Security

semgrep

semgrep

17.2k

Scan code for security vulnerabilities using Semgrep.

ida-pro

mrexodia

13.1k

IDA Pro plugin for binary analysis: decompilation, disassembly and automatic malware analysis reports.

GhidraMCP

LaurieWired

11.5k

Autonomous reverse engineering with Ghidra: decompile binaries, rename methods and data, and list methods, classes, imports and exports.

jadx-ai

zinja-coder

2.9k

JADX decompiler plugin providing live, LLM-assisted reverse engineering.

beelzebub

mariocandela

2.2k

Honeypot framework for building decoy MCP tools that an agent would never use in normal work, to detect prompt injection and malicious agent behavior.

vet

safedep

1.1k

Locally check npm and PyPI packages, such as those suggested by AI coding tools, for vulnerabilities and malicious code.

skylos

duriantaco

848

Dead code detection, security scanning and code quality analysis for Python, TypeScript and Go, with AI-assisted remediation.

GhidrAssistMCP

jtang613

779

Native Ghidra integration with GUI configuration, logging and no external dependencies.

apktool

zinja-coder

677

Automate reverse engineering of Android APKs with Apktool.

emilia-protocol

emiliaprotocol

612

Requires a named human's approval before irreversible agent actions such as payments or deploys, then issues an offline-verifiable Ed25519 trust receipt.

binary_ninja

fosdickio

456

Binary Ninja plugin and bridge for automating binary analysis and reverse engineering.

Wireshark

bx33661

346

Wireshark packet analysis: capture, protocol statistics, field extraction and security analysis.

r2mcp

radareorg

329

Disassemble and inspect binaries for reverse engineering with the Radare2 disassembler.

DashClaw

ucsandman

313

Fail-closed approval layer for unattended agent runs: checks actions against org policy, requests human approval and logs every decision to a causal ledger.

OpenWorkProof

dengyier

287

Verifiable execution protocol for agent tool calls: signed policy decisions, causal evidence chains and offline verification from a SQLite ledger.

maigret

BurtTheCoder

270

Search usernames across social networks and analyze URLs with maigret, an OSINT tool that collects account information from public sources.

server-wazuh

gbrigandi

240

Access real-time security alerts and event data from Wazuh SIEM.

PyMemoryEditor

JeanExtreme002

226

Read, write and scan the memory of running processes, Cheat Engine style: value scans that narrow down as the value changes, pointer chains, and scan results kept server-side behind a handle.

secops

securityfortech

219

Security testing toolbox that combines open source tools behind a single interface for pentesting, bug bounty hunting and threat hunting.

shodan

BurtTheCoder

178

Query the Shodan API and Shodan CVEDB: IP lookups, device searches, DNS lookups, vulnerability queries and CPE lookups.

rsigma

timescale

172

Author, lint, validate and convert Sigma detection rules with RSigma, evaluate and explain detections against log events, and inspect correlation state.

virustotal

BurtTheCoder

151

Query the VirusTotal API: scan URLs, analyze file hashes and retrieve IP address reports.

GhidraMCP

13bm

149

Ghidra plugin for binary analysis: function inspection, decompilation, memory exploration and import/export analysis.

shellward

jnMetaCode

139

Agent security middleware with layered defenses: prompt injection detection, DLP data flow tracking, command blocking and PII detection.

cve-search

roadwy

108

Query the CVE-Search API: browse vendors and products, get CVEs by ID and list the latest updated CVEs.

OPNSenseMCP

vespo92

91

Manage and interact with the OPNsense open source firewall in natural language.

DocSentinel

arthurpanhku

88

Automate cybersecurity assessment of documents, questionnaires and reports to surface risks, compliance gaps and remediations, using a RAG knowledge base.

cybersec-toolkit

26zl

77

Install a large security toolset and discover and run it through an authorization-gated server for CTF, pentesting, bug bounty and DFIR.

cloud-audit

gebalamariusz

72

AWS security scanner with attack chain detection, breach cost estimation and remediation snippets for CLI and Terraform.

mobb-vibe-shield

mobb-dev

68

Mobb Vibe Shield identifies and remediates vulnerabilities in human and AI-written code.

zap-server

dtkmn

67

Self-hosted OWASP ZAP integration with guided security scans, findings summaries and report generation.

Dandan

82ch

67

Real-time security framework for MCP servers that detects and blocks malicious agent behavior by analyzing tool call patterns and intent.

kastell

kastelldev

60

Server security auditing and hardening (SSH, firewall, Docker, TLS) with CIS/PCI-DSS/HIPAA mapping, fleet management and forensic evidence collection.

studio

snyk

58

Embeds Snyk's security engines into agentic workflows to secure AI-generated code in real time and work through vulnerability backlogs faster.

security-audit

qianniuspace

57

Audit npm package dependencies for security vulnerabilities with real-time checks against the npm registry.

roadrecon

atomicchonk

53

Analyze ROADrecon gather results from Azure tenant enumeration.

Security

fr0gger

52

Query the ORKL API to fetch threat reports, analyze threat actors and retrieve intelligence sources.

volatility

Gaffx

52

Memory forensics with Volatility 3, exposing plugins such as pslist and netscan through REST APIs.

dnstwist

BurtTheCoder

51

Run dnstwist, a DNS fuzzing tool, to detect typosquatting, phishing and corporate espionage.

database-sentinel

Farenhytee

50

Read-only security audit for Supabase. Four tools surface RLS gaps, permissive policies, exposed functions and grants; an audit prompt returns scored findings with fix SQL.

codeinspectus

Synvoya

49

Local security scanner for AI-generated JS/TS that combines Opengrep, Gitleaks and Trivy with checks for exposed secrets, Supabase RLS and prompt injection.

authenticator

firstorderai

47

Securely interact with the Authenticator App.

panther

panther-labs

47

Use Panther's SIEM platform in natural language to write detections, query logs and manage alerts.

cyberchef-api

slouchd

44

Use CyberChef operations through the CyberChef server API.

osv

StacklokLabs

42

Query the OSV (Open Source Vulnerabilities) database by package version or commit, batch-query multiple packages and get vulnerability details by ID.

entraid

hieuttmmo

41

Microsoft Entra ID (Azure AD) directory, user, group, device, sign-in and security operations via Microsoft Graph.

agent-bom

msaad00

35

AI supply chain security scanner: discovers MCP clients, scans dependencies for CVEs, maps blast radius to credentials and tools, and generates SBOMs.

contrastapi

UPinar

35

Security intelligence: CVE/EPSS/KEV lookups, domain recon (DNS, WHOIS, SSL, subdomains), IOC threat intel, OSINT and code scanning for secrets and injection.