MCP Server Directory

Safety checks for AI agents on Solana: transaction preflight, intent matching and token safety verdicts.

Check MCP servers, skills and packages before install: field reports, skill scans and AI trap data.

emektor/toolwrit

Policy sidecar for any MCP server: deny-by-default tool allowlist with argument rules, call and USD budget caps, and a hash-chained audit log with RFC 3161 timestamp anchors. Also usable as a TypeScript or Python library.

Cubiczan/trust-ledger-os

Trust and risk control plane for AI teams, with phases, routes and a package catalog.

IOCs (URLs, domains, IPs, hashes) shared on X by the security community: lookups, tags, trends, campaigns.

CVE intel for bug-bounty agents: CVE claim fact-checks, attack approaches from HackerOne reports. Free key for calls.

OksigeniaSL/checker-mcp

Local-first domain security and privacy checker: live SPF, DMARC, DKIM, DNSSEC, TLS, CAA and security header checks, scored with remediation advice.

AIops-tools/Compliance-AIops

Turn other AIops tools' audit trails into tamper-evident, hash-chained evidence bundles mapped to HIPAA, PCI-DSS, SOC 2 and GDPR. Offline and deterministic.

AIops-tools/Identity-AIops

Keycloak and Authentik SSO/IAM operations: root-cause analysis for login, permission, client and MFA issues, plus guarded writes with audit logs and rollback.

robyroro/mcp-latchpoint

Offline, read-only audit of MCP client configs: flags plain HTTP, shell wrappers, unpinned runners, embedded credentials and broad access scopes; outputs redacted text, JSON or SARIF.

jaimenbell/rails-mcp

Self-hosted default-deny action registry, append-only spend-intent ledger and human sign-off audit trail for gating irreversible agent actions.

Kjopstad-IT/rqwstr-mcp

HTTP security testing toolkit (send, intruder, race, chain, out-of-band) with low-level HTTP/1.1 and HTTP/2 control: raw framing and connection pinning.

aurumflux20/seal

Exactly-once payments for agents: prevents double settlement across processes and retries, confirms charges with the provider and reconciles out-of-band spend.

verax-ai/verax

Sits between an agent and its tools: every call passes a policy gate and leaves a signed decision record before it runs, a refusal is recorded like an approval, payments wait for an operator on the same machine, and the ledger stays there and verifies offline. Apache-2.0.

Fulcrum-Enterprises/verify-proof

Verify blockchain-anchored timestamp proofs locally: recompute a file's SHA-256, walk the Merkle path and check the anchor on Polygon or Bitcoin.

infai-tech/vulnfeed-mcp

Scans dependency lockfiles for vulnerabilities, prioritizes them by EPSS exploit probability and recommends fix versions, with monitoring and alerting.

Test and debug your AI agent's Web Bot Auth (RFC 9421) signature and see exactly what to fix.

Scans a public URL for hidden instructions aimed at AI agents and returns a risk level with evidence.

Verify an AI agent's signed credential and the human mandate behind it; keys are public for offline checks.

Post-quantum TLS and certificate checks, Wazuh rules tested on a real manager, and a PHP2Shell CVE check.

One-call domain audit: MX receiving, SPF/DMARC/DKIM spoofing protection, disposable-address risk.

Grade a domain's live DMARC, SPF, DKIM, MX, BIMI and MTA-STS records, and generate SPF and DMARC records.

Checks a domain's SPF, DKIM, DMARC, BIMI, MX, MTA-STS and TLS-RPT, with a 0–100 score and fixes.

Check a domain's DMARC, SPF and DKIM, build an SPF record, explain bounces, read DMARC reports.

SaravananJaichandar/etch-mcp

Signed audit chain for AI agent decisions: events are signed, Merkle-chained per project, anchored to public transparency logs and verifiable offline.

project-feldspar-resources/feldspar-scan

Deterministic security scan of public git repositories: vulnerable dependencies via OSV, hard-coded secrets and risky config lint, as file:line findings.

Read-only dApp and website domain checks: registrar and registry locks, DNSSEC, CAA, SRI, SEAL DNS & Registrar controls.

IP risk and geolocation lookup where every verdict carries the age of its evidence.

Checks a business against US registries, sanctions and its domain before an agent pays or signs, with signed receipts.

CVE, KEV, ATT&CK, CWE and detection graph; links marked declared or inferred. 3 tools keyless, all 7 with a free key.

Passive leak check for a live app you own: open Supabase/Firebase data, keys in JS, exposed .env/.git.

Gateway for the API your AI agent calls: per-app keys, allowed calls, loop breaker, approvals and an audit log.

Search and read Web3 security education: 120 articles and a 230-term crypto scam glossary.

Checks whether AI agents can find, trust and pay a business, and looks up a verified domain key and prices.

Scans an MCP server for security gaps before your agent connects.

Prompt-injection payloads, OWASP LLM risk guidance, release planning, and CI test-pack creation.

HTTPS certificate check and published business facts (CMS, mobile viewport, role emails, phones) for any site.

4DA-Systems/4da-mcp-server

Upgrade intelligence for AI agents: what an upgrade changes, where it touches your code, CVE scans.

pipeworx-io/mcp-advice

Advice MCP — wraps Advice Slip API (free, no auth)

aegisgatesecurity/aegisgate-mcp

Secure MCP server framework with 23 security layers and ML threat detection. Zero deps.

ipezygj/agent-guard

Safety checks an agent runs before it acts: package malware, destructive command, secret leak.

johnInarti/agent-passport-mcp

Post-quantum (ML-DSA-65/FIPS-204) agent identity + AI-decision receipts, verifiable offline.

ItzxFin2323/agent-venue-radar

Screen AI-work venues for inventory, funding, payouts, withdrawal, economics, and security risk.

radi-totev/agent-auth

Identity and auth for AI agents: credentials, tokens, delegations, and permission checks.

shuaicongxiaomai/agentguard

Secret, CVE and dependency-vulnerability scanning for AI agents (free, OSV.dev).

professor2k8/agent-security-lens

MCP security trust-check for agents before installing MCPs, Skills or tools.

pipeworx-io/mcp-agify

Agify MCP — age prediction from first name (agify.io, free, no auth)

garagon/aguara-mcp

Security scanner for AI agent skills and MCP servers