"Finding MCP Servers with F Security Grades" matching MCP servers:

Zero-key security toolkit for your AI assistant: grade any website's security A+ to F, check if CVEs are actively exploited via CISA KEV and EPSS, and get MITRE ATT&CK defenses explained in plain English. No API keys, no signup.

Security auditor for MCP servers that enumerates tools, resources, and prompts, scans for injection patterns, classifies risk levels, and produces a scored report (0-100, grades A-F).

Provides security tools (prompt injection detection, CVE lookup, version impact assessment) for MCP clients like Claude.

14 atomic MCP tools for AppSec and AI Security engineers: source/schema/prompt audit primitives, JWT inspect, HTTP diff, pentest atoms (default creds, GraphQL introspect, phpggc, interactsh OOB), and a defensive helpers library that fixes the bugs the detectors flag. SARIF output, PyPI Trusted Publishing with Sigstore provenance.

Provides security audit primitives for MCP servers, agent tool schemas, and system prompts, along with pentest utilities like JWT inspection and HTTP diffing.

Security scanning, prompt injection detection, secret leak detection, and agent permission auditing for AI agent workflows.

Integrates Checkov, Semgrep, Bandit, and ASH to provide comprehensive code security analysis for AI coding assistants.

Security scanning for MCP servers from the inside out. Provides runtime inspection, AST-based static analysis, config audit, dependency analysis, and OWASP MCP Top 10 compliance in a single MCP server.

An MCP server that enables AI assistants to analyze Android APK and iOS IPA files for security issues through natural language conversation, including permission auditing, secret detection, and SDK enumeration.

Security for the MCP servers you use: detects tool poisoning, rug pulls, shadowing, secrets and supply-chain risk (OWASP MCP Top 10), with runtime guards and approved-server policy. Runs locally.

Vulnerability intelligence for AI agents that enables CVE lookup, package vulnerability checks, and dependency auditing without API keys.

Enables comprehensive vulnerability scanning using Nuclei scanner with support for single targets, network ranges, and cluster-wide security assessments with customizable severity levels and automated scheduling.

Unified MCP server integrating NIST and OWASP security frameworks with live vulnerability data, enabling security searches, compliance mapping, threat modeling, and checklist generation.

Enables auditing a Supabase project's security beyond the dashboard's Security Advisor, checking anonymous access, RLS policies, and cross-tenant data leaks via read-only probes and a two-account test.

Enables AI agents and developers to audit any URL or domain for seven critical OWASP HTTP security headers, returning an A+ to F grade plus actionable Nginx, Apache, Caddy, and Cloudflare remediation snippets. It also probes /.well-known/security.txt and /security.txt to surface responsible vulnerability disclosure contacts, bug bounty scopes, and PGP keys.

Comprehensive DNS security toolkit for AI agents: 103 tools across 13 categories including DNSSEC validation, subdomain takeover detection, email security audit, and more, all running locally with no external API calls required.

MCP server for Appwrite security audits that scans permissions and provides structured fix proposals, with active live leak confirmation via anonymous fetch.

Enables evolving scan and policy configurations by inferring security phenotypes from observed findings, seeding competing genomes, measuring fitness, and generating bounded trial plans with ancestry lineage.

Enables AI agents to intercept, inspect, modify, and replay HTTP, WebSocket, TCP, and UDP traffic through mitmproxy, with controlled security constraints and process isolation.

Enables scanning OpenAPI specifications for security gaps and generating security test checklists for APIs.

Enables unified security workflows with secret scanning, dependency CVE auditing, TLS/SSL inspection, and DNS/SPF/DMARC checks through a single MCP server.

An MCP server that wraps Trivy and Gitleaks to provide file system vulnerability and secret scanning as tools for AI agents, enabling local, free security analysis.

Enables autonomous AI agents and penetration testers to conduct authorized security audits with persistent cross-session memory, zero-trust secret scrubbing, dynamic OWASP/ASVS checklists, and hallucination-free exploit PoC generation from captured traffic.

Audit any MCP server for tool-poisoning, prompt-injection, and data-exfiltration risk before connecting an agent.

Multi-language SAST and AI-powered fuzzing MCP server for Claude Code integration, enabling static and dynamic security analysis of code.

Official Model Context Protocol server exposing static AST security tools (audit_mcp_repository, audit_local_directory) to scan MCP tools for vulnerabilities before connecting them to Claude or Cursor.

Enables AI agents to audit URLs for security headers, generate CSP Level 3 policies, compute SRI hashes, evaluate WCAG 2.2 contrast, and remediate headers.

Enables enterprise MCP security auditing through 12 deterministic no-LLM tools for evidence-gated claims, skill/prompt supply-chain audits, token profiling, and server auth-mode checks.

Enables auditing and monitoring of AI agent MCP tool calls, with behavioral anomaly detection, lab-scoped red-team simulation, and Telegram notifications.

Zero-execution static AST security scanner and vulnerability auditor for MCP servers. Detects Command Injection (CWE-78), Path Traversal (CWE-22), Hardcoded Secrets (CWE-798), and Unauthenticated Transports (CWE-306).