- Conduid
- Marketplace
- #appsec
MCP servers tagged appsec
86 live MCP servers tagged "appsec", ranked by trust score. Tags come from package metadata and repository topics, so this list covers servers across every category that work with appsec.
Burp AI Agent
Burp Suite extension that adds built-in MCP tooling, AI-assisted analysis, privacy controls, passive and active scanning and more
SafeLine
SafeLine is a self-hosted WAF(Web Application Firewall) / reverse proxy to protect your web apps from attacks and exploits.
qianniuspace/mcp-security-audit
A powerful MCP (Model Context Protocol) Server that audits npm package dependencies for security vulnerabilities. Built with remote npm registry integration for real-time security…
Cybermes
Zero-Go Model Context Protocol (MCP) Server for Cybermes Autonomous Security & Diagnostic Framework
Numasec
The AI Agent for Cyber Security.
Copilot Security Instructions
✨ A customizable copilot-instructions.md ruleset & prompts to guide GitHub Copilot toward secure coding defaults in Java, Node.js, C# and Python. Blocks risky patterns, teaches sa…
Fuzzforge AI
AI-powered workflow automation and AI Agents platform for AppSec, Fuzzing & Offensive Security. Automate vulnerability discovery with intelligent fuzzing, AI-driven analysis, and…
Secpipe
MCP server for AI-driven security pipelines
Hacker Bob
A local MCP runtime that attacks what you own and only reports what it proved. 17 CVEs across 9 projects came out of this repo. Install: npx -y hacker-bob@latest install /path/to/…
SecuritySkills
Open-source security skills for AI coding agents. Grounded in OWASP, NIST, MITRE ATT&CK, CIS. Works with Claude Code, Gemini CLI, Cursor, Codex CLI, OpenClaw, Kiro.
Fetch Cwe List
MCP (Model Context Protocol) server exposing fetch-cwe-list tools for LLM agents. Experimental/alpha — APIs may change.
Sectinel
Open-source security arsenal for AI coding agents: 784 cybersecurity skills, scanner integrations, and a security MCP for Claude Code, Cursor, opencode, Gemini CLI, Cline, and any…
Soup Wall
Soup Wall: a local firewall for what an AI agent does - tool calls, tool results, MCP handshakes, subagents. Deterministic, shadow-first, no account, no network.
Bluerock
Runtime visibility for Python MCP servers. Captures tool calls, session lifecycle, module imports (SHA-256), and subprocess execution as structured NDJSON. No code changes. Apache…
Tcpk
Thick client penetration testing and MSIX security audit toolkit for Windows. Audits .NET, Electron and native binaries: static and runtime checks, IL-verified findings, computed…
Sabba
SABBA - Security Templates CLI & MCP Server for coding agents that prove every finding by running it
Bugbountyrules
Behavioral-discipline skill turning an AI agent into a methodical, non-robotic bug-bounty & pentest hunter - 42 always-on rules: scope, coverage, no false positives, never quits e…
Quell
Stop API keys and passwords leaking into AI tools. Offline secret detection and redaction for VSCode, Cursor, Windsurf, and Claude Code.
Secure Sdlc Agents
A team of Claude Code sub-agents that enforce security across the full SDLC, from ASVS requirements and threat modelling to SAST triage, IaC review, compliance attestation and rel…
Oauthlint
Catch the OAuth, OIDC, JWT & MCP security bugs AI coding assistants ship on repeat, across ten languages (JavaScript, Python, Go, C#, and more). A free, low-false-positive linter…
Security Agent Skills
Security-testing methodology as portable, tool-agnostic agent skills for Claude Code and any agent runtime: white-box bug hunting, AI-agent and LLM red-teaming, supply-chain risk,…
Firebreak
Security MCP server that turns your AI into a penetration tester. 20 tools, 100 best practice guides, 47 vulnerability patterns. Connect to Claude, Cursor, or any MCP client.
Toolpoison
Security scanner for MCP servers. Detects tool poisoning, prompt injection hidden in tool descriptions, leaked API keys, and supply-chain risk across Claude, Cursor, VS Code, Wind…
AI Security Labs
Hands-on AI security labs. Build, break, understand.
TorusGuard
Autonomous Security Guardrails & Governed Remediation for AI-Built Apps. Tri-Mode Parity (CLI, Chat Slash Commands, Native MCP Server), First-Principles Security Suite, Multi-Moda…
Vakt
Open-source AST aware code scanner to find your app’s vulnerabilities.
Claude Skills Security
Defensive security audit skills for Claude — tech-stack-keyed and audit-domain-keyed packs for SaaS apps.
Brokenbazaar
Deliberately vulnerable AI agent marketplace — the full Product Security lifecycle: threat model → attack → defend → regression test → detect. MCP + Agent Skills supply chain.
Authscan
Static detector for self-rolled-auth failure classes in MCP servers. Part of VATA — receipts over promises.
Zeropath MCP Server
Open-source MCP server for querying ZeroPath security issues, patches, and scans using Claude, Cursor, Windsurf, or any AI assistant.
Beforeship
Open-source launch gate for vibe-coded apps: CLI + MCP pre-deploy checks for auth, payments, secrets, Supabase, and production readiness.
Toolfence Site
MCP security scanner — Toolfence scans any Model Context Protocol server and reports the risks your AI agents inherit: tool poisoning, prompt injection, tool drift, over-broad sco…
DefectDojo MCP Server
MCP server for DefectDojo OSS with capability parity to DefectDojo Pro's built-in MCP, plus a deterministic analytics superset. Uses the caller's own API token, so DefectDojo's pe…
Moneypath
Find payment logic flaws in Razorpay and Stripe checkouts - client-trusted amounts, rupee/paise bugs, unverified webhooks
Saltcode
Give your coding assistant security super powers with Salt Code. Secure code with every prompt and a much quieter security team.
EAtheria Security
Self-hosted application security platform: SAST, DAST and SCA with AI false-positive validation. OWASP Top 10/CWE mapping, SBOM export, CI/CD integrations and MCP server.
Security Hunter MCP
🛡️ Production-grade Model Context Protocol (MCP) Server for Autonomous AI Security Bug Hunting, Persistent Pentest Memory, Dynamic Checklists, Secret Redaction, and Exploit PoC Ge…
DepGuard
Dependency vulnerability scanner over OSV.dev with CISA KEV actively-exploited flags. No API key.
Agent Trust Preflight
Free MCP + AI agent trust preflight: 20 practical checks, safe examples, VS Code tooling, drift review and authority analysis.
Mobix
Authorized Android pentest lab, drivable by hand or by AI — Frida bypass chain, live traffic capture with automatic IDOR flagging, full MCP control plane, web dashboard.
Overstep
Authorization testing for REST APIs and MCP servers. Declare who may do what as a matrix, and overstep turns it into positive and negative tests that catch BOLA, BFLA, BOPLA and p…
Jakk
Black-box security scanner for MCP servers — deterministic single-call probes, no LLM. 13 probes across 7 surfaces.
Mcpnuke
MCP red teaming & security scanner — enumerate, probe, and exploit Model Context Protocol servers
Surface Audit
Deterministic security smoke tests for preview, staging, and pre-deploy web URLs.
Secops
Security operations as conversation. An MCP server connecting 13 security platforms (Wiz, Kodem, GitHub, Okta, SentinelOne, Apono, Twingate, Pluto, Panorays, Abnormal, Slack, Mond…
Zfuzz MCP
Security copilot for AI coding agents. 10 MCP tools — SAST, SCA, secrets, MCP/skill scanning — for Claude, Cursor & co. Rust-native, local, $0, Apache-2.0.
Tlad Semgrep
Semgrep rules to detect Transport-Layer Auth Divergence (TLAD) in MCP servers — auth applied to some transports but not others.
Exploit Validator
Proves whether AI agent (MCP) tool configurations are actually exploitable - not just risky-looking. Existing scanners infer risk from manifests; this one validates it in a sealed…
Xche AI App Security Pack
Free security guardrails for apps built with AI coding tools (Claude Code, Cursor, Lovable, Bolt). Drop-in rules + OWASP/LLM/MCP policy + secret-scanning hooks & CI gate.
SleepyWalker
🛡️ Autonomous SQL injection pipeline — crawls, probes, confirms with AI, exploits with sqlmap, reports in HTML/JSON/SARIF. Built for authorized red teams. One command, full databa…