"OWASP" matching MCP servers:

Enables querying OWASP security standards, including Top 10 lists for web, API, LLM, and mobile, ASVS 5.0 verification requirements, and defensive cheat sheets via MCP tools or plain-language questions.

OWASP Agentic - MCP server providing AI-powered tools and automation by MEOK AI Labs

MCP server exposing the OWASP Web Security Testing Guide via semantic search and knowledge graph traversal.

A WebSocket-based MCP server for OWASP ZAP security scanning, enabling real-time control and monitoring of security assessments.

Passive security scanner that audits a running MCP server against the OWASP MCP Top 10 and grades it A-F. Read-only static analysis of the advertised tools, prompts and resources with console/JSON/SARIF output, and it also runs as an MCP server itself.

Enables AI assistants to drive OWASP ZAP for authorized penetration testing and bug-bounty workflows, including authenticated scans and vulnerability triage through 67 curated safety-gated tools.

Read-only MCP server for precise lookup, search, and versioned retrieval of OWASP testing guides (WSTG, MASTG, ISTG, AITG) with full provenance on every result.

Enables AI coding agents to search a security corpus, scan Terraform plan JSON for cited findings, and list sources via MCP tools grounded in CIS AWS Foundations and OWASP Top 10 CI/CD risks.

Enables AI models to search and retrieve offline security knowledge from over 20 curated sources including HackTricks, PayloadsAllTheThings, and OWASP guides, via the Model Context Protocol.

Security for the MCP servers you use: detects tool poisoning, rug pulls, shadowing, secrets and supply-chain risk (OWASP MCP Top 10), with runtime guards and approved-server policy. Runs locally.

Enables Claude to scan a website's HTTP security headers and receive an A–F grade against OWASP best practices, including per-header pass/warn/fail results and copy-paste fixes for missing headers.

Security scanning for MCP servers from the inside out. Provides runtime inspection, AST-based static analysis, config audit, dependency analysis, and OWASP MCP Top 10 compliance in a single MCP server.

Bawbel MCP Server lets any agent scan MCP servers and skill files for security vulnerabilities mid-conversation. Seven tools covering server-card scanning, conformance scoring, rug pull detection, and AVE threat intelligence queries. Powered by the AVE standard with OWASP MCP Top 10 mapping on every finding. Free, Apache 2.0, no API key required.

Unified MCP server integrating NIST and OWASP security frameworks with live vulnerability data, enabling security searches, compliance mapping, threat modeling, and checklist generation.

Safe, self-hosted OWASP ZAP operator for guided AI security scans, findings, and reports. Requires a separately running OWASP ZAP daemon.

Enables guided security evaluation of a virtual lab machine, including network scanning, HTTP/TLS analysis, OWASP Top 10 assessment, and Markdown report generation, without performing exploitation.

Enables asynchronous OWASP Dependency-Check vulnerability scanning of allowlisted repositories via three narrow tools for starting scans, checking status, and retrieving structured findings.

Enterprise-grade zero-dependency security shield and runtime governance engine for MCP servers, providing OWASP MCP Top 10 audits, cryptographic tool call signing, AIBOM generation, and inline parameter firewall protection.

Provides AI agents with structured access to the OWASP Bug Logging Tool (BLT) ecosystem for logging bugs, triaging issues, and managing security workflows. It enables actions like submitting vulnerabilities, tracking contributor leaderboards, and awarding gamified bacon points through a unified interface.

Automated security red-team for any MCP server that scans manifests against OWASP LLM Top 10 and MCP-specific risks, returning a 0-100 hardening score and HMAC-signed report.