Security
Scanning, secrets, vulnerabilities, authentication and threat intelligence.
MCP servers (2144)
See allTop picks by need
- Best for first-timersOpenMetadataNo install, runs remotelyOfficial from OpenMetadataSign in with OAuth
- Best for developersOpenOSINTOne-command installRuns fully localMIT license
- Best for teamsmcpOfficial makerApache-2.0 licenseActive in the last 90 days
- Best for privacyGhidraMCPRuns fully localOpen source
- MCP serverOfficial
OpenMetadata
OpenMetadata
Official OpenMetadata MCP: 21 read and write tools for search, lineage, data quality, governance.
16kActive- Remote
- OAuth
- MCP server
OpenOSINT
AI-powered OSINT agent & MCP server. 21 tools: email, breach, IP, WHOIS, DNS, Shodan, GitHub & more.
1.8kActive- Runs locally
- API key
- MCP serverOfficial
mcp
Semgrep
Semgrep Guardian integrates natively with AI coding agents like Claude Code and Cursor to catch security issues before they ship. It bundles the Semgrep MCP server, Hooks, and Skills into a single install, and scans every file an agent generates using Semgrep Code, Supply Chain, and Secrets.
17kActive- Remote
- API key
- MCP server
MCP Server for WinDbg Crash Analysis
A Model Context Protocol server for Windows crash dump analysis using WinDbg/CDB
1.6kActive- Runs locally
- MCP server
HOL Guard
Local-first AI agent security evidence and approval workflows through HOL Guard's stdio MCP server.
1kActive- Runs locally
- MCP server
SafeDep Vet MCP
Protect your AI agents and IDEs from malicious open-source packages.
1.1kActive- Runs locally
- MCP server
mcp
Authorize consequential AI agent actions before execution
672Active- Runs locally
- Remote
- API key
- MCP server
skylos
Dead code, security, secrets detection and code quality for Python, TypeScript, Go.
857Active- Runs locally
- API key
- MCP server
GhidraMCP
Ghidra
https://github.com/user-attachments/assets/36080514-f227-44bd-af84-78e29ee1d7f9
12kActive- Runs locally
- No auth
- MCP server
Attestix
AI agent identity, signed credentials, delegated authority and governance evidence.
840Active- Runs locally
- MCP server
ida-pro-mcp
Hex-Rays
Simple MCP Server to allow vibe reversing in IDA Pro.
13kActive- Runs locally
- No auth
- Paid
- MCP server
vibe-check-mcp-server
Metacognitive AI agent oversight: adaptive CPI interrupts for alignment, reflection and safety
502Active- Runs locally
- API key
Skills (11)
See allTop picks by need
- Best for first-timersgoogle-cloud-waf-securityOfficial from Google CloudActive in the last 90 days
- Best for developersaig-agent-redteamShips its own scriptsApache-2.0 licenseActive in the last 90 days
- Best for teamsgoogle-cloud-recipe-authOfficial from Google CloudApache-2.0 licenseActive in the last 90 days
- Best for privacyreverse-engineer-anythingWorks offlineOpen source
- Skill
reverse-engineer-anything
Reverse engineer native, managed, Electron/JavaScript, packaged, firmware, and browser targets with REA, and build agent environments (AgentEnv bundles) of web applications from a live instance or a capture. Use shipped-artifact or requested runtime evidence to explain features, compare versions…
398kActive- No scripts
- Works offline
- SkillOfficial
security-audit-skill
Cloudflare
A coding-agent skill that turns your agent into a security auditor. It orchestrates isolated agents through reconnaissance, coverage-led hunting, candidate validation, structured output, independent record verification, and target-neutral reporting.
50kActive- No scripts
- Works offline
- SkillOfficial
google-cloud-recipe-auth
Google Cloud
Provides expert guidance on Identity and Access Management (IAM) and authenticating and authorizing to Google Cloud services and APIs, covering human users, service identities, Application Default Credentials (ADC), and best practices for secure access.
22kActive- No scripts
- Needs network
- SkillOfficial
google-cloud-waf-security
Google Cloud
Generates security-focused guidance for Google Cloud workloads based on the design principles and recommendations in the Google Cloud Well-Architected Framework (WAF). Use this skill to evaluate workloads, identify security requirements, and provide actionable recommendations for IAM, network…
22kActive- No scripts
- Works offline
- Skill
Anthropic-Cybersecurity-Skills
A junior analyst knows which Volatility3 plugin to run on a suspicious memory dump, which Sigma rules catch Kerberoasting, and how to scope a cloud breach across three providers. Your AI agent doesn't — unless you give it these skills.
35kActive- No scripts
- Needs network
- Skill
aig-agent-redteam
当用户要求 AI/Agent 安全评估、蓝军演习、AI 安全审查、提示词注入测试、MCP/Skill/插件/代码包审计、Agent 工具链滥用测试，或需要生成类似渗透测试报告的 Markdown/HTML 时，必须使用本 skill。本 skill 让 Agent 以授权蓝军视角成为 AI 安全专家，面向 AI 产品、Agent、MCP Server、Skill、代码仓库和 AI 基础设施进行安全演习。优先使用第一性原理推理和真实证据，而不是机械跑 payload 库；脚本只用于 HTTP 指纹识别、证据聚合、报告渲染等确定性辅助任务。
7.2kActive- Bundles scripts
- SkillOfficial
email-best-practices
Resend
Use when building email features, emails going to spam, high bounce rates, setting up SPF/DKIM/DMARC authentication, implementing email capture, ensuring compliance (CAN-SPAM, GDPR, CASL), handling webhooks, retry logic, making emails accessible (alt text, headings, contrast, screen readers), or…
207Active- No scripts
- Skill
clawsec
ClawSec is an AGPL collection of security skills and signed advisory intelligence for AI agent runtimes. It helps operators verify skill artifacts, detect configuration drift, audit agent environments, and approval-gate risky installs across OpenClaw, NanoClaw, Hermes, and Picoclaw.
1.1kActive- Bundles scripts
- Skill
computer-forensics
Claude Code Skills for software engineering workflows - Git automation, testing, and code review
689Slow - Skill
file-deletion
Claude Code Skills for software engineering workflows - Git automation, testing, and code review
689Slow