock.json, yarn.lock or pnpm-lock.yaml and matches every pinned version against published malicious-package advisories in one call, free and with no API key, catching compromised releases like chalk@5.6.1 while leaving their clean releases alone. `scan_artifact` adds deterministic b
alexar76/aimarket-oracle-gateway
Verifiable oracle MCP server**: Platon VRF (`get_random`), Chronos VDF (`compute_vdf` / `verify_vdf`), LUMEN reputation (`get_reputation_scores`) as agent tools. Pay-per-call over AIMarket Hub; every result independently verifiable. stdio · Python · [Glama](https://glama.ai/mcp/servers/alexar76/aimarket-oracle-gateway).
corewebvitals/state-of-cwv-mcp
Free remote MCP for Core Web Vitals metrics by CMS, CDN, and framework (Chrome field data + multi-site crawl). No auth. Endpoint: `https://www.corewebvitals.io/api/state-of-cwv/mcp`.
tatavarthitarun/nowsecure-mcp-server
MCP server for NowSecure Platform mobile security testing. List applications, pull remediation findings via GraphQL, and generate PDF reports locally (bypasses broken UI export). Published as `nowsecure-mcp-server`. `npx -y nowsecure-mcp-server`
kent-tokyo/shohei
Rust infrastructure diagnostics MCP server for AI agents: DNS checks, TLS certificate chain inspection, email security, global DNS propagation, and DNS latency benchmarking.
rudraneel93/mcp-guardian
Security and governance proxy for MCP infrastructure. Enforces YAML-configurable policies (blocklists, rate limits, token budgets), tracks real token costs via tiktoken, monitors server health with live JSON-RPC probes. Features include OAuth 2.1/OIDC with RBAC, web dashboard with Prometheus metrics, payload normalization against encoding bypasses, semantic shell AST analysis, mTLS zero-trust netw