ZBS Index What actually exists in applied AI, with the source next to it

Security

Everything here was classified as security by keyword match against the maintainer's own description, so treat the grouping as a starting point rather than a verdict.

The list is ordered by the most recent commit, not by stars. A popular project that stopped in 2024 is not a better answer than a smaller one shipped last week.

Worked on in the last 90 days (60)

Someone pushed a commit recently. This is the shortlist worth trying first.

  • io.github.DownAtTheBottomOfTheMoleHole/megalinter — last commit 2026-08-08, v3.0.2
    MCP server for running Ox Security MegaLinter via mega-linter-runner
  • MCP ZAP Server — last commit 2026-08-08, v0.11.0
    Safe, self-hosted OWASP ZAP operator for guided AI security scans and reports.
  • MCP Safety Warden — last commit 2026-08-08, v1.4.10
    MCP proxy adding security scanning, behavioral profiling, risk gating, and safe tool call execution.
  • io.github.Gorgon-Cyber/gorgon-scout — last commit 2026-08-07, v1.0.37
    Run AI-driven web-app and API security scans (DAST) from Claude or any MCP agent. Windows.
  • io.github.duriantaco/skylos — last commit 2026-08-07, v3.5.10
    Dead code, security, secrets detection and code quality for Python, TypeScript, Go.
  • io.github.gambadio/onepassword-agent-mcp — last commit 2026-08-06, v0.3.0
    Local MCP access to approved 1Password fields without exposing plaintext secrets to AI agents.
  • io.github.DingDawg-dev/dingdawg-healthcare-agent — last commit 2026-08-06, v2.0.4
    HIPAA-aware healthcare AI. Clinical documentation, compliance checks, audit prep. Free local tier.
  • io.github.dingdawg/dingdawg-healthcare-agent — last commit 2026-08-06, v2.0.7
    HIPAA-aware healthcare AI. Clinical documentation, compliance checks, audit prep. Free local tier.
  • CrowdStrike Falcon MCP Server — last commit 2026-08-06, v0.16.0
    Connects AI agents with CrowdStrike Falcon for security analysis and automation.
  • Frihet ERP — last commit 2026-08-06, v1.16.3
    AI-native ERP MCP: ES/EU fiscal compliance (VeriFactu/TicketBAI/Facturae), invoicing, tax, banking
  • io.github.99blakeD99/the-metis-fca-handbook-ai-harness-mcp — last commit 2026-08-06, v0.1.3
    MCP server for FCA Handbook compliance analysis with verbatim citations.
  • io.github.altrsoftware/altr-mcp-server — last commit 2026-08-06, v0.5.6
    MCP server for ALTR data security: databases, tags, policies, classification, access, audits
  • com.blackveilsecurity/dns — last commit 2026-08-06, v3.42.0
    DNS and email security scanner with 80 MCP tools for SPF, DMARC, DNSSEC, SSL, and brand audits.
  • com.royalplugins/royal-mcp — last commit 2026-08-06, v1.4.34
    Security-first WordPress MCP server. 129 tools for Claude, ChatGPT, Gemini. Free on wp.org.
  • io.github.getaegis/aegis — last commit 2026-08-06, v1.0.5
    Credential isolation for AI agents. Inject secrets at the network boundary.
  • pkgxray — last commit 2026-08-06, v1.0.5
    Pre-install security scans for npm packages, MCP servers, and AI agents with cited verdict evidence.
  • lu — last commit 2026-08-06, v0.1.0
    lu.ma events MCP server with draft+confirm safety, audit logging, and prompt-injection scrubbing.…
  • Draugr — last commit 2026-08-06, v0.69.0
    Security scanning for AI agents: SAST, SCA, secrets, IaC, DAST, ranked by real risk.
  • com.dbtrail/dbtrail — last commit 2026-08-06, v0.1.0
    MySQL change tracking with instant row-level recovery and forensic attribution for compliance.
  • io.github.dingdawg/dingdawg-code-review — last commit 2026-08-05, v2.0.6
    AI code review — security, quality, performance. Learns your patterns. Receipted.
  • io.github.dingdawg/dingdawg-legal-agent — last commit 2026-08-05, v2.0.7
    AI contract review, clause drafting, compliance checklists & legal research.
  • io.github.dingdawg/dingdawg-shield — last commit 2026-08-05, v1.0.4
    AI security scanning and trust scoring. Stack-specific threat models. Free local scan.
  • n8n MCP Community — last commit 2026-08-05, v0.2.1
    A security-focused MCP server for self-hosted n8n Community Edition.
  • ai.aliengiraffe/spotdb — last commit 2026-08-05, v0.1.0
    Ephemeral data sandbox for AI workflows with guardrails and security
  • io.github.CallMarcus/securityscorecard-mcp — last commit 2026-08-05, v1.1.1
    Community-built, comprehensive MCP server for the SecurityScorecard API (unofficial).
  • TempGuru Event Staffing — last commit 2026-08-05, v1.6.0
    Plan, price, and request quotes for W-2 event staff across 345 US/CA markets; rates and compliance.
  • io.github.4DA-Systems/4da-mcp-server — last commit 2026-08-05, v4.6.6
    Dependency intelligence for AI agents. CVE scanning, health checks, upgrade planning.
  • com.geiant/mcp-agentcore — last commit 2026-08-05, v0.1.0
    AI governance MCP server for EU AI Act compliance and jurisdiction verification
  • io.github.airblackbox/air-blackbox-mcp — last commit 2026-08-05, v0.2.0
    EU AI Act compliance scanner for Python AI agents. 14 tools across 6 articles.
  • Solana Security Standard — last commit 2026-08-05, v1.5.0
    Scan Solana/Anchor code against the Solana Security Standard and serve the ruleset to MCP clients.
  • squirrelscan — last commit 2026-08-05, v1.0.2
    Website QA for your coding agent: audit SEO, performance, security, accessibility over MCP.
  • io.github.eutech-directory/legis-link — last commit 2026-08-04, v0.6.0
    Construction compliance AI. Wire sizing, load calc, battery clearance. AU, USA, CA, UK, EU.
  • MCP Superset — last commit 2026-08-04, v0.2.3
    Apache Superset MCP server — 135+ tools for dashboards, charts, datasets, SQL Lab, and security
  • io.github.CSOAI-ORG/soc2-compliance-ai-mcp — last commit 2026-08-04, v1.0.12
    Soc2 Compliance Ai MCP Server by MEOK AI Labs
  • io.github.CSOAI-ORG/gdpr-compliance-ai-mcp — last commit 2026-08-04, v1.1.12
    Gdpr Compliance Ai MCP Server by MEOK AI Labs
  • Helixar Security — last commit 2026-08-04, v0.0.1
    Security tools for AI agents: scan MCP servers, validate HDP delegation chains, audit releases.
  • ContrastAPI — last commit 2026-08-04, v1.36.0
    55 tools, 7 Resources, Sigma rules, email SPF/DMARC, MITRE, CVE/KEV, risk_score. No key.
  • io.github.bx33661/wireshark-mcp — last commit 2026-08-03, v0.6.5
    Professional network analysis with tshark. Security audits, deep-dives, and threat detection.
  • 1Claw Vault — last commit 2026-08-03, v0.43.1
    HSM-backed vault secrets for AI agents (JIT fetch) plus prompt-injection and threat scanning.
  • AgentAegis — last commit 2026-08-03, v0.3.0
    Pay-per-call cybersecurity for AI agents: vuln scans, threat intel, compliance, code security.
  • com.threadlinqs/intelthreadlinqs-mcp — last commit 2026-08-03, v8.1.1
    Threadlinqs threat-intelligence MCP — 73 tools: threats, detections, IOCs, actors, C2, MITRE, CVEs
  • io.github.Gowthaman90/mcp-bastion — last commit 2026-08-03, v0.6.1
    Reliability + security proxy for MCP: runtime tool-security and a compliance-mapped audit trail.
  • Compliance AIops — last commit 2026-08-03, v0.8.0
    Compliance evidence from AIops audit trails: HIPAA/PCI/SOC2/GDPR, hash-chain-sealed, 18 tools.
  • com.datakoot/security-intel-mcp — last commit 2026-08-02, v2.0.0
    CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.
  • io.github.eltociear/secrets-audit-mcp — last commit 2026-08-02, v1.0.1
    Detects leaked secrets & API keys: 32+ provider rules (AWS, GitHub, Stripe, OpenAI…), zero deps.
  • io.github.arifulislamat/database-mcp-mariadb — last commit 2026-08-02, v0.4.2
    MCP server for MariaDB. Read-only by default, row caps, timeouts, secrets never logged.
  • io.github.arifulislamat/database-mcp-mysql — last commit 2026-08-02, v0.4.2
    MCP server for MySQL. Read-only by default, row caps, statement timeouts, secrets never logged.
  • io.github.arifulislamat/database-mcp-postgres — last commit 2026-08-02, v0.4.2
    MCP server for PostgreSQL. Read-only by default, row caps, timeouts, secrets never logged.
  • Departi – Travel Compliance & Curated Booking — last commit 2026-08-01, v3.1.0
    Visa, Schengen, tax & curated booking for digital nomads across 105 European destinations.
  • mcp-scan — last commit 2026-08-01, v0.2.1
    Passive security scanner: audits MCP servers against the OWASP MCP Top 10, graded A-F.
  • ai.kernora/agent-sec — last commit 2026-07-31, v0.1.0
    Zero-install security baseline for AI coding agents — OWASP/CWE-cited rules over MCP.
  • The Bot Wire — last commit 2026-07-31, v0.5.0
    57 real-time wires from primary sources: SEC, CVEs, courts, Fed, weather, arXiv, news. Free tier.
  • ai.smithery/Nekzus-npm-sentinel-mcp — last commit 2026-07-31, v1.11.8
    Provide AI-powered real-time analysis and intelligence on NPM packages, including security, depend…
  • io.github.cyanheads/nist-nvd-mcp-server — last commit 2026-07-31, v0.2.0
    Search and audit NIST NVD CVEs by keyword, severity, CWE, CISA KEV status, and CPE.
  • io.github.cyanheads/epa-mcp-server — last commit 2026-07-30, v0.3.0
    EPA data: ECHO facility compliance, TRI releases, Superfund, drinking water, and AirNow air quality.
  • io.github.cyanheads/pentest-mcp-server — last commit 2026-07-30, v0.1.6
    Offline methodology engine for authorized penetration testing, CTF, and security research.
  • com.dustforge/demipass — last commit 2026-07-30, v2.5.0
    Credential custody for agents: use secrets blind (ssh/http/smtp/git/db), never in context.
  • Avalara AvaTax — last commit 2026-07-30, v1.0.1
    Access Avalara AvaTax API for tax calculation, transactions, nexus management, and compliance
  • Avalara Classification — last commit 2026-07-30, v1.0.0
    Classify, validate & verify HS codes and access tariff compliance data for cross-border trade
  • Avalara Cross-Border — last commit 2026-07-30, v1.0.0
    Cross-border duty-rate and Trade & Tariff content lookups with product compliance and restrictions

Page 1 of 13

How this page is ordered

Entries are grouped by whether anyone is still working on them, using the date of the most recent push to the repository. They are not ordered by stars, because a star is a bookmark somebody left once and never took back.

Where we have not checked an entry yet, it says so rather than being mixed in with the verified ones.