MCP servers and skills: search, filter by where they run, and compare.
Review the implementation source code of MCP (Model Context Protocol) servers, clients, and tool handlers against a security baseline — authentication, sessions, rate limiting, input-schema validation
OfficialSkillMIT★ 40k in collectionNo key
Automated security scanner for Model Context Protocol servers that detects RCE, path traversal, prompt injection, and protocol vulnerabilities.
SkillMIT★ 31No key
Turn any LLM into an autonomous pentester. You define the scope, the agent does the work, you review the findings.
SkillAGPL-3.0★ 497No key
Offensive MCP server auditor: detects tool poisoning, credential leaks, RCE vectors, SSRF, session hijacking, and supply chain vulnerabilities across stdio, HTTP, and SSE transports.
Node.jsMIT★ 24No key
Defense-in-depth bundle for MCP stdio servers: drop-in guardExec/guardSpawn wrappers, AST audit CLI, reference MCP server. Closes the Ox-Security 200k-server stdio-RCE class (LiteLLM CVE-2025-69256).
Node.jsMITFew starsNo key
An AI-driven dynamic protocol fuzzer for the Model Context Protocol (MCP). Prove runtime exploitability by discovering state violations, transport crashes, and application-layer logic flaws (SSRF, LFI
PythonMIT★ 27No key
Deliberately vulnerable MCP server (aka MCP Goat) for security training — 26 challenges across 4 difficulty levels (incl. a secure reference), a victim-agent harness, and one-command Docker deploy. Pr
SkillMIT★ 11No key
🕵️ Scans MCP servers for injection with 30+ canonical detection rules across 5 severity levels (April 2026 MCP RCE class). MIT.
PythonMITFew starsNo key
A practical, community-driven checklist for pentesting MCP servers. Covers traffic analysis, tool-call behavior, namespace abuse, auth flows, and remote server risks. Maintained by Appsecco and licens
SkillCC-BY-4.0★ 42No key
SkillSync MCP — security-gated skill management for Claude Code, OpenClaw, Cursor & Windsurf. 60+ threat pattern scanner.
SkillMIT★ 4Few starsNo key
Layer-2 supply-chain hardening for MCP servers — Ed25519-signed tool manifests, runtime spawn-attestation, default-deny argument sanitizer. Defends against marketplace-poisoning + CVE-2025-69256 + CVE
Node.jsMITFew starsNo key
Open-source zero-trust proxy for MCP servers — adds OAuth 2.1, tool-level RBAC, audit logging, and rate limiting to any MCP server. One Docker command, zero code changes.
GoMIT★ 4Few starsNo key
Scan, Score, Install MCP Servers with confidence. The missing toolkit for the MCP ecosystem.
PythonMIT★ 1Few starsNo key
Security scanner for MCP servers — vet an MCP before you wire it into an agent. Detects prompt-injection, credential exfiltration (via taint analysis), RCE, and supply-chain risks, and catches cross-s
Node.jsMITFew starsNo key
🛡️ Free open-source AI-powered security terminal & vulnerability scanner (CVE, SBOM). Supports SSH, SFTP, RDP, VNC, Serial, and 12+ autonomous AI agents (DeepSeek, OpenAI) for automated security work
SkillMIT★ 788No key
Blitz Strike — a universal MCP security-audit toolbelt. Reconnaissance at speed. Analysis in depth. Validation before report.
Node.jsMIT★ 509No key
Security infrastructure your AI can't be — deterministic, daily CVE intel past your model's training cutoff, whole-repo-aware, author-independent, and shift-left: secure_prompt secures the prompt befo
Node.jsApache-2.0★ 6No key
MCP server that gives AI assistants (Claude, Codex, Cursor, Opencode) SSH access to run commands, transfer files, and manage server fleets
PythonMPL-2.0★ 4Few starsNo key
Who stands behind it
