- Conduid
- Categories
- Security
Security MCP servers
Security MCP servers indexed by Conduid, ranked by trust score. 4.9K live listings from GitHub, npm, PyPI and the official registry, each with a 0–100 score, security checks, and install commands.
com.thetempleofdoom.draco/draco
Coding & security oracle grounded in 1855 real books. Cited answers via MCP.
Qeemah Accounting & ZATCA e-Invoicing
Saudi ZATCA e-invoicing Phase 2 compliance audit, invoice drafting, and CFO VAT analytics.
net.tipmaster/consensus
Crowd football predictions from TipMaster players, per match. Read-only, no auth, no odds.
Prefetchparse
Surface program-execution evidence from Windows Prefetch exports
Cipherdetect
Detect & crack classical ciphers (caesar/vigenere/xor) by scoring
Shell Guard
MCP server for safe shell access. Every command validated against per-agent permission rules before execution. Powered by AgentsID.
Avert Spec
AVERT — open specification for verifiable AI-agent execution against government systems. Reference implementation: Apier, the Norwegian compliance API (apier.no).
Conferencegrid MCP
MCP server for verified B2B conference data: dates, sponsors, exhibitors, speakers and open calls for speakers. Hosted, OAuth, read-only.
Allquiet
MCP server for the All Quiet incident management API
Sealref
Keychain-backed secrets for coding agents: the agent sees sealref:// refs, never values. macOS, MCP server, local entry form.
Rustfortimcp
Enterprise MCP server for Fortinet FortiGate (then FortiManager) on the mecmcp foundation — scoped access, audited change control. A mechub project.
Protonmail AI
Security-first Proton Mail automation for AI agents — direct QR session-fork auth, local-first Rust CLI + MCP, least-privilege tools, and auditable sessions.
Aicaudit
aicaudit — AI-powered code audit for Python: taint-path static analysis + evidence-grounded AI verdicts. Every result ships with a machine-checkable source-to-sink path.
Prompt Shield Security MCP
Deterministic prompt injection classification, secret entropy detection, PII redacting, and synthetic dataset bias auditing.
Pancakes
Static-analysis engine for automation blueprints, with a language-neutral IR, security and delivery rules, Make.com translation, and an MCP interface.
Sec Wpscan MCP
MCP server for WPScan - WordPress security scanner
Sec Recon Ng MCP
MCP server for recon-ng - OSINT framework
AI Security Skill
A prompt-based security audit for AI systems. Copy it, paste it into any AI assistant with codebase access, and get a structured vulnerability report in minutes.
Salesforce MCP Bridge
Stdio MCP bridge to Salesforce Hosted MCP servers — workaround for broken OAuth discovery on api.salesforce.com
Sec Responder MCP
MCP server for Responder - LLMNR/NBT-NS poisoner for authorized penetration testing
Sec John The Ripper MCP
MCP server for John the Ripper - Password cracking and security auditing via SSH to Kali Linux
Lynq
Middleware framework for MCP servers — primitives for auth, payments & HTTP transport
Security Toolkit
13 atomic MCP tools for AppSec and AI Security: recon, MCP audit, prompt-injection audit, OWASP LLM Top 10
Grade Neq Gate
GRADE ≠ GATE — MCP inventory grade is not a runtime gate. Synthetic demo for sentinelagent-guard.
Drupalmcp Ts
Google ADK agents for Drupal, over MCP: OAuth credentials, the site's tools, and scope-aware refusals. Companion to the drupal/mcp module.
Tool Trust Metadata
Working paper: provenance and trusted metadata for MCP tools (SPDX 3 / CycloneDX reuse, offline verification)
Vulnbench
Benchmark of static analyzers on real, publicly disclosed vulnerabilities in open-source MCP servers: vulnerable/fixed commit pairs, Docker harness, SARIF scoring
Source Trace
SourceTrace: AI compliance provenance API. Traces regulations and standards to primary sources. Auditable JSON—no hallucinations. For AI agents and compliance teams.
Odavi
Architecture case study: self-hosted email platform with a credential boundary that keeps secrets out of an AI agent's context. Docs only, source is private.
Constellation MCP
Constellation MCP — one MCP server, sixteen tools, three products. Xavani Agent drives Gavaza (POPIA), Nyarhi (knowledge graph) and Mhangani (web audit) as native tools.
Omv MCP
MCP server for managing an OpenMediaVault NAS over SSH
Divergence
Precision-first security analyzer for MCP servers and agent skills. 0% false positives on traps, 96% recall.
Mcpg Aauth Core
AAuth protocol primitives — Ed25519/ES256 JWKs/JWTs, RFC 9421 request signing and verification, Signature-Key schemes
Mcpg Plugin Identity Mtls
mTLS identity plugin for MCPG gateway (dev.mcpg.identity.mtls) — header-injection sources
Sealmaker MCP
Free remote MCP server that carves Western names into authentic Chinese name seals (seal-script PNG) with real Chinese names and per-character meanings. No API key.
Skan Zgodnosci MCP
Serwer MCP: skala przesiewowa bezpieczenstwa informacji i zgodnosci RODO/NIS2 dla firm w Polsce
Agent Trust Plane
Authorization and security regression testing for AI agents and MCP tools.
Leasebroker
Local-first broker issuing time-bounded, least-privilege capability leases to AI agents and MCP servers — signed, scoped, expiring; deny-by-default with audit and human veto.
Bugsafe
Share bugs, not secrets
Jail
A local policy shim that blocks the MCP STDIO RCE class disclosed by OX Security in April 2026
Autonomous Security Lab Assistant
Safe-by-default MCP-style assistant for scoped security lab workflows.
Voizematic MCP
World's first and only AI voice agent MCP connector — manage agents, run campaigns, check TCPA/DNC compliance, and make calls directly from Claude.
Aionis Claude Code
Claude Code plugin, MCP hooks, and lifecycle integration for Aionis execution memory.
Sentori
🛡️ Security scanner for AI Agents and MCP Servers — like npm audit for AI
Tinymediamanager MCP
MCP server for tinyMediaManager HTTP API automation workflows.
Xmemo Gemini CLI
XMemo — user-owned long-term memory for AI agents, as a Gemini CLI extension (remote MCP over OAuth).
Server Card Trust MCP
ServerCard Trust MCP: Paid remote MCP for server-card validation, auth checks, trust packets, and readiness.
Blindkey
Local-first credential broker for AI agents — secrets your agents can use but never see. 66 testable security constraints. Rust.
Flowki Claude Code Hardening
Deny-list config, documented attack patterns, and pentester checklist from a hands-on security review of Claude Code's permission architecture.
OpenMoat
Local security gateway for MCP with deny-by-default policy and stateless protocol support.