- JFrog Remote MCP Server @jfrog/jfrog-mcp-serverMCP Server for JFrog, providing tools for development and artifact management.7% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.15 GitHub stars.
- Ntobjmanager @lupingqaq/ntobjmanager-mcpStateful Windows RPC attack-surface research for AI agents: 22 tools on NtObjectManager.Not assessed yet.Runs on your machine, installed from a package registry.14 GitHub stars.
- Bomly @bomly-dev/bomly-cliGive your coding agent the dependency graph it is about to change: scan, diff, explain, audit3% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.14 GitHub stars.
- pkgxray @adamsjack711-ux/pkgxrayPre-install security scans for npm packages, MCP servers, and AI agents with cited verdict evidence.4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.11 GitHub stars.
- Vulnicheck @andrasfe/vulnicheckHTTP MCP Server for comprehensive Python vulnerability scanning and security analysis.8% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from Docker.11 GitHub stars.
- VulnCheck @vulncheck-oss/mcpVulnCheck exploit intelligence — CVE research, exploit data, advisories, and threat analysis.5% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from Docker.10 GitHub stars.
- Starlog @starloghq/starlogVet a package (CVEs, license, maintenance) before your AI agent uses it, plus capability discovery.5% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.10 GitHub stars.
- lurq @jadenryu/lurqVerify npm packages before your AI agent installs them: hallucinations, advisories, API drift.4% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.8 GitHub stars.
- Wass @tb0hdan/wass-mcpMCP server for web application security scanning8% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from a package registry.8 GitHub stars.
- MCP Safety Warden @gautamvarmadatla/mcpsafetywardenMCP proxy adding security scanning, behavioral profiling, risk gating, and safe tool call execution.7% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.8 GitHub stars.
- Draugr @draugr/draugrSecurity scanning for AI agents: SAST, SCA, secrets, IaC, DAST, ranked by real risk.3% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from MCPB.7 GitHub stars.
- Vulners @vulnerscom/vulners-mcpMCP server for the Vulners.com API6% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.7 GitHub stars.
- Competitive Intel @martc03/competitive-intelSEC filings, patent data, and trade data. 4 competitive intel tools.10% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.6 GitHub stars.
- Husk @husk-security/huskLocal-first defensive scanner for vulnerable dependencies, leaked secrets, and risky agent configs4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.6 GitHub stars.
- Guardvibe @goklab/guardvibeDeterministic security layer your AI can't be. 574 rules, 39 tools, CLI + doctor + host audit.9% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.6 GitHub stars.
- Business Entity @martc03/business-entitySEC company search and SBA business resources. 4 MCP tools for business intelligence.8% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.6 GitHub stars.
- Pkgdiet @om-tajne/pkgdietPut your node_modules on a diet - find unused dependencies, analyze health, and reduce size4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.5 GitHub stars.
- Patch Tuesday @jonnybottles/patch-tuesdayQuery Microsoft Patch Tuesday security updates (MSRC) with EPSS and CISA KEV enrichment4% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.4 GitHub stars.
- SAST MCP Server @skyrxin/sast-mcp-server11-scanner SAST/DAST MCP server with closed-loop remediation, SBOM/SARIF, and CI integrations4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.4 GitHub stars.
- Ansvar: Threat Intelligence @ansvar/threat-intelCVE intelligence, STRIDE, OWASP test cases via Ansvar Gateway. Cited, OAuth + paid.6% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; you sign in with your account.3 GitHub stars.
- GuardianShield @sparkvibe-io/guardianshieldAI security layer: code scanning, PII detection, prompt injection, secrets, CVEs7% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.3 GitHub stars.
- Npm @alisaitteke/npm-mcpMCP server for npm package management, security analysis, and compatibility checking6% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.3 GitHub stars.
- NativeKeel @alicanakyol/nativekeelReact Native and Expo health check: upgrade blockers, store rules, crash risks, security findings3% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.2 GitHub stars.
- Valca @pranlabs/valcaScans code, IaC and AI-agent config for security problems. Read-only — nothing can be edited.Not assessed yet.Runs on your machine, installed from PyPI.2 GitHub stars.
