Tools · Security Scanning
Best MCP servers for security scanning
305 MCP servers in the Official MCP Registry do security scanning. 143 can be used as a hosted endpoint, with nothing to install, and 235 publish their source code.
| # | Tool | Relevance | Connect | Code | Seen |
|---|---|---|---|---|---|
| 101 | Snow Leo Risk & Compliance Screen names against OFAC, EU and UN lists; check CVEs, domain DNS and WHOIS, and public tenders | In description cves | HOSTEDLOCAL | Open | 3d ago |
| 102 | threatcluster Live threat intel for agents: incidents, actors, CVEs with KEV/EPSS, ransomware leak-site victims. | In description threat intel | HOSTEDLOCAL | Open | 3d ago |
| 103 | infinihash-kyt-mcp Screen crypto wallets vs OFAC SDN + threat intel; pre-payment checks, signed receipts; SAR drafts | In description threat intel | HOSTEDLOCAL | Open | 3d ago |
| 104 | ci-sentinel Multi-CI security scanner with a live threat-intel feed of compromised CI components | In description security scanner | HOSTEDLOCAL | Open | 3d ago |
| 105 | DevOps & Cloud Code Auditor Detects database migration table locks, terraform cost leaks, and OWASP API flaws. | In description owasp | HOSTEDLOCAL | Open | 3d ago |
| 106 | HumanMirror Outcome Verified AI-agent outcomes: secret scanning, JSON cleanup, dedupe, anomaly and schema checks. | In description secret scanning | HOSTEDLOCAL | Open | 3d ago |
| 107 | Kevscope CVE patch priority from CISA KEV, FIRST EPSS, CVSS and SSVC; exploited-CVE feeds. | In description cve | HOSTEDLOCAL | Open | 3d ago |
| 108 | CyberMax Data Free US data lookups: ZIP demographics, CISA KEV/EPSS CVEs, domain rank, county spending, recalls. | In description cves | HOSTEDLOCAL | Open | 3d ago |
| 109 | ecoa Verificação de segurança e conformidade de sites: cabeçalhos, TLS, DNS, e-mail, LGPD e pentest. | In description pentest | HOSTEDLOCAL | Open | 3d ago |
| 110 | WP HealthKit Security audits for WordPress plugins and themes — 62 verification layers, fix plans and SBOMs. | In description security audits | HOSTEDLOCAL | Open | 3d ago |
| 111 | sanctions-screening Sanctions screening, KYB, identifier validation, jurisdiction risk & secret scanning for AI agents | In description secret scanning | HOSTEDLOCAL | Open | 3d ago |
| 112 | mcp-server MCP server for Pentest-Tools.com: run scans, manage findings and reports via your preffered LLM. | In description pentest | HOSTEDLOCAL | Open | 3d ago |
| 113 | Security Intel MCP CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys. | In description cve | HOSTEDLOCAL | Open | 3d ago |
| 114 | ContrastAPI 55 tools, 7 Resources, Sigma rules, email SPF/DMARC, MITRE, CVE/KEV, risk_score. No key. | In description cve | HOSTEDLOCAL | Open | 3d ago |
| 115 | LaunchTrust Compliance & security scan for your app: secrets, exposed files, headers, privacy, AI-disclosure. | In description security scan | HOSTEDLOCAL | Open | 3d ago |
| 116 | agent-sec Zero-install security baseline for AI coding agents — OWASP/CWE-cited rules over MCP. | In description owasp | HOSTEDLOCAL | Open | 3d ago |
| 117 | magento.watch Magento Open Source, Adobe Commerce and Mage-OS releases, EOL, requirements, CVEs and patches | In description cves | HOSTEDLOCAL | — | 4h ago |
| 118 | Seal Security Vulnerability management: scan projects, search sealed packages, manage sealing rules and reports. | In description vulnerability | HOSTEDLOCAL | — | 8h ago |
| 119 | overflo.ws Look up CVEs, CISA KEV, EPSS and open-source package vulnerabilities, including malicious packages. | In description cves | HOSTEDLOCAL | — | 2d ago |
| 120 | agentdatafeed Source-verified data for agents: Amsterdam events from permits, CVEs with CISA KEV and EPSS. x402. | In description cves | HOSTEDLOCAL | — | 2d ago |
| 121 | Stack Facts Signed EOL dates, exploited CVEs and LLM prices; pay per call in USDC, no account, no daily cap. | In description cves | HOSTEDLOCAL | — | 2d ago |
| 122 | PromptGuard Scan MCP Paid remote MCP for LLM security scans, jailbreak checks, analytics, checkout, and readiness. | In description security scans | HOSTEDLOCAL | — | 2d ago |
| 123 | Patronus Security Scan text, documents, websites, and MCP metadata for prompt injection and sensitive-data risks. | In description security scan | HOSTEDLOCAL | — | 2d ago |
| 124 | Kadent Scan Free, read-only security scanner for remote MCP servers, before you connect them. | In description security scanner | HOSTEDLOCAL | — | 2d ago |
| 125 | Lattice Read-only cyber knowledge graph for AI agents: CVEs, ATT&CK, detections, with each link's source. | In description cves | HOSTEDLOCAL | — | 2d ago |
| 126 | KernelScan Linux kernel CVE analyzer: upload a .config, get a CycloneDX VEX report of affecting CVEs. | In description cve | HOSTEDLOCAL | — | 2d ago |
| 127 | DepScout Scan packages and lockfiles (npm, PyPI, Go, Maven, Cargo, NuGet) for vulnerabilities and malware. | In description vulnerabilities | HOSTEDLOCAL | — | 2d ago |
| 128 | Motiv Fleet DeFi MCP fleet: oracle, security audit, treasury yield, QA attestation, and compute tools on Base. | In description security audit | HOSTEDLOCAL | — | 2d ago |
| 129 | AgentSec MCP Security intelligence via x402 on Base. CVE lookup, IP reputation, secret scanning. | In description cve | HOSTEDLOCAL | — | 2d ago |
| 130 | osf-data-marketplace 8.1M+ US gov and science data via x402 USDC. 21 tools, $0.001 sample tier, sanctions, SEC, CVEs. | In description cves | HOSTEDLOCAL | — | 2d ago |
| 131 | MCP Fortress Security scanner for MCP servers. Detect vulnerabilities, prompt injection, and tool poisoning. | In description security scanner | HOSTEDLOCAL | — | 3d ago |
| 132 | Outage.Me Live cloud/SaaS outages, provider reliability and exploited CVEs from official status pages and CISA | In description cves | HOSTEDLOCAL | — | 3d ago |
| 133 | Fillin Search for AI agents. Closes the LLM-cutoff gap: CVEs, papers, frontier AI, prediction markets. | In description cves | HOSTEDLOCAL | — | 3d ago |
| 134 | ContractOracle-Sentinel DeFi smart contract forensic auditor and vulnerability scanner. | In description vulnerability | HOSTEDLOCAL | — | 3d ago |
| 135 | Fuzz-Breaker Automated API pentesting and structural fuzzing proxy. | In description pentesting | HOSTEDLOCAL | — | 3d ago |
| 136 | CodeVulnerability OWASP threat scanner auditing codebases for safety leaks. | In description owasp | HOSTEDLOCAL | — | 3d ago |
| 137 | PromptBrake Free Tools Free AI security tools: injection payloads, OWASP LLM mapper, ADLC release planner, test builder. | In description owasp | HOSTEDLOCAL | — | 3d ago |
| 138 | krabbot-devtools AI-agent-run devtools: package install risk, stack EOL/CVE checks, scored OSS bounties. | In description cve | HOSTEDLOCAL | — | 3d ago |
| 139 | Depcheck Known vulnerabilities for exact package versions from OSV, with fixes. Paid per call, x402. | In description vulnerabilities | HOSTEDLOCAL | — | 3d ago |
| 140 | mcp Query your team's drift, vulnerability, and upgrade data from any AI assistant. OAuth 2.1, 51 tools. | In description vulnerability | HOSTEDLOCAL | — | 3d ago |
| 141 | Rock8Cloud Deploy services, add databases, run agents, read logs, check vulnerabilities and publish pages. | In description vulnerabilities | HOSTEDLOCAL | — | 3d ago |
| 142 | Opzyai Pro Deep security scans of repos you own from your editor: dependency CVEs, SAST, git-history secrets. | In description security scans | HOSTEDLOCAL | — | 3d ago |
| 143 | Opzyai Vibe Check Free no-account URL security scan: 0-100 Launch Readiness score for any live site in ~15 seconds. | In description security scan | HOSTEDLOCAL | — | 3d ago |
| 144 | EPA EJScreen Environmental justice screening indicators, pollution burden, and demographic vulnerability | In description vulnerability | HOSTEDLOCAL | — | 3d ago |
| 145 | MCPFax Dev Package Intelligence Is this dependency current, licensed, deprecated, or already carrying a CVE? | In description cve | HOSTEDLOCAL | — | 3d ago |
| 146 | Malwagon Submit files and URLs to a malware sandbox, poll scans, fetch reports, hashes and IOCs. | In description malware | HOSTEDLOCAL | — | 3d ago |
| 147 | HTMLvault Publish and manage secure HTML links: PII/secret scanning, batch create, patch edits, analytics. | In description secret scanning | HOSTEDLOCAL | — | 3d ago |
| 148 | exploitwatch Check a dependency list against CISA's live Known Exploited Vulnerabilities catalog. | In description vulnerabilities | HOSTEDLOCAL | — | 3d ago |
| 149 | DataNexus MCP Public data intelligence for AI agents — CVE, compliance, patents, contracts, domains. | In description cve | HOSTEDLOCAL | — | 3d ago |
| 150 | Crimson Crawler Enrich, search, assess, and manage threat intelligence through 80+ typed MCP tools. | In description threat intelligence | HOSTEDLOCAL | — | 3d ago |
Ready-made AI agents
- $20/mo
- $24/mo · free plan
Other use cases
FAQ
How many MCP servers are there for security scanning?
Electra Index lists 305 active MCP servers for security scanning from the Official MCP Registry. 143 offer a hosted endpoint and 235 publish their source code.
Is there a hosted MCP server for security scanning, with nothing to install?
Yes. Snow Leo Risk & Compliance, threatcluster and infinihash-kyt-mcp declare a remote endpoint you add to your assistant's MCP settings.
Is there a ready-made AI agent for security scanning instead?
Yes. If you prefer a finished product to plugging tools into your own assistant, Claude Code and CodeRabbit do this out of the box.
How this list is ordered: a tool comes first when the use case appears in its name rather than only in its description, then when it offers a hosted endpoint, then when its source code is public, then by how recently our robot saw it in the Official MCP Registry. The match to security Scanning comes from the publisher's description (keyword method), not from a test of the tool. Only active tools with a real description are listed. No tool pays to appear here.