"How to review merge requests in GitLab" matching MCP servers:

An MCP server that enables Claude agents to interactively merge security audit findings by grouping duplicates, selecting canonicals, preserving authorship, and generating edit instructions, all against a GitHub issues repository.

Enables sandboxed agents to use a GitLab instance's own MCP tools by forwarding their requests to GitLab's official MCP endpoint and adding the GitLab token server-side. The client never holds a GitLab token, and the available tools follow the GitLab version itself.

Enables automated pull request review, security vulnerability analysis, and code quality improvement suggestions through any MCP client.

Comprehensive MCP server for analyzing GitHub pull requests, detecting security vulnerabilities, assessing code quality, and providing risk ratings across multiple languages.

An MCP server that sends plain-text Gmail messages only to a predefined allowlist, using generated recipient IDs instead of email addresses to enforce security.

Enables authorized web/API security analysis as a stateful, multi-stage workflow with persistent session state, human-controlled validation, candidate versus confirmed finding tracking, and stop conditions.

Panel Review is the guardian agent for AI's highest-stakes coding decisions. Before an agent's riskiest designs, diffs, or commits ship, four frontier models, from OpenAI, Anthropic, Google, and xAI, argue them through and return severity-tagged findings, with review gates the agent cannot silently skip.

Enables auditing product review streams for review-velocity clustering, sentiment dissonance, repetitive incentivized phrases, and review hijacking. Produces adjusted authentic ratings and authenticity indexes for e-commerce products.

Blocks AI coding assistants from installing non-existent packages and accessing non-existent files.

Authentik MCP provides seamless integration with Authentik's API, supporting both full-featured and diagnostic modes. These enable secure, automated user, group, and system management through MCP-compatible tools.

Enables autonomous agents and MCP-compatible clients to enforce policy-approved actions using risk tiers, reversible checkpoints, and token approval bounds.

Local MCP server that scans code for security issues (secrets, dependencies, configurations, risky patterns) and integrates with GitHub Copilot in VS Code for automated pre-commit reviews.

An MCP authorization server implementing OAuth2/OIDC flows, supporting dynamic client registration, PKCE, consent screens, and client ID metadata documents for MCP authorization.

Enables comprehensive security vulnerability scanning and code quality analysis for Python applications. Provides detailed reports with scoring, actionable suggestions, and comparison tracking specifically designed for backend developers working with frameworks like Django, Flask, and FastAPI.

MCP server for ai-scanner that enables AI agents to scan codebases for LLM usage, AI frameworks, and exposed secrets.

Enables Claude to list Iceberg tables and run read-only DuckDB SQL queries, including time travel by snapshot, with per-caller token authentication and audit logging.

Routes web requests from AI tools through Tor for anonymized fetching, with selective per-URL routing to bypass Tor-blocking sites.

Drop-in stdio interceptor that gates MCP tools/call requests through a YAML policy (block / require_approval / audit / budget cap) before they reach the real server. The same policy file is reused by @jamjet/claude-code-hook and @jamjet/openai-guardrail, so one rule set covers Claude Desktop, Cursor, OpenAI Agents, and custom clients.

Enables LLMs to make HTTP requests with OAuth2, session cookies, retry logic, and cURL command generation, while providing security features like SSRF protection and TLS enforcement.

Lets AI agents check whether an EVM wallet address carries an EIP-7702 delegation across eight chains (Ethereum, Base, BNB Chain, Arbitrum, OP, Polygon, Gnosis, Unichain) and learn how to obtain a deeper paid report with delegate bytecode heuristics and risk levels. Read-only, never touching private keys or seed phrases.

Visual CVE audit dashboard for npm, Python, Go, and Rust projects. Scans your project manifests (package-lock.json, requirements.txt, go.sum, Cargo.lock) against OSV.dev live data, opens a browser dashboard for human review, then applies fixes only after explicit confirmation. Supports multi-service monorepos in one command.

A hardened, self-hosted MCP server that lets AI agents query and govern an Infraveil control plane in-loop, reading state and filing deploy/remediation requests that require human approval.

Registers a set of inert, tempting decoy tools with any MCP-capable client so that any call from a hijacked or prompt-injected agent instantly raises an alert with full attack context and a per-call trace token. Also plants worthless canary tokens in honeypot files that trigger zero-false-positive leak alerts when they surface in agent output, files, or outbound requests.

Enables passive security scanning of HAR files from QA test automation to detect missing security headers, insecure cookies, CORS misconfigurations, and leaked secrets, without making any live requests.

Investigate fraud directly from Claude, Cursor, or any MCP-compatible client. Analyze suspicious activity with clear, evidence-backed verdicts. Pivot from a single signup to every account sharing the same device, IP address, or email inbox. Check entities against a cross-operator abuse network, review linked accounts, and efficiently process your fraud review queue. Read-only by default, with no r

Enumerates everything in a code checkout addressed to an AI agent, including instruction files, hook commands, declared MCP servers, and skills/subagents, so you can review what your agent will actually follow.

Enables AI assistants to scan multiple services and local filesystems for leaked secrets using n0s1 secret-scanning capabilities.

Enables agents to discover, compare, and install other MCP servers using natural language tasks, backed by a searchable index of thousands of servers.

Enables MCP hosts to recall verified compliant tool-call arguments before acting and calibrate calls against live policy as native tools, with locally signed requests.

MCP server for TurboPentest — run AI-powered penetration tests and review findings from your coding assistant.