"Using MCP and Windsurf to Build Modern Web and Mobile Apps" matching MCP servers:

An MCP server that enables AI assistants to analyze Android APK and iOS IPA files for security issues through natural language conversation, including permission auditing, secret detection, and SDK enumeration.

Enables verifying that recorded build accesses stay within a declared closure by inspecting and verifying hash-only receipts, without executing builds or making network requests.

Validates URLs and checks their reputation to help identify AI hallucinations and verify web page authenticity.

An MCP server that lets an AI agent probe a live URL and confirm whether sensitive files (e.g., .git, .env, source maps) are genuinely served by fetching and validating the content, avoiding false positives.

Enables live website health checks including TLS, HTTPS, and security headers, returning an A-F grade with specific fixes.

A Node.js-based frontend security audit tool that performs comprehensive dependency security audits for both local projects and remote repositories. Generates detailed Markdown reports with vulnerability detection, risk assessment, and fix recommendations.

Enables generating secure passwords, exposing password policies, and providing reusable prompt templates for secure password creation through MCP primitives.

Enables AI agents to audit URLs for security headers, generate CSP Level 3 policies, compute SRI hashes, evaluate WCAG 2.2 contrast, and remediate headers.

A wrapper for mcp-remote that provides secure authentication for protected MCP servers using Adobe IMS or Okta OAuth flows. It features automated token management, validation, and background refreshing for seamless access to remote resources.

Enables AI agents to discover and execute tools via a secure MCP server with JWT authentication, RBAC, rate limiting, and audit logging.

A deployable MCP server template for Cloudflare Workers that provides Google OAuth authentication and comprehensive analytics tracking of tool usage, performance metrics, and user behavior.

Stateless Streamable HTTP MCP endpoint with OAuth 2.1 authentication via Cloudflare Workers, supporting PKCE, DCR, and token introspection.

An MCP server that sends plain-text Gmail messages only to a predefined allowlist, using generated recipient IDs instead of email addresses to enforce security.

Enables AI agents to discover and invoke backend tools over MCP JSON-RPC while enforcing 3-legged OAuth 2.0 identity propagation, role-based access control, and protocol transcoding to REST APIs.

Demonstrates OAuth2/OIDC authentication for MCP servers using Asgardeo, with JWT validation and a sample weather tool to showcase secured API access.

Implements a secure MCP server with API Key and JWT authentication, providing tools like echo, login, secure_action, and admin_action. Includes MCP Inspector integration for testing and debugging.

Connects AI coding assistants to Snyk API & Web for onboarding scan targets, configuring authentication, running DAST scans, and triaging findings through natural language.

Python MCP server that bridges VS Code Copilot agents to the Firm Gateway ecosystem.

A governed MCP server for digital-forensics and incident-response (DFIR) work, exposing curated forensic tools (Volatility 3, Plaso, RegRipper, etc.) through a single FastMCP HTTP endpoint with bearer-token authentication and tamper-evident audit logging.

Enables automated review and analysis of network security controls (AWS Security Groups, Network ACLs) using natural language queries. Supports NSC configuration reviews, network segmentation testing, and identifying security gaps through conversational LLM interaction.