Tools · Security Scanning
Best MCP servers for security scanning
305 MCP servers in the Official MCP Registry do security scanning. 143 can be used as a hosted endpoint, with nothing to install, and 235 publish their source code.
| # | Tool | Relevance | Connect | Code | Seen |
|---|---|---|---|---|---|
| 201 | Repository Intelligence Analyze repos of any size - security scanning code analysis monorepo support | In description security scanning | HOSTEDLOCAL | Open | 3d ago |
| 202 | mythos-agent Open-source AI security agent: SAST, DAST, and policy-as-code over MCP. | In description sast | HOSTEDLOCAL | Open | 3d ago |
| 203 | agent-bom Security scanner and graph for agentic infrastructure — agents, MCP, runtime, and blast radius. | In description security scanner | HOSTEDLOCAL | Open | 3d ago |
| 204 | osv-mcp Use this MCP server to OSV open source vulnerability data and package security checks. Tools... | In description vulnerability | HOSTEDLOCAL | Open | 3d ago |
| 205 | maltiverse-mcp Threat intelligence for IPs and domains from Maltiverse. No key required. | In description threat intelligence | HOSTEDLOCAL | Open | 3d ago |
| 206 | dnstwister-mcp DNS twister domain threat intelligence: fuzz domains for typosquatting, check whois. | In description threat intelligence | HOSTEDLOCAL | Open | 3d ago |
| 207 | cisa-kev-mcp Use this MCP server to CISA Known Exploited Vulnerabilities catalog search. Tools include search... | In description vulnerabilities | HOSTEDLOCAL | Open | 3d ago |
| 208 | package-guard-mcp Supply-chain guard for AI coding agents: verify packages, check vulns/malware, detect typosquats. | In description malware | HOSTEDLOCAL | Open | 3d ago |
| 209 | detectzestack-mcp Detect any website's tech stack, security headers, SSL, DNS and CVEs via DetectZeStack. | In description cves | HOSTEDLOCAL | Open | 3d ago |
| 210 | code-guard-mcp Security scan for AI-generated code: injection, SSRF, secrets, weak crypto, unsafe deserialization. | In description security scan | HOSTEDLOCAL | Open | 3d ago |
| 211 | Vanta Vanta compliance MCP server: vulnerabilities, tests, controls, evidence, people, vendors, docs | In description vulnerabilities | HOSTEDLOCAL | Open | 3d ago |
| 212 | microquery-mcp SQL over real-world data — FDA, SEC, blockchain, genomics, CVEs, and more. No config. | In description cves | HOSTEDLOCAL | Open | 3d ago |
| 213 | mcp-server Scan APIs for OWASP Top 10, LLM, and GraphQL security vulnerabilities. | In description owasp | HOSTEDLOCAL | Open | 3d ago |
| 214 | agent-security Security scanning and threat detection for AI agents | In description security scanning | HOSTEDLOCAL | Open | 3d ago |
| 215 | Keyspoor Offline secret scanning for AI agents. Redacted findings; scans text and files in a chosen root. | In description secret scanning | HOSTEDLOCAL | Open | 3d ago |
| 216 | Bug Detector Analyzes code for bugs, security vulnerabilities, and code smells | In description vulnerabilities | HOSTEDLOCAL | Open | 3d ago |
| 217 | contract-scanner Smart contract security scanner — vulnerabilities, risk scores, and calldata decoding | In description security scanner | HOSTEDLOCAL | Open | 3d ago |
| 218 | base-security-scanner-mcp MCP server to scan smart contracts on Base for honeypots, rug pulls, and vulnerabilities. | In description vulnerabilities | HOSTEDLOCAL | Open | 3d ago |
| 219 | mcpwatch Audit MCP servers from inside Claude Code. 10 OWASP checks, A-F grade, live leaderboard. | In description owasp | HOSTEDLOCAL | Open | 3d ago |
| 220 | bridgeguard-mcp BridgeGuard MCP Server - Cross-chain bridge security audit tools for AI coding agents. Scan bri... | In description security audit | HOSTEDLOCAL | Open | 3d ago |
| 221 | kastell Server security audit (413 checks), hardening, and fleet management across 4 cloud providers. | In description security audit | HOSTEDLOCAL | Open | 3d ago |
| 222 | mcp-server-security-audit Scan websites for security vulnerabilities, headers, TLS, and email security. | In description vulnerabilities | HOSTEDLOCAL | Open | 3d ago |
| 223 | agent-guard Safety checks an agent runs before it acts: package malware, destructive command, secret leak. | In description malware | HOSTEDLOCAL | Open | 3d ago |
| 224 | inkog Security co-pilot for AI agents. Scan for vulnerabilities, audit MCP servers, verify governance. | In description vulnerabilities | HOSTEDLOCAL | Open | 3d ago |
| 225 | mcp-codeaudit Security audit for AI agents — scan code/diffs for leaked secrets, check deps via OSV. | In description security audit | HOSTEDLOCAL | Open | 3d ago |
| 226 | 3ilm-mcp Search 1,032 verified smart contract vulnerability findings from Sherlock audits by pattern. | In description vulnerability | HOSTEDLOCAL | Open | 3d ago |
| 227 | Eleion Scanner Register/verify your domains, queue security scans, and read findings (CVE, severity). | In description security scans | HOSTEDLOCAL | Open | 3d ago |
| 228 | Aguara MCP Security scanner for AI agent skills and MCP servers | In description security scanner | HOSTEDLOCAL | Open | 3d ago |
| 229 | cloud-audit AWS security scanner with attack chain detection, IAM privilege escalation, and fixes | In description security scanner | HOSTEDLOCAL | Open | 3d ago |
| 230 | MCPSentinel Precision-first security scanning for Model Context Protocol servers. | In description security scanning | HOSTEDLOCAL | Open | 3d ago |
| 231 | flagrix Scan GitHub repos and profiles for malware before cloning — commit-pinned risk verdicts for agents | In description malware | HOSTEDLOCAL | Open | 3d ago |
| 232 | MobiLoop Guarded AI mobile Appium testing, security scanning, verification, and fix-retest MCP tools. | In description security scanning | HOSTEDLOCAL | Open | 3d ago |
| 233 | taskbounty-check Local GitHub Actions/CI maintenance check (action pinning, token perms). Not a full security audit. | In description security audit | HOSTEDLOCAL | Open | 3d ago |
| 234 | skylos Dead code, security, secrets detection and code quality for Python, TypeScript, Go. | In description secrets detection | HOSTEDLOCAL | Open | 3d ago |
| 235 | Purify Security Feeds Query CISA KEV / EPSS vulnerability feeds with full per-record provenance and auditable versions | In description vulnerability | HOSTEDLOCAL | Open | 3d ago |
| 236 | synapse-audit AI-Powered Security Scanner for LLMs. Detects vulnerabilities and syncs with SynapseAudit. | In description security scanner | HOSTEDLOCAL | Open | 3d ago |
| 237 | tubemind-secure-mcp Secure MCP server for YouTube intelligence — 18 tools, OAuth2, OWASP Top 10 controls. | In description owasp | HOSTEDLOCAL | Open | 3d ago |
| 238 | obsidian-mcp-secure Secure MCP server for Obsidian with OWASP Top 10 controls and full audit logging. | In description owasp | HOSTEDLOCAL | Open | 3d ago |
| 239 | wireshark-mcp Professional network analysis with tshark. Security audits, deep-dives, and threat detection. | In description security audits | HOSTEDLOCAL | Open | 3d ago |
| 240 | diffpilot MCP server for PR code review, commit messages, changelogs, and secret detection. | In description secret detection | HOSTEDLOCAL | Open | 3d ago |
| 241 | Bawbel Scanner Scan MCP servers and skill files for AVE vulnerabilities. Conformance scoring and threat intel. | In description vulnerabilities | HOSTEDLOCAL | Open | 3d ago |
| 242 | attestd-mcp CVE checks, supply chain signals, live catalog, and CVE detail for MCP clients (infra, PyPI, npm). | In description cve | HOSTEDLOCAL | Open | 3d ago |
| 243 | Grasp — Code Architecture & Dependency Analysis Codebase analysis: dependency graphs, security scanning, and refactor plans for GitHub and GitLab. | In description security scanning | HOSTEDLOCAL | Open | 3d ago |
| 244 | dvalincode Deterministic security scanning, no model or API key, plus offline-verifiable proof a fix worked. | In description security scanning | HOSTEDLOCAL | Open | 3d ago |
| 245 | mcp-threatintel Unified threat intel - OTX, AbuseIPDB, GreyNoise, abuse.ch, Feodo Tracker | In description threat intel | HOSTEDLOCAL | Open | 3d ago |
| 246 | vulnicheck HTTP MCP Server for comprehensive Python vulnerability scanning and security analysis. | In description vulnerability | HOSTEDLOCAL | Open | 3d ago |
| 247 | Prism Scanner Security scanner for AI Agent skills, plugins, and MCP servers with A-F grading. | In description security scanner | HOSTEDLOCAL | Open | 3d ago |
| 248 | pkgxray Pre-install security scans for npm packages, MCP servers, and AI agents with cited verdict evidence. | In description security scans | HOSTEDLOCAL | Open | 3d ago |
| 249 | yotta-verify-mcp Pre-install security scanner for AI agent skills (local stdio MCP). Offline static scan; no upload. | In description security scanner | HOSTEDLOCAL | Open | 3d ago |
Ready-made AI agents
- $20/mo
- $24/mo · free plan
Other use cases
FAQ
How many MCP servers are there for security scanning?
Electra Index lists 305 active MCP servers for security scanning from the Official MCP Registry. 143 offer a hosted endpoint and 235 publish their source code.
Is there a ready-made AI agent for security scanning instead?
Yes. If you prefer a finished product to plugging tools into your own assistant, Claude Code and CodeRabbit do this out of the box.
How this list is ordered: a tool comes first when the use case appears in its name rather than only in its description, then when it offers a hosted endpoint, then when its source code is public, then by how recently our robot saw it in the Official MCP Registry. The match to security Scanning comes from the publisher's description (keyword method), not from a test of the tool. Only active tools with a real description are listed. No tool pays to appear here.