Security MCP servers

MCP for Roblox Studio and Open Cloud: drive Studio, run headless tests, and review game security.

MCP server for npm package management, security analysis, and compatibility checking

Verify a photo's capture time and provenance: C2PA Content Credentials validation, EXIF/XMP consistency checks and pixel forensics combined into one verdict.

CISO-Approved Zero-Trust PII & Secrets Redaction MCP Server for Cursor, Windsurf, and Claude Desktop. Prevent API leaks and comply with HIPAA/SOC 2 locally.

AIShield - OWASP MCP Top 10 aligned security scanner. Scan MCP servers, detect tool poisoning, prompt injection, and supply chain risks.

Action logs for AI agents: records every action in a SHA-256 hash chain as an audit trail.

Trust intelligence for AI agents: identity stamps, reputation scoring, a registry, forensic audit trails and A2A passports via x402 micropayments.

Agent identity registry (reputation, capability search, task marketplace, messaging) plus a local encrypted vault that leases provider keys to agents.

Scan and fix a domain's email authentication (SPF, DMARC, DKIM, MX), blacklist status and domain/SSL expiry, with deterministic, validated fix records.

CVE, KEV, EPSS, SBOM and advisory lookups; per-CVE exposure from Shodan data (© Shodan). Keyless.

Scan GitHub repos and profiles for malware before you clone — CLI and MCP server for the Flagrix scanner

Read-only static scanner that scores MCP and agent-gateway repos on RBAC, fail-closed behavior, supply chain, observability, cost and secrets handling.

Honeypot threat intelligence from a sensor network: IP reputation, scanner classification, CVE probing trends and JA4, JA4H and HASSH fingerprints.

DNS and email security scans via IntoDNS.ai: SPF, DKIM, DMARC, DNSSEC, MTA-STS, BIMI, TLS, blacklist and deliverability checks plus security header analysis.

Administer Keycloak via its Admin REST API: users, roles, clients, groups, identity providers, federation and events, with a read-only mode.

Privacy gateway that sanitizes German and English PII before prompts reach an LLM and issues a signed, timestamped certificate for each call.

EVM bytecode capability analysis, EIP-1967 proxy resolution, gas recommendations and preflight safety checks for agents on Base.

MINT Protocol work attestation for agents: cryptographically attest, verify, rate and discover agent work to build portable on-chain reputation.

Real-browser QA audits of a URL: broken signup, login and checkout flows, console errors, missing analytics, security headers, tap targets and accessibility.

CNCF release intelligence: security fixes, breaking changes and deprecations from graduated and incubating project release notes, with local version checks.

MCP server providing screenshot capture capabilities for AI agents with multi-format support, PII masking, and security controls

Payment guardrails for AI agents: spend caps, budget and approval gates, prompt-injection defense, an encrypted secret vault and an audit trail.

Local, read-only scanner for GitHub Actions and CI maintenance issues in AI-built apps, with finding explanations and fix plans.

HSM-backed vault secrets for AI agents (JIT fetch) plus prompt-injection and threat scanning.

Cryptographic provenance, blind reputation scoring and tamper-evident logging for agent interactions, with dispute resolution and trust-based matchmaking.

Identity and credential gateway for agents: Ed25519 identity, encrypted credential vault, OPA policies with audit logging, per-agent memory and web scraping.

Identity and credential broker for MCP servers: issues scoped, short-lived credentials per agent, with audit logging and human approval gates.

Code review as an MCP server — structured reviews with OWASP security scanning.

Intelligence endpoints for security, company, threat, compliance, sales, sports, property and health data, paid via x402 micropayments on Base.

MCP server for static security analysis of Android source code

Cited EU & global law, regulations & security frameworks via Ansvar Gateway. OAuth, free + paid.

54 AI agent tools: OSINT, intel feeds, DeFi, crypto, weather, DNS, proxies. x402 micropayments.

Runtime governance for MCP tool calls that blocks prompt injection and capability abuse before tool results reach the agent.

Third-party certifying proxy that signs any HTTP call with an independent Ed25519 signature, RFC 3161 timestamp and Sigstore Rekor anchor.

Security analysis for Aiken smart contracts on Cardano. 75 vulnerability detectors.

Scan MCP servers and skill files for AVE vulnerabilities. Conformance scoring and threat intel.

Retirement planning for Canada & US. CPP/OAS, Social Security, RRSP/TFSA, 401k/IRA, Monte Carlo.

An MCP server that provides tools to author OSCAL security compliance documentation

Inspect an MCP server for common security risks before you install it. Offline, zero telemetry.

Twelve tools: token, wallet, contract and site security. Two free, the rest $1 in USDC over x402.

Public data lookups: CVE/SBOM security audits, license compliance, patents, federal contracts, NPI providers, nonprofit 990 filings and domain intelligence.

Local STDIO MCP for DugganUSA threat intel. 1.13M IOCs. Read-only. npm: dugganusa-cli.

Electron.js MCP server — IPC scaffolding, security auditing, build tooling for AI assistants

Security-first, self-hosted MCP server for Firefly III — 152 operations behind 5 scoped tools.

Gitleaks Cloud - GitHub API Key Hunter & Secret Scanner

Offline full-text search over the HackTricks security wiki, synced every 3 days.

Headless IDA Pro binary analysis with concurrent sessions and Il2CppDumper and Blutter metadata import for Unity and Flutter reverse engineering.

Scans Greenhouse, Lever, Ashby, Workday, Rippling for roles in any category. Clay-ready.