Skip to main content
Glama
78,745 servers. Updated

Matching MCP tools:

Matching MCP Connectors:

"Free and open-source coding assistants" matching MCP servers:

  • PenTest MCP

    omamishra8051-source
    A
    license
    C
    quality
    C
    maintenance
    AI-powered security scanning MCP server that exposes 25+ professional tools, enabling penetration testing and security assessments through natural language interaction with AI agents like Claude Desktop.
    31
    MIT

  • Zfuzz

    Zfuzz-dev
    A
    license
    Not graded
    quality
    A
    maintenance
    Real security scanners for AI coding agents — SAST (441 rules), secret detection (419+ patterns), dependency CVEs (OSV.dev), MCP/skill vetting, MITRE ATT&CK. Open-source, Rust, free
    18
    Apache 2.0

  • Dechonet MCP

    node-man
    A
    license
    A
    quality
    A
    maintenance
    Domain security reconnaissance for AI agents — 13 tools (DNS+DNSSEC, SSL/TLS, HTTP security headers, SPF/DKIM/DMARC email auth, port scan, ASN, RDAP/WHOIS) plus a one-shot security_scan returning a 0–100 Health Score (A–F). Free, no API key.
    13
    51
    1
    MIT

  • solidit-mcp-server

    HBlackfoxx
    A
    license
    A
    quality
    D
    maintenance
    Connects AI assistants to Solodit's 49,000+ blockchain vulnerability database, enabling search, browse, and lookup of audit findings directly from your AI workflow.
    4
    MIT

  • web-exposure-mcp

    Perufitlife
    A
    license
    A
    quality
    C
    maintenance
    An MCP server that lets an AI agent probe a live URL and confirm whether sensitive files (e.g., .git, .env, source maps) are genuinely served by fetching and validating the content, avoiding false positives.
    2
    9
    1
    MIT

  • vibecheck

    ArisRhiannon
    A
    license
    A
    quality
    B
    maintenance
    Agent-native "safe to ship?" security gate for AI-generated code. Uses real parsers and inter-rocedural taint analysis (JS/TS, Python, Go) to flag the classes AI coding agents get wrong — secrets, SQL injection, SS, SSRF, path traversal, command injection, weak JWT/CORS — and ranks findings by confidence. Exposes a scan tool over MCP.
    1
    6
    2
    MIT
  • Polygraph by polygraphso

    Polygraphofficial

    polygraphso
    A
    license
    A
    quality
    A
    maintenance
    Open behavioral litmus for MCP servers — grades A–F across tool-output injection, egress, sensitive-data, and adversarial-input, with reproducible, content-addressed evidence. Tools: run_litmus, verify_attestation.
    4
    157
    7
    Apache 2.0

  • mcp-security-toolkit

    x0base
    A
    license
    A
    quality
    C
    maintenance
    14 atomic MCP tools for AppSec and AI Security engineers: source/schema/prompt audit primitives, JWT inspect, HTTP diff, pentest atoms (default creds, GraphQL introspect, phpggc, interactsh OOB), and a defensive helpers library that fixes the bugs the detectors flag. SARIF output, PyPI Trusted Publishing with Sigstore provenance.
    14
    MIT

  • Voraxx MCP Server

    bharat3645
    A
    license
    A
    quality
    C
    maintenance
    A minimal, dependency-free MCP server that gives AI agents three real, read-only security-orchestration tools: cve_lookup, shodan_host_lookup, and nuclei_scan.
    3
    MIT

  • rizin-mcp

    kd992102
    A
    license
    A
    quality
    A
    maintenance
    MCP server integrating Rizin reverse engineering, RzGhidra decompiler, and capa for binary analysis, enabling LLMs to open binaries, identify capabilities, extract function addresses, and decompile to C pseudocode.
    10
    MIT

  • GhostFree

    shane-js
    A
    license
    A
    quality
    B
    maintenance
    A local MCP server that scans repository dependencies for known vulnerabilities (CVEs) using OSV.dev, enriches findings with NVD and CISA KEV data, and supports triage, remediation, and accepted risk management directly from an AI coding assistant.
    6
    27
    1
    MIT

  • AynOps

    AynOps
    A
    license
    A
    quality
    A
    maintenance
    CyberSecurity MCP Server extends Claude with real-time cybersecurity reconnaissance capabilities that Claude doesn't have by default. Instead of manually running 5 different tools across different terminals, just tell Claude "analyze google.com" and get a complete security breakdown instantly. Tools included: * WHOIS Lookup — registrar, ownership, creation/expiry dates * DNS Enumeration — A,
    8
    22
    MIT

  • @arcwall/mcp-server

    rom-baro
    A
    license
    A
    quality
    D
    maintenance
    Security scanning for AI coding tools (Claude Code, Cursor, Windsurf) including secrets detection, MCP config vulnerabilities, agent instruction checks, threat modeling, prompt injection testing, pre-commit security checks, and dependency vulnerability scanning.
    7
    55
    1
    MIT

  • PatchPilot MCP

    ProduktEntdecker
    F
    license
    A
    quality
    C
    maintenance
    Security scanner for vibe coders that checks npm packages for known vulnerabilities before installation, integrating with AI coding tools like Claude Code and Cursor.
    1

  • novelty

    GOJO-SENPA1
    A
    license
    A
    quality
    B
    maintenance
    An MCP security toolkit that integrates Burp-style HTTP proxying, AI-driven vulnerability hunting, source code auditing, and reporting into AI coding agents, enabling authorized security testing of web applications and source code.
    24
    MIT

  • agent-security-scanner-mcp

    sinewaveai
    A
    license
    A
    quality
    A
    maintenance
    A security scanner for AI coding agents and autonomous assistants that scans code for vulnerabilities, detects hallucinated packages, blocks prompt injection, and provides LLM-powered semantic code review via MCP or CLI.
    22
    1,309
    121
    MIT