"Y Combinator" matching MCP servers:

Checks the code your AI writes for leaked keys and made-up packages, on your computer. Never uploads code. Run it with npx -y @yof/cli mcp.

Static scanner for MCP/agent-gateway readiness anti-patterns, providing a 7-dimension R/Y/G score by scanning code and config for common failure modes.

Version-accurate library docs for coding agents, with a supply-chain check of every dependency they add: known advisories, malware records, lookalike names and versions that do not exist. Runs locally over stdio with npx -y pinright; no account or API key.

Diagnoses a domain's email authentication — SPF, DMARC, DKIM, MX, blacklists and domain or SSL expiry - and returns copy-paste fix records generated by a validating engine, never a language model. The MCP server is hosted remotely; this repository carries the plugin manifest, connector config and bundled skill.

Checks and fixes a domain's email authentication (SPF, DKIM, DMARC), DNS health, propagation, blacklists and domain/SSL expiry, returning copy-paste fix records from a validating engine, never a model guess. Local stdio server (npx -y @dnsdoctor/mcp) with the same 27 tools as the hosted https://dnsdoctor.dev/mcp.

Append-only evidence receipts for AI records: seal, verify, cite, chain-check, anchor status. A seal proves a record existed at a time, not that its contents are true. Five tools over stdio with npx -y apex-psi-mcp — no account, no key, verification free forever.

Mandatory human approval gate for autonomous AI agents. Before any critical, irreversible, or financially significant action executes — file deletion, production deployment, financial transaction — the agent calls oracle_validate. A human receives a real-time Telegram notification with full context and taps Approve or Reject. The agent waits for the decision before proceeding.

Zero-Trust local PII & secrets masking MCP (ZTDS RFC v1.0). Zero server logs. Features: 23 zero-trust tools, 30 industry profiles, offline OCR, RAM-only masking. Run: npx -y @privacyscrubber/mcp-server. Website: https://privacyscrubber.com SDK: https://www.npmjs.com/package/@privacyscrubber/sdk

A local stdio MCP server that enables coding agents to discover credential handles and create scoped action requests with local approval and sanitized output.

A Python MCP server for SonarQube, enabling AI agents to query projects, issues, quality gates, coverage, and security hotspots.

An MCP server providing AI-powered cybersecurity, penetration testing, reconnaissance, vulnerability assessment, and security automation tools through the Model Context Protocol.

Enables triage, installation validation, and controlled automation of X-Ways Forensics and related tools through structured MCP tools for agents.

Enables local AI agents on macOS to drive the user's own signed-in Chrome through their own isolated tabs, with per-client tokens, blocked site categories, masked secrets and human hand-offs. Agents can open and navigate tabs, read pages, send real clicks and typing, inspect network requests, and hand tabs back to the user, all without touching other tabs or stealing focus.

Enables LLM clients to safely perform file operations such as create, read, edit, delete, move, copy, and more, with every path checked against an explicit permission database managed through a desktop GUI.

缔零法则MCP是基于LLM和RAG技术搭建的实现完全替代人力的全自动化风险识别的内容安全审查平台，致力于通过代理AI技术减少人力成本，高效高精度为用户提供分钟级接入的内容风控解决方案，破解安全威胁，提供从风险感知到主动拦截策略执行的全链路闭环与一体化解决方案。This MCP tool is an AI-powered content security review platform built on LLM and RAG technologies, designed to achieve fully automated risk identification that completel

MCP server (stdio, npx -y myclawn-mcp) that lets your agent meet other people's agents. A local firewall decides what goes out: agents exchange only what each owner put on their card, and only two things come back to the human — anything not on the card, and any commitment on their behalf. Works in Claude Code, Codex and Cursor.

Enables LLM clients to read and modify MS-SQL, PostgreSQL, MySQL/MariaDB and SQLite databases through 38 MCP tools, with every table, view, function and procedure gated by explicit permission rules that deny by default. Ships with a desktop GUI for authoring rules, approving destructive operations and auditing what the model did.

Enables MCP clients to triage SOC alerts while enforcing a trust firewall across retrieval, memory, and privileged actions. It exposes tools for alerts, logs, memory, and alert actions, with defenses that refuse risky operations in the presence of attacker-controllable content.

Lets local AI assistants query and manage e-Boekhouden.nl administrations, including REST accounting reports, Dutch VAT/BTW classification, booking proposals, and Digital Archive access, while requiring native biometric hardware confirmation for write operations.

Enables AI agents to call tools through a security gateway that intercepts requests, enforces deterministic policy and risk checks, blocks or escalates high-risk actions for human approval, and keeps tool credentials and audit logs protected.

Enables AI agents to request an independent second opinion from a different frontier model, with PII scrubbing before transit, live web search grounding, caching, and multi-provider failover.

Enables Grok Bot and other MCP clients to retrieve X mentions and posts, create drafts, and publish approved posts or replies with server-side prompt-injection defenses, reply whitelisting, deduplication, and rate limits.

MCP servers are installed via npx -y @scope/package — which silently downloads the latest version every time your AI tool starts, with no integrity check. mcp-lock fixes this by recording exact tarball hashes on first run and detecting any changes on every run after that — the same guarantee npm ci gives you for Node.js projects.

Lab MCP for CuNi exactness, Chamber two-key JSON seal, Agent-Rider identity, and x402 catalog. Remote https://www.slidphilabs.com/mcp or npx -y spl-pay-per-suite mcp.

Enables assessment of AI use cases against the IKI-Gov reference model, scoring maturity across six measurement dimensions, checking readiness of lifecycle quality gates, and mapping coverage against ISO/IEC 42001, the EU AI Act, and NIST AI RMF. Supports scriptable CLI and JSON output, persisted portfolios with trend tracking, and Markdown or JSON report export.

Agent-Q is an MCP server that separates execution surfaces from signing authority, enabling secure Sui signing flows where the signing device holds keys and policy while requesters submit bounded signing requests through a local host process.

Enables Claude and other MCP clients to search, read, write and organise mail on Stalwart servers over JMAP — including folders, Sieve filters, out-of-office replies and one-click unsubscribe — with draft-first and confirmation safeguards against prompt injection. A separate admin endpoint additionally exposes account, domain, mailing-list, queue, IP, log and task management through Stalwart's JMAP management API.

Enables secure chat-based interaction with PostgreSQL databases through Claude Desktop. Features GitHub OAuth authentication, role-based access control, and enterprise-grade security for database queries and operations.

This MCP server provides secure access to databases for AI agents, enforcing authentication, authorization, human approval, logging, and notifications to prevent dangerous actions.

Enables management of system users through a simple sample API, exposed as MCP tools for natural-language interaction.

A secure MCP server that wraps ERPNext with five narrow tools and layered safety gates (identity passthrough, risk grading, approvals, isolation), enabling agents to safely interact with ERPNext data.

An MCP server that enables interaction with Xero's Identity Service API, providing OAuth 2 authentication and identity management capabilities through natural language commands.

An MCP server template with built-in OAuth 2.0 authorization code flow and PKCE, enabling Grok to authenticate and invoke tools such as hello and publish_page.

Enables administrators to securely record approved parking reservations to a durable text file with validation, concurrency safety, and audit logging.

Remote MCP/API trust gate for AI agents to inspect readiness before performing Korean business workflow operations like vendor onboarding and payment release.

Enables management of system users through a simple sample API, with support for HTTP and stdio transports and forwarding of authentication headers.

Enables management of system users through a simple API, exposing two MCP tools that forward authentication headers to the upstream service.

A pre-payment safety gate for x402 that screens payment metadata for PII, enforces spending policies, and detects replay attacks before signing.

MCP server for administering wg-easy (WireGuard Easy) instances, enabling listing, creating, updating, enabling/disabling, and deleting WireGuard clients, fetching configs and QR codes, and inspecting server status via the wg-easy REST API.

Read selected local folders from ChatGPT on macOS, with per-folder read-only or read-write access and hash-checked, recoverable edits. Requires local installation and a private ChatGPT app. The Glama container is a synthetic evaluation demo; it does not connect to files on your Mac.