Tools · Security Scanning
Best MCP servers for security scanning
305 MCP servers in the Official MCP Registry do security scanning. 143 can be used as a hosted endpoint, with nothing to install, and 235 publish their source code.
| # | Tool | Relevance | Connect | Code | Seen |
|---|---|---|---|---|---|
| 251 | diffpilot MCP server for PR code review, commit messages, changelogs, and secret detection. | In description secret detection | HOSTEDLOCAL | Open | 3d ago |
| 252 | attestd-mcp CVE checks, supply chain signals, live catalog, and CVE detail for MCP clients (infra, PyPI, npm). | In description cve | HOSTEDLOCAL | Open | 3d ago |
| 253 | Grasp — Code Architecture & Dependency Analysis Codebase analysis: dependency graphs, security scanning, and refactor plans for GitHub and GitLab. | In description security scanning | HOSTEDLOCAL | Open | 3d ago |
| 254 | dvalincode Deterministic security scanning, no model or API key, plus offline-verifiable proof a fix worked. | In description security scanning | HOSTEDLOCAL | Open | 3d ago |
| 255 | mcp-threatintel Unified threat intel - OTX, AbuseIPDB, GreyNoise, abuse.ch, Feodo Tracker | In description threat intel | HOSTEDLOCAL | Open | 3d ago |
| 256 | vulnicheck HTTP MCP Server for comprehensive Python vulnerability scanning and security analysis. | In description vulnerability | HOSTEDLOCAL | Open | 3d ago |
| 257 | Prism Scanner Security scanner for AI Agent skills, plugins, and MCP servers with A-F grading. | In description security scanner | HOSTEDLOCAL | Open | 3d ago |
| 258 | pkgxray Pre-install security scans for npm packages, MCP servers, and AI agents with cited verdict evidence. | In description security scans | HOSTEDLOCAL | Open | 3d ago |
| 259 | yotta-verify-mcp Pre-install security scanner for AI agent skills (local stdio MCP). Offline static scan; no upload. | In description security scanner | HOSTEDLOCAL | Open | 3d ago |
| 260 | HackTricks MCP Server Search and query HackTricks pentesting documentation with quick lookup and section extraction | In description pentesting | HOSTEDLOCAL | Open | 3d ago |
| 261 | npm Registry MCP Server npm registry MCP server — package intelligence, security audits, dependency analysis | In description security audits | HOSTEDLOCAL | Open | 3d ago |
| 262 | ESET PROTECT MCP server for ESET PROTECT's ESET Connect API - device, EDR, vulnerability, patch, and user data. | In description vulnerability | HOSTEDLOCAL | Open | 3d ago |
| 263 | release-gate Pre-deploy security auditor for AI agent code — the risks generic SAST misses. | In description sast | HOSTEDLOCAL | Open | 3d ago |
| 264 | Scout Security Deterministic, zero-token security scanner your AI agent calls to find and re-verify issues. | In description security scanner | HOSTEDLOCAL | Open | 3d ago |
| 265 | sphior-code-mcp Deterministic SAST/SCA findings + fix guidance for your GitHub repos, handed to your AI agent. | In description sast | HOSTEDLOCAL | Open | 3d ago |
| 266 | ScriptDocs MCP Real, live npm/PyPI docs and OSV.dev vulnerability data for AI coding agents. No fake data. | In description vulnerability | HOSTEDLOCAL | Open | 3d ago |
| 267 | mcp Symbiotic CLI MCP Server for security scanning and analysis | In description security scanning | HOSTEDLOCAL | Open | 3d ago |
| 268 | CodeInspectus Local-first MCP security scanner and CLI for AI-generated applications. | In description security scanner | HOSTEDLOCAL | Open | 3d ago |
| 269 | freshdeps-mcp Live npm/PyPI dependency-health verdicts so AI agents stop recommending stale or CVE'd packages | In description cve | HOSTEDLOCAL | Open | 3d ago |
| 270 | Action1 MCP Every Action1 endpoint, plus fleet-wide patch and vulnerability views across all your organizations. | In description vulnerability | HOSTEDLOCAL | Open | 3d ago |
| 271 | skillguard Security scanner for third-party AI agent-skill files (SKILL.md, hooks, scripts) via MCP. | In description security scanner | HOSTEDLOCAL | Open | 3d ago |
| 272 | Domain Security Audit a domain's email and web security: SPF, DKIM, DMARC, MTA-STS, DNSSEC, TLS, WHOIS. No API keys. | In description security audit | HOSTEDLOCAL | Open | 3d ago |
| 273 | InsAIts - AI Communication Security Monitor Runtime AI-to-AI security monitor. 23 anomaly types, OWASP MCP Top 10 coverage. | In description owasp | HOSTEDLOCAL | Open | 3d ago |
| 274 | nel-veil Free passive security scanning - check any domain's DMARC, TLS, headers, and exposures. | In description security scanning | HOSTEDLOCAL | Open | 3d ago |
| 275 | mcpshield Security scanner for MCP servers - detects tool poisoning and injection | In description security scanner | HOSTEDLOCAL | Open | 3d ago |
| 276 | mcp-observatory MCP security scanner. CI-native testing, attack simulation, health scoring, and SARIF. | In description security scanner | HOSTEDLOCAL | Open | 3d ago |
| 277 | rqwstr AI-native HTTP security testing MCP server — 17 tools with raw HTTP/1.1 + HTTP/2 control | In description security testing | HOSTEDLOCAL | Open | 3d ago |
| 278 | global-intel-exchange Real-time sanctions screening, CVE, and company registry checks for agents. | In description cve | HOSTEDLOCAL | Open | 3d ago |
| 279 | checkmcp Audit any MCP server's security & quality — OWASP MCP Top 10 + explainable 0-100 MCP Score | In description owasp | HOSTEDLOCAL | Open | 3d ago |
| 280 | ExposureGuard Domain security scanning for AI agents. A-F grades, 8 checks, fix snippets. | In description security scanning | HOSTEDLOCAL | Open | 3d ago |
| 281 | Deepsleuth Deterministic, no-LLM security scanner for MCP servers, plus an inline proxy gate. | In description security scanner | HOSTEDLOCAL | Open | 3d ago |
| 282 | TridentChain Security Local supply-chain CVE scanner via OSV/NVD. Scans deps and IDE extensions. No upload. | In description cve | HOSTEDLOCAL | Open | 3d ago |
| 283 | selvo Linux CVE prioritisation: 16 MCP tools for scan, fleet, runtime, and PR-able fix discovery. | In description cve | HOSTEDLOCAL | Open | 3d ago |
| 284 | cisa-kev-mcp CISA Known Exploited Vulnerabilities feed + remediation deadlines for US federal + critical infr... | In description vulnerabilities | HOSTEDLOCAL | Open | 3d ago |
| 285 | aikido-mcp Security analysis for Aiken smart contracts on Cardano. 75 vulnerability detectors. | In description vulnerability | HOSTEDLOCAL | Open | 3d ago |
| 286 | Clevername AI agent governance — security scanning, BYOK routing, audit logging, and Council approvals. | In description security scanning | HOSTEDLOCAL | Open | 3d ago |
| 287 | pentagonal-mcp AI smart contract forge — 8-agent security audits, generation, and compilation across 8 chains | In description security audits | HOSTEDLOCAL | Open | 3d ago |
| 288 | Darkmoon Drive a self-hosted Darkmoon Pro AI pentest instance: start runs, read campaigns and findings. | In description pentest | HOSTEDLOCAL | Open | 3d ago |
| 289 | cybersec-toolkit Authorization-gated MCP server to discover and run 670+ security tools for CTF, pentest, and DFIR. | In description pentest | HOSTEDLOCAL | Open | 3d ago |
| 290 | Klarion Secret scanning for AI agents: rules and entropy find candidates, a model decides which are real. | In description secret scanning | HOSTEDLOCAL | Open | 3d ago |
| 291 | stackhawk An MCP server that provides interaction with StackHawk's security scanning platform. | In description security scanning | HOSTEDLOCAL | Open | 3d ago |
| 292 | o360-mcp Run Offensive360 SAST scans (60+ languages) on local code; findings with file/line and fixes | In description sast | HOSTEDLOCAL | Open | 3d ago |
| 293 | Holster MCP Local-first secret scanning, rotation, vault, and audit-log tools for AI agents. | In description secret scanning | HOSTEDLOCAL | Open | 3d ago |
| 294 | mcp-safeguard MCP server security scanner: detects prompt injection, credential leaks, SSRF, tool poisoning. | In description security scanner | HOSTEDLOCAL | Open | 3d ago |
| 295 | arc-security Scan AI agent skills for 25 attack classes + runtime monitoring. 1,316+ findings. | In description security scan | HOSTEDLOCAL | Open | 3d ago |
| 296 | XploitScan Security scanner for AI-generated code. Scan, explain rules, and grade before you ship. | In description security scanner | HOSTEDLOCAL | — | 2d ago |
| 297 | mcp-server-security-scanner Scan MCP configs for 30+ CVEs, prompt injection, tool poisoning; validate OAuth configs | In description cves | HOSTEDLOCAL | — | 3d ago |
| 298 | Polarity Real-time threat intelligence lookups and IOC parsing from your self-hosted Polarity instance. | In description threat intelligence | HOSTEDLOCAL | — | 3d ago |
Ready-made AI agents
- $20/mo
- $24/mo · free plan
Other use cases
FAQ
How many MCP servers are there for security scanning?
Electra Index lists 305 active MCP servers for security scanning from the Official MCP Registry. 143 offer a hosted endpoint and 235 publish their source code.
Is there a ready-made AI agent for security scanning instead?
Yes. If you prefer a finished product to plugging tools into your own assistant, Claude Code and CodeRabbit do this out of the box.
How this list is ordered: a tool comes first when the use case appears in its name rather than only in its description, then when its description covers more aspects of the use case, then when it offers a hosted endpoint, then when its source code is public, then by how recently our robot saw it in the Official MCP Registry. The match to security Scanning comes from the publisher's description (keyword method), not from a test of the tool. Only active tools with a real description are listed. No tool pays to appear here.