- Heimdall @caglarbozkurt/heimdallScan an MCP server or agent config for injection, exfiltration, and risky capabilities.3% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
- Mund — MCP Security Scanner @tyox-all/mundScan for prompt injection, secrets, PII, and vet MCP servers before installation15% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
- SymbioticSec MCP @symbioticsec/mcpSymbiotic CLI MCP Server for security scanning and analysis7% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
- Shipcheck MCP @tatelyman/shipcheck-mcpRead-only Shipcheck launch-risk scans for authorized JS, TS, and MCP repos.4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
- Mcpshield @mcpshield-dev/mcpshieldSecurity scanner for MCP servers - detects tool poisoning and injection7% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
- Rqwstr @kjopstad-it/rqwstrAI-native HTTP security testing MCP server — 17 tools with raw HTTP/1.1 + HTTP/2 control16% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from MCPB.
- Gorgon Scout @gorgon-cyber/gorgon-scoutRun AI-driven web-app and API security scans (DAST) from Claude or any MCP agent. Windows.9% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from MCPB.
- ExposureGuard @exposureguard/exposureguard-mcpDomain security scanning for AI agents. A-F grades, 8 checks, fix snippets.6% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.
- Meok Injection Scan @csoai-org/meok-mcp-injection-scan-mcpMCP injection / prompt-poisoning / SSRF scanner. 30+ canonical rules covering the April 202617% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.
- Cloud Pathfinder @baneado98/cloud-pathfinderIaC attack-path auditor: finds internet-to-crown-jewel chains in Terraform/CFN/K8s.16% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
- Hackertarget @pipeworx-io/hackertargetHackerTarget MCP.13% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
- Domain Intel @lazymac2x/domain-intelCloudflare Workers MCP server: domain-intel6% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
- Frogeye Security Scanner @frogeye-ai/mcpZero-config MCP security scanner for AI-generated apps. 25K+ vulnerability patterns.11% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
- Bright Security @neuralegion/mcpAI-powered application security testing — scan APIs, discover endpoints, and find vulnerabilities.9% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; it needs your API key.
- Compuute MCP Security Scanner @compuute/compuute-scan-apiScan any public GitHub MCP-server repo for security issues. 37 MCP-specific L1 rules, 8 languages.6% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
- ScanMalware.com URL Scanner @scanmalware/scanmalware-mcpMCP server for ScanMalware.com URL scanning, malware detection, and analysis.7% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
- Bumblebeereceipt @clauxel/bumblebeereceipt-mcpA paid remote MCP for developer endpoint scanner MCP, built to return verdicts, receipts, usage logs14% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; it needs your API key.
- Helixar Security @helixar/mcpSecurity tools for AI agents: scan MCP servers, validate HDP delegation chains, audit releases.7% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
- Enoki @enokilabs/enokiTest your AI agents for security and safety weaknesses, and re-verify the fixes.9% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; you sign in with your account.
- Grisoco AI security audits @grisoco/auditsSmart-contract security audits for EVM chains and DAML: quote, run and fetch reports.10% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; it needs your API key.
- HeaderGuard @mike-tusa/headerguardScan a website's HTTP security headers (HSTS, CSP, framing, COOP/CORP, cookies). Score + fixes.5% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
- Tanod Security @tanod/securityContract and agent-package scans, phishing URL and OFAC checks, domain and header checks.6% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
- Redthread @redthreadsec/redthreadAttack paths, scan findings and shadow AI for AI-native apps and their clouds; vet MCP servers.12% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; you sign in with your account.
- Shippable @egarter/shippableFind leaks in AI-built apps: open Supabase/Firebase data, exposed keys, unsafe edge functions22% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
