"Free tools for file management, project structuring, planning, and coding" matching MCP servers:

Scans code for exposed secrets, API keys, tokens, and credentials across 69 patterns covering cloud services, AI platforms, payment providers, authentication services, and databases.

Enables AI assistants to list directories, read, write, and search files within a locked root directory, using resolve-then-validate path checks, size caps, and binary detection to prevent sandbox escapes.

Enables MCP clients to inspect, back up, restore-plan, and safely manage Discord guilds with local-only stdio operation, confirmation and audit reasons, and guarded mutations requiring backups for high-impact changes.

Lets the owner of a Zetrix agentic wallet read, preflight and change that wallet's spending policy from their own agent, including deploying, updating and removing policies. Any change that loosens the policy is routed to an owner approval prompt before anything is paid or altered.

Security scanner for MCP servers and AI-generated code. Detects leaked API keys, PII, prompt injection, and MCP misconfigs with A-F security grades.

MCP server for managing devices via JAMF Pro and Microsoft Intune APIs, enabling AI assistants to query and control device management tasks.

Provides a human-in-the-loop security layer for AI agents by intercepting file operations, explaining them with a local LLM, and enforcing a deterministic policy that requires user approval for risky actions.

Enables AI agents to safely read, write, and search files within a whitelisted sandbox directory, rejecting any attempts to escape the sandbox.

Enables safe file system operations including reading, writing, updating, and deleting files with built-in security safeguards, automatic backups, and comprehensive error handling. Provides directory listing, file metadata extraction, and protects against operations on system-critical paths.

Enables role-based order management operations such as viewing orders, checking refund eligibility, issuing refunds, deleting orders, and managing users through MCP tools with audit logging and permission checks.

Enables AI agents to safely interact with Supabase through read-only and gated-write tools, with bounded queries, allowlists, and explicit project targeting.

Enables agents to securely stage, validate, and submit binary data for on-premises storage, then list, inspect, process via registered server-side processors, and token-guarded delete those assets using opaque identifiers. Upload bytes travel over a separate data plane rather than through MCP JSON, with staging, validation, and prepare/apply/verify flows enforced throughout.

MCP server that enforces role-based access control for order management, allowing users to view, refund, or delete orders based on their role (USER, MANAGER, ADMIN) with a JWT-authenticated FastAPI frontend.

An MCP server that exposes 43 domain tools behind 4 meta-tools, applying guardrails such as budgets, rate limits, schema validation, human-in-the-loop confirmation for mutations, PII redaction, and an append-only audit log while reducing context window usage.

Enables AI agents to inspect any public domain’s web technology stack, email deliverability and DNS health (MX, SPF, DKIM, DMARC, MTA-STS, TLS-RPT, BIMI), and HTTPS security posture with typed JSON scores and remediation-ready findings, plus history, bulk checks, monitoring alerts, and reverse technology lookups.

Post-quantum readiness for AI coding agents: scans code for quantum-vulnerable cryptography (RSA/ECDH/ECDSA/DH) and returns NIST ML-KEM/ML-DSA/SLH-DSA (and hybrid) migration guidance, with fix verification and dependency checks. Content-based, advisory tools only; runs local (npx @quantakrypto/mcp) or as a hosted OAuth endpoint.

Enables AI agents to pay per call for live package-safety and GitHub merge-readiness trust signals via the x402 protocol.

Community MCP server for the Cymulate security validation platform. It exposes the full Cymulate REST API (337 endpoints) as 106 semantic tools for BAS, exposure validation, attack surface management, and platform administration.

Enables MCP clients to use paid tools for secret scanning, agent-config auditing, and OG image rendering, with payments handled over the x402 protocol on Base.

Enables MCP clients to run local scans for known AI coding-assistant backdoor indicators and risky Claude Code/MCP configuration patterns, returning findings directly in chat.

Enables scanning projects for dependency vulnerabilities, secrets, license conflicts, code quality, and git health, returning a 0-100 health score with actionable suggestions.

Presents a plausible, tool-rich workspace surface — file reading, credential listing, command execution, database queries, and configuration retrieval — that returns only synthetic results while logging every connection, tool call, and argument received. It enables researchers to measure what MCP clients and agents actually do when handed dangerous-sounding tools, including whether they follow injected instructions or complete a retrieve-then-use credential chain.

Enables AI agents to perform common utility tasks through a streamable HTTP MCP endpoint, including JSON inspection, regex testing, cron parsing, hashing, base64 encoding/decoding, URL analysis, color conversion, text diffing, CSV parsing, JWT decode/verification, Markdown-to-HTML rendering, and UUID/token generation without API keys.

Provides 9 utility APIs for AI agents covering DNS, email, IP, QR, WHOIS, URL health, headers, text extraction, and tech detection, with x402 micropayments on Base.

Enables MCP clients to manage files in an isolated workspace and perform lightweight Git operations through a protected Streamable HTTP endpoint, including listing, reading, writing, searching, replacing, and deleting files plus checking status and diffs.

Enables role-based order management through MCP tools, allowing users to view and refund orders according to their permissions (USER, MANAGER, ADMIN) with audit logging and JWT authentication handled by a FastAPI client.

Enables AI agents to run passive, boundary, and gated active reconnaissance and web-security CLI tools (nmap, sqlmap, commix, httpx, ffuf, nikto, subfinder, and more) against authorized targets through a persistent, API-key-protected HTTP service. Scope gates, authorization windows, evidence capture, and a full audit trail are enforced in code so every tool call stays within the engagement's declared rules.

Site, email and agent safety — SPF/DKIM/DMARC, AI/SEO audit, page-change monitor, free hidden-AI scanner (4 MCP tools).

Two-way Burp Suite MCP bridge enabling AI agents to capture traffic, analyze endpoints, queue scans, and send findings back to Burp.

Provides AI assistants with specialized tools to interact with NIST's Open Security Controls Assessment Language (OSCAL) framework. It enables agents to retrieve schemas, explore models, and generate valid OSCAL documentation for security compliance automation.