MCP Server Directory

Paraphern/rugsnare

Pin MCP tool contracts by hash and catch silent drift, rug pulls and per-client bait-and-switch after approval, with a CI gate, live stdio/HTTP proxies, canary replay, call policies and on-chain release verification.

mdfifty50-boop/agent-security-mcp

Security scanning and threat detection for AI agents

Aakashbhardwaj27/ai-scanner-mcp

Scan codebases for LLM/AI SDK usage, exposed API tokens, and hardcoded secrets.

lordbasilaiassistant-sudo/base-security-scanner-mcp

MCP server to scan smart contracts on Base for honeypots, rug pulls, and vulnerabilities.

charmshots/mcp-server

Read-only MCP connector for Charmshots photoshoots, photo metadata and owner-authenticated links.

zrk222/code-factory

Read-only audit evidence for security, tests, native coverage, runtime failures and repair status.

mcpcustoms/mcp-customs

Inspect an MCP server for common security risks before you install it. Offline, zero telemetry.

mlugo-apx/detectzestack-mcp

Detect any website's tech stack, security headers, SSL, DNS and CVEs via DetectZeStack.

KevinRabun/FedRAMP20xMCP

An MCP server that provides access to FedRAMP 20x security requirements and controls.

myanptl/golive-mcp

Check a site before you share it: link previews, SPA refresh 404s, noindex, security headers.

omarei-omoto/hush

Team secrets your AI agent can use but never read: encrypted in the repo, value-blind tools.

husk-security/husk

Local-first defensive scanner for vulnerable dependencies, leaked secrets, and risky agent configs

CodingSelim/mcp-scan

Passive security scanner: audits MCP servers against the OWASP MCP Top 10, graded A-F.

jarod-vyent/xrpl-identity-mcp

MCP server for XRPL identity: DIDs, credentials, signer lists, and safe transaction workflows.

AgentAvow/AgentAvow

Signed, recomputable safety scores for MCP servers, packages and tools, with offline-verifiable attestations and a GitHub Action to gate CI merges.

toan203/osv-ui

Visual CVE audit dashboard for npm, Python, Go and Rust using OSV data, with browser-based human review and fixes applied only after confirmation.

aurelio-nakamura/cmdxray

Offline safety gate for agent shell commands: rates each command as danger, caution or none and explains every flag, pipe, redirect and subshell.

oleg-vdv/kepil

Accountability layer for AI agents: per-version passports, per-job mandates with spending limits, a fail-closed action gate and a hash-chained journal.

shyshlakov/pci-dss-mcp

PCI DSS static analysis for Go payment code: finds PAN/CVV exposure, weak crypto, missing audit logs and vulnerable deps, each mapped to a PCI requirement.

ironclawdevs27/Argus

Automated web QA via Chrome DevTools MCP — a11y, security, visual, env diff, CI; Aegis redaction.

MMasey/atag-mcp

ATAG 2.0 (Authoring Tool Accessibility Guidelines) guidance for authoring tool developers

laureennicholson635/automatedrcm-billing-mcp

Medical-billing tools for AI agents: prior-auth checks, denial decoding, claim triage, appeals.

bkalafat/DiffPilot

MCP server for PR code review, commit messages, changelogs, and secret detection.

twayst0/fsv

Scan your own website for vulnerabilities: DNS takeover, compromised CDNs, debug mode and more.

RCOLKITT/hardening-mcp

Enterprise certification for codebases with multi-agent security, reliability, and quality audits

yarrasys/kdbx

Read-only access to secrets in a local KeePassXC vault. Runs commands with them injected.

paperdavid/manoma

MCP server for soul.md — your portable AI identity layer across every LLM.

SageMindAI/moltbridge

Agent network intelligence for AI agents. Trust scoring, broker discovery, and Ed25519 identity.

Goingparabolic/painprep-mcp-server

Interventional pain medicine MCP: Medicare checklists, CPT/ICD-10, ASRA, prior-auth & appeals

eltociear/skill-audit-mcp

MCP server: static security scanner for MCP servers, agent skills & plugins. 17 attack patterns.

GUCCI-atlasv/Skillssafe.com

AI skill security scanner. Detects prompt injection, credential theft, ClawHavoc. Free, no signup.

composable-delivery/snowfakery-mcp

MCP server for authoring, analyzing, debugging, and running Snowfakery recipes

bonesdefi/Tripwire

Security gateway for MCP agents: blocks prompt-injection-driven tool calls before they execute.

cyntrisec/cyntrisec-cli

Local-first AWS security analyzer that discovers attack paths and generates remediations using graph theory.

Buggy1111/anonymize-mcp

Anonymize PII for GDPR in Czech and many other languages using ÚFAL/LINDAT NLP (MasKIT, NameTag), plus morphology, translation and spellcheck.

rudraneel93/mcp-guardian

Security and governance proxy for MCP with YAML policies (blocklists, rate limits, token budgets), token cost tracking, health monitoring and RBAC.

Skyrxin/sast-mcp-server

SAST/DAST scanners (Bandit, Semgrep, Trivy, CodeQL, OWASP ZAP and more) with closed-loop remediation, SARIF/SBOM/VEX export and compliance reporting.

1clawAI/1claw-mcp

HSM-backed vault secrets for AI agents (JIT fetch) plus prompt-injection and threat scanning.

anaconda/anaconda-mcp

Beta conda env/package MCP server; requires conda, auth, and Beta Terms.

sudomichael/analyticsautopilot

Cookieless analytics for AI coding agents. Install in one prompt, 28 tools, OAuth onboarding.

Easysend-co/easysend-mcp

EasySend file sharing MCP server - upload, download and share files. No authentication required.

ExposureGuard/haldir

Guardian layer for AI agents: identity, secrets, audit via MCP.

leakferrethq/leakferret

Context-aware secret scanner: lets an AI agent scan, verify, and rewrite secrets before committing.

MCPShield-Dev/mcpshield

Security scanner for MCP servers - detects tool poisoning and injection

george-bobby/mcp-modal

MCP server for managing Modal apps, containers, volumes, and secrets.

parth-unjiya/odoo-mcp-gateway

Security-first MCP gateway for Odoo 17/18/19 — YAML-driven security, 27 tools

opengolfapi/mcp-server

Golf for AI agents — every US course free, plus open contribution, identity & tournaments.

cyberdroid2077/opsecforge-tools

Local MCP tools that keep secrets out of agent context: redact files, scan commits, verify webhooks.