- Jikida.io MCP @jikida/mcpSecurity tools for your AI: scan, pentest, check headers, guard code and scan repos for secrets.15% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.1 GitHub stars.
- SecHelix @omarmohelal/sechelixEvidence-first security review of authorized repositories. Read-only, root-confined, no shell.5% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.1 GitHub stars.
- Sentinel Scan @ventrova/sentinel-scan-cliMCP security scanner: detect tool poisoning, prompt injection & rug-pulls - 10 OWASP heuristics.7% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.1 GitHub stars.
- BeVigil OSINT @santhosh-005/bevigilDiscover mobile app attack surfaces via BeVigil OSINT — hosts, subdomains, URLs, and more.9% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.1 GitHub stars.
- MCPSentinel @gentaarnezzi/mcpsentinelPrecision-first security scanning for Model Context Protocol servers.7% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.1 GitHub stars.
- GAUNTLEX @sanjoy1234/gauntlexConcurrent Builder + Breaker agents generate code and adversarial tests at once, gated in CI.7% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.1 GitHub stars.
- Cybersec @xu-c0/cybersec-mcpCybersecurity MCP server: 323 prompts + 7 workflows for red team, blue team, SOC, cloud, OSINT.12% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.1 GitHub stars.
- Eidolon @sudohnim/eidolonPrivacy-first OSINT scanner: breaches, credentials, Shodan, username sweep. Scored PDF report.23% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from a package registry.1 GitHub stars.
- Arcwall Security @rom-baro/arcwall-securitySecurity scanning for AI coding tools. Detects secrets, threat models, and runs pre-commit checks.5% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.1 GitHub stars.
- OSINT MCP @rjn32s/osint-mcp26 free OSINT tools as MCP tools for AI agents. Auto-installs everything on first run.22% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.1 GitHub stars.
- Recon Kit @nan786521/recon-kit-mcpRead-only network & security recon tools (DNS, TLS, headers, CORS) for AI agents, each graded.12% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.1 GitHub stars.
- Secrets Audit @eltociear/secrets-audit-mcpDetects leaked secrets & API keys: 32+ provider rules (AWS, GitHub, Stripe, OpenAI…), zero deps.5% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from Docker.1 GitHub stars.
- SynapseAudit @digidenone/synapse-auditAI-Powered Security Scanner for LLMs. Detects vulnerabilities and syncs with SynapseAudit.7% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.1 GitHub stars.
- Pwntools @daedalus/mcp-pwntoolsMCP server exposing pwntools 4.15.0 functionality for binary exploitation19% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.1 GitHub stars.
- Pymetasploit3 @daedalus/mcp-pymetasploit3MCP server for Metasploit Framework via pymetasploit340% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.1 GitHub stars.
- Attack Surface @cyanheads/attack-surface-mcp-serverPassive external attack-surface mapping: CT subdomains, DNS, TLS, HTTP posture, RDAP/WHOIS, Shodan.7% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.1 GitHub stars.
- Hookwarden — Webhook Integrity @hookwarden/mcpWebhook signature-verification audit. Stripe, GitHub, Shopify, Twilio +23. Local. Deterministic.3% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.1 GitHub stars.
- Pentagonal @achilles1089/pentagonal-mcpAI smart contract forge — 8-agent security audits, generation, and compilation across 8 chains11% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.1 GitHub stars.
- APSA mobile app security audit @ictechgy/apsaLocal, evidence-graded Android/iOS security audits of source, APK, AAB and IPA for AI agents.Not assessed yet.Runs on your machine, installed from PyPI.
- Darkmoon @ascit31/darkmoon-mcp-serverDrive a self-hosted Darkmoon Pro AI pentest instance: start runs, read campaigns and findings.10% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
- Unchore Defend @smilemino/unchore-defendGrade a site's security headers with fixes and a badge; read logs or code for the defender.Not assessed yet.Runs on your machine, installed from MCPB.
- Securityscan @securityscan-api/securityscanSecurity for AI agents: MCP audits, secret redaction, skill vetting, network scans, agent checkout.9% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.
- DLP @cx-anand-nandeshwar/dlp-mcpThe DLP MCP provides the compliance violation in the one drive, google drive documents.9% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from a package registry.
- OSINT Toolbox @renkagod/osint-toolbox-mcpRun Sherlock, Maigret, Holehe, GHunt, theHarvester, SpiderFoot and more OSINT tools locally11% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.
