- Conduid
- Marketplace
- #sbom
MCP servers tagged sbom
49 live MCP servers tagged "sbom", ranked by trust score. Tags come from package metadata and repository topics, so this list covers servers across every category that work with sbom.
AI Security Tool
🛡️ Free open-source AI-powered security terminal & vulnerability scanner (CVE, SBOM). Supports SSH, SFTP, RDP, VNC, Serial, and 12+ autonomous AI agents (DeepSeek, OpenAI) for aut…
Veritensor
The Anti-Virus for AI Artifacts & RAG Firewall. A static analysis tool scanning Models and Notebooks for RCE, Datasets and RAG docs for Data Poisoning, PII, and Prompt Injections.…
Vulnometry
Measure what a vulnerability is worth to your business, not how severe it is in the abstract. Business Exposure Index scoring over NVD, EPSS, CISA KEV, OSV and GHSA.
Static Site Generator
A secure-by-default static site generator built in Rust. WCAG 2.2 AA validation, CSP/SRI hardening, native JS/CSS minification, automated CycloneDX SBOM, local LLM content pipelin…
agent-bom
Open security scanner and self-hosted control plane for AI, MCP, and cloud. One evidence model — run scans in your environment, centralize findings, govern in your VPC.
Nuguard
AI red-teaming tool and LLM security framework to evaluate agentic AI applications. Tests prompt injections, handles vulnerability assessment, SBOM generation, and static analysis.
Tcpk
Thick client penetration testing and MSIX security audit toolkit for Windows. Audits .NET, Electron and native binaries: static and runtime checks, IL-verified findings, computed…
Mpak
Open-source package registry for MCP (Model Context Protocol) servers with built-in security scanning, trust scoring (L1-L4), and CLI. Every bundle verified across 25 supply-chain…
Airom
Open-source AI Bill of Materials (AIBOM) scanner: inventories AI models, datasets, prompts, embeddings, vector DBs & RAG pipelines across code, containers & Kubernetes — with file…
supply-chain-mcp-server
90-tool MCP server for software supply chain security — OSV, GHSA, NVD, EPSS, CISA KEV, npm, PyPI, crates.io, RubyGems, NuGet, Packagist, Go, deps.dev, Scorecard, Rekor, ClearlyDe…
Grim
Security audit for AI agents. Finds code, dependency, exposure, secrets, and active-compromise gaps across any stack, with drift detection and SBOM.
Codeslick MCP Server
CodeSlick Security Analysis MCP Server - 323 security checks across 5 languages + 17 MCP-specific behavioral checks + AI code detection
Dtrack
Model Context Protocol server for OWASP Dependency-Track.
Celmis
Self-hosted. Your monitoring already told you something broke — Celmis is what happens next: it knows which repository the alert belongs to, and an embedded Claude Code session on…
Sec Recon Agent
Type-safe LLM vulnerability triage on Pydantic AI + MCP. Ten typed tools (NVD, OSV, KEV, EPSS, Exploit-DB, ATT&CK, SBOM, Nmap) ground a validated TriageReport with a deterministic…
Mpak Trust Framework
MTF: An open security standard for MCP server bundles. Defines compliance levels, controls, and verification methods.
Semclone
mcp-semclone - Model Context Protocol Server for SEMCL.ONE
Comply
AI-powered open source license compliance scanner. Analyzes how dependencies are actually used — not just what license they have — to determine if obligations trigger for your dis…
Scrub MCP
A 22-tool MCP server and CI-ready CLI that cuts cloud LLM token usage on code quality tasks. Deterministic tools handle what they can. A local LLM (via DSPy) handles the rest. Clo…
Enterprise AI Accelerator
AI-native unified cloud governance platform — multi-cloud discovery, 6R migration planning, IaC security, FinOps, compliance audit, and executive AI chat. Built on Claude Opus 4.7…
Sbomb
Generate a CycloneDX SBOM directly from an unpacked firmware root filesystem and flag components with known CVEs and EOL kernels.
EAtheria Security
Self-hosted application security platform: SAST, DAST and SCA with AI false-positive validation. OWASP Top 10/CWE mapping, SBOM export, CI/CD integrations and MCP server.
Licenselens
Dependency license + SBOM gate, developer-CLI first
Shellockolm AI CLI MCP Scanner
Welcome to Shellockolm-ai-CLI-MCP-Scanner - 🎯 Your React app is probably vulnerable. Find out in 30 seconds 🚀
Eagle Scout
MCP server for Docker Scout - container security scanning
Dtrack MCP
Read-mostly MCP server for Dependency-Track: AI-powered vulnerability triage with alias dedup, cross-project duplicate discovery, diff + carry-over between versions, and broadcast…
Reeve
Audit AI agents, starting at the endpoint.
Py Lintro
Open-source AI code review engine + unified quality CLI orchestrating 15+ linters. CLI, GitHub Action, and MCP server.
Agentnotary
Notarize, govern, and audit AI agents — cryptographic seal, runtime guard, EU AI Act docs, AI-BOM, adversarial fuzzer
Attestload
attestload
Authorization Bom
ABOM: a portable Authorization Bill of Materials schema and reference toolkit for human, workload, service, and AI-agent access
Oss Cash Lab
Six monetizable OSS bets: MCP SDK gen, gateway, agent CI, AI-BOM, OTel cost, CN IM agents.
Cpe Skills
Comprehensive CPE (Common Platform Enumeration) toolkit — SKILLS, Go SDK, CLI & MCP integration for parsing, matching, generation, storage and NVD integration. ≥91% coverage, 108…
Reusable Github Workflows
Security-hardened reusable GitHub Actions workflows for Go, Python and Docker CI/CD: lint, test, scan, build, publish, release. Plus ClawHub skill/plugin publishing, MCP registry…
Rousseau Agent
Self-hosted, container-native coding agent — 9 chat transports, 5 LLM providers, SLSA-3 provenance, cosign-signed releases, MCP-native. Zero telemetry.
Vendorvet
Third-party / vendor risk questionnaires with SBOM cross-ref
Security Audit MCP Server Showcase
Showcase site for a private MCP server that audits codebases for secrets, CVEs, SAST issues, and SBOM; includes 4 interactive HTML demos.
SprintLoop Assurance Kit
Independent release assurance for AI-built code. Model-neutral CLI, GitHub Actions, and read-only MCP bind evidence and finite human authority to an exact Git candidate.
Agent Sbom
Capability-aware SBOM and SARIF scanner for agent skills, MCP manifests, prompts, and scripts.
Agent Skill Supply Chain Auditor
Static supply-chain auditor for Agent Skill bundles and MCP configurations with SARIF, Agent-SBOM, and deterministic evaluation.
Sbomgate
Continuous SBOM diff & vulnerability watch with maintainer-change tracking
Depgraph
Dependency risk visualizer — Scorecard + OSV + typosquat + maintainer signals
Sbomx
Generates a CycloneDX SBOM for mobile apps by unpacking native libs and bundled SDKs, then matches components against known-vuln and tracker/privacy databases.
Zfuzz CLI
The Rust-native security scanner behind every Zfuzz tool. SAST, SCA, secrets, MCP/skill audit, Sealed Vault — one $0 binary. npx @zfuzz/cli scan .
Opsforge
Forge your DevOps workstation: TUI installer for 287 CLIs, policy-as-code shell guards, CVE-correlated SBOM + OpenVEX.
Tool Trust Metadata
Working paper: provenance and trusted metadata for MCP tools (SPDX 3 / CycloneDX reuse, offline verification)
Agentic Deep Audit
Evidence-first repository audit engine for local & GitHub projects. Python CLI with safety model, provenance tracking, supply-chain/license/risk analysis, MCP handoff, schema vali…
Valvur
Offline security scanning for AI-generated code: seven open-source scanners and AI-specific checks in one command. It finds secrets, vulnerable, hallucinated and malicious depende…
FortressCI
No description published.