Security scanning MCP servers & tools, page 5

Security reviews, threat models over a repo or website, and remediation tracking, in your editor.

MCP server for automated URL scanning and forensic phishing triage. Captures full DOM snapshots, network requests, and visual screenshots to identify malicious redirects and infrastructure. Supports historical threat hunting using Custom Query Language (CQL) to map actor patterns across millions of recorded scans.

MCP proxy adding security scanning, behavioral profiling, risk gating, and safe tool call execution.

MCP server for the Vulners.com API

Security MCP for vibe coding with 330 rules and 29 tools. Purpose-built for AI-generated code — scans Next.js, Supabase, Clerk, Stripe, Prisma, Hono, GraphQL, and 25+ modules. Cross-file taint analysis, host security audit, auto-fix, SARIF export, pre-commit hook, and CVE version detection. Zero config, runs locally.

Analyzes threats and verifies URLs align with the agent's intended goal.

Zero-config MCP security scanner for AI-generated apps. 25K+ vulnerability patterns.

PreClick scans links for threats and confirms intent match with high accuracy before agents click.

Local-first defensive scanner for vulnerable dependencies, leaked secrets, and risky agent configs

Agentless, read-only security audit of Linux servers over SSH. Ranks what to patch first: CVEs with KEV and EPSS, SSH access, exposed ports, host health, with rollback-ready fixes. Terminal UI, web UI and an MCP server in one Go binary. No telemetry.

SAST/DAST server exposing 11 security scanners (Bandit, Semgrep, Trivy, CodeQL, Checkov, Gitleaks, OSV-Scanner, Grype, OWASP ZAP, and more) with closed-loop remediation (scan→patch→re-scan→verify), SARIF/SBOM/VEX export, compliance reporting, and CI integrations (GitHub Advanced Security, DefectDojo, Slack, Jira).

Microsoft Patch Tuesday triage from the official MSRC Security Update Guide. Monthly rollups, CVE/KB lookups, supersedence chains, product watchlists, and urgency-ranked results enriched with EPSS scores and the CISA KEV catalog. No API keys; also available as a free hosted remote endpoint. uvx patch-tuesday-mcp

PCI DSS v4.0.1 static-analysis MCP server for Go payment codebases. 12 scanners detect PAN/CVV exposure, weak crypto, missing audit logs, vulnerable deps, TLS misconfig, auth weaknesses, plus CycloneDX 1.6 SBOM generation - each finding mapped to the exact PCI requirement. AI-assisted triage via triagefindings. Keyless-signed multi-arch Docker image on ghcr.io.

Rust infrastructure diagnostics MCP server for AI agents: DNS checks, TLS certificate chain inspection, email security, global DNS propagation, and DNS latency benchmarking.

Signed, recomputable safety scores for MCP servers, packages and tools, with offline-verifiable attestations and a GitHub Action to gate CI merges.

VMware vSphere compliance and hardening — read-only baseline scanning plus drift detection across CIS, vSphere SCG, China DJCP 2.0, and PCI-DSS frameworks. 6 read-only tools with LLM-powered remediation suggestions (apply-side gated through vmware-pilot approval workflow).

Security scanner for MCP servers with vulnerability detection and prompt injection analysis.

MCP server for Pentest-Tools.com: run scans, manage findings and reports via your preffered LLM.

Security scanner for AI agent skills and MCP servers

MCP server for OWASP ZAP vulnerability scanning with Docker management

EU AI Act compliance scanner for Python AI agents. Scans, analyzes, and remediates LangChain/CrewAI/AutoGen/OpenAI code across 6 articles with 10 tools including prompt injection detection, risk classification, and trust layer integration. The only MCP compliance server that generates fix code, not just findings.

MCP server for static security analysis of Android source code

AI security layer: code scanning, PII detection, prompt injection, secrets, CVEs

Live threat intel for agents: incidents, actors, CVEs with KEV/EPSS, ransomware leak-site victims.

Honeypot threat intelligence for AI agents: 90 days of probe data from a sensor network for IP reputation, scanner classification, CVE probing trends, and JA4/JA4H/HASSH fingerprints. Remote MCP, free tier.

Control plane MCP for scoped recon, triage, and bounded proofs.

Scans Agent2Agent (A2A) protocol code for webhook SSRF, missing auth, and credential exposure

Query OSV.dev for package vulnerabilities and batch-audit dependency lists via MCP.

Scan installed MCP servers for security vulnerabilities with 16 detection engines.

Audit AI skill safety before you ship. Static, semantic, adversarial, supply chain scans.

Read-only CVE intelligence, remediation playbooks, and agent setup guides. Not a scanner.

AI-driven penetration testing - 22 security tools behind safety-hardened MCP endpoints

Threat intelligence: enrich IOCs (IP, domain, URL, hash), search CVEs and actors, scan SBOMs.

MCP server for SecObserve: triage findings, manage products, import scan reports and SBOMs.

Scans code, IaC and AI-agent config for security problems. Read-only — nothing can be edited.

Security scanner for AI agents that detects prompt injections using 42+ regex patterns

Blockchain compliance: screen wallets vs OFAC SDN + threat intel, open cases, generate SAR drafts

Pre-connect trust checks for AI agents and MCP servers using HVTracker's public trust registry.

Local AI chat history secret scanner for macOS. Finds API keys and secrets leaked into Claude Code, Cursor, Copilot Chat, Cline, Codex, Gemini CLI, and other AI tool transcripts. 9 MCP tools: findings list with redacted previews, boolean secret detection (sievechecktext), placeholder-only redaction (sieveredacttext returns sieve://project/key, never raw values), vault-backed command execution, and scan health. Local-only stdio transport, macOS Keychain vault, no plaintext secrets in any tool response. Mac App Store.

AI code security scanner MCP server. Detects 9 categories of threats in AI-generated code (invisible Unicode, Trojan Source, homoglyphs, Glassworm steganography, rules file backdoors, dependency typosquatting, obfuscation) using static analysis plus CodeBERT deep learning. Runs locally, free tier.

Static security scanner and MCP server for MCP servers and AI agent tools. Detects secrets, shell execution, risky tool descriptions, environment access, and prompt-injection phrases. mcp-shield-server

AI-agent admission-control MCP server: validates file edits against Ring 0 syntax + Ring 0.5 structural-cost regression + workspace boundary (path / glob / shell-redirect / symlink). Negative-space framing — emits BLOCK / WARN / PASS verdicts, never coaches the agent.