MCP Server Directory

Aguantar/vibescan-mcp-server

MCP server for VibeScan — scan projects for leaked secrets and security issues

ciloops/vuln-check

Local vulnerability scan on top of grype, with prioritised upgrade actions for agents.

MRFrazer25/Vulnerability-Exposure-MCP

Confirmed vulnerabilities and exposure for IPs, domains and software versions (NVD, CISA KEV, EPSS)

pipeworx-io/mcp-words

Words MCP — wraps Datamuse API (free, no auth required)

davidmosiah/youtube-shorts-agent

Agent-first YouTube Shorts uploader: dry-run validation, OAuth checks, synthetic-media metadata.

imattau/yunohost-mcp

Nostr-authenticated MCP server for secure YunoHost administration.

pipeworx-io/mcp-zenquotes

ZenQuotes MCP — wraps ZenQuotes API (free, no auth) with a dummyjson sibling fallback for when…

jasontally/mac-address-lookup

Find the organization behind a MAC address or OUI prefix in the IEEE registries. No auth, no key.

Remote, no-auth MCP server providing AI-powered codebase context and answers

Clean up sloppy AI code and prevent vulnerabilities

Gate for AI agent steps: ALLOW or DENY before a step runs, sealed into signed receipts that verify offline.

Fail-closed governance and separation of powers for MCP-enabled AI agents.

Verifies AI agent artifacts against JSON Schema and catches positional prompt injection.

elang2/mcp-audit-gateway

Transparent MCP proxy that keeps a signed, hash-chained audit trail of agent tool calls, with YAML policy enforcement and OpenTelemetry export.

whatsinmycloud/aws-audit-scanner

Read-only AWS audit scanner: public S3 buckets, root and user MFA gaps, unused access keys, world-open security groups, CloudTrail gaps, and forgotten EC2/EBS/RDS spend across every region. Only makes Describe/List/Get calls and runs locally with your own credentials.

Jimil-Joshi/blastradius-mcp

Zero-trust security proxy, pre-execution blast radius simulation, DLP secret redaction, and cryptographic audit logging for MCP.

Four tools scan public websites for cookie, tracker, consent, policy, and HTTPS/TLS risk signals.

A signed answer about any site before an agent acts: policy, what crawlers were served, findings, a decision per action.

Checks CVEs and dependency lists against OSV, NVD, EPSS and CISA KEV, and ranks what to fix first.

gaoharimran29-glitch/Cybersecurity-MCP-Server

Local security reconnaissance: WHOIS, DNS and subdomain enumeration, Nmap scanning, TLS inspection, tech fingerprinting, CVE and IP reputation lookups.

Domain recon: RDAP registration, DNS, SPF/DMARC deliverability, tech stack and subdomains from CT logs.

CVE lookups with CISA KEV and EPSS exploit scores, plus OSV package vulnerabilities and package.json audits.

Phishing-link checks opened like a Korean phone, plus DNS, TLS, headers, email auth and domain history.

WHOIS/RDAP, DNS, SSL, live subdomains with IPs and SPF/DMARC/DKIM for any domain; 1,000 free lookups a month.

Remote SSE MCP server for hosting HTML webpages and sharing content through temporary URLs without authentication

Security audits of shipped code, in plain English.

jtang613/GhidrAssistMCP

Native Ghidra integration with GUI configuration, logging and no external dependencies.

Cubiczan/governed-mcp-gateway

HTTP MCP gateway that attaches a principal to tool calls and SSE streams, with allowlists and vault rotation.

SECRET4422/guardrail-mcp

Enterprise security and code-safety guardrail for AI agents featuring AST taint analysis, SARIF/SBOM generation, and policy gates.

dean/HAL

HTTP toolkit providing all 7 HTTP methods (GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS) with secret substitution, comprehensive error handling, and support for JSON, XML, HTML, and form data.

Claim-by-claim AI hallucination detection with sources, agent trajectory verification, and prompt-injection guard.

Checks code an agent wrote for secrets, injection risks and declared-vs-real dependency drift before merge.

Checks if an IP is residential, datacenter or proxy, and whether ChatGPT, Claude, Gemini or Muse support its region.

Canadian privacy compliance: enforcement actions, glossary and Law 25 checks.

arian-gogani/nobulex

Proof-of-behavior enforcement for AI agents: define permit/forbid/require rules, enforce them at runtime and keep hash-chained, tamper-evident audit logs.

Checks npm packages for known vulnerabilities, malware, typosquats, risky install scripts and maintainer takeovers.

cyberdroid2077/opsecforge-tools/opsecforge-mcp

Local stdio server that keeps secrets out of coding-agent context: redact_file takes a path and returns only redacted content, scan_secrets checks staged changes before commit, plus offline webhook signature verification and JWT inspection. No network calls; optional Claude Code hook blocks direct .env/private-key reads. Redaction is heuristic.

Public phishing-domain feed: check a domain, search detections by brand, and pivot on campaigns and certs.

pollinations/model-context-protocol

Multimodal MCP server for generating images, audio, and text with no authentication required

Check text before your agent reads it: hidden instructions, invisible characters and links that leak data.

Agent identity, scoped access, and proof across tools. Check authority before an agent acts.

Notarize AI outputs, audits and agreements on the TON blockchain, with nothing stored server-side.

I4cTime/quantum_ring

Quantum-inspired keyring for AI coding agents, securing secrets with superposition, entanglement, tunneling and teleportation.

Scan URLs in a sandboxed browser and pivot across past scans by domain, IP, ASN or fingerprint.

Sanctions-screening signal for AI agents: check a person or organization against OFAC and EU lists.

toby7979/sealmyapp-tools

Offline security helpers for AI-built (vibe-coded) apps: classify whether a key is safe to expose, generate Supabase RLS audit SQL and owner-only policy templates, and pre-launch checklists for Lovable, Bolt, Cursor, Replit and v0. Ships with a Cursor rule and an Agent Skill.

Check whether AI agents can safely operate a WordPress site: llms.txt, robots.txt and schema.org.

epistemedeus/skillguard

Static scanner that checks Claude Code skills, plugins and MCP servers for exfiltration, install hooks and prompt injection before you install them.