Skip to main content
Glama
72,300 servers. Updated

Matching MCP tools:

Matching MCP Connectors:

"OWASP" matching MCP servers:

  • owasp-mcp-scan

    CodingSelim
    A
    license
    -
    quality
    B
    maintenance
    Passive security scanner that audits a running MCP server against the OWASP MCP Top 10 and grades it A-F. Read-only static analysis of the advertised tools, prompts and resources with console/JSON/SARIF output, and it also runs as an MCP server itself.
    75
    MIT

  • MCP Shamash

    NeoTecDigital
    F
    license
    B
    quality
    D
    maintenance
    Enables security auditing, penetration testing, and compliance validation with tools like Semgrep, Trivy, Gitleaks, and OWASP ZAP. Features strict project boundary enforcement and supports OWASP, CIS, and NIST compliance frameworks.
    7

  • MCP ZAP Server

    dtkmn
    A
    license
    -
    quality
    C
    maintenance
    Safe, self-hosted OWASP ZAP operator for guided AI security scans, findings, and reports. Requires a separately running OWASP ZAP daemon.
    63
    Apache 2.0

  • bawbel-mcp

    bawbel
    A
    license
    A
    quality
    A
    maintenance
    Bawbel MCP Server lets any agent scan MCP servers and skill files for security vulnerabilities mid-conversation. Seven tools covering server-card scanning, conformance scoring, rug pull detection, and AVE threat intelligence queries. Powered by the AVE standard with OWASP MCP Top 10 mapping on every finding. Free, Apache 2.0, no API key required.
    10
    1
    Apache 2.0

  • Orihime

    srinivasan-sundaresan95
    A
    license
    A
    quality
    C
    maintenance
    Cross-repository code knowledge graph MCP server for Java, Kotlin, JavaScript, and TypeScript. Indexes source code into embedded KuzuDB via tree-sitter and exposes 30+ tools for call-flow tracing, multi-hop taint analysis (OWASP/CWE/PCI/STIG), entry-point reachability filtering, performance hotspot detection, and license compliance — without reading source files. 95% fewer tokens vs source-read
    33
    1
    MIT

  • DevSecOps MCP Server

    JesusDavidQuarksoft
    A
    license
    B
    quality
    D
    maintenance
    An MCP server that integrates SAST, DAST, and SCA security tools to enable AI-driven vulnerability scanning and automated security reporting. It allows AI assistants to execute and analyze results from tools like Semgrep, OWASP ZAP, and Trivy within a DevSecOps workflow.
    6
    MIT

  • MEOK MCP Hardening MCP

    CSOAI-ORG
    A
    license
    B
    quality
    B
    maintenance
    Automated security red-team for any MCP server that scans manifests against OWASP LLM Top 10 and MCP-specific risks, returning a 0-100 hardening score and HMAC-signed report.
    7
    MIT

  • VulneraMCP

    telmon95
    A
    license
    B
    quality
    A
    maintenance
    AI-powered bug bounty hunting platform that integrates security tools (OWASP ZAP, Caido, Burp Suite) for automated reconnaissance, vulnerability testing, JavaScript analysis, and finding management with PostgreSQL storage.
    47
    38
    MIT

  • MCPGuard

    piyushptiwari1
    A
    license
    -
    quality
    C
    maintenance
    A security gateway that enforces policies, tracks data taints, and sandboxes tool calls between AI agents and MCP servers. It provides a secure chokepoint to prevent prompt injection and ensure OWASP ASI compliance through audit logging and deterministic execution.
    1
    Apache 2.0

  • ZAP MCP Server

    LisBerndt
    A
    license
    -
    quality
    C
    maintenance
    Integrates OWASP ZAP security testing with AI assistants through MCP, enabling automated vulnerability scanning and AI-powered security analysis during development. Supports multiple scan types including active, passive, and AJAX spider scans with real-time status updates.
    5
    MIT

  • swt3-mcp

    tenova-labs
    A
    license
    -
    quality
    A
    maintenance
    Cryptographic AI governance and audit. 18 tools, 28 frameworks. EU AI Act, NIST AI RMF, OWASP Agentic Top 10, CMMC, SR 11-7, ISO 42001. Tool policy gates, trust mesh, inference attestation, audit sessions. Zero-config demo mode.
    256
    Apache 2.0

  • mcpwatch

    lazymac2x
    A
    license
    -
    quality
    C
    maintenance
    MCP server that audits other MCP servers. Run MCPWatch security scans from inside Claude Code or any MCP-compatible agent with 10 OWASP MCP Top 10 aligned checks and A-F letter grades.
    MIT

  • MCPSec

    mcp-shark
    A
    license
    -
    quality
    C
    maintenance
    A security linter for MCP that audits other MCP servers for compliance with the MCP specification and OWASP security standards, providing detailed findings and remediation.
    1
    MIT
  • Adversa by cognis-digital

    Adversaofficial

    cognis-digital
    F
    license
    -
    quality
    C
    maintenance
    LLM red-team harness that scans for OWASP LLM Top 10 and MITRE ATLAS vulnerabilities, providing prioritized findings in table, JSON, SARIF, or via an MCP server for AI agents.