Easily find and fix security issues in your applications leveraging Snyk platform capabilities.
Free
2,165 MCP servers
Security & Testing
Reverse engineer anything from your terminal or agent with one CLI and MCP server.
Free
Local MCP capabilities provider for Expo
Free
Aikido MCP server
Free
MCP server for Appium mobile automation on iOS and Android devices with test creation tools.
Free
Model Context Protocol server for Vanta's security compliance platform
Free
Connects AI agents with CrowdStrike Falcon for security analysis and automation.
Free
This package has been renamed to snyk-agent-scan. This is a redirect package that installs snyk-agent-scan and forwards the mcp-scan CLI to
Free
MCP server + live dashboard for AI code governance — OWASP LLM Top 10 (10/10), real-time MCP App UI, 25+ security patterns, Bayesian
Free
Evidence-backed AppSec for AI applications and agents. Powered by HAIEC.
Free
Static analysis scanner for MCP server code and multi-tenant SaaS applications.
Free
Proves software work: triages failing tests, checks whether a test can fail, and reads migrations.
Free
Official MCP server for Qase — manage test cases, runs, suites, defects via AI tools.
Free
Vibe reversing with IDA Pro
Free
Testrail is an MCP server that runs on your own machine, started by your client over stdio.
Free
Mobile device interaction automation via MCP
Free
Open COSO internal-control review MCP: scope, risk, controls, sampling, testing, workpapers.
Free
MCP server for Shodan API — device search, IP lookup, DNS, and CVE/CPE queries.
Free
MCP server for AI-powered web search via intel.asrai.me with x402 micropayments on Base
Free
Open-source terminal AI agent. 100+ specialist skills + audit-grade finance infra via @kernel.chat/kbot-finance. Content-addressed
Free
MCP server for Baseline UI design system documentation
Free
Security & Testing MCP servers on mcprush stand in front of everything else an agent does: allow, deny or ask, per tool; short-lived credentials instead of keys in the context window; findings ranked by whether they are reachable rather than by how many there are.
What to look at before installing one is where the credential lives and whether it ever enters the model’s context. That single answer separates most of this category into two halves. Every server here names the publisher behind it and whether that publisher has been verified, the runtime it uses, how it authenticates, the tool surface it exposes and the price model it is sold under — and where a security scan has been run against it, what the scan found. The filters on the left narrow it further and the sort at the top decides what comes first.
Nearly every server in this catalogue is connected straight to its publisher: the listing gives the publisher’s own address or start command, and mcprush is not in the path, so nothing is routed, metered or billed here. The exception is a server delivered through the mcprush gateway — there one key covers everything installed against your account, the calls are metered where you can see them and the ceiling on what they may cost is yours to set, and installing it is a line of the mcprush CLI: npx mcprush@latest add, followed by the server’s id. The listing says which of the two it is before you install anything.