Security MCP servers
Security scanning, identity and secrets. Every server below is from the official MCP registry and is checked by us each day.
Security
498 servers · page 1 of 17
-
Archytan Lite MCP gate
io.github.High-ArchyTech-Solutions/archytan-mcp-gatePuts an MCP tool server behind Archytan Lite: each tool call is authorized and spent before it runs.
Local install -
Toolproof
io.github.ayush00dhyani-star/toolproofTrust grades for MCP servers and APIs — scan, grade, and pin capability drift.
Local install -
MCP Safety Warden
io.github.gautamvarmadatla/mcpsafetywardenMCP proxy adding security scanning, behavioral profiling, risk gating, and safe tool call execution.
Local install -
MCP Modal Server
io.github.george-bobby/mcp-modalMCP server for managing Modal apps, containers, volumes, and secrets.
Local install -
Frame Mcp
io.github.lambdasec/frame-mcpMCP server for the Frame security scanner: scan, verify, fix, exploit, packs and separation logic.
Local install -
vetcode
io.github.openyard-cloud/vetcodeSecurity check for coding agents: malware, supply chain, secrets and web bugs. Reads, never runs.
Local install -
Draugr
dev.draugr/draugrSecurity scanning for AI agents: SAST, SCA, secrets, IaC, DAST, ranked by real risk.
Local install -
gmi-security-mcp
io.github.Jayanng/gmi-security-mcpTriage semgrep findings with GMI Inference, with cost shown before every run.
Local install -
Vulnerability Exposure
io.github.MRFrazer25/vulnerability-exposure-mcpConfirmed vulnerabilities and exposure for IPs, domains and software versions (NVD, CISA KEV, EPSS)
Local install -
Agentscore
io.github.Thezenmonster/agentscoreMCP security trust layer: scan packages, inspect repos, check exposure, monitor changes.
Local install -
Vericairn
io.github.Vericairn/vericairnRead and contribute to a Vericairn estate under the acting principal's authority.
Local install -
WARDEN by AIMarket — MCP tool firewall
io.github.alexar76/wardenMCP security firewall: stdio wrap proxy or inspection tools; zero runtime dependencies.
Local install -
Guardvibe
io.github.goklab/guardvibeDeterministic security layer your AI can't be. 669 rules, 39 tools, CLI + doctor + host audit.
Local install -
QR Code & Barcode Scanner
io.github.qrcode-ai-com/qrcode-barcode-scannerLocal MCP server for QR and barcode image scanning, preserved payload bytes and QR diagnostics.
Local install -
Vizier Guard
io.github.vassiliylakhonin/vizier-guardDeterministic authorization and security guard for AI agent actions with signed receipts.
Local install -
Skarn
com.getskarn/skarnScans AI coding sessions and assistant configs for leaked secrets and risky hooks; local, redacted
Local install -
GhostPaw Souls
io.github.GhostPawJS/soulsLocal cognitive identity engine with traits, behavioral evidence, and revision history.
Local install -
Local install
-
Dvalincode
io.github.arthurpanhku/dvalincodeDeterministic security scanning, no model or API key, plus offline-verifiable proof a fix worked.
Local install -
ICHI — Internet Cyber Health Index
io.github.bernik-bot/ichi-mcpDaily internet-wide cyber threat band (NORMAL-CRITICAL), numeric score, advisories, source health.
Local install -
PressBridge
io.github.pressbridgesupport/pressbridgeRead-only Claude access to WordPress over MCP: secrets hidden, sandboxed, works on broken sites.
Local install -
TAR Engine
io.github.qingxuantang/tar-engineAudit AI skill safety before you ship. Static, semantic, adversarial, supply chain scans.
Local install -
PandaWard
io.github.ratomirjovanovic/pandawardLocal, evidence-based application security assessment with an evidence ledger and retests.
Local install -
Cratis Chronicle
io.github.Cratis/chronicle-mcpInspect Cratis Chronicle event stores read-only by default; opt-in, authorized job control.
Local install -
Domain Security
io.github.OrtaMarco/domain-security-mcp-serverAudit a domain's email and web security: SPF, DKIM, DMARC, MTA-STS, DNSSEC, TLS, WHOIS. No API keys.
Local install -
vibe-shield — security scanner for AI-generated code
io.github.avivgerz-hue/vibe-shieldScans AI-written code for leaked secrets, unguarded routes and missing RLS.
Local install -
rustsdcmcp
io.github.mechubsec/rustsdcmcpJuniper Security Director Cloud MCP server: scoped, audited change control. Rust.
Local install -
Panda Web Security Tools
io.github.pandadad0214/panda-web-security-toolsSite/email/agent safety and monitors: SPF/DKIM, SEO, change + RSS monitors, hidden-AI, WHOIS (7).
Local install -
Polymation
io.github.paradoxsyn/rivemcpAuthor Rive; convert Lottie, After Effects, Animate and Figma into it; animate AI and pixel art.
Local install -
prodlint
io.github.prodlint/prodlintScan AI-generated JS/TS for security and reliability issues; score a site for AI-agent readiness.
Local install
Data: the official MCP registry, read daily. Live status, response time and tool lists come from our own check: we connect without credentials, so servers that need a key show as "Live, key required". Maintainers can add a "Listed on NestDaddy" badge from their server's page.