Security MCP servers

Live markets, conflicts, country risk, chokepoints, energy, and China decision signals. 74 tools.

Validate VAST, VMAP, and DAAST ad tags against IAB specs. 232 rules, pure Rust core.

Licensed, rights-cleared content for AI agents - verifiable license keys + EU AI Act attestation.

HexStrike AI MCP Agents is an advanced MCP server that lets AI agents (Claude, GPT, Copilot, etc.) autonomously run 150+ cybersecurity tools for automated pentesting, vulnerability discovery, bug bounty automation, and security research. Seamlessly bridge LLMs with real-world offensive security capabilities.

Search the HeyClaude directory of Claude Code agents, MCP servers, skills, and tools.

23 MCP tools: compliance, verification, messaging, booking and US contract search. 13 keyless.

Detect grooming, bullying, fraud, and 16+ online threats across text, voice, image, and video.

MCP security scanner: detect tool poisoning, prompt injection & rug-pulls - 10 OWASP heuristics.

AI-native ERP MCP: ES/EU fiscal compliance (VeriFactu/TicketBAI/Facturae), invoicing, tax, banking

Plan W-2 event staffing from 345 catalog entries; a coordinator confirms each order.

All-in-One malware analysis tool.

Pre-payout IBAN screening for AI agents: validation, sanctions, Swiss clearing, risk scoring

Query OSV.dev for package vulnerabilities and batch-audit dependency lists via MCP.

Offline methodology engine for authorized penetration testing, CTF, and security research.

Unified threat intel - OTX, AbuseIPDB, GreyNoise, abuse.ch, Feodo Tracker

Search and audit NIST NVD CVEs by keyword, severity, CWE, CISA KEV status, and CPE.

368 AI skills, 76 expert agents, and 859 stdlib Python tools for every team: engineering, PM, marketing, C-level, compliance, business ops, and research. Installs on Claude Code, Cursor, Codex, Gemini, Copilot, and 6 other AI assistants.

Reliability + security proxy for MCP: runtime tool-security and a compliance-mapped audit trail.

Public data intelligence for AI agents — CVE, compliance, patents, contracts, domains.

AI news, model pricing, service status, and machine-payable premium tools. AFTA-certified.

Config-driven engine that turns JSON into production-grade AI agents. Multi-agent orchestration, 12+ LLM providers, MCP/A2A protocols, RAG, persistent memory, and enterprise compliance (EU AI Act, GDPR, HIPAA). Built on Quarkus.

HSM-backed vault secrets for AI agents (JIT fetch) plus prompt-injection and threat scanning.

Search EPA compliance, TRI, Superfund, drinking-water, EJScreen, and AirNow data.

Security-first MCP server for reverse engineering, malware analysis, forensics, and SAST.

Package intelligence MCP for AI agents — 22 tools, 19 ecosystems, AGPL SDK, free.

Production-grade MCP server for Wazuh SIEM — 55 security tools for alert triage, threat hunting, vulnerability management, compliance (PCI DSS, GDPR, HIPAA, NIST CSF, ISO 27001) and active response. Connect Claude or any LLM to your SOC. OAuth 2.1, RBAC, multi-cluster, air-gap ready.

CertScore website risk-signal tools for scans, findings, evidence, and latest-domain lookups.

Arkana - Your entire malware analysis lab, behind one AI prompt. 250+ MCP tools for binary analysis with Claude Code or other MCP

One-step legal compliance for vibe-coded apps: privacy, terms, cookie banner and EU AI Act check.

OWASP Foundation web repository

AI URL safety validator: SAFE/SUSPICIOUS/DANGEROUS verdict, trust score, threat intel.

UK company data: profiles, iXBRL financials, directors, PSC chains, ECCTA. Hosted, no key.

CLI tool and MCP server that tests MCP servers for spec compliance

Full-spectrum wireless security MCP server — WiFi, Bluetooth, RF/SDR, NFC/RFID, Cellular/5G, IoT, MouseJack, air-gap, UWB, WIDS/WIPS, compliance. 34 tools, 9 knowledge bases.

EU AI Act + GDPR compliance scanner. One call, no arguments, 10 seconds. 22 AI frameworks detected.

Scan GitHub repos and profiles for malware before cloning — commit-pinned risk verdicts for agents

Safe, self-hosted OWASP ZAP operator for guided AI security scans and reports.

pentestMCP: AI-Powered Penetration Testing via MCP, an MCP designed for penetration testers.

A fast, keyboard-driven HTTP intercepting proxy and hacking & pentesting toolkit for the terminal.

A collection of servers which are deliberately vulnerable to learn Pentesting MCP Servers.

Authorization-gated MCP server to discover and run 670+ security tools for CTF, pentest, and DFIR.

Threadlinqs threat-intelligence MCP — 73 tools: threats, detections, IOCs, actors, C2, MITRE, CVEs

MCP server for Shodan API — device search, IP lookup, DNS, and CVE/CPE queries.

32 WHOIS, DNS, IP, threat intelligence, email, and bulk tools for AI agents via WhoisXML API.

Evidence-readiness MCP server: validate, audit, and score briefs, memos, and evidence packs.

Agentic memory for CTI in Python — STIX knowledge graphs, threat-actor alias resolution, offline-first RAG, MCP server for Claude Code and LangChain agents

AI-powered security scanning using Black Duck Signal for vulnerability detection.

Cryptographic AI governance + audit. 59 tools, 36 frameworks. EU AI Act, NIST, OWASP, CMMC, SR 11-7

Static compliance-controls checker for UK Online Safety Act & ICO Children's Code. CLI + MCP.

Abnormal Security email threats, cases, and reporting in your terminal and your AI agents.

MCP server for Kali Linux penetration testing - 121 tools for AI-assisted security testing - Giving Agents access to full pentesting tools

ISO 27001 compliance workspace for Claude. Risks, policies, SoA, evidence, and audit workflows.

The community-driven Claude Code plugin marketplace for MSPs — 70+ plugins across PSA, RMM, security, documentation, and accounting, plus cross-vendor industry workflow packs (ops, security, finance, compliance, sales, DevOps, cloud infra) that compose whatever tools you have connected.

MCP server for Shodan — search internet-connected devices, IP reconnaissance, DNS lookups, and CVE/CPE vulnerability intelligence. Works with Claude Code, Codex, Gemini CLI, and Claude Desktop.

Eu Ai Act Compliance MCP Server by MEOK AI Labs

NOT for educational purposes: An MCP server for professional penetration testers including STDIO/HTTP/SSE support, nmap, go/dirbuster, nikto, JtR, hashcat, wordlist building, and more.

Compliance infrastructure API connecting AI agents to Norwegian government systems (Altinn, BRREG).

GPSR, EUDR plots, FDA and EU nutrition labels, fragrance allergens, CPSC certificates.

Deterministic axe-core accessibility scans (WCAG 2.1 AA, EN 301 549, PDF/UA) via your account.

Scans AI-generated code for invisible Unicode, Trojan Source, and supply-chain threats.

US company filing obligations, plus a 25-check bookkeeping diagnostic. Sourced, dated, no signup.

MCTS (Model Context Threat Scanner) is a local-first security scanner for MCP servers -- static and live tool discovery, multiple analyzers, auditable risk scores, and JSON, SARIF, and HTML output. For authors and platform teams; CI-ready, no cloud API.

AI agent identity, W3C credentials, EU AI Act compliance. 47 MCP tools.

Let AI agents run nmap, metasploit, sqlmap, hydra and more in parallel — MCP server built for pentesting and CTF

Query Microsoft Patch Tuesday security updates (MSRC) with EPSS and CISA KEV enrichment

A Model Context Protocol (MCP) server for querying the CVE-Search API

Sourced market and compliance research for Claude Desktop, Claude Code and Cursor.

Pay for HTTP APIs and charge for your own: x402 micropayments in USDC on Base.

Prior direction, kept rather than deleted. Signed, offline-verifiable receipts for AI agent actions, and a reference implementation of the OWASP Agentic Skills Top 10 AST09 receipt pattern. Nobulex is now the independent reliability registry for agent tools: github.com/arian-gogani/nobulex-registry

Independent A-F trust grade for any MCP server, watched for drift. Free, never for sale.

🛡️ The security firewall for AI agent tools & MCP servers (Claude, GPT-5.6, Gemini 3.7, Antigravity, Cursor, Codex, Hermes). Catch command injection, secret theft & toxic flows in <50ms. 100% offline Rust SAST + 1-click auto-fix + SARIF.

Software engineering discipline grounded in named primary standards (OWASP, ITIL, IETF RFCs, ISO, BABOK, SBAR, and more), shipped as a Claude Code plugin and an MCP server.

AVE - Agentic Vulnerability Enumeration. The behavioral classification standard for agentic AI components.

Open-source AI security agent: SAST, DAST, and policy-as-code over MCP.

A curated list of AI-powered pentesting tools, frameworks, MCP servers, and resources for autonomous cybersecurity operations

Elevate your AI assistants (like Claude & Cursor) into autonomous cybersecurity experts. Pentester-MCP integrates 200+ pentesting tools via the Model Context Protocol (MCP) using a secure Docker sandbox.

DMARC analytics and domain onboarding for AI assistants — health, SPF/DKIM, compliance, anomalies.

MCP server bridging Kali and FlareVM for automated Windows malware analysis. 48 tools, 5 prompts, 5 resources, composite playbooks (triage, behavioral, unpack, persistence audit).

Huntable CTI Studio is an AI-assisted cyber threat intelligence workbench that turns open-source CTI into Sigma rules.

A practical, community-driven checklist for pentesting MCP servers. Covers traffic analysis, tool-call behavior, namespace abuse, auth flows, and remote server risks. Maintained by Appsecco and licensed for remixing.

Real-time macroeconomic signals for AI agents. 86 FRED series, regime classification, DeFi rates.

The MCP server that vets MCP servers: identity, risk grade and per-tool risk before you install.

MCP server for secure SSH remote management — 337 tools across 74 groups for DevOps, Docker, Kubernetes, databases, systemd, Windows, cloud, compliance & more. Built in Rust.

Runtime AI governance: decision gates, human approval, hash-chained audit, compliance mapping.

25 production-tested defensive security skills for Claude Code - WordPress, VPS, Cloudflare, Next.js hardening, AI agent guardrails, MCP security, prompt injection defense, OWASP LLM Top 10, LLM coding failure modes (slopsquatting, hallucinated APIs, sycophancy), incident response, GDPR/DACH compliance. MIT, battle-tested.

Ten government-record evidence tools for property, healthcare, facilities, Norway, and routing.

Governance middleware for AI agents: permission gates, approvals, compliance scanning, audit ledger.

Real-time threat intel for AI agents: 890K+ IOCs incl. prompt-injection & AI-skill threats

Security scanning for AI agents: SAST, SCA, secrets, IaC, DAST, ranked by real risk.

IOCs (URLs, domains, IPs, hashes) shared by the infosec community on X/Twitter. No auth, CC0.

Read-only breach intel, full history 2007-today: reports THAT an org was breached, never the data.

Travel-compliance intelligence and curated booking for digital nomads and long-stay travellers.

Search 1,032 verified smart contract vulnerability findings from Sherlock audits by pattern.

SAP SuccessFactors MCP server — 43 HR tools for Claude Desktop & Cloud Run. Query employees, permissions, time off, hiring, compliance, and more via natural language.

npm/PyPI dependency upgrades: package security, compatibility, target ranking, and migration plans.

CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.

Free no-key search over CASA, FAA, EASA & ICAO aviation regulations. By Deepsky (deepskyai.com).

Scan website GDPR compliance: consent, privacy policy, trackers. Score 0-100. x402.

Search Vascue's public healthcare-ops, insurance-claims and booking docs. Public content only.

HTTP header analysis — security headers, cache, server detection. x402 micropayment.

Detect PII in text: emails, phones, SSNs, credit cards, IPs. Regex + Luhn. x402.

Portfolio and strategy stress diagnostics with hedge-break detection and regime outlook. Free tier.

XRPLOracle - 31 XRP Ledger tools: payments, DEX, AMM, hooks, NFTs, validators, DIDs.

Web scraping & search for AI agents: extract, SearXNG search, rerank, robots compliance. No API key.

MCP server for Proofpoint TAP — threat intelligence, forensics, quarantine, and email security.

Code review as an MCP server — structured reviews with OWASP security scanning.

Search and query HackTricks pentesting documentation with quick lookup and section extraction

FlareOracle - 12 Flare tools: FTSO oracles, FAssets, state connector, FXRP, FlareDrops.

Makuri (EU AI tutoring for immigrant children): 11 tools, 2 interactive panels, no user data.

271 agent-payable tools: competitive intel, finance, KYC, compliance, ESG. x402 per-call.

Vacation rental discovery, direct booking, and property protection for AI agents.

MCP server for ScanMalware.com URL scanning, malware detection, and analysis.

55 tools, 7 Resources, Sigma rules, email SPF/DMARC, MITRE, CVE/KEV, risk_score. No key.

Brazilian AI-powered accounting & tax automation: NFS-e invoicing, CBS/IBS tax reform, compliance.

AI-native settlement rail + intelligence oracle for autonomous agents. x402, Base mainnet, 81 tools.

Improve security writing, score it against rubrics, plan IR, CTI, vuln, and product strategy.

Read-only CVE intelligence, remediation playbooks, and agent setup guides. Not a scanner.

Clean FDA regulatory data: company resolution, facilities, recalls, inspections, approvals.

100+ MCP tools for AI agents: content metadata, trade intelligence, business-expertise analysis.

Research U.S. federal contracts, awards, vendors, changes, exclusions, and source documents.

Due diligence & KYC: PEP, national and international sanctions (OFAC, UN, EU, UK, FBI, INTERPOL, FIN

Personalised developer security learning pathways from SecDim's challenges and courses.

MCP server for Mimecast email security: message queue, held messages, domains, and threats.

DORA (EU Digital Operational Resilience Act) compliance for AI agents. 5-pillar audit, incident ...

DriftOracle - 15 tools for model/data drift monitoring: PSI, KS-test, alerts, evidence packs.

Audited AI-regulation data: laws, bills, news and obligations across US, EU and 62 jurisdictions

Pay-per-call cybersecurity for AI agents: vuln scans, threat intel, compliance, code security.

ArbitrumOracle - 12 Arbitrum tools: ERC-20, Camelot, GMX, sequencer, gas, bridge txs.

InsuranceOracle - 12 insurance compliance tools: GDV, BaFin VAG, Solvency II, IDD.

PolicyOracle - 12 policy lifecycle tools: drafting, approval, distribution, attestation.

27 engineering compliance and calculation tools for the built environment (UK, EU, UAE).

What one compliance standard already evidences of another, with the reasoning and the rejections.

ReserveOracle - 11 stablecoin reserve tools: attestations, composition, MiCA Art.36/37.

10,065 source-verified compliance nodes, 39 pillars, 25 MCP tools (EU AI Act, GDPR, NIST, MITRE).

AI-powered Hong Kong SFC regulatory intelligence. Bilingual EN/ZH compliance queries.

ChangeOracle - 10 change management tools: CAB workflow, risk, impact, post-implementation.

AccessOracle - 10 access control tools: IAM, PAM, recertification, segregation of duties.

Agent bookkeeping, sanctions, KYB, VAT and e-invoice checks - pay per call in USDC

Zero-trust gateway for AI agents: score tool calls, verify agent cards, enforce policy, audit.

Read-only public CVE records, capability metadata, and agent instructions from Hacker Bob.

AML/CFT compliance oracle: wallet screening, sanctions, PEPs, jurisdiction risk.

Linux package, file, command, vulnerability, lifecycle, migration, and repository intelligence.

Sentiment, toxicity, entity extraction, PII, translation, summary, QA, fraud scoring, safety audit.

Detect malicious or vulnerable npm packages: registry search, OSV.dev and GitHub advisory lookups

device.house — words become circuits. Design devices: BoM, enclosure, firmware, routed PCB.

Mocap, rehab biomechanics, threat intel, fleet vision. 21 MCP tools, 10 free. x402/USDC paid.

China's apparel supply chain data for AI: 1,000+ suppliers, 350+ fabrics, 170+ clusters.

Keep AI answers fresh with free source previews, scheduled monitoring, evidence history, and alerts.

French company and procurement data APIs for AI agents, with x402 payments in USDC on Base.

Live KTA rates, market data, payment rails, AML/VAT compliance, SDK snippets. 16 tools.

Read your 18 U.S.C. 2257 compliance records: what is outstanding, expiring, or certified.

XFA's remote MCP server — query device posture, compliance, policies & CVEs. Read-only.

Dependency vulnerability scanner with EPSS scoring. 9 MCP tools. Free tier + x402.

Tiny zero-dependency verifier for MEOK AI Labs compliance attestations (DORA, NIS2, CRA, EU AI Act,

Children's privacy compliance: COPPA (US), FERPA (US edu), EU AI Act children's provisions, UK A...

KYA identity verification, trust scoring, and performance bonds for AI agents

TLPTOracle — 17-tool TIBER-EU TLPT framework: scope, threat intel, scenarios, reports.

Threat modeling, code, API & cloud security, shadow-AI & compliance governance.

DORA OS Conductor — 16-tool meta-orchestrator for DORA compliance workflow automation.

Threat modeling, code/cloud/pipeline scanning, shadow-AI discovery, compliance checks and fixes.

Trust checks for MCP servers: trust scores, tool-drift detection, signed diligence receipts. Free.

Vet any MCP server before you depend on it. Stamp: PASS, REVIEW, or BLOCK.

DORAOracle — 15 tools for DORA Art.5-32: risk register, ICT incidents, TLPT, third-party.

DORA OS EventFabric - 14-tool event stream for DORA compliance signals and pub/sub fabric.

ZKEvidenceOracle - 14 zero-knowledge proof tools for compliance evidence: Groth16, PLONK.

CloudOracle - 14-tool multi-cloud compliance MCP: AWS, Azure, GCP posture, IAM, configs.

Threat intel + your scans/findings/Shield posture. CVE, EPSS, KEV, package vuln lookup, DAST.

Crypto marketing compliance rulesets over MCP: MiCA, FCA, GDPR, SEC, MAS, VARA. Not legal advice.

162K English words, 74K lessons, knowledge graph, semantic reverse-dictionary search.

CyberShield - 12 cybersecurity tools: NIS2 mapping, MITRE ATT&CK, vulns, threat intel.

HealthGuard - 12-tool health/medical AI safety MCP: PII redaction, HIPAA, GDPR Art.9.

Booking decisions, scorecards, and self-checks for Florida food vendors over live DBPR data.

Twelve tools: token, wallet, contract and site security. Two free, the rest $1 in USDC over x402.

PredictOracle - 12 forecasting tools: time-series, scenario analysis, risk projections.

FEODE: AI-accessible precision machining & testing; offshore P&A, subsea wellhead, drill-pipe

Source-cited EU/UK/US/AU market-access checks for Amazon and cross-border product compliance.

MCP server connecting AI agents to non-custodial staking data across 130+ networks.

ZEN SecDB MCP server for CVE intelligence, CVSS/EPSS scoring, advisories, SSVC, and package audits.

Read-only pre-sign evidence for onchain agents: route quality, MEV exposure, clear/caution verdict.

ResearchOracle - 11 financial research tools: 10-K parsing, equity, macro, citation graph.

Oceania govt data, cited: rates, VAT, tax, wages, holidays, FX. 8 countries; Australia free.

Linux kernel CVE analyzer: upload a .config, get a CycloneDX VEX report of affecting CVEs.

Asian govt data, cited to source: rates, VAT, tax, wages, holidays, FX. 28 countries; Japan free.

LatAm govt data, cited to source: rates, VAT, tax, wages, holidays, FX. 22 countries; Brazil free.

EOL dates, risk scores, CISA KEV exposure, SBOM audits and edge-device EOS for 500+ products.

European govt data, cited: rates, VAT, tax, wages, holidays, FX. 35 countries; Germany free.

Mid-East govt data, cited to source: rates, VAT, tax, wages, holidays, FX. 9 countries; UAE free.

N American govt data, cited to source: rates, VAT, tax, wages, holidays, FX. 10 countries; USA free.

Tarot card meanings, spreads and seeded reproducible readings for AI agents, one API key.

Judge-level filing rules, court holidays and enforcement data for US federal and state courts.

Public read-only MCP for products, frameworks, guides, methodology, and blog metadata.

Blockchain SSN for AI agents. MCP gateway that blocks at the point of action, tamper evident audit.

Honeypot probe data: IP reputation, scanners, CVE probing, TLS and SSH fingerprints.

Compliance & security scan for your app: secrets, exposed files, headers, privacy, AI-disclosure.

Agentic identity trust: precision decisioning, cryptographic release tokens, hash-chained proof

Cuvo Health published site content and live discovery-call booking tools for AI agents.

UK & EU tenders, planning, companies, insolvency, sanctions and debarment as clean JSON APIs.

AI governance MCP server for EU AI Act compliance and jurisdiction verification

US healthcare data for AI agents: CMS, FDA adverse events, CDC, NPPES NPI. Keyless, real samples.

Keyless x402 compliance on Base: $0.001 OFAC wallet screen, $0.05 pack, $0.95 company file.