- Conduid
- Marketplace
- #blue-team
MCP servers tagged blue-team
80 live MCP servers tagged "blue-team", ranked by trust score. Tags come from package metadata and repository topics, so this list covers servers across every category that work with blue-team.
Sanctscan
Screens counterparties and transactions against OFAC/EU/UN sanctions lists with fuzzy name matching and explainable hit scoring.
Probesite
Synthetic uptime and Playwright checks exported to Prometheus
Apkpeek
One-command static triage of Android APK/AAB binaries: surfaces hardcoded secrets, exported components, dangerous permissions, and insecure manifest flags as a single SARIF report.
Honeyurl
Generate canary URLs/tokens + a matcher for trip events
Ssrfind
Find SSRF-prone sinks and unvalidated URL fetches in code
Memtriage
Triage memory-dump artifacts: strings, IOCs, suspicious processes from a dump export
Sbomgate
Continuous SBOM diff & vulnerability watch with maintainer-change tracking
Embedaudit
Embedding / vector-store drift and poisoning audit
Dirsight
Analyze web content-discovery output (ffuf/gobuster) into ranked endpoints
Auditrail
Tamper-evident audit-log aggregator with hash-chained attestation
Ghaudit
Audit a GitHub org's security posture (branch rules, 2FA, secrets) from an export
Graphqlmap
Analyze GraphQL introspection for risky fields, depth, and authz gaps
Cspbuilder
Generate and audit a Content-Security-Policy from a page's resources
Dnsaudit
DNS posture & misconfiguration scanner — SPF/DKIM/DMARC/DNSSEC/CAA
Dastlite
A headless, config-as-code DAST runner that crawls an authenticated web/mobile-API surface and fires a curated active-scan ruleset, emitting deduplicated SARIF.
Edrgap
EDR coverage & bypass detector — reconciles MDM + EDR + AD inventories
Redpath
Active Directory attack path mapper — minimum-cost paths + remediation priority
Adversa
LLM red-team harness — OWASP LLM Top 10 + MITRE ATLAS attack packs
Blukit
Scope-gated launcher for the Claude Code CLI — records the authorized defense scope into .mcp.json (atomic, fail-closed), pins the model, and logs each launch. Blue-team mirror of…
Prefetchparse
Surface program-execution evidence from Windows Prefetch exports
Cipherdetect
Detect & crack classical ciphers (caesar/vigenere/xor) by scoring
Ttphunt
Hunt MITRE ATT&CK techniques across logs with a rule pack
Apiseclint
Lint OpenAPI specs for security gaps (authz, rate-limit, data exposure)
Iamlint
Lint cloud IAM policies (AWS/GCP/Azure JSON) for least-privilege violations
Certpatrol
TLS cert lifecycle & rogue-issuance watch via Certificate Transparency
Elastic Genai Secops
Open, AI-assisted SecOps platform on the Basic-licensed Elastic Stack: SIEM, detection rules, alert correlation, PII masking, LLM triage with human review, and a read-only MCP ser…
Soc Cmm System
Self-hosted web app for running SOC-CMM® 2.4.2 maturity assessments: 649 questions, official workbook scoring, progress tracking, EN/PT-BR, MCP server. Independent; not affiliated…
LLM Blue Team Guardrail
A layered LLM guardrail (fast heuristics + an LLM judge) against prompt injection, with a guarded RAG pipeline that quarantines poisoned documents and an MCP server for AI agents.…
Soc Watchfloor
No description published.
Claude Code Cyber Defense Writeups
No description published.