#MCP serverStars · npm/mo

1. 577Datakoot Security IntelCVE lookups with CISA KEV and EPSS exploit scores, plus OSV package vulnerabilities and package.json audits.RemoteFree
2. 578DechoNetPhishing-link checks opened like a Korean phone, plus DNS, TLS, headers, email auth and domain history.RemoteFree
3. 579DnstwistBurtTheCoder/mcp-dnstwistRun dnstwist, a DNS fuzzing tool, to detect typosquatting, phishing and corporate espionage.LocalAccount needed
4. 580Domain IntelligenceWHOIS/RDAP, DNS, SSL, live subdomains with IPs and SPF/DMARC/DKIM for any domain; 1,000 free lookups a month.RemoteFree
5. 581DropBinRemote SSE MCP server for hosting HTML webpages and sharing content through temporary URLs without authenticationLocalFree
6. 582ForgeSecurity audits of shipped code, in plain English.RemoteFree
7. 583GhidrAssistMCPjtang613/GhidrAssistMCPNative Ghidra integration with GUI configuration, logging and no external dependencies.LocalFree
8. 584Governed GatewayCubiczan/governed-mcp-gatewayHTTP MCP gateway that attaches a principal to tool calls and SSE streams, with allowlists and vault rotation.LocalFree0
9. 585GuardrailSECRET4422/guardrail-mcpEnterprise security and code-safety guardrail for AI agents featuring AST taint analysis, SARIF/SBOM generation, and policy gates.LocalFree0
10. 586HALdean/HALHTTP toolkit providing all 7 HTTP methods (GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS) with secret substitution, comprehensive error handling, and support for JSON, XML, HTML, and form data.LocalFree
11. 587HallucCClaim-by-claim AI hallucination detection with sources, agent trajectory verification, and prompt-injection guard.RemoteFree
12. 588HefestoAIChecks code an agent wrote for secrets, injection risks and declared-vs-real dependency drift before merge.RemoteFree
13. 589IP JudgeChecks if an IP is residential, datacenter or proxy, and whether ChatGPT, Claude, Gemini or Muse support its region.RemoteFree
14. 590ISMS CopilotThe compliance specialist your AI calls: ISO 27001, SOC 2, GDPR, NIS 2, DORA and more.RemoteAccount needed
15. 591MaigretBurtTheCoder/mcp-maigretSearch usernames across social networks and analyze URLs with maigret, an OSINT tool that collects account information from public sources.LocalAccount needed
16. 592Mcpindexmcpindex-ai/mcp-server-mcpindexFind MCP servers by describing a task and get advisory trust screens before connecting, using the mcpindex directory.LocalAccount needed0
17. 593Movahedi PrivacyCanadian privacy compliance: enforcement actions, glossary and Law 25 checks.RemoteFree
18. 594NetAPIDomain intelligence: compromised domain and IP checks, TLD stats, Top 1M ranks, new domains, registrars and DNS.RemoteAccount needed
19. 595Nobulexarian-gogani/nobulexProof-of-behavior enforcement for AI agents: define permit/forbid/require rules, enforce them at runtime and keep hash-chained, tamper-evident audit logs.LocalFree
20. 596NPMScanChecks npm packages for known vulnerabilities, malware, typosquats, risky install scripts and maintainer takeovers.RemoteFree
21. 597Opsecforge Toolscyberdroid2077/opsecforge-tools/opsecforge-mcpLocal stdio server that keeps secrets out of coding-agent context: redact_file takes a path and returns only redacted content, scan_secrets checks staged changes before commit, plus offline webhook signature verification and JWT inspection. No network calls; optional Claude Code hook blocks direct .env/private-key reads. Redaction is heuristic.LocalFree0
22. 598PG1 Threat IntelligenceAgent threat intel: wallet sanctions screening, wallet and domain age, hostname reputation; paid STIX 2.1 feed via x402.RemotePaid service
23. 599PhishuntPublic phishing-domain feed: check a domain, search detections by brand, and pivot on campaigns and certs.RemoteFree
24. 600Pollinationspollinations/model-context-protocolMultimodal MCP server for generating images, audio, and text with no authentication requiredLocalFree
25. 601Prompt Injection ScannerCheck text before your agent reads it: hidden instructions, invisible characters and links that leak data.RemoteFree
26. 602PromptguardLayered prompt-injection checks for LLM hosts; 100 welcome credits on signup.RemotePaid service
27. 603ProofableAgent identity, scoped access, and proof across tools. Check authority before an agent acts.RemoteFree
28. 604ProofCoreNotarize AI outputs, audits and agreements on the TON blockchain, with nothing stored server-side.RemoteFree
29. 605Quantum RingI4cTime/quantum_ringQuantum-inspired keyring for AI coding agents, securing secrets with superposition, entanglement, tunneling and teleportation.LocalFree
30. 606ScanMalwareScan URLs in a sandboxed browser and pivot across past scans by domain, IP, ASN or fingerprint.RemoteFree
31. 607ScreenSealSanctions-screening signal for AI agents: check a person or organization against OFAC and EU lists.RemoteFree
32. 608Sealmyapp Toolstoby7979/sealmyapp-toolsOffline security helpers for AI-built (vibe-coded) apps: classify whether a key is safe to expose, generate Supabase RLS audit SQL and owner-only policy templates, and pre-launch checklists for Lovable, Bolt, Cursor, Replit and v0. Ships with a Cursor rule and an Agent Skill.LocalFree0
33. 609SemgrepScan code for security and correctness findings with Semgrep rules.RemoteAccount needed
34. 610Site PassportCheck whether AI agents can safely operate a WordPress site: llms.txt, robots.txt and schema.org.RemoteFree
35. 611SitelemetryAudit sites you own for security, SEO, AI readiness, accessibility, performance and integrations.RemoteAccount needed
36. 612Skillguardepistemedeus/skillguardStatic scanner that checks Claude Code skills, plugins and MCP servers for exfiltration, install hooks and prompt injection before you install them.LocalFree0
37. 613Solana PulseSafety checks for AI agents on Solana: transaction preflight, intent matching and token safety verdicts.RemoteFree
38. 614The Agent ForgeCheck MCP servers, skills and packages before install: field reports, skill scans and AI trap data.RemoteFree
39. 615Toolwritemektor/toolwritPolicy sidecar for any MCP server: deny-by-default tool allowlist with argument rules, call and USD budget caps, and a hash-chained audit log with RFC 3161 timestamp anchors. Also usable as a TypeScript or Python library.LocalFree0
40. 616Trust Ledger osCubiczan/trust-ledger-osTrust and risk control plane for AI teams, with phases, routes and a package catalog.LocalFree0
41. 617TweetFeedIOCs (URLs, domains, IPs, hashes) shared on X by the security community: lookups, tags, trends, campaigns.RemoteFree
42. 618vuln-intelCVE intel for bug-bounty agents: CVE claim fact-checks, attack approaches from HackerOne reports. Free key for calls.RemoteFree
43. 619withHumanConfigure approval pipelines, escalation paths and teams that decide which agent tool calls need a human.RemoteAccount needed
44. 620AIMarket Oracle Gatewayalexar76/aimarket-oracle-gatewayVerifiable oracle tools via AIMarket Hub: Platon VRF randomness, Chronos VDF computation and verification, and LUMEN reputation scores.LocalAccount needed0
45. 621CheckerOksigeniaSL/checker-mcpLocal-first domain security and privacy checker: live SPF, DMARC, DKIM, DNSSEC, TLS, CAA and security header checks, scored with remediation advice.LocalFree0
46. 622Compliance AIopsAIops-tools/Compliance-AIopsTurn other AIops tools' audit trails into tamper-evident, hash-chained evidence bundles mapped to HIPAA, PCI-DSS, SOC 2 and GDPR. Offline and deterministic.LocalFree0
47. 623Identity AIopsAIops-tools/Identity-AIopsKeycloak and Authentik SSO/IAM operations: root-cause analysis for login, permission, client and MFA issues, plus guarded writes with audit logs and rollback.LocalFree0
48. 624Latchpointrobyroro/mcp-latchpointOffline, read-only audit of MCP client configs: flags plain HTTP, shell wrappers, unpinned runners, embedded credentials and broad access scopes; outputs redacted text, JSON or SARIF.LocalFree0