Security MCP servers

GuardBee MCP bridge to Agent Threat Rules (ATR) for runtime agent/MCP threat detection

Scans LLM/agent code for Unbounded Consumption / denial-of-wallet risks (OWASP LLM Top 10 2026 #6)

MCP server for Logto: users, applications. Works with Cloud or self-hosted.

22 rules that name the lines where a Node or TypeScript service writes personal data into logs, cras

Scans code for insecure LLM/AI integration: exposed keys, unsafe output, prompt injection

MCP server for Pi-hole: status, stats, blocking toggle. Works with any instance.

Marks every base image in your Dockerfiles, compose files and CI workflows whose security patches ha

Scans agent code for untrusted input poisoning persistent cross-session memory

MCP server for Frigate NVR: version, stats, cameras, recent events.

Checks declared npm/PyPI dependencies against real registries to catch slopsquatting

URL scanning from urlscan.io. No key required.

MCP elicitation anti-patterns: secrets in forms, third-party authorize URLs, credentials in URLs

Scan local or remote hosts for open TCP ports. Runs locally.

CVE scanning for npm/pip/cargo dependencies via OSV

Decode and verify JSON Web Tokens locally. No network and no key.

Local first MCP checks for Unicode confusables, mixed scripts, invisible controls, and...

Score password strength locally with the zxcvbn algorithm. No network and no key.

Generate strong random passwords locally. No network and no key.

Check if a password has appeared in known breaches without sending the password. No key required.

Generate and verify time based one time passwords locally. No network and no key.

Use this MCP server to OSV open source vulnerability data and package security checks. Tools...

Infostealer breach intelligence from Hudson Rock. No key required.

Search CVE vulnerability records from the NIST NVD database. No key required.

TLS security grades from SSL Labs. No key required.

Inspect TLS certificates of a host: issuer, expiry, and SAN. No key required.

Search the MITRE ATT&CK enterprise knowledge base for adversary techniques and tactics.

Count secret-like patterns in bounded local files without returning values, keys, paths,...

Threat intelligence for IPs and domains from Maltiverse. No key required.