Skip to main content
Glama
116,519 servers. Updated
20 Best Security MCP Servers: compared and ranked, November 2026Ranked from 4,408 matching servers on stars, growth, downloads and maintenance. Updated .

Matching MCP tools:

Matching MCP Connectors:

"Search for known security vulnerabilities on the NSIS website" matching MCP servers:

GET /v1/servers – MCP directory API reference
  • A
    license
    Not graded
    quality
    A
    maintenance
    Detect live website vulnerabilities and security flaws in GitHub repositories using automated DAST and SAST scanning. Safeguard applications by identifying exposed secrets, insecure dependencies, and common code patterns prone to exploitation. Receive structured fix plans with precise code remediation steps to resolve identified risks and improve security posture.
    2
    MIT
  • A
    license
    A
    quality
    B
    maintenance
    Provides AI-visibility scoring and site auditing capabilities for websites, enabling agents to check how sites appear in AI engines like ChatGPT and Perplexity, run full SEO/security audits, and monitor changes over time.
    20
    333 npm
    1
    MIT
  • A
    license
    A
    quality
    B
    maintenance
    Enables auditing a Supabase project's security beyond the dashboard's Security Advisor, checking anonymous access, RLS policies, and cross-tenant data leaks via read-only probes and a two-account test.
    4
    33 npm
    MIT
  • A
    license
    A
    quality
    C
    maintenance
    Gives AI agents ten website and domain research tools, including full domain reports, readable page extraction, DNS lookups, feed and sitemap parsing, link and metadata extraction, site checks, and redirect tracing. Calls are paid per use in USDC on Base via x402 from a configured wallet, so no account, API key, or subscription is required.
    10
    MIT
  • A
    license
    Not graded
    quality
    A
    maintenance
    A lightweight MCP server for security reviews that injects security requirements before code generation, scans dependencies for CVEs, and verifies generated code without disrupting workflow.
    73
    MIT
  • A
    license
    Not graded
    quality
    C
    maintenance
    Zero-key security toolkit for your AI assistant: grade any website's security A+ to F, check if CVEs are actively exploited via CISA KEV and EPSS, and get MITRE ATT&CK defenses explained in plain English. No API keys, no signup.
    MIT
  • A
    license
    Not graded
    quality
    A
    maintenance
    Skill librarian for coding agents: describe a task and get the few matching skills from a large local skill collection, then report whether they worked. Runs locally with Ollama and SQLite.
    42
    MIT
  • A
    license
    Not graded
    quality
    B
    maintenance
    Enables AI clients to search curated, cited knowledge bases built from founders', CEOs', and investors' public talks, essays, and posts, returning passages with source links and dates. It also exposes available source collections via MCP tools so users can ask how those individuals might approach business, product, or growth questions.
    96
    MIT
  • A
    license
    Not graded
    quality
    C
    maintenance
    Official Model Context Protocol server exposing static AST security tools (audit_mcp_repository, audit_local_directory) to scan MCP tools for vulnerabilities before connecting them to Claude or Cursor.
    MIT
  • A
    license
    Not graded
    quality
    Not graded
    maintenance
    Enables searching and retrieving security conference papers from major venues (S&P, USENIX, CCS, NDSS, etc.) using natural language queries through the MCP protocol.
    3 npm
    MIT
  • F
    license
    Not graded
    quality
    C
    maintenance
    Provides deterministic, standards-based calculations for data center critical power infrastructure. Enables site selection, generator sizing, UPS sizing, NFPA 110 compliance, and more via 50+ AI agents and 8 compound chains.
    -
  • A
    license
    A
    quality
    C
    maintenance
    MCP server that lets AI coding agents (Claude Code, Cursor, Cline) audit Supabase projects for security misconfigurations AND apply the fixes — without leaving the agent. Tools: audit_project, list_findings, preview_fix (BEGIN/ROLLBACK safety), apply_fix (with confirmation), apply_all_fixes (transactional bulk). Closes the audit-fix loop entirely in the agent — other Supabase scanners only report.
    5
    4 npm
    1
    MIT
  • A
    license
    A
    quality
    B
    maintenance
    Vulnerability intelligence for AI agents that enables CVE lookup, package vulnerability checks, and dependency auditing without API keys.
    5
    MIT
  • A
    license
    A
    quality
    A
    maintenance
    MCP server for The Commons (jointhecommons.space), a persistent, noncommercial space where AI voices from different models post and reply to each other with persistent identities. 48 tools; reading needs no token, writing uses a facilitator-issued token.
    55
    3
    MIT
  • A
    license
    B
    quality
    B
    maintenance
    Zero-trust safety & settlement rail for autonomous AI agents. Sub-10ms deterministic guardrails, secret leak defense, bounded wallet controls, and on-chain Proof-of-Safety attestations via x402.
    15
    273 PyPI
    3
    MIT
  • A
    license
    Not graded
    quality
    A
    maintenance
    Local stdio MCP server for Bitwarden (Public API + Secrets Manager). 50+ admin tools for members, groups, collections, policies, licensing, projects, and secrets. For Claude Desktop / Claude Code.
    909 npm
    MIT
  • A
    license
    Not graded
    quality
    C
    maintenance
    Enables AI assistants to search checked US roofing, siding, and gutter contractors by city and trade, and to retrieve individual contractor profiles with contact details, claimed status, and ratings. Read-only, requires no login or API key, and filters out closed or unlisted businesses.
    MIT
  • A
    license
    Not graded
    quality
    C
    maintenance
    Enables enterprise MCP security auditing through 12 deterministic no-LLM tools for evidence-gated claims, skill/prompt supply-chain audits, token profiling, and server auth-mode checks.
    MIT