Security MCP servers

Dark web OSINT over Tor: search onion engines, scrape pages, report with your own model.

Governs what AI agents do: tool calls, SQL, commands, files checked against policy before they run.

Privileged command execution proxy with human approval via pkexec or sudo

Send and read one-time encrypted secrets with local encryption.

Zero-key security toolkit: grade sites A+ to F, check CVE exploits, plain-English attack defenses

Security-first MCP server for reverse engineering, malware analysis, forensics, and SAST.

MCP server for RoboShadow's Rubicon Platform Data API.

Prompt template drift and structural fingerprint sentinel detecting unauthorized prompt mutations an

Verify a SCITT receipt under a trust root you hold — offline, no backend, no key, no network

Decode JWTs without verifying, flag risky algorithms and claims, verify HS256 or RS256 with a key.

Inspect Kairon VMs, network policy and VM-edge flows from an agent. Read-only by default.

Token safety: honeypot sim, contract powers, rug checks, watch alerts, plain card, paper test.

Decide by policy, gate behind a human, verify by read-back, record a hash-chained ledger.

Config drift, CIS/PCI checks, 802.1X diagnosis, certs inside configs, topology, change pre-flight.

MCP server for Kaseya SaaS Alerts — SaaS security monitoring for M365 & Google Workspace.

68k+ security-audited MCP skills + free agent trust layer: signed ATC cards, tool gating, audits.

Stops secrets, cross-tenant queries and unsafe migrations before they merge.

MCP proxy that checks every tools/call against Agent Trust policy, with evidence, before it runs.

Local-first PHI detection for source code, LLM prompts, logs, and analytics

Zero-knowledge MCP secrets vault for AI agents: secrets injected at runtime, never seen by the model

SSH & Kubernetes access broker for AI agents; the model never touches a credential.

Puts Approve/Deny on your phone before an agent acts, and waits for your fingerprint.

Local-first, read-only ECZ-ID verifier over MCP (stdio): checks, reports, explains, routes.

API-key pre-action risk gate: any irreversible agent action (money, SQL, delete, email).

Weavatrix Online extension: guarded sync, advisories, malware review, architecture contracts.

Weavatrix Online extension: guarded sync, advisories, malware review, architecture contracts.

Verify a photo's capture time and provenance: C2PA validation, EXIF/XMP, and pixel forensics.

logi (1pass) IdP — manage your OAuth apps, redirect URIs, passkeys, login history and docs.