"CodeQL for Code Auditing" matching MCP servers:

Wraps the CodeQL Language Server Protocol to enable LLM agents to write CodeQL queries with intelligent code completion, hover information, and other language features.

Enables AI-assisted development of CodeQL queries for security analysis through the Model Context Protocol. Provides tools for compiling, testing, and executing CodeQL queries across multiple programming languages.

AI-powered security code review for Claude Code that runs multiple scanners (CodeQL, Semgrep, etc.) to detect vulnerabilities, secrets, and dependency CVEs, producing prioritized reports.

Enterprise-grade code intelligence server for AI assistants that analyzes codebases for due diligence, tech debt, security vulnerabilities, and code quality.

Enables AI agents to interact with Fortinet FortiManager through a minimal MCP interface using sandboxed JavaScript for querying the API spec and executing JSON-RPC calls.

Aziel Runtime is a node-meshed MCP software orchestration suite for digital forensics, auditing, provenance, research, intelligence-support, and secure agent workflows, with a single gated execution path, compartmentalized engines, verifiable receipts, temporal integrity, and explicit capability refusal. It is not merely an API aggregator or generic tool router.

Routes web requests from AI tools through Tor for anonymized fetching, with selective per-URL routing to bypass Tor-blocking sites.

Provides email validation and domain configuration auditing tools for AI assistants, enabling single address checks, bulk list cleaning, SPF verification, and full mail setup grading (A-F) with actionable fixes.

Enables auditing emails for internal contradictions and reporting detected incoherences with literal textual evidence, without issuing a phishing verdict.

Scans code strings for hardcoded secrets (AWS keys, tokens, private keys, etc.) and returns redacted findings, helping AI coding agents catch secrets before writing or committing code.

Security analysis for Python codebases through the guard-core engine: SecurityConfig validation that catches keys pydantic silently drops, docs search over the vendored corpus, live detection probing, and verified setup guidance for Python, Typescript, Rust, PHP and Go adapters.

PCI DSS v4.0.1 compliance scanner for Go payment services, delivered as an MCP server. Every finding maps to a specific PCI DSS requirement ID. Taint-aware cardholder data flow analysis with PCI SSC FAQ semantics, designed to complement broad SAST tools like Semgrep and CodeQL - not replace them.

Enables auditing any domain's email deliverability and DNS health, including SPF, DKIM, DMARC, MX, mail provider, DNS blacklist status, catch-all, domain age, and a deliverability score.

MCP server for auditing infrastructure-as-code attack paths, finding multi-hop chains from public internet to sensitive resources.

Read selected local folders from ChatGPT on macOS, with per-folder read-only or read-write access and hash-checked, recoverable edits. Requires local installation and a private ChatGPT app. The Glama container is a synthetic evaluation demo; it does not connect to files on your Mac.

MCP security server with 7 tools: command safety check, prompt injection detection (32+ rules, zh+en), PII/sensitive data scanning, file path protection, tool policy enforcement, response auditing, and security status. 8-layer defense, zero dependencies.

VS Code Extension & Model Context Protocol Suite Orchestrator for Cursor, Claude Desktop, and VS Code IDEs.

Server security auditing (413 checks, 29 categories), production hardening, and fleet management. Supports Hetzner, DigitalOcean, Vultr, and Linode.

Provides access to ODEI's constitutional knowledge graph, AI safety guardrails, and EVM smart contract auditing tools. It enables users to query structured domain nodes, validate agent actions, and perform security audits directly through an MCP client.

Dependency security & health auditing for AI agents with no account or API key required.

Mechanical write gates, evidence receipts, and adversarial review for AI coding agents. Fable Mode enforces a Think → Prove → Attack → Write workflow before an agent earns permission to edit a workspace.

Lightweight Node.js dependency vulnerability audit tool with CLI and MCP Server modes. Supports npm/pnpm, full dependency chain tracing, remote GitHub repo auditing, and generates Markdown/HTML reports.

Analyzes Telerik Fiddler SAZ session archives, enabling AI assistants to inspect, search, and filter HTTP sessions, plus performance and security auditing.

Checks a code repository without running it: Safe, Works and Complete scores with an A-F grade, catching leaked keys, dangerous calls, invented or lookalike packages, broken imports and missing project files. Standard-library Python; MCP tools scan, orphans and explain.

Enables AI assistants to perform cybersecurity tasks including hash analysis, CVE lookup, HTTP header auditing, WHOIS/OSINT, payload decoding, password strength evaluation, and threat report generation.

Encrypted token store for Claude Code sessions, providing MCP tools for secure secret management with macOS Keychain integration, per-project allowlists, and native dialog input.

Enables AI agents to securely manage OneGuard secrets through natural language, including syncing .env files, rotating database passwords, generating and managing vaults and secrets, and auditing team access, without exposing secret values to the model.

Enables local-first scanning of Terraform for security misconfigurations while an AI assistant writes the code, providing fixes and compliance mappings without uploading infrastructure code.

Two-way Burp Suite MCP bridge enabling AI agents to capture traffic, analyze endpoints, queue scans, and send findings back to Burp.

A CLI agent that acts as an MCP hub, enabling discovery, auditing, and governance of MCP servers across AI tools like Claude and Cursor.