"OSF" matching MCP servers:

Enables scanning Java (Maven) projects for known vulnerabilities via natural language, returning severity-sorted reports with CVSS scores and fix versions.

Supply chain risk scoring for npm, PyPI, and GitHub repos

The server can be utilized for secure development by listing all packages' CVEs, their affected versions and their fix versions.

Living off the Land intelligence for AI agents. GTFOBins, LOLBAS, LOOBins, LOLDrivers, LOLRMM, WADComs, LOLC2 and more — unified into a single MCP server.

Enables agents to prove and verify that a real, unique human performed an action, issuing machine-readable signed credentials with public verification.

MCP server for querying Google's Open Source Vulnerabilities (OSV) database. Enables vulnerability lookups by package, version, commit, or ID using natural language via Pipeworx gateway.

Query OSV.dev for package vulnerabilities, batch-audit dependency lists, and fetch full advisory records via MCP.

A ready-to-deploy MCP server with in-process agent verification via KYA-OS Checkpoint, enabling secure tool access for verified agents.

Enables MCP clients to exchange an MCP-audience token for a Microsoft Graph token and call Graph as the signed-in user, with tools for identity verification and recent mail access.

Enables comprehensive NIST Cybersecurity Framework 2.0 assessments with 40+ MCP tools for maturity scoring, gap analysis, implementation planning, risk assessment, and executive reporting across 740 security questions.

Security-focused MCP adapter that combines read-only DataHub metadata with a reviewed OKF-derived policy IR to execute closed, typed SQL queries against synthetic PostgreSQL data.

Visual CVE audit dashboard for npm, Python, Go, and Rust projects. Scans your project manifests (package-lock.json, requirements.txt, go.sum, Cargo.lock) against OSV.dev live data, opens a browser dashboard for human review, then applies fixes only after explicit confirmation. Supports multi-service monorepos in one command.

Provides AI ingress governance by masking prompts, classifying risk, and enforcing tool policies before agent calls reach model providers or sandboxes.

MCP server for verifying high-impact decisions with Trust OS.

Connects AI assistants to VulnCheck vulnerability intelligence for querying CVEs, exploits, advisories, and vulnerable packages via natural language.

A personal agent control harness that governs AI agents by checking every consequential action against user-defined rules, logging all actions to a tamper-evident audit chain, and providing a global kill switch. It runs as an MCP server sidecar to coding agents or standalone, keeping users in charge of what their agents can do.

Open-source MCP servers that give AI agents structured access to networking standards, device databases, and security data.

Enables assessing and comparing domains for email spoofing risk by evaluating SPF, DMARC, MX, and DKIM records from public DNS, providing A-F grades and concrete remediation steps.

Enables AI agents to conduct authorized penetration tests by providing scope-enforced access to Metasploit Framework's RPC, with tools for reconnaissance, exploitation, session management, and post-exploitation.

Governance kernel for AI agents — policy enforcement, code safety verification, multi-model hallucination detection (CMVK), trust attestation (IATP), and immutable audit trails. Works with Claude Desktop, Cursor, and any MCP client.