"Security" matching MCP servers:

Enables secure interaction between LLMs and MCP tools by applying zero-trust security controls, including sensitive data masking, file system protection, and policy enforcement.

Enables transparent security for any MCP server by intercepting tool calls, blocking prompt injection attempts, masking PII in responses, and writing immutable audit logs.

An MCP server for Security Onion Community Edition that provides 21 read and write tools for SOC operations, including event querying, alert management, detection tuning, PCAP retrieval, and agent enrollment, without requiring a Pro license.

An enterprise-level MCP gateway and proxy that sits between an organization's MCP servers and clients. MCP Manager mitigates security threats, enables fine-grained permissions, enforces policies and guardrails, and generates comprehensive, end-to-end logs.

8 standalone MCP servers for SMBs — Guardrails (prompt injection, PII, secrets detection), FinOps (AI cost tracking and budgets), Observability (agent tracing), Smart Router (17+ models, 9 providers), Trust Score (governance scoring 0-100), Memory (persistent agent memory), ThinkSecure (runtime security + SOC2/GDPR audit), and A2A Lite (agent-to-agent protocol). 37 tools total, TNC credits

Enables security analysts to investigate Microsoft Entra ID security logs through natural language, exposing read-only tools for user context, sign-ins, risky users, risk detections, directory audits, and conditional access policies.

MCP server exposing qbit_manage's Web API as tools, so an LLM can read and manage a qbit_manage instance: run maintenance commands on qBittorrent torrents, manage config files, scheduler, logs, security settings, and system state.

Official MCP server for the openITCOCKPIT monitoring platform: host and service state, check and state history, log entries, downtimes, acknowledgements, software inventory and pending security updates.

An MCP server that enables AI assistants to interact with Tenzir, a data pipeline engine for security operations, including executing pipeline queries, managing OCSF schemas, and generating parsers.

Enables diagnosing web hosting and server issues by running live HTTP, SSL, DNS, and security-header checks alongside a searchable troubleshooting knowledge base.

MCP server that exposes OSSEC HIDS security monitoring capabilities as tools, resources, and prompts for AI assistants.

See which AI agent and MCP server talks to what on Windows, with a rule-based security verdict

DCL Trust Oracle is a deterministic AI audit layer, natively integrated with MCP, that evaluates LLM and agent outputs against configurable policies before and after action. Every verdict is written to a tamper-evident, hash-chained audit log storing only cryptographic metadata — never raw content — enabling privacy-first forensic review.

Analyzes Telerik Fiddler SAZ session archives, enabling AI assistants to inspect, search, and filter HTTP sessions, plus performance and security auditing.

MCP server for AWS infrastructure analysis. Connects to DynamoDB, Lambda, SQS, SNS, Secrets Manager, EventBridge, RDS, PostgreSQL, MongoDB, and CloudWatch — surfaces missing indexes, queue DLQs, Lambda config issues, IaC drift, and security findings for Claude Code and Cursor.

A Linux system monitoring MCP server that provides real-time information on CPU, memory, disk, network, processes, Docker, security, and more via MCP tools.

An MCP server for Microsoft Defender Advanced Hunting that enables AI assistants to investigate security events using natural language by translating queries to KQL and executing them against Defender.

Exposes the Tenable Identity Exposure (TIE) REST API as tools for LLM clients, enabling queries on security profiles, activity timelines, AD objects, and more.

Provides system monitoring tools for VPS including CPU, memory, disk, network ping, top processes, and Docker status, with read-only architecture and security features.

agent-bom is an open security scanner and self-hosted control plane for AI, MCP, and cloud infrastructure. The default scan profile in MCP server mode exposes 8 MCP tools. Additional profiles provide inventory, findings, compliance, graph, and runtime workflows. See the published Glama release for its packaged version.

Gives AI assistants access to F6 XDR alerts, incidents, emails, files, hosts, and audit logs via query-language search, with tools for counting records, inspecting available fields and filters, and marking events.

AI-powered threat intelligence server with real-time alert monitoring and multi-source IOC analysis, enabling security investigations directly in Claude Desktop.

AI-powered MCP server that enables security analysts to query Wazuh SIEM/XDR for alert triage, threat hunting, compliance audits, and incident response through natural language prompts.

Enables natural language queries to Firewalla Gold for read-only network security monitoring, including alarms, devices, traffic flows, and system status via local API.

Aggregates real-time threat intelligence from multiple sources including Feodo Tracker, URLhaus, CISA KEV, and ThreatFox, with IP/hash reputation checking via VirusTotal, AbuseIPDB, and Shodan for comprehensive security monitoring.

An MCP server for Zeek and Suricata, providing intelligent log parsing, querying, and analysis over network security monitoring data.

Enables AI assistants to interact with self-hosted Dynatrace Managed environments to retrieve observability data, security insights, and performance metrics. It allows users to query problems, logs, events, and SLOs through natural language interfaces in both local and remote modes.

Enables MCP-capable clients to monitor and manage Apache Kafka clusters, including topics, partitions, configs, and consumer groups with lag, while enforcing configurable security modes, topic allowlists, protected topics, and audit logging.

A secure, local-first MCP server for read-only inspection and troubleshooting of development environments, exposing narrow, typed, auditable capabilities for repository inspection, log summarization, Docker review, and security scanning without granting unrestricted machine access.

Enables AI agents to check whether Elastic Security detection rules will actually work in an environment by verifying data source, data freshness, field mappings, and alert volume, then filing enable requests. Requests take effect only after a human reviews and approves them, with read-only credentials, tamper checks, and an audit log.