List your agent
Tools · Security Scanning

Best MCP servers for security scanning

305 MCP servers in the Official MCP Registry do security scanning. 143 can be used as a hosted endpoint, with nothing to install, and 235 publish their source code. First by relevance and readiness: PG1 Sovereign Threat Intelligence, Dockerfile Security Audit and GitHub Actions Security Audit.

#ToolRelevanceConnectCodeSeen
1PG1 Sovereign Threat Intelligence
STIX IOCs, CVE lookups w/ EPSS/KEV, ATT&CK dossiers, OFAC wallet sanctions, domain age checks.
In name
threat intelligence
HOSTEDLOCALOpen2h ago
2Dockerfile Security Audit
Audit Dockerfiles for root users, baked-in secrets, curl-pipe-shell and unpinned base images.
In name
security audit
HOSTEDLOCALOpen2d ago
3GitHub Actions Security Audit
Audit GitHub Actions workflows for script injection, unpinned actions and missing permissions.
In name
security audit
HOSTEDLOCALOpen2d ago
4Agent Skill & Config Security Audit
Scan AI agent skills and configs for hidden Unicode, prompt injection and exfiltration.
In name
security audit
HOSTEDLOCALOpen2d ago
5Malwarebazaar
MalwareBazaar MCP — abuse.ch malware sample database (free, key required)
In name
malware
HOSTEDLOCALOpen2d ago
6Circl Vulnerability Lookup
CIRCL Vulnerability-Lookup — aggregated vulnerability records
In name
vulnerability
HOSTEDLOCALOpen2d ago
7Jeevesus — DugganUSA Threat Intelligence MCP
check-package: block malicious npm/PyPI deps before your AI agent installs them. Free, no key.
In name
threat intelligence
HOSTEDLOCALOpen2d ago
8SBOMApp - SBOM Generator & Vulnerability Scanner
Generate SBOMs, scan vulnerabilities, and analyze dependencies from local projects or Git repos.
In name
vulnerability
HOSTEDLOCALOpen2d ago
9Nullcone Threat Intelligence
Real-time threat intel for AI agents: 890K+ IOCs incl. prompt-injection & AI-skill threats
In name
threat intelligence
HOSTEDLOCALOpen2d ago
10Frogeye Security Scanner
Zero-config MCP security scanner for AI-generated apps. 25K+ vulnerability patterns.
In name
security scanner
HOSTEDLOCALOpen2d ago
11Repo Security Scanner — Malicious Code & Supply Chain
Audit GitHub repos for malicious and supply-chain code before you depend on them.
In name
security scanner
HOSTEDLOCALOpen2d ago
12pentest-mcp-server
Offline methodology engine for authorized penetration testing, CTF, and security research.
In name
pentest
HOSTEDLOCALOpen2d ago
13Company filing and CVE evidence snapshots
Company filing/CVE snapshots, status and optional feedback. Remote MCP or local stdio. Free Phase A.
In name
cve
HOSTEDLOCALOpen2d ago
14Cybersecurity Threat Intelligence MCP
CVE search, vulnerability database, EPSS exploit prediction, KEV, IP reputation & threat feed.
In name
threat intelligence
HOSTEDLOCALOpen2d ago
15Compuute MCP Security Scanner
Scan any public GitHub MCP-server repo for security issues. 37 MCP-specific L1 rules, 8 languages.
In name
security scanner
HOSTEDLOCALOpen2d ago
16MCP Security & Vulnerability Auditor
Static AST security scanner detecting command injection, leaked secrets, and SSRF in MCP tools.
In name
vulnerability
HOSTEDLOCALOpen2d ago
17EchelonGraph CVE & Exposure
CVEs (NVD, CISA-KEV, EPSS, GHSA) and per-CVE exposure from Shodan data (© Shodan). Free, keyless.
In name
cve
HOSTEDLOCALOpen2d ago
18Kevscope CVE Check
Is a CVE exploited? CISA KEV, FIRST EPSS, CVSS and SSVC with a patch-first verdict. Free, no key.
In name
cve
HOSTEDLOCALOpen2d ago
19Truss Threat Intelligence
Query Truss threat intelligence via hosted MCP (OAuth). Growth+ plans.
In name
threat intelligence
HOSTEDLOCALOpen2d ago
20SkillsSafe Security Scanner
AI skill security scanner. Detects prompt injection, credential theft, ClawHavoc. Free, no signup.
In name
security scanner
HOSTEDLOCALOpen2d ago
21ScanMalware.com URL Scanner
MCP server for ScanMalware.com URL scanning, malware detection, and analysis.
In name
malware
HOSTEDLOCALOpen2d ago
22Feldspar free repository security scan
Free deterministic security scan of public git repos: OSV.dev vulnerable deps, secrets, config lint.
In name
security scan
HOSTEDLOCALOpen2d ago
23BlackVeil DNS & Email Security Scanner
DNS and email security scanner with 80 MCP tools for SPF, DMARC, DNSSEC, SSL, and brand audits.
In name
security scanner
HOSTEDLOCALOpen2d ago
24IntoDNS.ai DNS & Email Security Scanner
DNS and email security: check SPF, DKIM, DMARC, DNSSEC, DANE and build the records. 45 tools.
In name
security scanner
HOSTEDLOCALOpen2d ago
25NotCVE — CVE & Vulnerability Intelligence
CVE & vulnerability search: 365k+ CVEs/NotCVEs, CVSS, EPSS, CISA KEV, exploits, patches, versions.
In name
cve
HOSTEDLOCAL—2d ago
26Vulnerability Intel MCP
Defensive vulnerability intelligence search across public CVE/NVD and GitHub advisory APIs with CVSS
In name
vulnerability
HOSTEDLOCAL—2d ago
27cve-triage
x402 CVE triage MCP: EPSS + CISA KEV -> exploit priority, $0.01 per query.
In name
cve
HOSTEDLOCAL—2d ago
28Kloudle Cloud Security Scanner
AWS cloud security scanners for AI agents — S3, IAM, EC2, EKS, RDS, CloudTrail, CloudWatch Logs
In name
security scanner
HOSTEDLOCAL—2d ago
29Execute delegatecall-vulnerability-mcp
Premium agentic endpoint for delegatecall-vulnerability-mcp.
In name
vulnerability
HOSTEDLOCAL—2d ago
30Malware Patrol Threat Intelligence MCP server
Our MCP Server connects AI workflows to current, curated cyber threat intelligence
In name
malware
HOSTEDLOCAL—2d ago
31FHI MCP Server Security Audit
Free payment guide and Base-USDC x402 MCP security, package, domain, and SEC tools.
In name
security audit
HOSTEDLOCAL—2d ago
32ScanLabsAI Security Scanner
Scan a website for vulnerabilities: OWASP Top 10, CVEs, SSL, headers - with plain-English fixes
In name
security scanner
HOSTEDLOCAL—2d ago
33CDC Social Vulnerability Index
SVI scores and theme breakdowns by county and tract
In name
vulnerability
HOSTEDLOCAL—2d ago
34Grisoco AI security audits
Smart-contract security audits for EVM chains and DAML: quote, run and fetch reports.
In name
security audits
HOSTEDLOCAL—2d ago
35Exploit Intelligence Platform — CVE, Vulnerability and Exploit Database
Real-time CVE, exploit, and vulnerability intelligence for AI assistants (350K+ CVEs, 115K+ PoCs)
In name
cve
HOSTEDLOCAL—2d ago
36cve-intelligence
CVE intelligence: exploitation (KEV/EPSS), detection coverage, fixed versions. All tools keyless.
In name
cve
HOSTEDLOCAL—2d ago
37CVElens Vulnerability Intelligence
CVE triage in one call: NVD, CVSS, CISA KEV, EPSS, public exploits and an explained risk score.
In name
vulnerability
HOSTEDLOCAL—2d ago
38CVE Risk Check
Triage a CVE: how severe it is, whether it is exploited, and how likely exploitation is.
In name
cve
HOSTEDLOCAL—2d ago
39AIS CVE Priorities — daily exploit-ranked patch list for AI agents
Daily CVE priorities ranked by real exploitation (KEV+EPSS) for AI agents; free teaser, paid full
In name
cve
HOSTEDLOCAL—2d ago
40owasp-scan
Unified OWASP MCP Top 10 scan — path or live tools/list, A–F grade, SARIF
In name
owasp
HOSTEDLOCALOpen5h ago
41vulnerability-scanner
Triggers GuardBee scans, queries findings, AI-assisted remediation guidance
In name
vulnerability
HOSTEDLOCALOpen1d ago
42cve-cache
Recent CVE + GHSA cache for AI agents auditing dependencies (npm/PyPI/Cargo/Maven/Go).
In name
cve
HOSTEDLOCALOpen2d ago
43OWASP ZAP MCP Server
MCP server for OWASP ZAP vulnerability scanning with Docker management
In name
owasp
HOSTEDLOCALOpen2d ago
44nvd-cve-mcp
Search CVE vulnerability records from the NIST NVD database. No key required.
In name
cve
HOSTEDLOCALOpen2d ago
45PostgreSQL CVE & Release Intelligence
PostgreSQL security for AI agents: CVEs, yanked releases, exploits, and upgrade paths
In name
cve
HOSTEDLOCALOpen2d ago
46AIShield Security Scanner
Scans MCP servers for tool poisoning, prompt injection and supply chain risks.
In name
security scanner
HOSTEDLOCALOpen2d ago
47APSA mobile app security audit
Local, evidence-graded Android/iOS security audits of source, APK, AAB and IPA for AI agents.
In name
security audit
HOSTEDLOCALOpen2d ago
48Contract Security Scanner
Scans Base L2 smart contracts for security risks. Risk score 0-100, detects backdoors & proxies.
In name
security scanner
HOSTEDLOCALOpen2d ago
49MCPAmpel - MCP Security Scanner
Scan installed MCP servers for security vulnerabilities with 16 detection engines.
In name
security scanner
HOSTEDLOCALOpen2d ago
50Fray — WAF Security Testing MCP Server
WAF security testing: 5,500+ payloads, 25 WAF fingerprints, 21 recon checks, bypass AI
In name
security testing
HOSTEDLOCALOpen2d ago

Ready-made AI agents

Other use cases

Page 1 / 7Next →

FAQ

What is the best MCP server for security scanning?

By relevance and readiness, PG1 Sovereign Threat Intelligence, Dockerfile Security Audit and GitHub Actions Security Audit come first: the use case appears in their name and they can be used as a hosted endpoint. Check each page for how to connect and what keys it needs.

How many MCP servers are there for security scanning?

Electra Index lists 305 active MCP servers for security scanning from the Official MCP Registry. 143 offer a hosted endpoint and 235 publish their source code.

Is there a hosted MCP server for security scanning, with nothing to install?

Yes. PG1 Sovereign Threat Intelligence, Dockerfile Security Audit and GitHub Actions Security Audit declare a remote endpoint you add to your assistant's MCP settings.

Is there a ready-made AI agent for security scanning instead?

Yes. If you prefer a finished product to plugging tools into your own assistant, Claude Code and CodeRabbit do this out of the box.

How this list is ordered: a tool comes first when the use case appears in its name rather than only in its description, then when it offers a hosted endpoint, then when its source code is public, then by how recently our robot saw it in the Official MCP Registry. The match to security Scanning comes from the publisher's description (keyword method), not from a test of the tool. Only active tools with a real description are listed. No tool pays to appear here.