Security MCP servers

Scans files for leaked secrets and API keys

Detects leaked secrets & API keys: 32+ provider rules (AWS, GitHub, Stripe, OpenAI…), zero deps.

Detect hardcoded secrets in source and config. Reports masked previews, never the values.

Static C/C++ memory-safety scanning and PE/ELF binary protection audits (ASLR, DEP/NX, SafeSEH, PIE), with remediation via secure templates.

Fetch a URL's response headers and grade CSP, HSTS, X-Frame-Options and related security headers.

Reads security headers and CSP line by line in your config file and names the lines that silently do

MCP gateway: many servers, one policy, lethal-trifecta blocking, PII masking, audit log

Bundle of secret-scanner, dependency-auditor, ssl-inspector, and dns-intelligence

13 rules that decide whether a vulnerability report ever reaches you

Static security scanner for MCP servers and agent tools: detects secrets, shell execution, risky tool descriptions, environment access and prompt injection.

Security intelligence: HIBP password breach checks, email/domain/IP/URL reputation, prompt injection detection and skill supply chain scanning.

Local macOS scanner for secrets leaked into AI tool chat transcripts, with redacted findings, placeholder-only redaction and Keychain-backed command execution.

Security scanner for third-party AI agent-skill files (SKILL.md, hooks, scripts) via MCP.

Scan SKILL.md files, MCP configs and system prompts for credential theft, prompt injection, zero-width character attacks and ClawHavoc indicators.

Checks declared npm/PyPI dependencies against real registries to catch slopsquatting

Search stories and discover OSINT sources in Taranis AI.

Enterprise code intelligence for M&A, security audits, and tech debt. Hosted server with 200k free.

Fail-closed MCP adapter for untrusted model output over a local Tkach runtime.

Scans MCP tool definitions for hidden instructions and confused-deputy sinks

Supply-chain gate for agent skills and MCP servers: detects poisoned tool definitions, pins servers by hash, checks drift in CI and proxies only pinned tools.

AI URL safety validator: SAFE/SUSPICIOUS/DANGEROUS verdict, trust score, threat intel.

Security-first MCP server for PostgreSQL, SQLite, MySQL, DuckDB with SQL injection prevention.

UPI ID OSINT - Phone to UPI VPAs + Bank Names (India)

Share end-to-end encrypted, self-destructing secrets from an agent, reading them from env vars or files so they stay out of LLM context.

Injects secrets into shell commands at exec time; plaintext never reaches the LLM context

Probes vector-database endpoints for unauthenticated exposure of embeddings/RAG data

MCP server for VibeScan — scan projects for leaked secrets and security issues

Triggers GuardBee scans, queries findings, AI-assisted remediation guidance

Weavatrix Online extension: guarded sync, advisories, malware review, architecture contracts.

Read-only check of a live URL for publicly exposed secret files: .git, .env, JS source maps, backup/SQL dumps, directory listings and dotfiles.

Model Context Protocol server for a self-hosted secrets manager on Cloudflare Workers and D1. Lets an AI coding assistant list and write secrets without a value ever entering the conversation.

See which AI agent and MCP server talks to what on Windows, with a rule-based security verdict

Trust-aware repository facts for agents: build, test, docs, license, and security, no scraping.

Team secrets your AI agent can use but never read: encrypted in the repo, value-blind tools.

Scan code for Korean compliance risks — PIPA/개인정보보호법, Network Act, Credit Info. Not legal advice.

Journals every MCP tool call with secrets redacted; with a policy, holds risky calls for approval

Check, test, prove and review a rowstile policy: access rules for Postgres row-level security

Query the Small Print record: versioned, diffed tool descriptions and schemas of MCP servers, skills and plugins, with graded changes and public advisories.

Check lockfiles against malicious-package advisories and scan artifacts for credential theft, exfiltration, obfuscation, prompt injection and droppers.

MAC address (OUI) vendor lookup with randomized-address detection, plus router default login IPs and admin credentials cited to manufacturer documentation.

Dependency intelligence for coding agents: live CVE scanning, dependency health, upgrade planning, ecosystem news and decision memory.

MCP server for ai-supply.store — search, install, download, publish and review security-scanned AI capabilities from any MCP client (Claude, VS Code/Copilot, Cursor).

Verifiable oracle tools via AIMarket Hub: Platon VRF randomness, Chronos VDF computation and verification, and LUMEN reputation scores.

MCP server providing security scanning, prompt injection detection, secret leak detection, and agent permission auditing for AI agent workflows

MCP server exposing pay-per-call developer and npm supply-chain security tools for coding agents, over x402.

Algenta decision engine: dataset discovery, exact queries, utility models, decision memory and governed agent runs with approvals and execution receipts.

AlienVault OTX MCP — Open Threat Exchange (free with key)

Risk gate that agents call before irreversible actions, returning a risk score, reversibility class, red flags and a proceed/confirm/human-required decision.