"OWASP Dependency-Check" matching MCP servers:

Enables querying projects, fetching findings, triggering analysis, uploading CycloneDX BOMs, and checking async token status for OWASP Dependency-Track.

Twelve tools combine per-function complexity and branch coverage to rank work and check edited functions against their ceiling. Packets include source, uncovered lines, change-coupled files and near-duplicates. MCP calls can write local caches and metadata; they do not run test suites, edit source or claim work.

An MCP server that diagnoses Flutter + Stripe (flutter_stripe) setup issues — so Claude can check your project automatically.

Agent Ready is an AI agent readability scanner — point it at any public URL and get back a 0–100 score plus per-check remediation hints for every failing check. This package wraps the same engine that powers agent-ready.dev as an MCP server, so Claude Desktop, Claude Code, Cursor, Cline, VS Code, and Windsurf can run scans inline and explain the results.

MCP server for https://oathe.ai security audits. Runtime behavioral analysis and security scanner for Ai systems. Check trust scores before installing MCP servers, plugins, or AI agent skills.

Verify AI agent communication with session types and formal proofs. 4 tools: parse protocols, verify messages, check safety properties, browse 20 stdlib templates.

Translates a lockfile diff into a human-readable upgrade plan. For every dependency bump (npm or PyPI) returns semver class, breaking changes from GitHub release notes, CVEs fixed in the range, migration guide links, and a clear per-package recommendation. Bulk tool ranks up to 50 package changes in parallel by risk (security > caution > review > likely-safe > safe).

MCP server for verifying AI agent claims vs reality — single-transcript inline grounding-check that flags when an agent's response states facts not in the input context, when its code silently swallows exceptions and substitutes mock data, or when its multi-turn transcript contains contradictions or unverified completion claims. Sub-second, local, free, no API calls.

Keyless, local MCP server bringing ISTQB / OWASP / IEEE / ISO / EU AI Act QA standards into your AI client. Standards-grounded retrieval, deterministic QA effort estimation, automated QA document quality review (0-100 rubric), and JUnit/CSV test-results flakiness analysis.

Exposes Semgrep as deterministic, rule-matching analysis tools over MCP so a code-review agent can scan only the lines changed in a diff, scan whole files on demand, and check analyzer availability, version, ruleset, and limits. Results are returned as compact per-finding lines with source snippets suitable as comment anchors, along with counts of suppressed out-of-diff matches.

Stops your AI from re-introducing bugs, leaking provider keys, or weakening tests. Bug fixes become permanent regression guards; blocked mistakes become AI lessons the agent reads and learns from before its next edit.

Enables agents to verify that a deploy actually worked by checking pages, links, and comparing environments, catching blank 200 responses, broken links, stray noindex, and staging that never updated.

An MCP server that lets an agent read its own eval results, run suites, explain failures, check drift, and view judge calibration status.

Enables agents to inspect print artwork and check it against product presets, identifying issues like low resolution, missing bleed, unsafe margins, wrong colour mode, and unwanted transparency, then suggesting fixes without modifying the files.

Enables AI coding agents to test and automate Android apps rendering UI in OpenGL/Vulkan/Metal surfaces via screenshot-based vision tools for tapping, swiping, long-pressing, and recording, without accessibility tree dependency.

Provides coding agents with visibility into test health through tools for flaky test detection, test quality linting, and LLM evaluation harness, enabling them to triage failures, review test quality, and check prompt changes for regressions.

An MCP server that gives AI assistants the ability to check open-source packages for vulnerabilities, enrich findings with real-world exploit intelligence, and statically analyse whether vulnerable code is actually reachable in your project.

Enables agents to check whether an execution trace contains the evidence needed for post-hoc causal reconstruction, retrieve individual requirement details, and list evidence requirements per failure class over MCP stdio. It works on files, directories, or inline JSON locally and never transmits or persists data.

Enables web accessibility audits using axe-core, allowing users to scan URLs, check WCAG compliance levels, and export reports. It uses an anti-detect browser to bypass Cloudflare and other bot protection.

DocGuard, an official, zero-dependency Node.js MCP server (npm: docguard-cli, docguard mcp) exposing 5 read-only doc-governance tools: guard, score, explain, verify-claims, diagnose.