- Conduid
- Marketplace
- #sast
MCP servers tagged sast
114 live MCP servers tagged "sast", ranked by trust score. Tags come from package metadata and repository topics, so this list covers servers across every category that work with sast.
Mcpwatchman
Independent security and quality audit for Model Context Protocol servers — static analysis, dependency CVE scanning, and evidence-linked scores for every server in the official M…
Skillxray
Scan an AI agent skill for prompt injection, hidden Unicode, dangerous commands, and leaked secrets before you install it.
Vakt
Open-source AST aware code scanner to find your app’s vulnerabilities.
Blackduck Polaris MCP Server
Feature-rich MCP server for Black Duck Polaris — 66 tools for scan management, findings, reports, policies, and more
Twira
Coding power tools for AI agents. 18 deterministic MCP tools: code-graph search, SAST, blast radius, wire-level PII redaction, signed audit chain. Works with Claude Code, Codex, G…
Security Auditor
It's a Python-based CLI security scanner built specifically to audit MCP (Model Context Protocol) servers — the integration layer that connects AI assistants like Claude to extern…
Shipsafe
Find the security holes your AI coding assistant just shipped. MCP server + CLI for vibe-coded web & mobile apps: leaked keys, missing Supabase RLS, open Firebase rules, unauthent…
Agentguard
Scan AI coding agent extensions (skills, plugins, hooks, MCP servers) for unsafe patterns. Community rule pack for Claude Code and Grok Build.
Secure MCP
Local MCP server that helps coding agents run defensive, remediation-focused secure code review of source repositories.
Github Security MCP
GitHub security posture analysis for AI agents — 39 MCP tools, 45 checks across org, repos, Actions, secrets, supply chain, and access control
goklab/guardvibe
commit hook, and CVE version detection. Zero config, runs locally.
srinivasan-sundaresan95/orihime
reading baseline. `pip install orihime`
Pledgeguard
Rust-native secret scanner with MCP server, AST refinement, and WASM plugins
DevSecShield Public
DevSecShield is a unified, AI-powered Devsecops assistant designed to provide comprehensive security analysis across multiple dimensions of modern software development. From tradi…
Farofino MCP
Faro Fino Smart Contract Auditor MCP Server
Moneypath
Find payment logic flaws in Razorpay and Stripe checkouts - client-trusted amounts, rupee/paise bugs, unverified webhooks
EAtheria Security
Self-hosted application security platform: SAST, DAST and SCA with AI false-positive validation. OWASP Top 10/CWE mapping, SBOM export, CI/CD integrations and MCP server.
Ironward
Security scanning for the vibe coding era — MCP server + CLI + GitHub Action. 9 tools, 665 secret patterns, 27 static rules. Four tools run fully offline, no API key.
Bastyn Scan
Static analysis for AI and agent code: Python, TypeScript, JavaScript, MCP manifests, and dependency CVEs.
Sage Kernel
Proof-first, MCP-native engineering OS for your local machine — run the full SDLC on any repo from your AI client (Claude, Cursor, Codex), with evidence instead of vibes.
Hexis MCP Guard
Security scanner for MCP (Model Context Protocol) servers. Static analysis + 14 security rules + SARIF output for GitHub Security tab.
Zfuzz MCP
Security copilot for AI coding agents. 10 MCP tools — SAST, SCA, secrets, MCP/skill scanning — for Claude, Cursor & co. Rust-native, local, $0, Apache-2.0.
Code Security MCP
Security MCP server for AI agents — native per-language analysis: Kotlin (detekt), Java (SpotBugs), Python (Bandit), C# (Roslyn); diff review; secure patterns
Saleha
Local-first autonomous multi-agent AI platform: ReAct agent loop, sandboxed self-healing codegen, real test-driven healing, SAST security scanning, vision-to-code, MCP engine. Run…
Websec Validator
Local-first security recon that briefs your AI coding agent: facts + tailored probes, code-in / artifacts-out. No LLM, no server, no running app.
Hacking The LLM AI Goat Red Team
Red teaming AI Goat™ to explore OWASP Top 10 for LLM Applications (2025), prompt injection, RAG poisoning, MCP-assisted auditing, and AI security vulnerabilities.
Noscape
MCP server security scanner. Know what your AI agents are connecting to.
Achilles Harness
Achilles - A local, private cybersecurity AI Agent harness for app sec, code review, vuln detection, and more
Cursor Rules Generator
Create optimized configuration files for Cursor AI to improve coding accuracy across your development projects.
Praetor Security
Multi-engine static security analysis for code, repos, and AI agents: SAST, secrets, SCA, AI-security, and serialized-model/pickle scanning. Reports attack CHAINS and an agent cap…
Aisec
Security scanning for MCP servers and agent applications — Claude Code plugin and CLI
Binhunt
Game/desktop binary integrity scanner that fingerprints executables, detects common packers/obfuscators, and diffs against a known-good baseline to catch tampering.
Security Audit MCP Server Showcase
Showcase site for a private MCP server that audits codebases for secrets, CVEs, SAST issues, and SBOM; includes 4 interactive HTML demos.
Deeplinkfuzz
Fuzzes Android/iOS deep links, intents, and custom URL schemes against an emulator/device to surface unvalidated-redirect, injection, and component-hijack bugs.
Apkpeek
One-command static triage of Android APK/AAB binaries: surfaces hardcoded secrets, exported components, dangerous permissions, and insecure manifest flags as a single SARIF report.
Sentrymcp
A static + runtime security scanner for MCP (Model Context Protocol) servers
AI Protect
AI-application security assurance pipeline: tier-aware SAST · DAST · AI red-team scanning with a findings dashboard, CVE intel feeds & auto-remediation. For AppSec & platform team…
Hookcraft
Generates ready-to-run Frida instrumentation scripts from a YAML intent (e.g. 'bypass SSL pinning', 'dump crypto keys') and verifies they attach to a target process.
Semsift
Lightweight semantic-aware SAST that runs curated taint rules over diffs only, so PRs get fast incremental SAST instead of whole-repo scan fatigue.
Nightprism
MCP-native security scanner that asks "should I ship tonight?" for AI-generated code.
Sbomx
Generates a CycloneDX SBOM for mobile apps by unpacking native libs and bundled SDKs, then matches components against known-vuln and tracker/privacy databases.
Dastlite
A headless, config-as-code DAST runner that crawls an authenticated web/mobile-API surface and fires a curated active-scan ruleset, emitting deduplicated SARIF.
Verum
Deterministic, whole-program, multi-language code analysis
Keel Sec Guard
Automated AI security auditor and SAST scanner powered by Google Gemini. Runs locally via CLI/Agent Skill and in CI/CD via GitHub Actions.
Qwiet
Qwiet AI (formerly ShiftLeft, now part of Harness) is an application security testing platform delivering SAST, SCA, IaC, container, and secrets scanning in a single scan, with re…
Objauthz Lab
Vulnerable-by-design MCP server for learning object-level / cross-tenant authorization (BOLA/IDOR) bugs, plus Semgrep rules that find the same shapes in JavaScript/TypeScript, Pyt…
Zfuzz CLI
The Rust-native security scanner behind every Zfuzz tool. SAST, SCA, secrets, MCP/skill audit, Sealed Vault — one $0 binary. npx @zfuzz/cli scan .
Mobile Security Research Framework
Self-contained Mobile & IoT SAST/DAST/pentest toolkit: MobSF + Frida + objection + mitmproxy + rooted emulator, as a desktop app, CLI and MCP server.
LinWay
AI-powered Static Application Security Testing (SAST) tool
Llmsafe
Static security scanner for Python AI agents, LLM apps, and MCP servers.