- EchelonGraph CVE & Exposure @echelongraph/echelongraph-mcpCVE, KEV, EPSS, SBOM and advisory lookups; per-CVE exposure from Shodan data (© Shodan). Keyless.3% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.2 GitHub stars.
- mlab.sh @mlab/mcpThreat intelligence: enrich IOCs (IP, domain, URL, hash), search CVEs and actors, scan SBOMs.8% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; you sign in with your account.2 GitHub stars.
- Security Recipes @stevologic/security-recipesRead-only CVE intelligence, remediation playbooks, and agent setup guides. Not a scanner.4% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.2 GitHub stars.
- RATATOSK @garlickim21/ratatosk-mcpCNCF release intelligence: typed changes from release notes; check_stack compares versions locally.5% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from Docker.2 GitHub stars.
- HoneyLabs @honeylabs/mcpHoneypot probe data: IP reputation, scanners, CVE probing, TLS and SSH fingerprints.5% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.2 GitHub stars.
- Zyrax Guard @tiagosilva07/zyrax-guardAudit AI agent configs for prompt injection & rogue MCP servers; vet packages6% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.2 GitHub stars.
- Raven Nest @tidynest/raven-nest-mcpAI-driven penetration testing - 22 security tools behind safety-hardened MCP endpoints25% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from Docker.2 GitHub stars.
- DugganUSA CLI — Local STDIO MCP @pduggusa/dugganusa-cliLocal STDIO MCP for DugganUSA threat intel. 1.13M IOCs. Read-only. npm: dugganusa-cli.7% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.2 GitHub stars.
- Bawbel Scanner @bawbel/bawbel-mcpScan MCP servers and skill files for AVE vulnerabilities. Conformance scoring and threat intel.5% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.2 GitHub stars.
- npm Registry MCP Server @yawlabs/npmjs-mcpnpm registry MCP server — package intelligence, security audits, dependency analysis10% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.2 GitHub stars.
- Hex.pm MCP @joshrotenberg/hexpm-mcpMCP server for hex.pm and hexdocs.pm: search, inspect, compare, and audit Elixir packages2% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.2 GitHub stars.
- osv-advisory-mcp-server @cyanheads/osv-advisory-mcp-serverQuery OSV.dev for package vulnerabilities and batch-audit dependency lists via MCP.3% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.2 GitHub stars.
- Security Suite @guardbee/security-suiteBundle of secret-scanner, dependency-auditor, ssl-inspector, and dns-intelligence8% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.1 GitHub stars.
- OSV Advisories @basitalisandhu/mcp-osv-advisoriesQuery OSV.dev for known vulnerabilities by package and version, and scan lockfiles in batch.3% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from Docker.1 GitHub stars.
- Readout @kaitzyy-dev/readoutMeasured readings on open-source dependencies: health, end-of-life, model prices, incidents.Not assessed yet.A remote server; no sign-in.1 GitHub stars.
- Vulnerability Scanner @4hmetuyar/vulnerability-scannerTriggers GuardBee scans, queries findings, AI-assisted remediation guidance7% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.1 GitHub stars.
- Dependency Auditor @4hmetuyar/dependency-auditorCVE scanning for npm/pip/cargo dependencies via OSV6% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.1 GitHub stars.
- ThreatCluster @jam0k/threatclusterLive threat intel for agents: incidents, actors, CVEs with KEV/EPSS, ransomware leak-site victims.5% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; you sign in with your account.1 GitHub stars.
- Agent Guards @mlawsonking/agent-guardsAll six agent guard suites in one local MCP server, with optional cloud intelligence.6% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.1 GitHub stars.
- Package Guard @mlawsonking/package-guard-mcpSupply-chain guard for AI coding agents: verify packages, check vulns/malware, detect typosquats.5% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.1 GitHub stars.
- Base Image Eol Lint @jmshinhwa/base-image-eol-lintMarks every base image in your Dockerfiles, compose files and CI workflows whose security patches ha6% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.1 GitHub stars.
- Jikida.io MCP @jikida/mcpSecurity tools for your AI: scan, pentest, check headers, guard code and scan repos for secrets.15% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.1 GitHub stars.
- RoboShadow @wyre-ai/roboshadow-mcpMCP server for RoboShadow's Rubicon Platform Data API.6% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from Docker.1 GitHub stars.
- cisa-cybersecurity-mcp-server @cyanheads/cisa-cybersecurity-mcp-serverCISA KEV with BOD 26-04 deadlines, SSVC prioritization, and the ICS advisory corpus (CSAF). Keyless.3% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.1 GitHub stars.
