"A list of all MCP items" matching MCP servers:

Enables MCP clients to triage SOC alerts while enforcing a trust firewall across retrieval, memory, and privileged actions. It exposes tools for alerts, logs, memory, and alert actions, with defenses that refuse risky operations in the presence of attacker-controllable content.

An MCP server that manages a TODO list with user authentication via Stytch, enabling AI agents to interact with a full-stack application.

Enables AI agents to call tools through a security gateway that intercepts requests, enforces deterministic policy and risk checks, blocks or escalates high-risk actions for human approval, and keeps tool credentials and audit logs protected.

MCP server that acts as an adapter to a shopping list web application, using OAuth 2.1 with Keycloak for secure authorization.

Provides email validation and domain configuration auditing tools for AI assistants, enabling single address checks, bulk list cleaning, SPF verification, and full mail setup grading (A-F) with actionable fixes.

Supply-chain gate for AI agent skills and MCP servers: poison-scan tool definitions, hash-pin the vetted set into a lock file and verify drift in CI. truecopy-mcp is a drop-in stdio proxy that filters a live server's tools/list down to its pinned, unmodified, unpoisoned tools.

An MCP server that reads a file's embedded C2PA Content Credential to report whether it declares AI generation or a real-world capture, and checks whether that declaration's signature still verifies against the file's current bytes.

Enables AI agents to screen business partners against EU/US/HADDEX sanctions and PEP lists, and maintain the easycompliance daily monitoring list.

Agent-readable feed of AI and agent tech news (framework releases, security advisories, compliance deadlines, classified hourly) and upcoming live events. Read anonymously; post items with a free API key.

An MCP server that lets LLM agents operate the IDnow Trust Platform sandbox to list verification flows, create sessions, check sessions, and get session details.

Enables scanning diffs or code blobs for leaked secrets, returning a verdict with severity and masked findings, all processed locally with no data sent externally.

Enables auditing any domain's email deliverability and DNS health, including SPF, DKIM, DMARC, MX, mail provider, DNS blacklist status, catch-all, domain age, and a deliverability score.

AI Bill of Materials compliance tracking and SBOM generation for AI/ML systems

Enables passive security scanning of HAR files from QA test automation to detect missing security headers, insecure cookies, CORS misconfigurations, and leaked secrets, without making any live requests.

A read-only MCP server that provides tools to read, list, and inspect secrets from HashiCorp Vault's KV secrets engine (versions 1 and 2) using a Vault token.

Enables users to search and retrieve CVE records, CVE history, CPE Dictionary entries, and CPE match criteria through MCP tools, with local caching, pagination, and upstream rate-limit handling.

An MCP server that exposes macOS-native device trust signals — the facts about a Mac that cannot be gathered from a Linux container or a cloud runner. All tools are strictly read-only.

Enables recognition and defense against covert influence patterns (Milton Model) and generation of hypnotic language patterns, with a defensive spine to prevent manipulation.

Answer CTRLRun approvals from your assistant: list the agent actions waiting on a human, inspect one action's full history, and approve, deny or resolve it, plus read receipts, effects and stats. Reads answer without a credential; the three write tools refuse without one that names a person.

MCP server for the Nextcloud Passwords app, enabling reading and managing password entries (list, search, create, update, delete) with strong security guarantees.

Mandatory human approval gate for autonomous AI agents. Before any critical, irreversible, or financially significant action executes — file deletion, production deployment, financial transaction — the agent calls oracle_validate. A human receives a real-time Telegram notification with full context and taps Approve or Reject. The agent waits for the decision before proceeding.

Read-only attack-path tools for cloud and Kubernetes: list the reachable routes from internet exposure to sensitive assets, explain each hop and the evidence behind it, and simulate a fix before recommending it. Connects to a running PerspectiveGraph engine.

A blast-radius auditor for AI agents that computes combined effective permissions across all connected MCP tools, detects dangerous capability combinations deterministically, and provides a live risk graph and one-click policy fixes.

Zero-knowledge proof generation MCP server. AI agents can prove identity claims (Coinbase KYC, Country, Google OIDC, Google Workspace, Microsoft 365) without revealing personal data. Runs in AWS Nitro Enclave TEE with x402 USDC payments.

OS keychain secrets for AI coding agents, over MCP. Anchors credentials to the native vault (macOS Keychain, Linux Secret Service, Windows Credential Vault) and exposes them through 44 policy-governed tools: per-environment values, TTL, linked rotation, encrypted transfer bundles, redacted exec, and a tamper-evident audit log. Local-first, no cloud account.

Enables LLMs to safely query databases through a secure gateway that masks PII, enforces role-based table access, rate limits requests, and logs all queries, with Prisma support.

Provides structured access to the full NIST cybersecurity catalog, including SP 800/1800 publications, security controls, CSF 2.0, and the NVD database. It enables AI assistants to search and retrieve cybersecurity standards, CVEs, and compliance guidance directly from a local SQLite index.

Scans prompts for PII and masks or redacts sensitive data locally before sending to an LLM, supporting multiple anonymization modes.

Enables MCP-capable assistants to run read-only AI governance inventory checks, assemble Decision Packs, and validate signed Agent Trust Passports against pinned upstream tooling, returning every result as non-authorizing with authority_effect NONE.

Screens person, company, vessel and aircraft names against the U.S. Treasury OFAC SDN sanctions list and explains every potential match: name-part scores, aliases, and date-of-birth or country conflicts. Runs locally with no API key; names never leave your machine.