1. Conduid
  2. Developer Tools
  3. Awesome MCP Security
MCP server ยท Developer Tools

Awesome MCP Security

by ยท github.com/Puliczek/awesome-mcp-security

๐Ÿ”ฅ๐Ÿ”’ Awesome MCP (Model Context Protocol) Security ๐Ÿ–ฅ๏ธ

Unclaimed last commit 7 months ago devtools
InstallView source
78Good

Scored 7 days ago ยท breakdown

About Awesome MCP Security

Awesome MCP Security is an MCP server published by Puliczek in the Developer Tools category: ๐Ÿ”ฅ๐Ÿ”’ Awesome MCP (Model Context Protocol) Security ๐Ÿ–ฅ๏ธ.

The repository has 743 stars and 283 forks, with the last commit 7 months ago. Six months or more without a commit doesn't mean the server is broken, but check the open issues before depending on it in production.

Install

From source
git clone https://github.com/Puliczek/awesome-mcp-security

This server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.

Ask AI

✦

Ask AI about Awesome MCP Security

Powered by Claude · Grounded in docs

I know everything about Awesome MCP Security. Ask me about installation, configuration, usage, or troubleshooting.

Security checks

Static checks derived from the repository 10 hours ago. Heuristics on the source, not an audit.

  • โœ“README presentThe repository ships documentation.
  • !License declaredNo license file. Legally you have no right to use it in a product.
  • !Tests presentNo tests found. Behaviour changes may go unnoticed between versions.
  • !Dependencies pinnedNo lockfile. Installs can pull different code over time.
  • !Scoped permissionsDoesn't declare a permission scope. Assume it can do anything its process can.

1 check has not been run yet.

README

Awesome MCP Security Awesome

Everything you need to know about Model Context Protocol (MCP) security.

Table of Contents

๐Ÿ“” Security Considerations

Official Security Considerations from the Official MCP Specification Rev: 2025-03-26

[!NOTE] 15.04.2025: The current MCP auth specification is in progress of being replaced by a more robust specification. Please join the conversation if you have concerns around the current auth specification.

  • Servers MUST:

    • Validate all tool inputs
    • Implement proper access controls
    • Rate limit tool invocations
    • Sanitize tool outputs

  • Clients SHOULD:

    • Prompt for user confirmation on sensitive operations
    • Show tool inputs to the user before calling the server, to avoid malicious or accidental data exfiltration
    • Validate tool results before passing to LLM
    • Implement timeouts for tool calls
    • Log tool usage for audit purposes

[!WARNING]
For trust & safety and security, clients MUST consider tool annotations to be untrusted unless they come from trusted servers.

[!WARNING]
For trust & safety and security, there SHOULD always be a human in the loop* with the ability to deny tool invocations.

Applications SHOULD:

  • Provide UI that makes clear which tools are being exposed to the AI model.
  • Insert clear visual indicators when tools are invoked.
  • Present confirmation prompts to the user for operations, to ensure a human is in the loop.

[!NOTE]
*Human-in-the-Loop (HITL) means that user help monitor and guide automated tasks, like deciding whether to accept tool requests in Cursor.

๐Ÿ“ƒ Papers

๐Ÿ“บ Videos

๐Ÿ“• Articles, X threads and Blog Posts

๐Ÿง‘โ€๐Ÿš€ Tools and code

๐Ÿ’พ MCP Security Servers

๐Ÿ’ป Other Useful Resources

๐Ÿ˜Ž Contributing

๐Ÿ‘๐ŸŽ‰ First off, thanks for taking the time to contribute! ๐ŸŽ‰๐Ÿ‘

Please read and follow our contributing guide

Thanks! ๐Ÿฆ„

๐Ÿค Show your support

โœ”๏ธ Disclaimer

This project can only be used for educational purposes. Using this resource against target systems without prior permission is illegal, and any damages from misuse of this software will not be the responsibility of the author.

README fetched from the repository 10 hours ago. The original is authoritative.

Questions

About Awesome MCP Security

How do I install Awesome MCP Security?

No package has been published for this server, so install it from source: clone the repository and follow its README.

Is Awesome MCP Security safe to use with an AI agent?

Its trust score is 78 out of 100 (good). It passes 1 of the 5 static security checks run so far; the failures are listed above. It has no ConduID identity yet, so agent calls to it are not receipted.

Is Awesome MCP Security still maintained?

The last commit was 7 months ago and 247 open issues. That's long enough that you should check whether the maintainer is responding to issues before depending on it.