MCP servers for security
24 of the 8,106 servers we have read are placed here — scanning, secrets, reverse engineering. Placed by a stated rule over what each one declares it reaches and what it says it does, never by a classifier. Every row on this page, not a sample.
24 of the 8,106 MCP servers we have read are placed under security. The most starred is ida-pro-mcp with 13,080 stars.
- ida-pro-mcp 13,080 stars
- Wazuh-MCP-Server 257 stars
- mcp-shodan 178 stars
- pentestMCP 111 stars
- mcp-server-idapro 103 stars
Every server placed in security
AI-powered reverse engineering assistant that bridges IDA Pro with language models through MCP.
No credential named
LISTED · ★ 13080Production-grade MCP server for Wazuh SIEM — 55 security tools for alert triage, threat hunting, vulnerability management, compliance (PCI DSS, GDPR, HIPAA, NIST CSF, ISO 27001) and active response. Connect Claude or any LLM to your SOC. OAuth 2.1, RBAC, multi-cluster, air-gap ready.
vllmwebuiNeeds AUTH_SECRET_KEY · MCP_API_KEY · VLLM_API_KEY · WEBUI_SECRET_KEY
LISTED · ★ 257MCP server for Shodan — search internet-connected devices, IP reconnaissance, DNS lookups, and CVE/CPE vulnerability intelligence. Works with Claude Code, Codex, Gemini CLI, and Claude Desktop.
shodanNeeds SHODAN_API_KEY
LISTED · ★ 178pentestMCP: AI-Powered Penetration Testing via MCP, an MCP designed for penetration testers.
No credential named
LISTED · ★ 111A Model Context Protocol (MCP) server that enables AI assistants to interact with IDA Pro for reverse engineering and binary analysis tasks.
No credential named
STALE · ★ 103A fully functional and production-grade reverse engineering MCP Server
No credential named
LISTED · ★ 86MCP server for searching and retrieving Solodit vulnerability reports.
No credential named
STALE · ★ 42AI-Powered Threat Intelligence MCP tool
abuseipdbipinfootxvirustotalNeeds ABUSEIPDB_API_KEY · IPINFO_API_KEY · OTX_API_KEY · VIRUSTOTAL_API_KEY
STALE · ★ 40MCP server for querying OpenCTI threat intelligence, indicators, reports, malware, and threat actors.
openctiNeeds OPENCTI_TOKEN
LISTED · ★ 40Injectable MCP server for AI-driven reverse engineering inside processes
No credential named
LISTED · ★ 33An AI-driven MCP server that autonomously interfaces with Malware Bazaar, delivering real-time threat intel and sample metadata for authorized cybersecurity research workflows.
malwarebazaarNeeds MALWAREBAZAAR_API_KEY
LISTED · ★ 30This project provides a Docker containerized MCP server that runs on Kali Linux, giving AI assistants (like Claude) access to a full suite of security and penetration testing tools. The server communicates via Server-Sent Events (SSE) and allows AI to execute commands in a controlled environment.
No credential named
LISTED · ★ 26Free, open-source CLI for dependency intelligence, SBOMs, vulnerability auditing, and CI policy gates.
No credential named
LISTED · ★ 14Deliberately vulnerable MCP server (aka MCP Goat) for security training — 26 challenges across 4 difficulty levels (incl. a secure reference), a victim-agent harness, and one-command Docker deploy. Practice penetration testing against the Model Context Protocol.
No credential named
LISTED · ★ 11A fully local, autonomous AI penetration-testing agent powered by Gemma 4-12B and a Flask MCP tool server. Runs recon, attack loops, and report generation on its own — no cloud, no API keys. For authorized security testing only.
No credential named
LISTED · ★ 9Go-based SBOM, vulnerability, and secret scanner with MCP support.
No credential named
LISTED · ★ 3Free Kodus MCP HTTP server exposing OSV (v1) for open source vulnerability lookup via osv_query/osv_query_batch tools.
No credential named
LISTED · ★ 2MCP server for AI agent action governance. 14 tools that check every tool call, SQL query, file write, shell command, and agent message against your policy before it runs.
shrikeNeeds SHRIKE_API_KEY
LISTED · ★ 2Real-time Python package and vulnerability data for AI coding agents
No credential named
LISTED · ★ 1CVE database and vulnerability intelligence for AI agents
No credential named
LISTED · ★ 1MCP server for middleBrick API security scanning — scan APIs for vulnerabilities from Claude, Cursor, or any MCP-compatible AI tool
middlebrickNeeds MIDDLEBRICK_API_KEY
LISTED · ★ 0Vulnerability-intelligence MCP server for AI agents: CVE lookups (NVD) and dependency-manifest audits (OSV). Keyless.
No credential named
LISTED · ★ 0MCP Server for Threat Intelligence — query reports, CVEs, IOCs, STIX bundles and weekly briefings from your AI assistant
No credential named
LISTED · ★ 0KnyazevAI — MCP server for searching 24,500+ MCP servers and AI agents. Semantic search, trust scores, vulnerability data.
No credential named
LISTED · ★ 0
Common questions about MCP servers for security
- What are the most popular MCP servers for security?
- By GitHub stars: ida-pro-mcp (13,080 stars), Wazuh-MCP-Server (257 stars), mcp-shodan (178 stars), pentestMCP (111 stars), mcp-server-idapro (103 stars). Stars measure popularity, not quality, so read what each one reaches and how it is maintained.
- Which MCP servers for security need a credential?
- 7 of 24 name a credential in their source; the most common are ABUSEIPDB_API_KEY (1), AUTH_SECRET_KEY (1), IPINFO_API_KEY (1), MALWAREBAZAAR_API_KEY (1), MCP_API_KEY (1). A server with no credential listed has not been shown to need none; check its README.
- Are there official MCP servers for security?
- None placed here is named as a vendor’s official server in our data.
- How are servers placed under security?
- By a stated rule over what each one declares it reaches and what it says it does, never by a classifier. A server can sit in no category when no rule fired, which does not mean it belongs nowhere.