Security MCP servers

Top 100 by trust score Trust score 0–100

• VerifyMCP

  Independent trust scores, tool surfaces and change history for MCP servers.

  remote 99

• io.github.tiluckdave/hound

  The dependency bloodhound for AI coding agents. Zero API keys, zero config.

  npm 97

• data-breach-detector

  Read-only breach intel, full history 2007-today: reports THAT an org was breached, never the data.

  remote · pypi 96

• Emilia Protocol

  Exact-action approval for consequential agent actions: request, track, and verify signed receipts.

  npm 96

• io.github.kakunin-ai/kakunin

  X.509 identity, risk scoring, and audit logging for AI agents. MiCA + EU AI Act compliant.

  npm 96

• quantakrypto pqc-tools

  Scan code for quantum-vulnerable cryptography and get NIST post-quantum migration guidance.

  remote · npm 96

• Agent Readiness Auditor

  Audits any website for AI agent readiness and safety, scoring prompt injection risk and llms.txt.

  npm 95

• dev.cz-agents/dd

  Czech & EU due diligence in one call — facts, insolvency, sanctions, VAT, risk score, UBO chain.

  remote · npm 95

• Sealgate

  Sealgate gateway proxy: list governed MCP servers and review agent session and audit status.

  remote · npm 95

• OctoWatch DLP

  Read-only OctoWatch DLP Cloud MCP: risks, idle time, productivity, monitoring.

  pypi 95

• io.github.hxckya/pkgtruth

  Catches hallucinated and slopsquatted npm and PyPI packages before an agent installs them.

  npm 95

• Mail7 Email Validation

  Verify email addresses, clean lists, and audit a domain SPF, DKIM, DMARC and MX setup.

  npm 95

• bouncer

  Static compliance-controls checker for UK Online Safety Act & ICO Children's Code. CLI + MCP.

  npm 95

• ALTWEB Context Loader

  Loads signed ALTWEB context capsules — refuses unsigned, tampered, or untrusted by default.

  npm 95

• io.github.Spacetime-Technology/safehold

  Local, encrypted MCP vault for passports, IDs, visas and photos. You control access.

  npm 95

• io.github.uchit/mcp-regulated-ai-compliance

  Regulated-industry AI compliance: EU AI Act, APRA, NIST AI RMF, ISO 42001, AU AI Safety.

  npm 95

• io.github.xu-c0/cybersec-mcp

  Cybersecurity MCP server: 323 prompts + 7 workflows for red team, blue team, SOC, cloud, OSINT.

  npm 95

• BackBond Agent Scan

  Vet MCP tool manifests before attachment; returns block, review, or no blocking finding.

  npm 94

• Bawbel Scanner

  Scan MCP servers and skill files for AVE vulnerabilities. Conformance scoring and threat intel.

  pypi 94

• agentgate

  Read-only evidence for the tools agents run: MCP server records, coverage and policy.

  npm 94

• com.oksigenia/checker-mcp

  Domain security & privacy checker as an MCP server. 17 live checks, 0-100 score, local-first.

  npm 94

• ~Alter Identity

  Mint an agent identity in two free calls. Verify anyone. Earn 75% when someone reads you.

  remote 94

• io.github.darrenjrobinson/entrapulse-polyarchy

  Interactive Entra ID identity relationship visualization — the 2003 polyarchy, live as an MCP App

  npm 94

• io.github.dir-ai/voyager-agent

  One universal Voyager: name a goal; it activates senses (repo, net) and runs a live mission.

  npm 94

• io.github.inamprotocol/inam-mcp

  Check an agent's INAM reputation before trusting it, and sign a receipt when work is done.

  remote · npm 94

• AIShield Security Scanner

  Scans MCP servers for tool poisoning, prompt injection and supply chain risks.

  npm 94

• io.github.Nikolife2016/pulsefeed-x402

  Verify x402 payment endpoints before an AI agent pays: scam scan, on-chain checks, trust scores.

  remote · npm 94

• prodlint

  Production readiness for vibe-coded apps. 52 checks for security, reliability, and performance.

  npm 94

• x402 Triage MCP

  MCP server for no-payment x402 surface triage, 402 Index health checks, and paid review handoff.

  npm 94

• Zyrax Guard

  Audit AI agent configs for prompt injection & rogue MCP servers; vet packages

  npm 94

• app.scfcontrolsplatform/mcp-server-scf

  MCP server for the SCF Controls Platform — 187 tools for controls, evidence, risk, and TPRM.

  npm 93

• io.github.bch1212/agentvault

  Credential vault for AI agents — Fernet-encrypted keys, per-agent budgets, audit logs.

  npm 93

• io.github.calllint/calllint

  Static preflight safety gate for MCP servers — scan configs before you run them. Never executes.

  npm 93

• com.dechonet/mcp

  25 security tools for AI agents: phishing links, exposure maps, DNS, SSL, PQC, history, pivots.

  remote · npm 93

• io.github.dockndevai/mcp-keycloak

  Keycloak admin for AI agents — realms, users, clients, roles; safe-by-default governance.

  npm 93

• io.github.gambadio/onepassword-agent-mcp

  Save and use 1Password secrets locally without exposing plaintext to AI agents.

  npm 93

• io.github.goklab/guardvibe

  Deterministic security layer your AI can't be. 599 rules, 39 tools, CLI + doctor + host audit.

  npm 93

• io.github.H129hj/checkmcp

  Audit any MCP server's security & quality — OWASP MCP Top 10 + explainable 0-100 MCP Score

  pypi 93

• io.mcpskills/server

  Trust scoring for MCP servers, AI skills & npm packages — 15 signals + safety scanning.

  npm 93

• traql

  AML risk scoring for crypto addresses and transactions on Ethereum, BSC, TRON, TON, Bitcoin

  npm 93

• pkgproof

  Verify an npm or PyPI package before install: advisories, install scripts, typosquats, repository.

  npm 93

• Domain Security

  Audit a domain's email and web security: SPF, DKIM, DMARC, MTA-STS, DNSSEC, TLS, WHOIS. No API keys.

  npm 93

• io.github.sjh9714/mergewarden

  Check whether a coding agent's changes stayed inside the scope it was given.

  npm 93

• AI AppSec

  Evidence-backed AppSec for AI applications and agents. Powered by HAIEC.

  npm 93

• candor

  Per-function effect analysis for agents: blast radius, what reaches the network, gate verdicts.

  npm 93

• trustlists

  Find public vendor trust centers, analyze SOC 2 reports, and request trust-center access.

  npm 93

• Sentinel Scan

  MCP security scanner: detect tool poisoning, prompt injection & rug-pulls - 10 OWASP heuristics.

  npm 93

• Aileron Journal

  Read-only queries over Aileron audit journals: verify integrity, search recorded tool calls

  pypi 92

• io.github.bch1212/injectshield

  Prompt-injection firewall for AI agents — scan untrusted text before LLM calls.

  npm 92

• AxioRank: Zero-Trust for AI Agents

  Zero-trust gateway for AI agents: score tool calls, verify agent cards, enforce policy, audit.

  remote 92

• Malwagon

  Submit files and URLs to a malware sandbox, poll scans, fetch reports, hashes and IOCs.

  remote 92

• io.github.dir-ai/voyager

  Cited, OSV-gated, injection-hardened web briefs for coding agents. Verified, never raw web.

  npm 92

• RDAP API

  Normalized JSON for any domain across 1,200+ TLDs, reading WHOIS where no RDAP server exists.

  remote 92

• io.github.jamesdfinance-dev/lazaretto

  Free lockfile malware check plus paid behavioral scan of packages, agent skills and MCP tools.

  remote · npm 92

• io.github.mizcausevic-dev/mcp-kinetic-gain

  75-tool MCP server for 12 Kinetic Gain specs and DefenseTech checks.

  npm 92

• io.github.nugehs/aiglare

  Audit AI/LLM features for governance guardrails: confidence, fallback, validation, human-in-loop.

  npm 92

• OPA MCP

  Author, validate, debug, and explain OPA Rego policies through any MCP-compatible client.

  npm · oci 92

• Sequesign

  Cryptographically verifiable receipts of an agent's delegated work, verified offline.

  npm 92

• Shipcheck MCP

  Read-only Shipcheck launch-risk scans for authorized JS, TS, and MCP repos.

  npm 92

• io.github.4hmetuyar/prompt-injection-scanner

  Scans RAG content/scraped pages for indirect prompt injection

  npm 91

• IntoDNS.ai DNS & Email Security Scanner

  DNS and email security: check SPF, DKIM, DMARC, DNSSEC, DANE and build the records. 45 tools.

  remote · npm 91

• Feranor Resilience

  Scan/purge hidden text & score web domains: TLS, DNS, headers, speed. Free scans, $0.01 actions.

  remote 91

• SMI Aware Assistant

  Remote MCP server exposing SMI Aware tools, resources, and skills over Streamable HTTP.

  remote 91

• Trentina

  Secure MCP gateway and quarantine for AI agent traffic — three-layer prompt injection defense

  pypi 91

• Verify SCITT receipts from Forestrie transparency logs, offline

  Verify a SCITT receipt under a trust root you hold — offline, no backend, no key, no network

  npm 91

• Small Print

  Check an MCP server, skill or plugin before your agent uses it: tool text on record, changes graded.

  npm 91

• io.github.dir-ai/voyager-browser

  Voyager's web-page sense: safe read-only observation of one live URL (structure, security, a11y).

  npm 91

• io.github.dmarc-examiner/mcp

  Read your own DMARC aggregate and forensic reports: sources, alignment, alerts, CSV export.

  remote · npm 91

• Vanta

  Vanta compliance MCP server: vulnerabilities, tests, controls, evidence, people, vendors, docs

  npm 91

• PDF Verify (PDF Agent Stack)

  Verify PDF signatures, detect tampering, and identify PDF/A and PAdES conformance levels.

  npm 91

• Have I Been Pwned

  Breach intelligence API: email search, domain monitoring, passwords and stealer logs.

  remote 91

• HVTracker MCP

  Pre-connect trust checks for AI agents and MCP servers using HVTracker's public trust registry.

  remote · npm · oci · pypi 91

• TweetFeed

  IOCs (URLs, domains, IPs, hashes) shared by the infosec community on X/Twitter. No auth, CC0.

  remote 90

• io.github.4hmetuyar/prompt-leak-scanner

  Catches leaked credentials and PII in outbound LLM prompts

  npm 90

• pkgxray

  Pre-install security scans for npm packages, MCP servers, and AI agents with cited verdict evidence.

  npm 90

• io.github.aristiun/aribot

  Threat modeling, code/cloud/pipeline scanning, shadow-AI discovery, compliance checks and fixes.

  remote 90

• AtlaSent MCP Server

  Atlasent for AI agents: with an API key, actions wait for approval with signed proof. No key: demo.

  npm 90

• Aribot

  Threat modeling, code, API & cloud security, shadow-AI & compliance governance.

  remote 90

• MacTech CMMC / NIST 800-171

  NIST 800-171 controls and 800-171A objectives, crosswalks, exact SPRS scoring, POA&M generation.

  remote 90

• com.olane/copass-local

  Local encryption and project setup plugin for Copass. Keys never leave your machine.

  pypi 90

• shadow-mcp

  Local MCP server that inventories and risk-grades MCP servers configured on this machine.

  pypi 90

• Strac MCP DLP

  Detect and redact PII, PHI, PCI and secrets in text and files before an AI agent sees them.

  pypi 90

• SecScan

  Scan, monitor and fix a live web app from your editor: graded security reports with fix prompts.

  remote 90

• io.github.4DA-Systems/4da-mcp-server

  Upgrade intelligence for AI agents: what an upgrade changes, where it touches your code, CVE scans.

  npm 89

• io.github.4hmetuyar/secret-scanner

  Scans files for leaked secrets and API keys

  npm 89

• AgentGate

  Human-in-the-loop approval gateway for AI agents over MCP: request, decide, approve.

  npm 89

• ai.kaiv/dependency-trust

  Trust-check any dependency for agents: OpenSSF Scorecard, licenses, CVEs, deps. 7 ecosystems.

  remote 89

• ai.kaiv/email-check

  Email posture for any domain: can it receive mail, can it be spoofed? MX, SPF and DMARC.

  remote 89

• SRI — MCP Server Inspector

  2,000+ MCP servers read at source level. Know what one does before you connect. Free, no key.

  remote 89

• Shadow AI List

  Risk-ranked registry of AI tools: look up an AI tool's risk or check if a domain is shadow AI.

  remote 89

• SDSentry — SDS Lookup & OSHA HazCom

  Free safety data sheet (SDS) lookup by product name, plus an OSHA HazCom readiness check.

  remote 89

• ContrastAPI

  55 tools, 7 Resources, Sigma rules, email SPF/DMARC, MITRE, CVE/KEV, risk_score. No key.

  remote 89

• Opzyai Security Check

  Local-first security check for AI coding agents: secrets, .env exposure, git-history leaks, CVEs.

  npm 89

• io.github.cyanheads/sanctions-screening-mcp-server

  Screen names against OFAC, EU, UK, UN sanctions lists; resolve entities via GLEIF. Screening aid.

  remote · npm 89

• dev.turva/turva-mcp

  Read-only MCP server for turva.dev, an agent-readiness audit and advisory service.

  remote 89

• io.github.dir-ai/voyager-net

  A safe, read-only, authorized audit of one host you own: DNS, ports, TLS, HTTP hygiene.

  npm 89

• io.github.disclose/lookup-disclose-io

  Find the right security-disclosure contact for any internet asset (domain, IP, package, repo, app).

  remote 89

• io.skimguard/skimguard

  Ask whether a location has recent credit-card-skimmer detections, from a consumer sensor network.

  remote 89

• Uptimeify

  Free anonymous website, DNS, email and TLS checks, plus monitor read and opt-in write access.

  remote 89

• Kevros — Agentic Identity Trust

  Agentic identity trust: precision decisioning, cryptographic release tokens, hash-chained proof

  remote 89