Tools · Security Scanning
Best MCP servers for security scanning
305 MCP servers in the Official MCP Registry do security scanning. 143 can be used as a hosted endpoint, with nothing to install, and 235 publish their source code.
| # | Tool | Relevance | Connect | Code | Seen |
|---|---|---|---|---|---|
| 151 | Bright Security Enables AI agents to access Bright Security tools for app discovery and security testing. | In description security testing | HOSTEDLOCAL | — | 3d ago |
| 152 | ZEN SecDB ZEN SecDB MCP server for CVE intelligence, CVSS/EPSS scoring, advisories, SSVC, and package audits. | In description cve | HOSTEDLOCAL | — | 3d ago |
| 153 | zenable Zenable cleans up sloppy AI code and prevents vulnerabilities with deterministic guardrails | In description vulnerabilities | HOSTEDLOCAL | — | 3d ago |
| 154 | MAD Synapse · Wallets & Risk Pre-trade safety + wallets: Solana/EVM token risk, honeypots, counterparties, balances, txs, CVEs. | In description cves | HOSTEDLOCAL | — | 3d ago |
| 155 | exploitwatch Check dependencies against CISA's real Known Exploited Vulnerabilities feed. | In description vulnerabilities | HOSTEDLOCAL | — | 3d ago |
| 156 | Package Health Check Check an npm or Python package, or a package.json, for vulnerabilities and upkeep. | In description vulnerabilities | HOSTEDLOCAL | — | 3d ago |
| 157 | Strix AI pentesting: run scans, triage vulnerabilities, review PRs, manage schedules and assets. | In description pentesting | HOSTEDLOCAL | — | 3d ago |
| 158 | dependency-trust Trust-check any dependency for agents: OpenSSF Scorecard, licenses, CVEs, deps. 7 ecosystems. | In description cves | HOSTEDLOCAL | — | 3d ago |
| 159 | dynamic-feed 94 keyless tools of live, verifiable data for AI: weather, hazards, space, CVEs. Ed25519-signed. | In description cves | HOSTEDLOCAL | — | 3d ago |
| 160 | Cybret findings Validated API and app vulnerability findings with remediation guidance. | In description vulnerability | HOSTEDLOCAL | — | 3d ago |
| 161 | AIS Gateway — the campus front desk for AIS MCP buildings Front desk for the AIS MCP campus: lists our buildings (CVE, Flight Recorder), prices, how to pay | In description cve | HOSTEDLOCAL | — | 3d ago |
| 162 | MCP Safety Warden MCP proxy adding security scanning, behavioral profiling, risk gating, and safe tool call execution. | In description security scanning | HOSTEDLOCAL | Open | 29m ago |
| 163 | MCP ZAP Server Safe, self-hosted OWASP ZAP operator for guided AI security scans and reports. | In description owasp | HOSTEDLOCAL | Open | 4h ago |
| 164 | SkillTotal Deterministic security scan of MCP servers, agent skills and npm/PyPI packages. Runs locally. | In description security scan | HOSTEDLOCAL | Open | 4h ago |
| 165 | Proofpoint MCP server for Proofpoint TAP — threat intelligence, forensics, quarantine, and email security. | In description threat intelligence | HOSTEDLOCAL | Open | 11h ago |
| 166 | supply-chain-guard Supply-chain malware scanner and MCP server: vet packages in 15 ecosystems before install, offline. | In description malware | HOSTEDLOCAL | Open | 19h ago |
| 167 | dependency-auditor CVE scanning for npm/pip/cargo dependencies via OSV | In description cve | HOSTEDLOCAL | Open | 1d ago |
| 168 | VulnCheck VulnCheck exploit intelligence — CVE research, exploit data, advisories, and threat analysis. | In description cve | HOSTEDLOCAL | Open | 1d ago |
| 169 | OSV Advisories Query OSV.dev for known vulnerabilities by package and version, and scan lockfiles in batch. | In description vulnerabilities | HOSTEDLOCAL | Open | 1d ago |
| 170 | unbounded-consumption-auditor Scans LLM/agent code for Unbounded Consumption / denial-of-wallet risks (OWASP LLM Top 10 2026 #6) | In description owasp | HOSTEDLOCAL | Open | 1d ago |
| 171 | audit-gap-auditor OWASP MCP08 audit/telemetry gaps: missing tool-call logs, raw args in logs, disabled audit | In description owasp | HOSTEDLOCAL | Open | 1d ago |
| 172 | context-oversharing-auditor OWASP MCP10 context oversharing: session dumps, unscoped memory, shared context, prompt leaks | In description owasp | HOSTEDLOCAL | Open | 1d ago |
| 173 | otx MCP server for AlienVault OTX threat intelligence: indicators, pulses, search, and users. | In description threat intelligence | HOSTEDLOCAL | Open | 2d ago |
| 174 | shodan MCP server for Shodan API — device search, IP lookup, DNS, and CVE/CPE queries. | In description cve | HOSTEDLOCAL | Open | 2d ago |
| 175 | mcp Security tools for your AI: scan, pentest, check headers, guard code and scan repos for secrets. | In description pentest | HOSTEDLOCAL | Open | 3d ago |
| 176 | mcp-whoisxmlapi 32 WHOIS, DNS, IP, threat intelligence, email, and bulk tools for AI agents via WhoisXML API. | In description threat intelligence | HOSTEDLOCAL | Open | 3d ago |
| 177 | siteaudit-mcp SEO, performance, and security audits for any URL — no API keys required | In description security audits | HOSTEDLOCAL | Open | 3d ago |
| 178 | intelthreadlinqs-mcp Threadlinqs threat-intelligence MCP — 73 tools: threats, detections, IOCs, actors, C2, MITRE, CVEs | In description cves | HOSTEDLOCAL | Open | 3d ago |
| 179 | starlog Vet a package (CVEs, license, maintenance) before your AI agent uses it, plus capability discovery. | In description cves | HOSTEDLOCAL | Open | 3d ago |
| 180 | Snyk API & Web MCP Server MCP server for Snyk API & Web — DAST scanning, findings management, and vulnerability triage | In description dast | HOSTEDLOCAL | Open | 3d ago |
| 181 | GuardianShield AI security layer: code scanning, PII detection, prompt injection, secrets, CVEs | In description cves | HOSTEDLOCAL | Open | 3d ago |
| 182 | MCP Shield Security scanner for MCP servers. SSRF, path traversal, injection, auth, secrets. Grade A-F. | In description security scanner | HOSTEDLOCAL | Open | 3d ago |
| 183 | MCPProxy Local-first MCP proxy with BM25 tool discovery, security scanning, quarantine & ~99% token savings | In description security scanning | HOSTEDLOCAL | Open | 3d ago |
| 184 | Reversecore MCP Security-first MCP server for reverse engineering, malware analysis, forensics, and SAST. | In description malware | HOSTEDLOCAL | Open | 3d ago |
| 185 | agent-security-scanner-mcp Security layer for AI agents: blocks prompt injection, detects fake packages, scans vulnerabilities. | In description vulnerabilities | HOSTEDLOCAL | Open | 3d ago |
| 186 | AgentGuard — security checks for AI agents Secret, CVE and dependency-vulnerability scanning for AI agents (free, OSV.dev). | In description cve | HOSTEDLOCAL | Open | 3d ago |
| 187 | CyberLens Security scanning for websites, public repositories, and Open CLAW skills. | In description security scanning | HOSTEDLOCAL | Open | 3d ago |
| 188 | GhostFree MCP server that scans your repo's dependencies for security vulnerabilities based on published CVEs. | In description vulnerabilities | HOSTEDLOCAL | Open | 3d ago |
| 189 | weavatrix-online Weavatrix Online extension: guarded sync, advisories, malware review, architecture contracts. | In description malware | HOSTEDLOCAL | Open | 3d ago |
| 190 | ZettelForge Agentic memory for cyber threat intelligence. STIX graphs, actor aliasing, offline RAG, Sigma/YARA. | In description threat intelligence | HOSTEDLOCAL | Open | 3d ago |
| 191 | arcwall-security Security scanning for AI coding tools. Detects secrets, threat models, and runs pre-commit checks. | In description security scanning | HOSTEDLOCAL | Open | 3d ago |
| 192 | promptrejectormcp Security gateway for AI agents: detects prompt injections, jailbreaks, and common vulnerabilities. | In description vulnerabilities | HOSTEDLOCAL | Open | 3d ago |
| 193 | Security MCP Zero-key security toolkit: grade sites A+ to F, check CVE exploits, plain-English attack defenses | In description cve | HOSTEDLOCAL | Open | 3d ago |
| 194 | DugganUSA CLI — Local STDIO MCP Local STDIO MCP for DugganUSA threat intel. 1.13M IOCs. Read-only. npm: dugganusa-cli. | In description threat intel | HOSTEDLOCAL | Open | 3d ago |
| 195 | MCP Security Guard Audit MCP servers for tool poisoning, rug pulls and supply-chain risk (OWASP MCP Top 10). | In description owasp | HOSTEDLOCAL | Open | 3d ago |
| 196 | operant-mcp Security testing MCP server for penetration testing, forensics, and vulnerability assessment | In description security testing | HOSTEDLOCAL | Open | 3d ago |
| 197 | npm-plus npm MCP — search packages, bundle sizes, vulnerabilities, compare downloads. | In description vulnerabilities | HOSTEDLOCAL | Open | 3d ago |
| 198 | VulnFeed Dependency vulnerability scanner with EPSS scoring. 9 MCP tools. Free tier + x402. | In description vulnerability | HOSTEDLOCAL | Open | 3d ago |
| 199 | mcp-code-sanitizer Strict AI code reviewer powered by Groq. Finds bugs and vulnerabilities. | In description vulnerabilities | HOSTEDLOCAL | Open | 3d ago |
Ready-made AI agents
- $20/mo
- $24/mo · free plan
Other use cases
FAQ
How many MCP servers are there for security scanning?
Electra Index lists 305 active MCP servers for security scanning from the Official MCP Registry. 143 offer a hosted endpoint and 235 publish their source code.
Is there a hosted MCP server for security scanning, with nothing to install?
Yes. Bright Security, ZEN SecDB and zenable declare a remote endpoint you add to your assistant's MCP settings.
Is there a ready-made AI agent for security scanning instead?
Yes. If you prefer a finished product to plugging tools into your own assistant, Claude Code and CodeRabbit do this out of the box.
How this list is ordered: a tool comes first when the use case appears in its name rather than only in its description, then when it offers a hosted endpoint, then when its source code is public, then by how recently our robot saw it in the Official MCP Registry. The match to security Scanning comes from the publisher's description (keyword method), not from a test of the tool. Only active tools with a real description are listed. No tool pays to appear here.