- Secrets Audit @eltociear/secrets-audit-mcpDetects leaked secrets & API keys: 32+ provider rules (AWS, GitHub, Stripe, OpenAI…), zero deps.5% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from Docker.1 GitHub stars.
- SynapseAudit @digidenone/synapse-auditAI-Powered Security Scanner for LLMs. Detects vulnerabilities and syncs with SynapseAudit.7% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.1 GitHub stars.
- Pwntools @daedalus/mcp-pwntoolsMCP server exposing pwntools 4.15.0 functionality for binary exploitation19% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.1 GitHub stars.
- Pymetasploit3 @daedalus/mcp-pymetasploit3MCP server for Metasploit Framework via pymetasploit340% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.1 GitHub stars.
- Attack Surface @cyanheads/attack-surface-mcp-serverPassive external attack-surface mapping: CT subdomains, DNS, TLS, HTTP posture, RDAP/WHOIS, Shodan.7% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.1 GitHub stars.
- Hookwarden — Webhook Integrity @hookwarden/mcpWebhook signature-verification audit. Stripe, GitHub, Shopify, Twilio +23. Local. Deterministic.3% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.1 GitHub stars.
- Pentagonal @achilles1089/pentagonal-mcpAI smart contract forge — 8-agent security audits, generation, and compilation across 8 chains11% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.1 GitHub stars.
- AgentAegis @astafford8488/agentaegisPay-per-call cybersecurity for AI agents: vuln scans, threat intel, compliance, code security.9% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.1 GitHub stars.
- pentest-mcp-server @cyanheads/pentest-mcp-serverOffline methodology engine for authorized penetration testing, CTF, and security research.9% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.1 GitHub stars.
- APSA mobile app security audit @ictechgy/apsaLocal, evidence-graded Android/iOS security audits of source, APK, AAB and IPA for AI agents.Not assessed yet.Runs on your machine, installed from PyPI.
- Darkmoon @ascit31/darkmoon-mcp-serverDrive a self-hosted Darkmoon Pro AI pentest instance: start runs, read campaigns and findings.10% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
- Unchore Defend @smilemino/unchore-defendGrade a site's security headers with fixes and a badge; read logs or code for the defender.Not assessed yet.Runs on your machine, installed from MCPB.
- Securityscan @securityscan-api/securityscanSecurity for AI agents: MCP audits, secret redaction, skill vetting, network scans, agent checkout.9% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.
- DLP @cx-anand-nandeshwar/dlp-mcpThe DLP MCP provides the compliance violation in the one drive, google drive documents.9% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from a package registry.
- OSINT Toolbox @renkagod/osint-toolbox-mcpRun Sherlock, Maigret, Holehe, GHunt, theHarvester, SpiderFoot and more OSINT tools locally11% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.
- EverThread @pb-digital-llc/everthreadPlain-English website security check for agents: certificate, headers, scripts, forms, spam.4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
- Betterleaks Cloud - GitHub, Git, S3, Dir Secret Scanner @anshumanatrey/betterleaks-cloudBetterleaks Cloud - GitHub, Git, S3, Dir Secret Scanner16% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; it needs your API key.
- Telivy @wyre-ai/telivy-mcpMCP server for Telivy's security assessment API for MSPs.4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from Docker.
- Swamp @swampai/swampAn open habitat where security agents register themselves, work in public, and rerun each other.14% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
- PYRESEC - AI Code Security Auditing @renaat-s/pyresec-agentAI code security audits via x402 USDC: $0.01 scans, $0.50 audits, $5 auto-fixes. SAST/SCA.12% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
- ZeroDOM @devhusnainai/zerodomDeterministic DOM perception for AppSec red teams and AI agents: live Chrome, attack-surface scans.16% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.
- MCP Security & Vulnerability Auditor @ansarii/mcp-security-auditorStatic AST security scanner detecting command injection, leaked secrets, and SSRF in MCP tools.10% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
- Censys @pipeworx-io/censysCensys MCP — internet-scan search over the Censys Platform API (censys.com)8% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
- Nel Veil @nelproinc/nel-veilFree passive security scanning - check any domain's DMARC, TLS, headers, and exposures.7% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
