"OWASP" matching MCP servers:

Enables querying OWASP security standards, including Top 10 lists for web, API, LLM, and mobile, ASVS 5.0 verification requirements, and defensive cheat sheets via MCP tools or plain-language questions.

OWASP Agentic - MCP server providing AI-powered tools and automation by MEOK AI Labs

A WebSocket-based MCP server for OWASP ZAP security scanning, enabling real-time control and monitoring of security assessments.

Passive security scanner that audits a running MCP server against the OWASP MCP Top 10 and grades it A-F. Read-only static analysis of the advertised tools, prompts and resources with console/JSON/SARIF output, and it also runs as an MCP server itself.

A minimal Model Context Protocol server that provides access to OWASP security cheat sheets through a simple HTTP API, enabling users to list, retrieve, and search security best practices.

Security for the MCP servers you use: detects tool poisoning, rug pulls, shadowing, secrets and supply-chain risk (OWASP MCP Top 10), with runtime guards and approved-server policy. Runs locally.

Enables AI assistants to monitor, analyze, and configure OWASP ModSecurity CRS via Docker, with tools for overview, drill-down, and rule/IP management.

Enables Claude to scan a website's HTTP security headers and receive an A–F grade against OWASP best practices, including per-header pass/warn/fail results and copy-paste fixes for missing headers.

A Model Context Protocol server that gives AI coding agents 16 tools to secure what they build: install the one-line Nemesis Shield SDK, learn/approve/enforce app protection, put a domain behind a Cloudflare-like edge, guard LLMs (OWASP LLM Top 10), and create + score Omniguard business-logic fraud rules. Runs locally over stdio; the discovery tools work with no account.

Bawbel MCP Server lets any agent scan MCP servers and skill files for security vulnerabilities mid-conversation. Seven tools covering server-card scanning, conformance scoring, rug pull detection, and AVE threat intelligence queries. Powered by the AVE standard with OWASP MCP Top 10 mapping on every finding. Free, Apache 2.0, no API key required.

MCP server that scans Salesforce Agentforce metadata for security vulnerabilities using 61+ SAST rules, integrating into AI coding workflows to guard against OWASP LLM top 10 risks.

Cross-repository code knowledge graph MCP server for Java, Kotlin, JavaScript, and TypeScript. Indexes source code into embedded KuzuDB via tree-sitter and exposes 30+ tools for call-flow tracing, multi-hop taint analysis (OWASP/CWE/PCI/STIG), entry-point reachability filtering, performance hotspot detection, and license compliance — without reading source files. 95% fewer tokens vs source-read

Unified MCP server integrating NIST and OWASP security frameworks with live vulnerability data, enabling security searches, compliance mapping, threat modeling, and checklist generation.

Safe, self-hosted OWASP ZAP operator for guided AI security scans, findings, and reports. Requires a separately running OWASP ZAP daemon.

Provides instant access to authoritative security documentation from organizations like OWASP, NIST, and major cloud providers through natural language semantic search. It enables users to retrieve security best practices, frameworks, and vulnerability information directly from a locally cached knowledge base.

Enables guided security evaluation of a virtual lab machine, including network scanning, HTTP/TLS analysis, OWASP Top 10 assessment, and Markdown report generation, without performing exploitation.

Human-in-the-loop approval gateway for agent tool calls: agents request, policies decide, humans approve via Slack/Discord/web — with an OWASP-LLM-Top-10-tagged audit trail. Self-hostable.

Enterprise-grade zero-dependency security shield and runtime governance engine for MCP servers, providing OWASP MCP Top 10 audits, cryptographic tool call signing, AIBOM generation, and inline parameter firewall protection.

An MCP server that integrates SAST, DAST, and SCA security tools to enable AI-driven vulnerability scanning and automated security reporting. It allows AI assistants to execute and analyze results from tools like Semgrep, OWASP ZAP, and Trivy within a DevSecOps workflow.

Provides AI agents with structured access to the OWASP Bug Logging Tool (BLT) ecosystem for logging bugs, triaging issues, and managing security workflows. It enables actions like submitting vulnerabilities, tracking contributor leaderboards, and awarding gamified bacon points through a unified interface.