Security MCP servers for scanning and threat intel
Security MCP servers for vulnerability scanning, secrets detection, threat intelligence, and SIEM queries. Compare scopes and trust scores side by side.
What to know about Security MCP servers
Security servers bring scanners and intelligence feeds into an assistant's toolbox. Common types include dependency and container vulnerability scanners, static analysis tools such as Semgrep, secrets detectors, threat intelligence lookups such as VirusTotal and Shodan, and connectors for SIEM platforms where analysts search alerts and logs.
For developers, the everyday win is asking an agent to scan a change and explain the findings in context, then propose a fix. For security teams, it is triage: enriching an indicator with several intelligence sources at once, or summarising a burst of related alerts into one narrative.
This is also the category where the server itself deserves the most scrutiny. Prefer servers with published source, pinned versions, and a clear list of tools, and check the security signals in each listing's trust score before connecting one to sensitive systems.
Security MCP servers
The 12 strongest of 1795 matching servers. Servers that name the topic directly come first, then by trust score.
- 76Trust score 76 of 100, Good
shodan
by burtthecoder · TypeScript
MCP server for Shodan API — device search, IP and domain recon, DNS, and CVE/CPE queries.
RegistryLicenseQualityMaintenanceLicense: A. MIT is a permissive open source license.Quality: Not graded. No README or tool list has been captured yet.Maintenance: A. Last commit or release 19 days ago. - 76Trust score 76 of 100, Good
virustotal
by burtthecoder · TypeScript
MCP server for querying VirusTotal API with comprehensive security analysis tools.
RegistryLicenseQualityMaintenanceLicense: A. MIT is a permissive open source license.Quality: Not graded. No README or tool list has been captured yet.Maintenance: A. Last commit or release 15 days ago. 
73Trust score 73 of 100, GoodEchelonGraph CVE & Exposure
by echelongraph · JavaScript
CVE, KEV, EPSS, SBOM and advisory lookups; per-CVE exposure from Shodan data (© Shodan). Keyless.
RegistryRemoteLicenseQualityMaintenanceLicense: A. MIT is a permissive open source license.Quality: Not graded. No README or tool list has been captured yet.Maintenance: A. Last commit or release 6 days ago.- 68Trust score 68 of 100, Good
Shodan
by pipeworx-io · JavaScript
Shodan MCP — wraps the full Shodan REST API (api.shodan.io)
RegistryRemoteLicenseQualityMaintenanceLicense: A. MIT is a permissive open source license.Quality: Not graded. No README or tool list has been captured yet.Maintenance: A. Last commit or release 9 days ago. - 67Trust score 67 of 100, Good
Shodan Internetdb
by pipeworx-io · JavaScript
Shodan InternetDB MCP — wraps Shodan InternetDB (internetdb.shodan.io)
RegistryRemoteLicenseQualityMaintenanceLicense: A. MIT is a permissive open source license.Quality: Not graded. No README or tool list has been captured yet.Maintenance: A. Last commit or release 9 days ago. - 67Trust score 67 of 100, Good
Virustotal
by pipeworx-io · JavaScript
VirusTotal MCP — file / URL / domain / IP reputation (BYO key)
RegistryRemoteLicenseQualityMaintenanceLicense: A. MIT is a permissive open source license.Quality: Not graded. No README or tool list has been captured yet.Maintenance: A. Last commit or release 9 days ago. - 55Trust score 55 of 100, Fair
BlackVeil DNS & Email Security Scanner
by madaburns · TypeScript
DNS and email security scanner with 81 MCP tools for SPF, DMARC, DNSSEC, SSL, and brand audits.
RegistryRemoteLicenseQualityMaintenanceLicense: Not graded. No license is recorded for this server.Quality: Not graded. No README or tool list has been captured yet.Maintenance: A. Last commit or release 12 days ago. - 55Trust score 55 of 100, Fair
Reference MCP server for synthetic APC action-security evaluation and local SQLite sandbox testin...
RegistryLicenseQualityMaintenanceLicense: Not graded. No license is recorded for this server.Quality: Not graded. No README or tool list has been captured yet.Maintenance: Not graded. No commit or release date has been recorded. 
55Trust score 55 of 100, FairAbnormal Security email threats, cases, and reporting in your terminal and your AI agents.
RegistryLicenseQualityMaintenanceLicense: Not graded. No license is recorded for this server.Quality: Not graded. No README or tool list has been captured yet.Maintenance: Not graded. No commit or release date has been recorded.- 55Trust score 55 of 100, Fair
Read-only library of 24 defensive cybersecurity skills: ATT&CK, ATLAS, DFIR, CTEM and more.
RegistryRemoteLicenseQualityMaintenanceLicense: Not graded. No license is recorded for this server.Quality: Not graded. No README or tool list has been captured yet.Maintenance: Not graded. No commit or release date has been recorded. - 55Trust score 55 of 100, Fair
Security-first Binance MCP. 26 tools, human-confirmed spot trades, offline quant research.
RegistryLicenseQualityMaintenanceLicense: Not graded. No license is recorded for this server.Quality: Not graded. No README or tool list has been captured yet.Maintenance: Not graded. No commit or release date has been recorded. - 55Trust score 55 of 100, Fair
Scan your own website for vulnerabilities: DNS takeover, compromised CDNs, debug mode and more.
RegistryLicenseQualityMaintenanceLicense: Not graded. No license is recorded for this server.Quality: Not graded. No README or tool list has been captured yet.Maintenance: Not graded. No commit or release date has been recorded.
How to install one
- Compare the shortlist. shodan leads this topic. Open two or three listings and compare their tools, transport, and required API keys.
- Copy the config for your client. Each listing has an install guide, for example Claude Desktop, Claude Code, Cursor, or VS Code. The client guides show where each config file lives.
- Scope credentials, then restart. Use the narrowest token or folder the server needs, restart the client, and check that the new tools appear.
Security MCP questions
How do I know a security MCP server is itself safe?
Check the license, source repository, release history, and install method on its page. The trust methodology explains the security signals that feed every score.
Can an MCP server scan my code for vulnerabilities?
Yes. Semgrep, Snyk, and other static analysis servers scan files or diffs and return findings the model can explain and fix. Dependency scanners check lockfiles against known CVEs.
Are there MCP servers for penetration testing?
Some servers wrap tools such as Nmap or Burp for authorised testing. Use them only against systems you are permitted to test, and keep them isolated from your everyday client configuration.