"Using Claude to Check the Current Weather Without an API Key" matching MCP servers:

Human-in-the-loop approval: a person approves the exact AI action with a passkey, and any service can check the signed approval offline.

MCP server enabling AI agents to use secrets (API keys, tokens) via encrypted vault, executing HTTP/shell/SSH actions server-side while never exposing secret values to the AI.

Enables AI agents to have planned actions checked before execution and to retrieve signed receipts for past checks, with tools for describing and explaining the ruleset.

Enables AI coding agents to audit Supabase or Postgres databases for Row Level Security and multi-tenant isolation holes, reading tables, grants, policies and functions for static findings and optionally probing those policies inside a rolled-back transaction. It reports each hole with an explanation and a fix, so an agent can verify the migrations it just wrote before declaring them done.

Retired. This MCP wrapper is no longer maintained. Check is now a Claude Code hook: npx @golproductions/check@latest --install. 120 free messages a day. Details: golproductions.com/check

Enables Claude to manage NVIDIA API keys through an OAuth-secured MCP connector, including listing, dispensing, rotating, and revoking keys with RBAC and audit trail.

A local MCP daemon that turns an agentic coding client into a bug bounty operator, with 103 tools for offensive security testing including MITM proxy, traffic analysis, and OOB callbacks.

Enables AI agents to scan directories, container images, and SBOMs for vulnerabilities, look up individual CVEs, and refresh the local vulnerability database. Findings come back prioritized with concrete upgrade targets rather than raw scanner output.

An MCP server that enables interaction with the Firebase App Check API, allowing users to verify and manage the authenticity of requests to Firebase backend services through natural language.

Enables AI coding agents to inspect GitHub repositories and shell commands for download-and-execute payloads, obfuscation, typosquatted dependencies, autorun hooks, and fake-star signals before following or running them.

Lets AI agents check whether an EVM wallet address carries an EIP-7702 delegation across eight chains (Ethereum, Base, BNB Chain, Arbitrum, OP, Polygon, Gnosis, Unichain) and learn how to obtain a deeper paid report with delegate bytecode heuristics and risk levels. Read-only, never touching private keys or seed phrases.

Read-only Supabase RLS check: explains in Arabic which tables anyone can read or change. No keys.

Enables users and AI agents to verify whether a crypto recipient address is an address-poisoning lookalike or has an invalid EIP-55 checksum before sending funds, and provides access to an on-chain history scan for suspicious transfers.

Enables checking whether a crypto link is a phishing lookalike of a wallet, exchange or dapp by comparing it against official domains and flagging lookalike characters, typosquats, punycode and bait words, fully offline. An optional paid full check adds domain registration age, DNS, redirect tracing and a page scan for seed-phrase prompts and drainer code.

Enables production-grade answer verification for LLM agents by independently re-checking answers with a configurable verifier model, enforcing confidence policies, and producing Ed25519-signed, auditable verification results with optional web search and knowledge-base evidence.

Runs a regular expression on real engines — JavaScript (V8), Python (CPython re), PCRE2 and RE2 — reporting each engine's own compile errors with positions, every match with its groups and named groups, replacement results, and where the engines disagree. It also detects catastrophic backtracking (ReDoS), naming the at-risk part of the pattern, generating an attack string, and timing how long each engine actually takes on it.

Enables reviewing GitHub Actions workflows for outdated actions, deprecated Node runtimes, retired runners, deprecated commands, and security risks, with file, line, and fix for each finding.

Enables agents to validate Dockerfiles for build-breaking syntax errors, risky patterns like root users and secrets in ENV/ARG, and cache-order problems, returning every finding with its line and a fix. It also verifies referenced container images against public registries, reporting tag existence, digests to pin, supported platforms, last rebuild time, and end-of-life status with an upgrade tag.

Enables AI agents to check whether a domain loads securely in a browser, including certificate validity and expiry, and to pull public homepage facts such as title, language, CMS, contact emails, phones, and social links. It also searches a small dated local-business index by category and area.

Local stdio MCP server for Bitwarden (Public API + Secrets Manager). 50+ admin tools for members, groups, collections, policies, licensing, projects, and secrets. For Claude Desktop / Claude Code.

An MCP server that detects potential risks in Solana meme tokens, helping AI agents avoid rug pulls and unsafe projects.

Enables users to register a single one-line secret credential (such as a personal access token) that is stored encrypted and scoped to their exact user and persona pair, then let MCP tools retrieve and use that key to call an upstream service. Key names can be listed for status checks, but the secret value itself is only decrypted inside a tool at call time.

MCP server that lets agents check domain email authentication (SPF, DKIM, DMARC, MX) via a free API, returning grades and shareable report URLs. Also provides tools for listing paid services and partner program terms.

Free wallet-OFAC SDN screening and trust-check preview for AI agents on Base. Single MCP tool call returns allow/block verdict against US Treasury OFAC SDN list.

Enables read-only comparison of Stripe active entitlements against an application's effective access snapshots, returning matched, mismatch, or unknown results for agent-driven diagnostics.

Scans repositories for owner identifiers and secrets, blocking pushes or CI merges if any are found.

Enables Claude to run safe, read-only diagnostics against servers and websites — certificate chains and expiry, HTTP status/redirects/security headers, DNS records, email authentication (SPF, DKIM, DMARC, MTA-STS, TLS-RPT) and sitemaps. Every check returns severity-tagged findings with concrete fixes, plus a 0-100 score and A-F grade, without any ability to modify the target.

Encrypted token store for Claude Code sessions, providing MCP tools for secure secret management with macOS Keychain integration, per-project allowlists, and native dialog input.

A comprehensive suite of HTTP and API testing tools that enables AI agents to perform requests, check endpoint health, and decode JWTs. It also provides utilities for URL parsing and detailed security analysis of HTTP response headers.

Enables AI assistants to perform password security auditing using John the Ripper on a remote Kali system via SSH, supporting cracking, hash management, and session control.