Security & Auth MCP Servers — Page 5

Arcjet

An MCP server for Arcjet - the runtime security platform that ships with your AI code.

Faable — Deploy & Auth

Deploy apps from GitHub, read build/runtime logs, and manage your app's users from your AI agent.

HitPay MCP Server

Official HitPay MCP: sales, payouts, balances; create payment links and invoices. OAuth; no refunds.

com.insumermodel/insumer

Wallet auth: send a wallet and conditions, get a signed boolean across 37 chains.

Monetize Marketing

The Monetize Marketing App as MCP tools: Brain, mission, training, skills, Library, software. OAuth.

Prizmad

Generate AI UGC video ads from any product URL — avatars, voiceover, OAuth Connect.

FoxAuth

Administer a FoxAuth OAuth 2.1 / OpenID Connect server: projects, apps, users, keys and settings.

Phishunt

Public phishing feed: suspicious/confirmed phishing URLs detected hourly. No auth, CC0.

io.github.100xPercent/pop-pay

Runtime security for AI agent commerce. CLI + MCP server blocks hallucinated purchases.

io.github.4hmetuyar/a2a-auditor

Scans Agent2Agent (A2A) protocol code for webhook SSRF, missing auth, and credential exposure

io.github.4hmetuyar/elicitation-auditor

MCP elicitation anti-patterns: secrets in forms, third-party authorize URLs, credentials in URLs

io.github.4hmetuyar/mcp-config-auditor

Scans Cursor/Claude/Windsurf/VS Code MCP configs for unpinned versions, secrets, typosquats

io.github.4hmetuyar/mcp-server-auditor

Scans MCP server tool definitions for excessive agency, injection sinks, hardcoded secrets

io.github.4hmetuyar/oauth-auditor

Scans MCP server auth code for OAuth 2.1 anti-patterns: token passthrough, missing audience

io.github.4hmetuyar/secret-scanner

Scans files for leaked secrets and API keys

io.github.4hmetuyar/security-proxy

MCP gateway: many servers, one policy, lethal-trifecta blocking, PII masking, audit log

io.github.4hmetuyar/security-suite

Bundle of secret-scanner, dependency-auditor, ssl-inspector, and dns-intelligence

io.github.4hmetuyar/ssl-inspector

TLS certificate/cipher/protocol inspection

AI Scanner

Scan codebases for LLM/AI SDK usage, exposed API tokens, and hardcoded secrets.

GitHub

GitHub via MCP: search, repos, issues, PRs, files, notifications. OAuth device flow or token.

HTTP

HTTP/REST client with saved collections, env secrets, and SSRF-safe host allowlisting.

io.github.Achilles1089/pentagonal-mcp

AI smart contract forge — 8-agent security audits, generation, and compilation across 8 chains

Linear MCP (multi-workspace, PAT auth)

Multi-workspace Linear MCP — PAT auth, 57 tools + 3 prompts, substrate enforcement, drop-in.

Multi-workspace Slack MCP server with draft+confirm safety, vault auto-export, a

Multi-workspace Slack MCP server with draft+confirm safety, vault auto-export, and triple-mode…

AgentStack (agentstack.tech)

Backend for AI agents: one batched tool over ~668 actions (hosting, storage, auth, payments).

io.github.Aguantar/vibescan-mcp-server

MCP server for VibeScan — scan projects for leaked secrets and security issues

io.github.AInoAKARI/keymaster-mcp

Read-only runtime secret retrieval from HashiCorp Vault via Keymaster for autonomous AI agents.

io.github.anima-labs-ai/anima

Give your AI agent an identity it owns: email inbox, US phone number, SMS, voice, and a vault.

AgentAegis

Pay-per-call cybersecurity for AI agents: vuln scans, threat intel, compliance, code security.

io.github.atmflow55/datafood-mcp

DataFood: 16 data sources (crypto/DeFi/security/news/finance) via one MCP. Bundles save ~92%.

Dockerfile Lint

Lint Dockerfiles for root users, latest tags, secrets in ENV or ARG, missing HEALTHCHECK and more.

JWT Tools

Decode JWTs without verifying, flag risky algorithms and claims, verify HS256 or RS256 with a key.

OpenAPI Lint

Lint OpenAPI 3.x documents for missing security, responses, descriptions and versioning.

Security Headers

Fetch a URL's response headers and grade CSP, HSTS, X-Frame-Options and related security headers.

io.github.benbergner/benspdf

Read PDFs locally: text, pages, metadata, scan detection, layout, permissions, render, OCR.

io.github.BlackBoxEngineering/agent-envelope-mcp

Neutral MCP server for AgentEnvelope authority: sovereign verify + vault verify/lookup/mint.

Tripwire

Security gateway for MCP agents: blocks prompt-injection-driven tool calls before they execute.

Margins

Use your Claude Pro/Max subscription on your Obsidian vault. Reads markdown, proposes writes.

Tremelay

Local MCP broker: agents call credentials through a daemon without seeing secrets.

io.github.chrischall/gogcli-mcp-docs

Extended Google Docs for Claude via gogcli — auth + full Docs and comments support

io.github.chrischall/gogcli-mcp-drive

Google Drive via gogcli for Claude — search, upload, download, permissions

io.github.chrischall/gogcli-mcp-sheets

Extended Google Sheets for Claude via gogcli — auth + full Sheets support

cQnce MCP

Add human approval to AI agent workflows through cQnce authorization tools.

Bee — The Progressive Intelligence Engine

Bee — The Progressive Intelligence Engine: tiered LLM, 4 tools, hosted API, free tier.

io.github.cyanheads/pentest-mcp-server

Offline methodology engine for authorized penetration testing, CTF, and security research.

gosidian

Self-hosted Obsidian-compatible markdown vault with a web UI and a 63-tool MCP server for AI agents

TikTok Agent Publisher

Local-first TikTok Content Posting API for AI agents: OAuth checks, dry-run and live uploads.

YouTube Shorts Agent

Agent-first YouTube Shorts uploader: dry-run validation, OAuth checks, synthetic-media metadata.