- NPM Sentinel @smithery/nekzus-npm-sentinel-mcpProvide AI-powered real-time analysis and intelligence on NPM packages, including security, depend…9% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; you sign in with your account.18 GitHub stars.
- JFrog Remote MCP Server @jfrog/jfrog-mcp-serverMCP Server for JFrog, providing tools for development and artifact management.7% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.15 GitHub stars.
- lurq @jadenryu/lurqVerify npm packages before your AI agent installs them: hallucinations, advisories, API drift.4% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.8 GitHub stars.
- Competitive Intel @martc03/competitive-intelSEC filings, patent data, and trade data. 4 competitive intel tools.10% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.6 GitHub stars.
- Business Entity @martc03/business-entitySEC company search and SBA business resources. 4 MCP tools for business intelligence.8% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.6 GitHub stars.
- Patch Tuesday @jonnybottles/patch-tuesdayQuery Microsoft Patch Tuesday security updates (MSRC) with EPSS and CISA KEV enrichment4% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.4 GitHub stars.
- Ansvar: Threat Intelligence @ansvar/threat-intelCVE intelligence, STRIDE, OWASP test cases via Ansvar Gateway. Cited, OAuth + paid.6% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; you sign in with your account.3 GitHub stars.
- EchelonGraph CVE & Exposure @echelongraph/echelongraph-mcpCVE, KEV, EPSS, SBOM and advisory lookups; per-CVE exposure from Shodan data (© Shodan). Keyless.3% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.2 GitHub stars.
- mlab.sh @mlab/mcpThreat intelligence: enrich IOCs (IP, domain, URL, hash), search CVEs and actors, scan SBOMs.8% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; you sign in with your account.2 GitHub stars.
- Security Recipes @stevologic/security-recipesRead-only CVE intelligence, remediation playbooks, and agent setup guides. Not a scanner.4% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.2 GitHub stars.
- HoneyLabs @honeylabs/mcpHoneypot probe data: IP reputation, scanners, CVE probing, TLS and SSH fingerprints.5% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.2 GitHub stars.
- Hex.pm MCP @joshrotenberg/hexpm-mcpMCP server for hex.pm and hexdocs.pm: search, inspect, compare, and audit Elixir packages2% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.2 GitHub stars.
- osv-advisory-mcp-server @cyanheads/osv-advisory-mcp-serverQuery OSV.dev for package vulnerabilities and batch-audit dependency lists via MCP.3% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.2 GitHub stars.
- Readout @kaitzyy-dev/readoutMeasured readings on open-source dependencies: health, end-of-life, model prices, incidents.Not assessed yet.A remote server; no sign-in.1 GitHub stars.
- ThreatCluster @jam0k/threatclusterLive threat intel for agents: incidents, actors, CVEs with KEV/EPSS, ransomware leak-site victims.5% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; you sign in with your account.1 GitHub stars.
- cisa-cybersecurity-mcp-server @cyanheads/cisa-cybersecurity-mcp-serverCISA KEV with BOD 26-04 deadlines, SSVC prioritization, and the ICS advisory corpus (CSAF). Keyless.3% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.1 GitHub stars.
- Sighttrue @kaitzyy-dev/sighttrueMeasured readings on open-source dependencies: health, end-of-life, model prices, incidents.3% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.1 GitHub stars.
- Dep Diff @digicatalyst-systems/dep-diff-mcpTranslates a lockfile diff into a human-readable upgrade plan for npm, PyPI, and GitHub Actions.3% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.1 GitHub stars.
- AgentAegis @astafford8488/agentaegisPay-per-call cybersecurity for AI agents: vuln scans, threat intel, compliance, code security.9% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.1 GitHub stars.
- Fetter MCP @fetter-io/fetter-mcpReal-time Python package and vulnerability data for AI coding agents.7% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; it needs your API key.1 GitHub stars.
- Koot by Datakoot @datakoot/koot-briefingsOne-call briefings for AI agents: dependency risk (KEV/EPSS), SEC companies, domains, US places.4% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
Vulnerability management MCP servers
A server here known vulnerabilities (CVEs), security advisories or vulnerable dependencies.
Not here: general code review and uptime monitoring.
185 remote220 localTagged by Odel's AI, which can make mistakes
Most popular in Vulnerability management
By GitHub stars, at most two per publisher- Number 1: GitHits@githits/githitsSearch public open-source code, documentation, metadata, vulnerabilities, changelogs, and examples.6% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; you sign in with your account.115 GitHub stars.
- Number 2: Dependency Management@sonatype/dependency-management-mcp-serverSonatype component intelligence: versions, security analysis, and Trust Score recommendations6% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; it needs your API key.74 GitHub stars.
- Number 3: ContrastAPI@contrastcyber/api55 tools, 7 Resources, Sigma rules, email SPF/DMARC, MITRE, CVE/KEV, risk_score. No key.10% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.33 GitHub stars.
