"The concept of thinking or introspection" matching MCP servers:

Autonomous M2M compliance and trust APIs for AI agents (KYB, OFAC, VAT, Sanctions checking).

Supply chain risk scoring for npm, PyPI, and GitHub repos

A local MCP daemon that turns an agentic coding client into a bug bounty operator, with 103 tools for offensive security testing including MITM proxy, traffic analysis, and OOB callbacks.

Enables AI coding agents to run one-shot commands and copy single files to and from remote servers through The Bastion, which authenticates, authorizes, and records each action. Access is controlled by the bastion rather than allowlists or deny lists.

Enables AI assistants to perform password security auditing using John the Ripper on a remote Kali system via SSH, supporting cracking, hash management, and session control.

the-real-unifi-mcp License: MIT Node MCP SDK [![CI](https://github.com/mguttmann/the-real-unifi-mcp/actions

Enterprise-grade code intelligence server for AI assistants that analyzes codebases for due diligence, tech debt, security vulnerabilities, and code quality.

Enables agents to prove and verify that a real, unique human performed an action, issuing machine-readable signed credentials with public verification.

Local stdio MCP server for Bitwarden (Public API + Secrets Manager). 50+ admin tools for members, groups, collections, policies, licensing, projects, and secrets. For Claude Desktop / Claude Code.

Living off the Land intelligence for AI agents. GTFOBins, LOLBAS, LOOBins, LOLDrivers, LOLRMM, WADComs, LOLC2 and more — unified into a single MCP server.

Enables authorized web/API security analysis as a stateful, multi-stage workflow with persistent session state, human-controlled validation, candidate versus confirmed finding tracking, and stop conditions.

A verifying MCP gateway that pins approved tool manifests and skill files to content addresses, blocking tampered descriptions before they reach model context.

Enables MCP clients to exchange an MCP-audience token for a Microsoft Graph token and call Graph as the signed-in user, with tools for identity verification and recent mail access.

Enables autonomous agents and MCP-compatible clients to enforce policy-approved actions using risk tiers, reversible checkpoints, and token approval bounds.

Enables agents to audit and safeguard repositories by detecting dependency pinning issues, license compliance problems, hardcoded secrets, and dead code through MCP tools.

MCP server for AI agent identity — verify agents with Ed25519 signatures, check trust scores, sign and verify content, exchange encrypted messages. Built on the Agent Identity Protocol (AIP).

Enables users to query BloodHound Active Directory graph data using natural language, finding attack paths, Kerberoastable accounts, and other AD security insights.

Validates AGENTS.md files against the cross-vendor coding-agent spec, detecting security smells and consistency issues.

Enables AI agents to scan, redact, and govern sensitive data before sending it to external tools through DLP, secure chat, and shadow AI discovery tools.

A production-shaped starter for putting an MCP server in front of an existing app, with OAuth and enterprise SSO handled through Clerk, enabling AI assistants to act on your product on behalf of logged-in users.

A local gate that lets agents submit risky tool actions for policy evaluation and receive ALLOW, DENY, or REQUIRE_APPROVE decisions before executing irreversible side effects. It can also open human approval holds and record an activity trail without executing the side effect itself.

Enables AI agents to inspect git working trees and history for exposed credentials without letting raw secrets reach the model, with false-positive filtering, baseline support, and remediation guidance.

Enables an AI agent to check whether a site is healthy and configured correctly by reading TLS certificates and classifying handshake failures, resolving DNS records from raw wire packets, tracing HTTP redirects and timings, and grading security headers with exact fixes. Every connection passes through an SSRF guard that vets and pins addresses so the agent cannot be aimed at internal networks.

MCP server for children's privacy compliance, enabling checks under COPPA, FERPA, UK Age Appropriate Design Code, and EU AI Act provisions for minors.

Enables scanning of Claude Code skills, plugins, or MCP servers for malware before installation via static analysis.

MCP server for offline verification of signed artifacts — receipts, manifests, and audit bundles. MIT licensed, works without accounts or API calls. Tools: self_test, verify_receipt, verify_bundle, explain_artifact.

Enables AI-powered analysis of Rapid7 vulnerability and asset data by exporting via the Bulk Export API and making it queryable through natural language or SQL in MCP-compatible tools.

Gemmein is the backend for AI-powered products: sign-in, data under seven access rules, AI tools priced in credits, and payments through Stripe, a relay, or RevenueCat. The @gemmein/mcp server gives a coding agent that whole contract as tools: the builder guide, the SDK reference, doc search, rule and error explainers, and check_integration, a live check of an app's access boundaries.

MCP proxy that puts a deterministic gateway in front of any MCP server. Every critical tool argument (payee, amount, recipients) must resolve against a signed mandate or the user's own registries before a Cedar policy decides; step-ups are confirmed by the user through MCP elicitation, and every decision is a hash-chained receipt.

Privacy layer for healthcare AI agents. Pseudonymises patient identifiers (NHS numbers, names, dates of birth, addresses; UK and US) into labelled tokens locally before text reaches an agent, then restores the originals afterwards, keeping the token map out of agent context.