- Conduid
- Marketplace
- #sast
MCP servers tagged sast
93 live MCP servers tagged "sast", ranked by trust score. Tags come from package metadata and repository topics, so this list covers servers across every category that work with sast.
Automated Security Helper
ASH is an extensible, open source SAST, SCA, and IaC security scanner orchestration engine.
Snyk
Language Server used by IDEs as Snyk Backend for Frontends
Phantom
Forensic CLI for AI-era supply-chain attacks: XZ tarball diffs, prompt injection scans, MCP/CLAUDE.md/Cursor config audits. SARIF for GitHub Code Scanning.
Static Analysis
⚙️ A curated list of static analysis (SAST) tools and linters for all programming languages, config files, build tools, and more. The focus is on tools which improve code quality.
Fuzzforge AI
AI-powered workflow automation and AI Agents platform for AppSec, Fuzzing & Offensive Security. Automate vulnerability discovery with intelligent fuzzing, AI-driven analysis, and…
Secpipe
MCP server for AI-driven security pipelines
Lucidshark
Ship AI-generated code without the fear
Hounddog
Privacy Code Scanner and Dataflow Context Engine for AI coding agents
0
A cybersecurity harness for full-stack LLM-driven penetration testing. Find and fix vulnerabilities autonomously, 24/7. [RESEARCH PREVIEW]
Cycode CLI
Boost security in your dev lifecycle via SAST, SCA, Secrets & IaC scanning
Throughline
Multi-engine SAST scanner that traces tainted data source-to-sink across JS/TS, Python, Go, PHP and Ruby — with AI triage over MCP.
0sec
[RESEARCH PREVIEW] The open & extensible cybersecurity harness - by the Swiss Applied AI Cybersecurity Research Lab.
Vibescan
Security scanner for AI-generated ("vibe-coded") code. Runs SAST, DAST, and sandboxed exploit simulation across 15+ languages using 30+ tools. Catches what LLMs introduce bef…
Eslint Plugin MCP SDK Security
ESLint plugin for Model Context Protocol (MCP) SDK security — catches tools registered without an input schema, handlers reading arguments the schema never declared, model-visible…
SafeAI
Static analysis and attack-surface scanner for AI agents — SAST for prompts, tools, MCP servers, and agent workflows. Detects capabilities, prompt risks, tool permissions, and gov…
Husk
Static security scanner for AI agent skills. Built against the bypass techniques that beat Snyk, Cisco & Vercel scanners. Offline, deterministic, zero dependencies, CI-ready. Benc…
Sectinel
Open-source security arsenal for AI coding agents: 784 cybersecurity skills, scanner integrations, and a security MCP for Claude Code, Cursor, opencode, Gemini CLI, Cline, and any…
scan-mcp
Static security scanner for MCP servers — detects tool poisoning, injection, secrets, Dockerfile and dependency issues.
Tcpk
Thick client penetration testing and MSIX security audit toolkit for Windows. Audits .NET, Electron and native binaries: static and runtime checks, IL-verified findings, computed…
Architect To Product
Vibe code fast. Ship like an engineer. AI engineering framework packaged as an MCP server that enforces TDD, security scanning, pentesting, secret management, QA audits, and depl…
Inkog
Static security scanner for AI agents. Catches prompt injection, runaway loops, missing oversight, and compliance gaps across 21 frameworks. Use from Claude Code, Cursor, ChatGPT…
Fucking Static Analysis
⚙️ A curated list of static analysis (SAST) tools for all programming languages, config files, build tools, and more. With repository stars⭐ and forks🍴
Secure Sdlc Agents
A team of Claude Code sub-agents that enforce security across the full SDLC, from ASVS requirements and threat modelling to SAST triage, IaC review, compliance attestation and rel…
Irulescan
:shield: irulescan - security analyzer for iRules
Oauthlint
Catch the OAuth, OIDC, JWT & MCP security bugs AI coding assistants ship on repeat, across ten languages (JavaScript, Python, Go, C#, and more). A free, low-false-positive linter…
Mcpguard
Security scanner for MCP servers — detect tool poisoning, malicious code patterns, and supply-chain risks before your AI agents execute them.
Grim
Security audit for AI agents. Finds code, dependency, exposure, secrets, and active-compromise gaps across any stack, with drift detection and SBOM.
Codeslick MCP Server
CodeSlick Security Analysis MCP Server - 323 security checks across 5 languages + 17 MCP-specific behavioral checks + AI code detection
Repomri
A zero-dependency MRI scan for your AI coding agent attack surface.
Safeguard
🛡️ Security scanner for MCP (Model Context Protocol) servers — prompt injection, credential exposure, SSRF, tool poisoning & source-level credential-handling flaws. pip install mc…
Mycop
Scan and fix vulnerabilities in Python, JavaScript, TypeScript, Go, and Java code using AI-powered analysis with 200 built-in security rules.
Scankii
A local-first SAST & Runtime Security scanner built exclusively for LLM Agents. Detects cross-modal data leaks, prompt injections, and intercepts credentials before execution.
Viperstrike
MCP (Model Context Protocol) server vulnerability auditor — AST/whitebox SAST for agentic AI tool handlers, SARIF-capable, oracle runtime mode
Sf Security Review Toolkit
Take an AppExchange / AgentExchange security review from audit to an honest readiness verdict, end to end.
Agenticqa Scan Action
Analyze AI codebases to identify integration points, security risks, and test coverage gaps in one step with comprehensive reports.
Guardrail MCP
Enterprise multi-language security MCP — advanced taint, tree-sitter, plugins, SARIF/SBOM, policy gates, dashboard
Shipsafe
Find the security holes your AI coding assistant just shipped. MCP server + CLI for vibe-coded web & mobile apps: leaked keys, missing Supabase RLS, open Firebase rules, unauthent…
Skillguard
Static security scanner for AI agent skills and plugins — flags prompt injection, hidden Unicode, exfiltration, and dangerous commands in SKILL.md/CLAUDE.md and scripts.
Agentic Workflow Guard
Static analysis for AI automation workflows. Find prompt-injection paths, overpowered tools, and write-capable agent jobs before they run.
Legit Security
Legit Security — independent third-party profile of a public API surface, by API Evangelist. Legit Security is an AI-native Application Security Posture Management (ASPM) platform…
Mcpwatchman
Independent security and quality audit for Model Context Protocol servers — static analysis, dependency CVE scanning, and evidence-linked scores for every server in the official M…
Skillxray
Scan an AI agent skill for prompt injection, hidden Unicode, dangerous commands, and leaked secrets before you install it.
Vakt
Open-source AST aware code scanner to find your app’s vulnerabilities.
Github Security MCP
GitHub security posture analysis for AI agents — 39 MCP tools, 45 checks across org, repos, Actions, secrets, supply chain, and access control
goklab/guardvibe
commit hook, and CVE version detection. Zero config, runs locally.
srinivasan-sundaresan95/orihime
reading baseline. `pip install orihime`
Pledgeguard
Rust-native secret scanner with MCP server, AST refinement, and WASM plugins
DevSecShield Public
DevSecShield is a unified, AI-powered Devsecops assistant designed to provide comprehensive security analysis across multiple dimensions of modern software development. From tradi…
Farofino MCP
Faro Fino Smart Contract Auditor MCP Server
Moneypath
Find payment logic flaws in Razorpay and Stripe checkouts - client-trusted amounts, rupee/paise bugs, unverified webhooks