- Conduid
- Marketplace
- #devsecops
MCP servers tagged devsecops
311 live MCP servers tagged "devsecops", ranked by trust score. Tags come from package metadata and repository topics, so this list covers servers across every category that work with devsecops.
Vuln Analyzer
Agentic vulnerability analyzer for Claude Code — runs grype via MCP, ranks findings, dispatches reachability / context / remediation sub-agents per top-5 vuln.
AI Protect
AI-application security assurance pipeline: tier-aware SAST · DAST · AI red-team scanning with a findings dashboard, CVE intel feeds & auto-remediation. For AppSec & platform team…
Cleanstart MCP
MCP server for executing AI agent code in CleanStart hardened containers — zero CVEs in the sandbox
React Native Security Toolkit
Mobile security toolkit for React Native: runtime root/jailbreak, debugger, hooking and integrity checks on Android and iOS, a static auditor with OWASP MASVS/CWE mappings and SAR…
Depgraph
Dependency risk visualizer — Scorecard + OSV + typosquat + maintainer signals
Envguard Secrets Vault
EnvGuard Secrets Vault - Zero-Trust .env Auditor, AES-256 Armored Vault, Transformer, MCP Server & Studio UI (design influenced by Material 3)
Toolproof
Trust grades, capability lockfiles, and signed evidence for the AI tool supply chain. Scan any MCP server or API before your agent connects. Paid by nobody we scan.
SkillWatch
Independent, local-only watcher for the AI-skill supply chain: flags bait-and-switch changes in the pages skills and MCP tools reference. Sends nothing anywhere. Python CLI.
Policies
78 Cedar policies and 369 rules governing AI coding agents. Every rule traces to a real incident, published CVE, or compliance framework requirement (SOC 2, NIST, ISO 27001, E…
Claude Code Crypto Lab
Hands-on Claude Code lab for safe agentic development with project memory, subagents, skills, hooks, MCP, observability, and CI/CD using a Python crypto portfolio app.
Firebase Security MCP
MCP server for Firebase Firestore Rules security audits inside Claude Code, Cursor, Cline.
Agent Permit Office
Pre-flight security checks for AI coding agents before tools, secrets, memory, MCP, or CI write access.
Google Cloud Genai Academy Apac Cohort 3
A security-first engineering portfolio from Google Cloud Gen AI Academy APAC Cohort 3, exploring how AI agents are grounded, connected to data and tools, deployed on Cloud Run, an…
Pii Shield
A secure, production-grade Model Context Protocol (MCP) server providing read-only PostgreSQL query execution with automatic PII masking, session-based pseudonymization, and telem…
AI Agent Security Control Plane
Defense-in-depth security control plane for autonomous AI agents using MCP, OPA/Rego, human approval, adaptive risk, detection, and automated containment.
Keel Sec Guard
Automated AI security auditor and SAST scanner powered by Google Gemini. Runs locally via CLI/Agent Skill and in CI/CD via GitHub Actions.
Qwiet
Qwiet AI (formerly ShiftLeft, now part of Harness) is an application security testing platform delivering SAST, SCA, IaC, container, and secrets scanning in a single scan, with re…
Vaultsaas
Self-hosted MCP credential gate for AI agents — short-lived leases, human approval, one-command revoke, tamper-evident audit. Pure Apache-2.0, no SaaS.
AI Policy Platform
Self-hosted AI compliance enforcement — one policy source enforced across Claude Code, Cursor, Copilot & any MCP agent, with git-hook + CI gates and an append-only audit trail
Drift Check
Zero-execution MCP security preflight + GitHub Action. Detect mutable package references before AI agents run them. Try any public repo in the browser.
Traceguard
Deterministic capability-contract testing for MCP servers
Zfuzz CLI
The Rust-native security scanner behind every Zfuzz tool. SAST, SCA, secrets, MCP/skill audit, Sealed Vault — one $0 binary. npx @zfuzz/cli scan .
AgentSecGateway
Open-source scanner for AI agent skills, MCP servers, and coding-agent security risks.
Pocketbase Security MCP
MCP server for PocketBase security: audit collection rules, preview fixes from inside any MCP client.
Dvarapala
द्वारपाल — gatekeeper between your LLM and third-party MCP servers. Reads every JSON-RPC message, denies what fails policy, redacts what leaks, audits the rest.
Opsforge
Forge your DevOps workstation: TUI installer for 287 CLIs, policy-as-code shell guards, CVE-correlated SBOM + OpenVEX.
Agenstral
Local preflight and audit tool for AI coding agents: scan repo risk, enforce tool-call policy, and record tamper-evident audit logs. Local-first, zero telemetry.
Llmsafe
Static security scanner for Python AI agents, LLM apps, and MCP servers.
Secretscan MCP Server
MCP server that scans a diff/file/snippet for leaked secrets (AWS, GitHub, Slack, Stripe, private keys, JWTs, entropy-gated generic) before an agent commits or shares it. Local-on…
Codetrust
AI Governance Enforcement Platform — governs what AI coding agents can do, before they do it.
Skillrank
What can this agent skill actually do to your machine? Static security grading for AI agent skills — 3,771 scanned in seconds, zero API cost.
Heldfast
You approve an MCP server. Heldfast records what you approved. Later it tells you what moved, and guard refuses the rest.
Skill Tool
AI Agent Skill 蒸馏工坊 — 从各大平台（Claude Code / Cursor / GPTs / MCP / Dify / Coze）蒸馏高质量 skill，适配 Hermes Agent 格式。技能市场和高质量 AI Agent 技能集合。
Agent Boundary
A deterministic tool-call broker that bounds what an LLM agent can actually do. Indirect prompt injection is assumed to succeed; authorisation lives outside the model.
Grade
Deterministic 0-100 capability-hygiene score for MCP servers: undeclared writes, unbounded params, baked-in secrets. No LLM in the loop. Zero-dep CLI + skill.
Valvur
Offline security scanning for AI-generated code: seven open-source scanners and AI-specific checks in one command. It finds secrets, vulnerable, hallucinated and malicious depende…
Vulngate
Agent-neutral security checks before you ship — SAST, secrets, and dependency audit as a merge gate. Find, understand, and fix vulnerabilities in AI- or human-written code. BYO-in…
Claude MCP Allow
Generate least-privilege Claude Code permission rules for MCP tools from their live annotations: readOnlyHint tools go to allow, everything else to ask, one mcp__server__tool rule…
Rc Check
MCP specification migration checker for the 2026-07-28 revision: scans a live stdio or HTTP server, a saved dump or a client config, flags removed, changed and deprecated construc…
Agentic Semgrep Rules
Semgrep rules for AI agent code: static analysis for LLM applications in Python, TypeScript and JavaScript. Finds model output reaching exec, shells, SQL, URLs, files and HTML, us…
Skill Scan Gate
CI gate for Claude Code skills and plugins: scans a skills or plugin repository for instruction-override text, exfiltration patterns, dangerous hook commands, unpinned MCP servers…
Glyph
🔮 MCP security scanner — find tool poisoning, credential leaks, and insecure transports in AI agent configurations
Guard
Security scanner for MCP (Model Context Protocol) servers: detects tool poisoning, prompt injection, command injection, path traversal and leaked secrets. SARIF, GitHub Action, si…
AI Surface
Find and govern AI attack surfaces in application code, at PR time and inside your AI coding tool (MCP server, Claude Code hook). Free, OSS, runs offline.
AI Surface
Find and govern AI attack surfaces in application code, at PR time and inside your AI coding tool (MCP server, Claude Code hook). Free, OSS, runs offline.
Template
Secure MCP server template in TypeScript and Python: stdio by default, optional streamable HTTP behind bearer auth, rate limit and body cap, bound to 127.0.0.1; bounded file and n…
Firewall
Scan and gate Model Context Protocol servers for tool poisoning, rug-pulls, and indirect prompt injection.
Beamhall
Self-hosted MCP backplane for agent-built internal apps: AI coding agents ship apps that inherit compute, data, secrets and identity — no credentials, governed and audited.
Audit
Python security scanner for Model Context Protocol (MCP) servers — find prompt injection, over-broad permissions, weak input validation, and credential leaks before your AI agent…
Audit
See what your AI agents can access. Scan MCP configs for exposed secrets, shadow APIs, and AI models. Generate AI-BOMs for compliance.