MCP servers for security scanning, vulnerability testing, secrets management and QA automation. Each entry is scanned with the deterministic Capability-Flow Trust Model — grades are computed, never self-reported.
(For Interal Use Only) Provided MCP Tools for code analysis and improvement of LWC components
The Stripe Agent Toolkit enables popular agent frameworks including LangChain and Vercel's AI SDK to integrate with Stripe APIs through function calling.
Mobile device interaction automation via MCP
<a href="https://flatt.tech/oss/gmo/trampoline" target="_blank"><img src="https://flatt.tech/assets/images/badges/gmo-oss.svg" height="24px"/></a>
A comprehensive Model Context Protocol (MCP) server that provides web performance auditing, accessibility testing, SEO analysis, security assessment, and Core Web Vitals monitoring using Google Lighthouse. Enables LLMs and AI agents to perform detailed we
Self-hosted OAuth 2.1 Authorization Server for MCP servers (Express/TypeScript). Implements the MCP Authorization spec: Client ID Metadata Documents (CIMD), Dynamic Client Registration, PKCE, resource indicators, device flow.
MCP server + live dashboard for AI code governance — OWASP LLM Top 10 (10/10), real-time MCP App UI, 25+ security patterns, Bayesian learning Brain, hallucinated import detection, multi-agent governance. Works with Claude, Cursor, VS Code, ChatGPT, Goose,
MCP server for VirusTotal API integration
Validate VAST 2.0–4.4, VMAP 1.0, and DAAST 1.0 ad tags against IAB specs. 212 rules. Rust/WASM core.
MCP server for Realm — exposes 7 tools for AI agent connections over stdio or HTTP.
Manage Authentik through AI assistants
MCP Server for TestCollab - Exposes test management functionality to AI assistants
Install deptrust, a local package vulnerability checker and MCP server for AI agents.
MCP server for Rhombus API
Security-first MCP server for Vikunja — full API coverage, read-only by default with opt-in write/delete, and just one dependency (the official MCP SDK).
MCP server for Cucumber Studio API integration
MCP server exposing a domain security & privacy checker (SSL/TLS, email auth, DNS, web headers). Local-first, zero telemetry.
MCP server for CallLint — a static preflight safety gate for MCP servers and agent tools. Use before installing or approving other MCP servers. Never executes the server it judges.
Model Context Protocol server to administer Keycloak through its Admin REST API
Audit your package.json dependencies
Local MCP server that authenticates to remote OAuth-protected MCP servers following MCP Auth Specification using client_credentials grant usefull for autonomous agents, background services, CI/CD pipelines, server-to-server integrations, and daemon proces
MCP (Model Context Protocol) server that provides pairwise combinatorial testing capabilities to AI assistants.
MCP (Model Context Protocol) server for AgentGate. Enables Claude and other MCP-compatible AI assistants to request approvals.
Domain security reconnaissance MCP server — 13 tools for AI agents. DNS, SSL, HTTP headers, email auth, port scan, ASN, RDAP and more. Free, no API key.
Vulnerability scanners, secret vaults and browser-test rigs were built for terminals and CI pipelines; the Model Context Protocol brings them into a conversation instead. An MCP server in this category typically wraps static-analysis engines in the Semgrep family, dependency and container scanners like Trivy, web probes such as OWASP ZAP and Nuclei, secret stores like HashiCorp Vault, or QA-automation frameworks built on Playwright and Selenium — so Claude, Cursor and other AI assistants can launch scans, read results and act on them conversationally.
An assistant can scan a changed branch and rank the findings by exploitability; it can fetch a short-lived credential from a secrets manager for a test run instead of leaving keys in config files; and it can generate a browser test suite, execute it, and diagnose the flaky cases. CVE lookups during code review are a common fourth. The MCP Trust Registry lists automatically scanned servers for all of these jobs.
Defensive tooling carries a built-in irony: it has the deepest reach into the system it protects. A server bridging a vault can read every secret its token can; one wrapping a scanner sees your unpatched vulnerabilities — a ready-made attack map; a scan runner can be aimed at hosts nobody authorized; a QA-automation server drives a real browser that may hold logged-in sessions. Before connecting one:
Only with tight scoping. A Model Context Protocol server that brokers vault or CI credentials can exfiltrate whatever its token reaches, and prompt-injected tool output can steer an assistant into requesting more than intended. Issue single-purpose, short-lived tokens, and review the server's capability profile and security findings on its registry page before connecting.