Security – MCP servers
246 MCP servers in the category Security. Open-source Model Context Protocol (MCP) servers that let AI assistants and agents use external tools and data. Entries come from the community list awesome-mcp-servers; we have not tested each server, so check the repository before you install one.
shyshlakov/pci-dss-mcp
PCI DSS static analysis for Go payment code: finds PAN/CVV exposure, weak crypto, missing audit logs and vulnerable deps, each mapped to a PCI…
sidclawhq/platform
Governance proxy that wraps MCP servers with policy evaluation, human approval workflows and hash-chain audit trails.
sint-ai/sint-protocol
MCP governance proxy with capability tokens, tiered approvals, fail-closed execution and tamper-evident audit receipts, plus preflight tool-risk…
Skyrxin/sast-mcp-server
SAST/DAST scanners (Bandit, Semgrep, Trivy, CodeQL, OWASP ZAP and more) with closed-loop remediation, SARIF/SBOM/VEX export and compliance reporting.
slouchd/cyberchef-api-mcp-server
Use CyberChef operations through the CyberChef server API.
snyk/studio-mcp
Embeds Snyk's security engines into agentic workflows to secure AI-generated code in real time and work through vulnerability backlogs faster.
sp3ak/safenode-mcp-gateway
Fail-closed policy proxy for MCP tool calls that denies, warns on or holds each call for human approval before forwarding, with client-side redaction.
srinivasan-sundaresan95/orihime
Cross-repository code knowledge graph for Java, Kotlin, JavaScript and TypeScript: call-flow tracing, taint analysis, reachability and license…
StacklokLabs/osv-mcp
Query the OSV (Open Source Vulnerabilities) database by package version or commit, batch-query multiple packages and get vulnerability details by ID.
suhui-organization/pod
Least-privilege compiler for agents: record real tool calls, compile a minimal policy, enforce it at an MCP gateway and keep a hash-chained audit.
swnotmetal/Project-Koma
Classify input for prompt injection and out-of-scope content with Koma Gate's LLM-based classifier.
Synvoya/codeinspectus
Local security scanner for AI-generated JS/TS that combines Opengrep, Gitleaks and Trivy with checks for exposed secrets, Supabase RLS and prompt…
takleb3rry/zitadel-mcp
Zitadel identity management: manage users, projects, OIDC apps, roles and service accounts in natural language.
taniwhaai/arai
Enforces rules from existing agent instruction files (CLAUDE.md, .cursorrules) by blocking prohibited tool calls and logging per-rule compliance…
teodorofodocrispin-cmyk/trustboost-pii-sanitizer
Redacts emails, phone numbers, national IDs, private keys and financial data before text reaches LLMs, in English, Spanish, Portuguese, German and…
Thezenmonster/agentscore-mcp-server
Security trust layer that monitors MCP packages on npm for install scripts, command injection, hardcoded secrets, capability drift and publisher…
thyn-ai/algenta-sdk
Algenta decision engine: dataset discovery, exact queries, utility models, decision memory and governed agent runs with approvals and execution…
timescale/rsigma
Author, lint, validate and convert Sigma detection rules with RSigma, evaluate and explain detections against log events, and inspect correlation…
toan203/osv-ui
Visual CVE audit dashboard for npm, Python, Go and Rust using OSV data, with browser-based human review and fixes applied only after confirmation.
tomjwxf/scopeblind-gateway
Security gateway that wraps MCP servers with per-tool policies, approval gates and optional signed receipts, in shadow (log-only) or enforce mode.
Top-Celestial-Company-Ltd/DROS-VajraClaw-Hacker
Deterministic execution governance gateway and W3C DID security guardrail for AI agent MCP tool calls.
trustscoreagent/trustscoreagent
Check the reputation of AI microservices and public APIs before calling them and submit ratings afterward, via an open trust registry.
tunahanaliozturk/derbent
One local gate for Claude Code, Codex, Copilot CLI and Antigravity: allow, deny and ask rules over MCP and built-in tool calls, approvals from a…
uchit/mcp-regulated-ai-compliance
Regulated-industry AI compliance knowledge: control lookup, use-case classification and crosswalks for EU AI Act, NIST AI RMF, ISO 42001, APRA, GDPR…
ucsandman/DashClaw
Fail-closed approval layer for unattended agent runs: checks actions against org policy, requests human approval and logs every decision to a causal…
UnboundCompute/lachesis
Code property graph for C, Python and TypeScript: callers/callees, data and taint flow with source-to-sink witnesses, points-to and guard/sink…
UPinar/contrastapi
Security intelligence: CVE/EPSS/KEV lookups, domain recon (DNS, WHOIS, SSL, subdomains), IOC threat intel, OSINT and code scanning for secrets and…
urldna/mcp
URL scanning and phishing triage: capture DOM snapshots, network requests and screenshots, and hunt historical scans with a custom query language.
vaulted-fyi/vaulted-mcp-server
Share end-to-end encrypted, self-destructing secrets from an agent, reading them from env vars or files so they stay out of LLM context.
velvetway/minreestr-mcp
Search the Russian software registry for import-substitution and FSTEC/FSB-certified products, with full-text search and manufacturer listings.
verax-ai/verax
Sits between an agent and its tools: every call passes a policy gate and leaves a signed decision record before it runs, a refusal is recorded like…
vespo92/OPNSenseMCP
Manage and interact with the OPNsense open source firewall in natural language.
vikasny30/aletheia-mcp
Deterministic pre-execution filter for agent tool calls that blocks scope creep (credential reads, SSRF, destructive shell/SQL) and prompt injection.
vinaybhosle/agentstamp
Trust intelligence for AI agents: identity stamps, reputation scoring, a registry, forensic audit trails and A2A passports via x402 micropayments.
wei9072/aegis
Admission control for agent file edits: checks syntax, structural-cost regressions and workspace boundaries, returning BLOCK, WARN or PASS verdicts.
williamblakecunningham-max/screenverity-mcp
U.S. exclusion, debarment and license screening (OIG LEIE, SAM.gov, state boards) with an Ed25519-signed receipt of the exact list snapshots checked.
WRG-11/wrg-sigma-rules
Write, validate and convert Sigma detection rules for Splunk, Elastic, Kibana and Wazuh, backed by a rule corpus covering MITRE ATT&CK tactics.
yessGlory17/job-verify
Check recruiters and job offers for scams: cross-checks company registration, domain age, look-alike domains, blocklists and crypto-scam databases.
YugantM/hvtracker-mcp
Pre-connect supply-chain trust checks for AI agents, frameworks and MCP servers: evidence-based HVTrust scores and verdicts from public signals…
zboralski/ida-headless-mcp
Headless IDA Pro binary analysis with concurrent sessions and Il2CppDumper and Blutter metadata import for Unity and Flutter reverse engineering.
zekebuilds-lab/captcha-mcp
Middleware that gates MCP tool calls behind a Hashcash proof-of-work challenge or an L402 Lightning payment via self-hosted LNbits.
zinja-coder/apktool-mcp-server
Automate reverse engineering of Android APKs with Apktool.
zinja-coder/jadx-ai-mcp
JADX decompiler plugin providing live, LLM-assisted reverse engineering.
zkproofport/proofport-ai
Generate zero-knowledge proofs of identity claims (Coinbase KYC, country, Google OIDC, Microsoft 365) without revealing personal information.
zw008/VMware-Harden
Read-only VMware vSphere compliance scanning and drift detection against CIS, vSphere SCG, China DJCP 2.0 and PCI-DSS, with remediation suggestions.
zyx77550/sparda
Injects a live, reversible MCP server into a running Express, FastAPI or Next.js app, with safe reads by default and writes gated behind human…