Citepath public MCP server for LLM readiness audits and public scan results.

Enables auditing GitHub Actions workflows for security problems directly from an MCP client, returning a risk score and findings with file:line evidence, attack narratives, and fixes. Also exposes the full rule catalog and a one-call demo that writes and scans a deliberately broken workflow.

AEO tools: scan any URL for AI-citation readiness, read the public leaderboard and citation panel.

MCP server for CVE lookups: EchelonGraph scores, CISA KEV, EPSS, CWE, exploits, version and SBOM checks, vendor advisories, and per-CVE exposure derived from Shodan data. Shodan data is owned by Shodan, which holds its copyright (© Shodan). Keyless.

IAM Policy Autopilot is an open source static code analysis tool that helps you quickly create baseline AWS IAM policies that you can refine as your application evolves. This tool is available as a command-line utility and MCP server for use within AI coding assistants for quickly building IAM policies.

MCP Server for GitHub repository health monitoring

Wassette: A security-oriented runtime that runs WebAssembly Components via MCP

All-in-One malware analysis tool.

HexStrike AI MCP Agents is an advanced MCP server that lets AI agents (Claude, GPT, Copilot, etc.) autonomously run 150+ cybersecurity tools for automated pentesting, vulnerability discovery, bug bounty automation, and security research. Seamlessly bridge LLMs with real-world offensive security capabilities.

Multi-account orchestration and secure token storage for OAuth-based MCP servers

No description yet.

Gives AI coding agents on-demand security playbooks, a code scanner they can run on their own output, and live lookups against CISA KEV, NVD and OSV so they verify threats instead of guessing. Runs locally with no API keys or accounts, exposing skills, tools and a secure-build prompt to Claude Code, Codex, Cursor or any MCP client.

Enables checking whether a crypto link is a phishing lookalike of a wallet, exchange or dapp by comparing it against official domains and flagging lookalike characters, typosquats, punycode and bait words, fully offline. An optional paid full check adds domain registration age, DNS, redirect tracing and a page scan for seed-phrase prompts and drainer code.

Rust MCP server and CLI for Tailscale devices, users, keys, policies, and auth.

🛡️ BLA (Blind LLM Agents) — Adversarial defense shield that protects binaries, Electron apps, JS bundles, Python, and WebAssembly against AI reverse-engineering agents like REA. Poison -> Exhaust -> Hallucinate.

Family inbox: read records; invite, reply, mint codes. API key or OAuth care_circle:write.

Invoicing, expenses, accounting analytics. OAuth 2.1 dynamic client registration, no API key.

Official SonarQube MCP Server for code quality and security in AI agents

Enables AI agents and IDE assistants to run zero-config security audits, detect secrets and vulnerable dependencies, and apply adversarial verification to reduce false positives.

Enables AI assistants to read videos, official subtitles, comments, private messages, and live room/danmaku data, plus scan-QR login and admin-approved sending of replies, comments, and danmaku with writes disabled by default.

Enables Cursor and Codex agents to audit Agent Skill structure (frontmatter, broken links, missing files), analyze dependencies for undeclared, unused or vulnerable packages via OSV, and run 28 local bug and code-quality rules with SonarQube-style A–E ratings. It can also optionally pull issues, metrics and quality-gate status from SonarQube or SonarCloud, or scan and upload results.

Enables MCP clients to create and control persistent, PTY-backed terminal sessions on macOS: launch commands and interactive programs, read output incrementally via byte cursors, send keystrokes, wait on conditions, and detect running/awaiting-input/exited states. Sessions run inside a Seatbelt sandbox with command policies, human approvals, secret redaction, and hash-chained audit logging.

Exposes explicitly approved local Windows stdio and loopback HTTP MCP backends through a single OAuth-protected remote HTTPS MCP endpoint, letting a mobile AI client invoke whitelisted tools with namespacing, PKCE-based authorization, and per-tool permissions.

Provides OAuth-secured MCP tools for working with private, Git-backed Markdown knowledge bases: searching pages, reading content, ingesting new source documents, retrieving cited original files, and reviewing history or rolling back accepted pages. Every tool call is checked against each person's or agent's current wiki grant and returns source paths and Git revisions for traceability.