Security MCP servers

CVE scanning for npm/pip/cargo dependencies via OSV

Package intelligence across many ecosystems: health, vulnerabilities (OSV, CISA KEV, EPSS), typosquats, malicious packages, alternatives and breaking changes.

AI-Powered Security Scanner for LLMs. Detects vulnerabilities and syncs with SynapseAudit.

AI code review — security, quality, performance. Learns your patterns. Receipted.

AI security scanning and trust scoring. Stack-specific threat models. Free local scan.

Lint Dockerfiles for root users, latest tags, secrets in ENV or ARG, missing HEALTHCHECK and more.

Audit a domain's email and web security: SPF, DKIM, DMARC, MTA-STS, DNSSEC, TLS, WHOIS. No API keys.

MCP server for Drone CI/CD: 45 tools for builds, repos, secrets, users and templates

Privacy-first OSINT scanner: breaches, credentials, Shodan, username sweep. Scored PDF report.

MCP elicitation anti-patterns: secrets in forms, third-party authorize URLs, credentials in URLs

16 checks on a system-security-plan JSON, in your editor, before a validator returns the package

URL fetcher and HTML-to-Markdown converter with layered prompt injection defense: hidden-element sanitization, risk scanning and content boundary wrapping.

Real-time Python package and vulnerability data for AI coding agents.

MCP server that scans your repo's dependencies for security vulnerabilities based on published CVEs.

Find US federal grants your organization is actually eligible to apply for. Free, no API key.

Guard Core security MCP: SecurityConfig validation, docs search, live threat detection.

AI Agent Guardrails MCP server - security layer

Runtime policy enforcement for AI agents: evaluate actions against organization policies before execution, in observe or enforce mode.

Screen crypto wallets vs OFAC SDN + threat intel; pre-payment checks, signed receipts; SAR drafts

Security tools for your AI: scan, pentest, check headers, guard code and scan repos for secrets.

Read-only Kubernetes MCP server: inspect resources, logs, events, and metrics. Secrets are masked.

Search and install 20,000+ security-graded MCP servers and agent skills.

Precision-first security scanning for Model Context Protocol servers.

Scans agent code for untrusted input poisoning persistent cross-session memory

Find relevant security data from Sentinel data lake for building effective agents. More:aka.ms/s/de

MCP server for Mimecast email security: message queue, held messages, domains, and threats.

MCP server for Mimecast email security: message queue, held messages, domains, and threats.

Scans ML model files (PyTorch, safetensors, Keras, ONNX) for supply-chain risks

Scan ML model artifacts, URLs and directories for unsafe serialization, malicious patterns and risky packaging using ModelScan, PickleScan and heuristics.

Mocap, rehab biomechanics, threat intel, fleet vision. 21 MCP tools, 10 free. x402/USDC paid.

This package is intended for demonstration only. Maintained by JFrog Security.

26 free OSINT tools as MCP tools for AI agents. Auto-installs everything on first run.

Developer and security utilities via the onlinecybertools.com API: encoding, hashing, JWT decoding, regex testing, formatters, network diagnostics and OSINT.

Lint OpenAPI 3.x documents for missing security, responses, descriptions and versioning.

Finds the lines in an OpenAPI file that publish an endpoint with no authentication, an API key in th

Cross-repository code knowledge graph for Java, Kotlin, JavaScript and TypeScript: call-flow tracing, taint analysis, reachability and license compliance.

Supply-chain guard for AI coding agents: verify packages, check vulns/malware, detect typosquats.

AI website audit: security, SEO, performance, UX and accessibility checks with actionable fixes.

Offline methodology engine for authorized penetration testing, CTF, and security research.

Least-privilege compiler for agents: record real tool calls, compile a minimal policy, enforce it at an MCP gateway and keep a hash-chained audit.

Post-quantum CMMC compliance scanner & AI agent attestation. FIPS 140-3, ML-DSA-65, 36K+ mappings.

Scans RAG content/scraped pages for indirect prompt injection

Catches leaked credentials and PII in outbound LLM prompts

Generate zero-knowledge proofs of identity claims (Coinbase KYC, country, Google OIDC, Microsoft 365) without revealing personal information.

Read-only network & security recon tools (DNS, TLS, headers, CORS) for AI agents, each graded.

Connect AI assistants to the Rubrik Security Cloud GraphQL API to discover, query, and automate.

Scam and threat checks for phone numbers, URLs, texts, emails, documents and QR codes using FTC/FCC complaints, URLhaus and ThreatFox, with risk scores.

Evidence-first security review of authorized repositories. Read-only, root-confined, no shell.