- Conduid
- Marketplace
- #threat-detection
MCP servers tagged threat-detection
29 live MCP servers tagged "threat-detection", ranked by trust score. Tags come from package metadata and repository topics, so this list covers servers across every category that work with threat-detection.
AiSOC
Open-source AI-powered Security Operations Center — alert fusion, purple-team drills, agent-assisted triage, MITRE ATT&CK investigation. MIT-licensed, self-hostable.
Adrian
Runtime security monitoring and control for AI agents. Catches malicious tool use, prompt injection, and policy drift in real time, before the agent acts.
Panguard MCP Proxy
MCP Proxy — runtime interception for AI agent tool calls using ATR rules
Wazuh Openclaw Autopilot
🤖 Automate SOC alert triage and incident response in Wazuh with OpenClaw agents and MCP for efficient security operations.
Huntable CTI Studio
Huntable CTI Studio is an AI-assisted cyber threat intelligence workbench that turns open-source CTI into Sigma rules.
Agentmetry
Local-first flight recorder for AI coding agents. Hash-chained audit trail, MITRE-mapped sequence detection, DLP. Forwards to the SIEM you already run.
WireMCP Rs
Provide high-speed real-time packet capture and network analysis with Rust-powered parsing and threat detection for efficient MCP server use.
Yararun
Run simple YARA-style string/regex rules over a directory
Agent Runtime Community
Agent Runtime Security Platform, Open-source zero-trust security and governance layer for autonomous AI agents featuring runtime policy enforcement, DLP scanning, MCP tool verific…
Cortextrace
Local-first desktop observability, tracing and threat detection for AI agents (Claude Code, Cursor, MCP, OpenTelemetry)
WRG-11/wrg-sigma-rules
rule production corpus across 11 MITRE ATT&CK tactic categories. Standalone server + Claude Code plugin distribution.
Firmis Scanner
AI agent runtime security scanner - detect malicious behavior in Claude Skills, MCP Servers, Codex Plugins, and more
Skillsync MCP
Provide an MCP server that enables seamless integration and management of SkillsMP data with Node.js environments supporting Model Context Protocol.
Shark Security Lab
Reference MCP security lab: toxic tool metadata, multi-server mcp.json harness for static scan, localhost AAuth fixtures, YARA (OWASP Agentic ASI01–ASI10). Stress-test MCPShark an…
Tenable Activity MCP
MCP server exposing the Tenable Vulnerability Management audit log as analysis tools: per-actor baselines, API-key usage attribution, and explained anomaly detection.
A10 Guardian
🛡️ REST API + MCP Server for A10 Networks Thunder TPS DDoS mitigation - Automate zone management, monitor attacks in real-time, and integrate with AI agents
Shellockolm AI CLI MCP Scanner
Welcome to Shellockolm-ai-CLI-MCP-Scanner - 🎯 Your React app is probably vulnerable. Find out in 30 seconds 🚀
Tdp MCP
Model Context Protocol (MCP) server in Go for ThreatBook TDP (微步在线威胁检测平台): 105 OpenAPI endpoints + 4 diagnostics as typed MCP tools - alert triage, incident forensics, log hunting…
Detection Lab
Detection-engineering for MCP: working Sigma rules for the OWASP MCP Top 10 + isolated home-lab + zero-dependency validator (git clone && python3 validate.py).
Anvilogic
Anvilogic — independent third-party profile of a public API surface, by API Evangelist. Anvilogic is an Agentic SecOps platform founded in 2019 by former SOC practitioners. It run…
Daylight
Daylight — independent third-party profile of a public API surface, by API Evangelist. Daylight (Daylight Security) is an AI-native Managed Detection and Response (MDR) provider d…
Malwar
Static analysis engine for detecting malware in agentic AI skill files
Runreveal
RunReveal — independent third-party profile of a public API surface, by API Evangelist. RunReveal is a unified security log management and detection platform that replaces traditi…
Netprobe MCP
An open-source, AI-native Model Context Protocol (MCP) server bridging Large Language Models with core network diagnostic tools for automated observability, threat detection, and…
FlowSentinel
Local-first MCP server for process-aware network visibility, PCAP analysis, and explainable behavioral threat detection in Go.
Yara Detection Harness
Detection-as-code for generated text & code: hand-written YARA rules, a paired synthetic corpus, and a CI harness gating on recall + false-positive rate — plus a VirusTotal enrich…
Nimbus MCP
Nimbus - AWS Security Assessment MCP Server | 45 Tools | Multi-Region Scanning | TRA Reports | CIS/NIST/PCI-DSS Compliance
Aitdp
AI Threat Detection Protocol — open spec, community ruleset and reference SDK for detecting prompt injection, jailbreaks, data exfiltration and tool abuse in LLM apps and AI agent…
Elastic Genai Secops
Open, AI-assisted SecOps platform on the Basic-licensed Elastic Stack: SIEM, detection rules, alert correlation, PII masking, LLM triage with human review, and a read-only MCP ser…