- Conduid
- Marketplace
- #owasp
MCP servers tagged owasp
178 live MCP servers tagged "owasp", ranked by trust score. Tags come from package metadata and repository topics, so this list covers servers across every category that work with owasp.
Shark Security Lab
Reference MCP security lab: toxic tool metadata, multi-server mcp.json harness for static scan, localhost AAuth fixtures, YARA (OWASP Agentic ASI01–ASI10). Stress-test MCPShark an…
Ctrlrun
The execution safety layer for AI agents.
Saltcode
Give your coding assistant security super powers with Salt Code. Secure code with every prompt and a much quieter security team.
EAtheria Security
Self-hosted application security platform: SAST, DAST and SCA with AI false-positive validation. OWASP Top 10/CWE mapping, SBOM export, CI/CD integrations and MCP server.
Parapet
Local-first security middleware for MCP servers. Content scanning, prompt-injection defence, trust boundaries, manifest integrity, and audit trails. No API keys, no telemetry. OWA…
Sap Security Scanner
Catch CVEs, leaked secrets, and BTP misconfigurations in your MTA/CAP project before you deploy.
Shrike
The autonomous security agent for your AI stack — finds the vulns in your MCP servers & agent tools AND writes the fixes, on a local model.
Hermes Pentest Lab
AI-orchestrated, Kali-native pentesting lab: an MCP tool-server with scope/VPN/rate/audit enforced in code, independent finding verification, MITRE ATT&CK + OWASP mapping, a reusa…
Overstep
Authorization testing for REST APIs and MCP servers. Declare who may do what as a matrix, and overstep turns it into positive and negative tests that catch BOLA, BFLA, BOPLA and p…
Security Patterns
MCP security patterns — 10 production implementations mapped to OWASP MCP Top 10. Prompt injection, credential isolation, HITL governance, session recording. Working attack demos…
Mcpkernel
The Security Kernel for AI Agents — MCP/A2A gateway with policy enforcement, taint tracking, sandboxed execution, deterministic envelopes, and Sigstore audit. OWASP ASI 2026 compl…
Bastyn Scan
Static analysis for AI and agent code: Python, TypeScript, JavaScript, MCP manifests, and dependency CVEs.
Detection Lab
Detection-engineering for MCP: working Sigma rules for the OWASP MCP Top 10 + isolated home-lab + zero-dependency validator (git clone && python3 validate.py).
Cinch AI Security
MCP server + cross-harness skills for building and operating AI agents safely. Grounded in NIST AI RMF, CISA, OWASP, CUSTODY, LASM.
Xche AI App Security Pack
Free security guardrails for apps built with AI coding tools (Claude Code, Cursor, Lovable, Bolt). Drop-in rules + OWASP/LLM/MCP policy + secret-scanning hooks & CI gate.
Secchecker
Static security scanner and analyser for AI agents, MCP tools, and LLM applications - OWASP LLM Top 10, and infrastructure checks. Zero runtime dependencies.
AI Security Red Team Testing Guide 2026
AI Security: Red Team Testing Guide 2026
Websec Validator
Local-first security recon that briefs your AI coding agent: facts + tailored probes, code-in / artifacts-out. No LLM, no server, no running app.
Sinon
AI agent pentest kit: a methodology and 54-probe corpus for prompt injection, tool abuse and over-permissioned agent actions. Verdicts rest on observed facts, not a judge model.
ODIN Project
Odin - Zero Trust AI Agent. Open-source autonomous LLM agent with CaMeL dual-LLM, IFC taint tracking, DID-based identity, 3-ring sandbox, 5-state circuit breaker, and 3-phase cogn…
Agent Security
AI agent security scanner — 176 detection patterns with taint analysis, auto-classification, and context flow tracing. OWASP ASI + MCP security.
Autonomyproof CLI
Prove what authority your AI agent holds — and fail the PR that grants new unsafe authority. Open-source, local, deterministic.
LLM Security Payloads
A defender's field guide to attacks on LLM apps — prompt injection, jailbreaks, system-prompt extraction, data exfiltration — mapped to OWASP LLM Top 10, each with its defense. EN…
Skillsentry
A semantic scanner for malicious MCP servers and agent skills — prompt-injection, tool-poisoning, rug-pulls, excessive agency.
OpenBOLA
Authorization-first, deterministic BOLA/IDOR validation for HTTP APIs
Awesome AI Agent Security
A curated, opinionated list of resources for securing AI agents, LLMs, and the Model Context Protocol (MCP) — attacks, defenses, tools, labs, and research. All links verified.
Security Auditor MCP
AI-powered security vulnerability scanning and code remediation MCP. Automated OWASP, dependency audit, and compliance gap detection.
Awesome Agent Security
A curated list for securing autonomous AI agents — configs, runtime, tools, MCP, and red-teaming
Agent Governance Toolkit
Manage and monitor AI agents in production environments with tools for governance, safety, and compliance.
Consentinel
Static security auditor for MCP servers. Finds tools that can do irreversible or external damage and verifies each one actually enforces a human-in-the-loop safeguard — not just d…
YeepForge
Automated web application penetration testing framework: OWASP Top 10 + advanced attacks, an autonomous AI agent (Ollama/Claude/OpenAI), SAST source-code analysis, and an MCP serv…
Corex Manager
Control plane, data plane, and web GUI for HAProxy — load balancing, TLS, WAF, caching, and API security
Hackmonty
Autonomous Sandbox Security Assessment
Minimal MCP Agent Loop
Secure MCP client and agent loop for local LLMs — bridges LM Studio to MCP tool servers with OWASP LLM mitigations
Claude Code Security
A 6-layer security framework for Claude Code workspaces: prompt injection detection, memory poisoning prevention, secrets scanning, behavioral audit logging, and pre-commit guardr…
Purplegate
purplegate — Red/blue-team CI gate for agentic-AI apps. Prompt-injection, secrets, SAST, deps, IaC/RLS, workflow injection, MCP checks. One signed GitHub Action, mapped to OWASP L…
Cybersec MCP
Security-tooling MCP server with SSRF guards, prompt-injection containment and a hash-chained audit log
Map
Static attack surface analyzer for MCP servers and LLM tool definitions
Promptsonar
Static security scanner for AI prompts, MCP configs, and agent workflows. Zero LLM calls. Local-first. OWASP LLM Top 10 aligned.
Agent Security Action
GitHub Action to scan for AI agent security vulnerabilities — 190+ detection patterns for OWASP ASI Top 10, prompt injection, MCP security, and credential exposure
Correctover Scan
Security scanner for MCP servers and AI agents — detects credential leaks, RCE, SSRF and missing auth against OWASP AISVS 1.0; also scans published JS bundles/npm packages.
Laravel Analyzer
Zero-dependency PHP static analysis CLI and MCP server for Laravel projects — security, OWASP, complexity, coupling, debt, and test coverage
Hardened
A deliberately small MCP server demonstrating security hardening against the OWASP MCP Top 10, with a test suite that proves the defenses hold.
Http Security Headers MCP
Analyze and score HTTP security headers (CSP, HSTS, CORS, cookies) with actionable fix recommendations. Free MCP server — A+ to F grading for any URL. Built by Shakil Ahamed.
Semgrep Scanner
Run Semgrep static analysis from an AI agent. OWASP top 10, secrets detection, custom rule packs. Baseline scanning to focus only on newly-introduced findings. Built for productio…
Best Practices
Security-first MCP portfolio tracking spec revision 2026-07-28: a policy-enforcing gateway, an Ed25519-signed registry, STRIDE threat models mapped to the OWASP MCP Top 10, and a…
Mcpxray
Static linter + 0-100 scorecard for MCP servers. OWASP MCP Top-10 rules (MCP101-109), Python + TypeScript static extraction, opt-in runtime tools/list capture, score + SVG badge.
React Native Security Toolkit
Mobile security toolkit for React Native: runtime root/jailbreak, debugger, hooking and integrity checks on Android and iOS, a static auditor with OWASP MASVS/CWE mappings and SAR…
Seosiri API Guard MCP Server
A sovereign, universal API validation and multi-industry compliance security MCP server supporting OWASP, HIPAA, PCI-DSS, GDPR, and SEO/AEO metadata guardrails.
Soc Triage Agent
Local defensive AI agent that triages synthetic SOC identity alerts (LangGraph + MCP), with a governance-as-code layer - security manifest, control matrix (OWASP LLM Top 10 / MITR…