"Security" matching MCP servers:

An MCP server that gives Claude and other AI agents the ability to audit any public URL's HTTP security headers. What it checks: * HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy * HTTPS enforcement and redirect chain depth * Presence of security.txt, robots.txt, sitemap.xml Payment model: * 0.05 USDC per scan, paid automatically on Base via the x402 proto

A production-ready MCP server that provides AI agents secure access to Exa web search with OAuth-based authentication, scoping, and auditing via ScaleKit.

An MCP server that integrates multiple security and reconnaissance tools (Nmap, Cariddi, ParamSpider, Metasploit, web scraping) for AI systems, enabling automated network scanning, API discovery, vulnerability testing, and remote access via ngrok.

A production-ready HTTP API server for security testing and reconnaissance, integrating nmap, cariddi, paramspider, metasploit, and web scraping via FastAPI. It supports optional ngrok tunneling and exposes tools through REST endpoints.

Enables LLMs to perform browser automation tasks including web scraping, taking screenshots, and executing JavaScript using Playwright. It facilitates real-time interaction with web pages and the generation of automated test code.

Provides local LLMs with web search and page fetching capabilities via MCP, with a focus on OWASP security best practices.

A comprehensive HTTP client MCP server for security testing, API testing, and web automation that provides full-featured HTTP tools with detailed logging capabilities.

Provides comprehensive code analysis (quality, complexity, linting, dependencies, security) and web scraping capabilities (static/dynamic content, API discovery) for development workflows.

Enables financial research and analysis through AI agents that combine web search, content crawling, entity extraction, and deep research workflows. Supports extracting stock/fund entities with security codes and conducting structured financial investigations.

An MCP server for crawling websites and extracting comprehensive data including images, SEO metadata, security headers, and business intelligence. It features twelve distinct extraction modes to perform detailed audits for e-commerce sites and general web analysis.

An AI-powered native browser that provides 12 MCP tools for AI clients to browse, interact with, and extract data from any website with low token cost and built-in security features.

Enables AI agents to perform web searches and fetch web pages as clean Markdown via the 9router API, with configurable provider fallbacks and local security controls.

Enables controlling an existing logged-in Chrome session through MCP, including page reading, DOM interaction, tab management, and allowed file upload/download with local security boundaries.

MCP server that bridges opencode into Firefox, enabling page reading, JavaScript execution, and security auditing directly from the terminal.

An MCP server that enables AI assistants to control a web browser through natural language commands, allowing them to navigate websites and extract information via SSE transport.

Enables privacy-focused web searches, social media lookups, and web archive retrieval across multiple engines including DuckDuckGo, Brave, Reddit, YouTube, and Wayback Machine with built-in caching and security features.

Provides structured search tools (web, news, images, videos, research) via a SearXNG instance, with direct URL reading disabled by default for security.

Aggregates security research articles from WeChat, QAX Butian, and Xianzhi community, with optional KimiCode web search. Supports smart deduplication, article fetching, and anti-bot measures.

Security-hardened MCP server that gives AI assistants full control over your real browser session, supporting 36 tools for navigation, data extraction, monitoring, and more.

A security-first, bring-your-own-key MCP server for bounded Firecrawl scraping, search, site mapping, credit visibility, and queue status.

Enables MCP-compatible AI hosts to access URL extraction, Python security scanning, email validation, domain intelligence, and PDF inspection/extraction tools, with automatic per-call USDC payments on Base.

A lightweight MCP server that fetches URLs and returns clean, readable markdown, enabling AI assistants to read any webpage with article extraction, caching, and security features.

Professional security testing server with 50+ integrated tools for web application vulnerability scanning, reconnaissance, fuzzing, and API testing. Enables comprehensive bug bounty hunting workflows including subdomain enumeration, XSS/SQLi detection, and automated security assessments.

Enables fetching and processing web content with advanced features including batch processing of up to 20 URLs, streaming support, metadata extraction, and multiple output formats (HTML, Markdown, plain text) with enterprise-grade security and global edge performance.

Enables Google search functionality through the Google Custom Search API with enterprise-grade security authentication. Supports streamable HTTP transport protocol for real-time search operations with configurable result limits.

Monitor website health, uptime, SEO, security and performance via your AI assistant.

MCP server for website SEO + GEO analysis. Scan any URL to get scores across 5 categories (SEO, GEO, Performance, Security, Accessibility) with actionable fix recommendations. Enables AI coding assistants to audit websites and implement fixes autonomously.

Enables auditing of websites for performance, SEO, accessibility, security, and mobile readiness, with tools to validate URLs, run page audits, save results, and retrieve reports.

Enables SSL/TLS certificate search and analysis using crt.sh data, supporting domain certificate discovery, subdomain enumeration, and security auditing through Cloudflare Workers deployment.

Local MCP server for Codex that provides on-demand, read-only access to Edge tabs and bookmarks, plus controlled interaction with agent-owned tabs. Requires manual activation via the browser extension and enforces a fail-closed security model.