"Finding MCP Servers with F Security Grades" matching MCP servers:

MCP server that provides a 216-rule, framework-aware Kotlin/JVM security analyzer, enabling AI coding agents to query real security findings while writing code.

14 atomic MCP tools for AppSec and AI Security engineers: source/schema/prompt audit primitives, JWT inspect, HTTP diff, pentest atoms (default creds, GraphQL introspect, phpggc, interactsh OOB), and a defensive helpers library that fixes the bugs the detectors flag. SARIF output, PyPI Trusted Publishing with Sigstore provenance.

Security scanning for MCP servers from the inside out. Provides runtime inspection, AST-based static analysis, config audit, dependency analysis, and OWASP MCP Top 10 compliance in a single MCP server.

An MCP server that enables AI assistants to analyze Android APK and iOS IPA files for security issues through natural language conversation, including permission auditing, secret detection, and SDK enumeration.

Enables comprehensive security scanning of code projects, detecting vulnerabilities in dependencies, code patterns (XSS, eval, etc.), and exposed secrets, with detailed reports in Spanish prioritized by severity.

A lightweight MCP server for security reviews that injects security requirements before code generation, scans dependencies for CVEs, and verifies generated code without disrupting workflow.

Enables comprehensive security scanning of code repositories to detect secrets, vulnerabilities, dependency issues, and configuration problems. Provides real-time security checks and best practice recommendations to help developers identify and prevent security issues.

Fetches GitHub Code Scanning alerts and applies minimal local patches to fix vulnerabilities, without creating branches, commits, or PRs.

Multi-language SAST and AI-powered fuzzing MCP server for Claude Code integration, enabling static and dynamic security analysis of code.

Automatically detects security vulnerabilities in AI-generated code, scanning for hardcoded secrets, injection flaws, XSS, weak cryptography, authentication issues, path traversal, and vulnerable dependencies across JavaScript, Python, Java, and Go.

Official Model Context Protocol server exposing static AST security tools (audit_mcp_repository, audit_local_directory) to scan MCP tools for vulnerabilities before connecting them to Claude or Cursor.

Zero-execution static AST security scanner and vulnerability auditor for MCP servers. Detects Command Injection (CWE-78), Path Traversal (CWE-22), Hardcoded Secrets (CWE-798), and Unauthenticated Transports (CWE-306).

MCP server for static security analysis of Android application source code.

MCP server that guides LLM security reviews step-by-step, tracking progress and ensuring all assigned source code is read before completing each plan step.

Integrates Checkov, Semgrep, Bandit, and ASH to provide comprehensive code security analysis for AI coding assistants.

Lets an MCP client triage a local project for leaked secrets, missing Supabase row-level security, unauthenticated data-changing API routes, insecure browser-exposed environment variables, and other common web-app security mistakes without network access. It returns severity-ordered findings or a plain-English go/no-go summary with what to fix first.

MCP server for the Codex Security Cloud service, enabling agents to list, inspect, close, reopen findings, request PRs, and apply generated patches.

A security scanner for AI coding agents and autonomous assistants that scans code for vulnerabilities, detects hallucinated packages, blocks prompt injection, and provides LLM-powered semantic code review via MCP or CLI.

An MCP server that provides CVE-driven security prompts for code review, enabling coding agents to get actionable security checks based on real vulnerabilities.

Automates 85-95% of the Secure Software Development Lifecycle (SSDLC) planning phase through multi-role AI orchestration, enabling business analysis, threat modeling, test strategy design, and security code review.

Statically analyzes exported n8n automation workflows for security issues and returns structured findings.

Enables local security scanning and compliance gap analysis for code and text, detecting secrets, PII, and OWASP vulnerabilities, and assessing readiness across major frameworks like NCA, ISO 27001, NIST CSF, and SOC 2.

Integrates multiple Android APK security analysis tools into MCP standard APIs for automated static and dynamic analysis and vulnerability detection.

Enables AI-assisted X++ development for Dynamics 365 Finance and Operations by pre-indexing the entire codebase and providing 54 specialized tools for metadata lookup, code generation, and best practice validation.

Deterministic AST vulnerability remediation and formal verification for AI coding assistants using Microsoft Z3 SMT logic.

Autonomous AppSec & DAST code and website security scanner across 12 security domains (260+ controls) with 3-Layer Triage.

Enables security scanning of codebases through integrated tools for secret detection, SCA, SAST, and DAST vulnerabilities, with AI-powered remediation suggestions based on findings.

Offers a control surface for AI agent security with four independent checks: source-code scanning, tenant isolation, LLM content verification, and deploy gating. Currently in pre-release, with no functional scanning engines yet.

Enables AI coding agents to scan smart contracts and code for vulnerabilities, check against 12 famous-hack patterns, and return public security receipts directly in the IDE.

This server integrates with GitHub Advanced Security to load security alerts and bring it into your context. Supports Dependabot Security Alerts, Secret Scanning Alerts, Code Security Alerts