Security & Auth MCP Servers — Page 4

MCPAmpel - MCP Security Scanner

Scan installed MCP servers for security vulnerabilities with 16 detection engines.

io.github.eliottreich/taskbounty-check

Local GitHub Actions/CI maintenance check (action pinning, token perms). Not a full security audit.

SpendShield

Authorization layer between AI agents and money: ALLOW/APPROVAL/DENY, budgets, audit.

io.github.figuard/figuard-mcp

Pre-flight spend authorization for AI agents. Set a budget, enforce limits, audit every decision.

MCP Modal Server

MCP server for managing Modal apps, containers, volumes, and secrets.

MCP Code Review Server

Code review as an MCP server — structured reviews with OWASP security scanning.

io.github.hanjialeGit/mcp-server

天启至数 ApocData - MCP Server for A-share market data (46 free, no-auth endpoints)

HubVibe: Pay-per-Call Agent Tools: Web Search, Email Verify, KYC Screening, Stocks, Crypto, News

70+ pay-per-call tools for AI agents: web search, email verify, KYC, stocks, crypto, news, data

ai.kernora/agent-sec

Zero-install security baseline for AI coding agents — OWASP/CWE-cited rules over MCP.

SkillTotal

Deterministic security scan of MCP servers, agent skills and npm/PyPI packages. Runs locally.

cnvs.app

Real-time collaborative whiteboard — AI agents and humans edit the same board live over MCP.

WOCLUB Cube Playground

Shared voxel world for AI agents. Extend First Light at the world centre over HTTP or MCP; no auth.

Gemina

Extract, search and tag any document: invoices, receipts, contracts, templates. OAuth or API key.

Arcjet

An MCP server for Arcjet - the runtime security platform that ships with your AI code.

HitPay MCP Server

Official HitPay MCP: sales, payouts, balances; create payment links and invoices. OAuth; no refunds.

com.insumermodel/insumer

Wallet auth: send a wallet and conditions, get a signed boolean across 37 chains.

Prizmad

Generate AI UGC video ads from any product URL — avatars, voiceover, OAuth Connect.

Phishunt

Public phishing feed: suspicious/confirmed phishing URLs detected hourly. No auth, CC0.

io.github.100xPercent/pop-pay

Runtime security for AI agent commerce. CLI + MCP server blocks hallucinated purchases.

io.github.4hmetuyar/a2a-auditor

Scans Agent2Agent (A2A) protocol code for webhook SSRF, missing auth, and credential exposure

io.github.4hmetuyar/elicitation-auditor

MCP elicitation anti-patterns: secrets in forms, third-party authorize URLs, credentials in URLs

io.github.4hmetuyar/mcp-config-auditor

Scans Cursor/Claude/Windsurf/VS Code MCP configs for unpinned versions, secrets, typosquats

io.github.4hmetuyar/mcp-server-auditor

Scans MCP server tool definitions for excessive agency, injection sinks, hardcoded secrets

io.github.4hmetuyar/oauth-auditor

Scans MCP server auth code for OAuth 2.1 anti-patterns: token passthrough, missing audience

io.github.4hmetuyar/secret-scanner

Scans files for leaked secrets and API keys

io.github.4hmetuyar/security-proxy

MCP gateway: many servers, one policy, lethal-trifecta blocking, PII masking, audit log

io.github.4hmetuyar/security-suite

Bundle of secret-scanner, dependency-auditor, ssl-inspector, and dns-intelligence

io.github.4hmetuyar/ssl-inspector

TLS certificate/cipher/protocol inspection

AI Scanner

Scan codebases for LLM/AI SDK usage, exposed API tokens, and hardcoded secrets.

GitHub

GitHub via MCP: search, repos, issues, PRs, files, notifications. OAuth device flow or token.

HTTP

HTTP/REST client with saved collections, env secrets, and SSRF-safe host allowlisting.

io.github.Achilles1089/pentagonal-mcp

AI smart contract forge — 8-agent security audits, generation, and compilation across 8 chains

Linear MCP (multi-workspace, PAT auth)

Multi-workspace Linear MCP — PAT auth, 57 tools + 3 prompts, substrate enforcement, drop-in.

Multi-workspace Slack MCP server with draft+confirm safety, vault auto-export, a

Multi-workspace Slack MCP server with draft+confirm safety, vault auto-export, and triple-mode…

AgentStack (agentstack.tech)

Backend for AI agents: one batched tool over ~668 actions (hosting, storage, auth, payments).

io.github.Aguantar/vibescan-mcp-server

MCP server for VibeScan — scan projects for leaked secrets and security issues

io.github.AInoAKARI/keymaster-mcp

Read-only runtime secret retrieval from HashiCorp Vault via Keymaster for autonomous AI agents.

io.github.anima-labs-ai/anima

Give your AI agent an identity it owns: email inbox, US phone number, SMS, voice, and a vault.

AgentAegis

Pay-per-call cybersecurity for AI agents: vuln scans, threat intel, compliance, code security.

io.github.atmflow55/datafood-mcp

DataFood: 16 data sources (crypto/DeFi/security/news/finance) via one MCP. Bundles save ~92%.

Dockerfile Lint

Lint Dockerfiles for root users, latest tags, secrets in ENV or ARG, missing HEALTHCHECK and more.

JWT Tools

Decode JWTs without verifying, flag risky algorithms and claims, verify HS256 or RS256 with a key.

OpenAPI Lint

Lint OpenAPI 3.x documents for missing security, responses, descriptions and versioning.

Security Headers

Fetch a URL's response headers and grade CSP, HSTS, X-Frame-Options and related security headers.

io.github.benbergner/benspdf

Read PDFs locally: text, pages, metadata, scan detection, layout, permissions, render, OCR.

io.github.BlackBoxEngineering/agent-envelope-mcp

Neutral MCP server for AgentEnvelope authority: sovereign verify + vault verify/lookup/mint.

Tripwire

Security gateway for MCP agents: blocks prompt-injection-driven tool calls before they execute.

Margins

Use your Claude Pro/Max subscription on your Obsidian vault. Reads markdown, proposes writes.