best of · updated September 2026

The 15 best security MCP servers

The 15 security MCP servers worth your time, out of 1,358 we track - actively maintained, with real adoption, ranked on monthly installs, GitHub stars, and commit recency. Checked nightly.

Security MCP servers assist with scanning, secrets hygiene, or policy checks. Verify scope of write actions and that the project is actively maintained before granting access.

01 Snyk MCP Server ★ 55 · commit 2026-08-19 Easily find and fix security issues in your applications leveraging Snyk platform capabilities. 2,686,402 installs/mo · 7 releases/90d · no env vars documented $ npx -y snyk 02 HOL Guard ★ 625 · commit 2026-09-18 Install HOL Guard Read the documentation PyPI Package (hol-guard) Report an Issue |. 102,537 installs/mo · 10+ releases/90d · no env vars documented $ uvx hol-guard 03 CrowdStrike Falcon MCP Server ★ 256 · commit 2026-09-17 falcon-mcp is a Model Context Protocol (MCP) server that connects AI agents with the CrowdStrike Falcon platform, powering intelligent security analysis in your agentic workflows. 45,564 installs/mo · 8 releases/90d · needs 3 env vars $ uvx falcon-mcp 04 Auth0 MCP Server ★ 121 · commit 2026-09-08 📚 Documentation • 🚀 Getting Started • 💻 Supported Tools • 💬 Feedback. 20,606 installs/mo · 24 tools documented · needs 1 env var $ npx -y @auth0/auth0-mcp-server 05 Observatory ★ 146 · commit 2026-09-15 MCP security scanner. CI-native testing, attack simulation, health scoring, and SARIF. 6,453 installs/mo · 10+ releases/90d · needs 1 env var $ npx -y @kryptosai/mcp-observatory 06 CTRLRun Operator ★ 22 · commit 2026-09-18 ctrlrun stops AI agents from taking wrong, restricted, or malicious actions in your workflows. 12,456 installs/mo · 10+ releases/90d · no env vars documented $ uvx ctrlrun 07 Decionis CommerceGate MCP ★ 533 · commit 2026-09-18 7 documented tools with a focus on commercegate; local stdio install. 823 installs/mo · 7 tools documented · 8 releases/90d · no env vars documented $ npx -y @decionis/commerce 08 Agent Security Scanner MCP ★ 122 · commit 2026-09-10 Security scanner for AI coding agents, MCP servers, prompts, and AI-suggested packages. 6,933 installs/mo · 2 releases/90d · no env vars documented $ npx -y agent-security-scanner-mcp 09 Wireshark MCP ★ 255 · commit 2026-09-05 Give your AI assistant a packet analyzer. 1,752 installs/mo · 2 releases/90d · needs 1 env var $ uvx wireshark-mcp 10 Conarium ★ 3 · commit 2026-09-17 Governed database access for AI assistants: masking, signed receipts, coverage reconciliation. 10,021 installs/mo · 10+ releases/90d · needs 4 env vars $ npx -y @conarium-ai/core 11 Shodan ★ 171 · commit 2026-09-08 A Model Context Protocol (MCP) server for querying the Shodan API and Shodan CVEDB. 1,492 installs/mo · 1 release/90d · needs 1 env var $ npx -y @burtthecoder/mcp-shodan 12 Thumb Gate ★ 26 · commit 2026-09-18 ThumbGate is the self-improving pre-action firewall for AI coding agents AI coding agents repeat mistakes - and one wrong tool call can wipe a directory, leak a key, or push broken code. 2,325 installs/mo · 10+ releases/90d · no env vars documented $ npx -y thumbgate 13 AI AppSec ★ 4 · commit 2026-08-21 Evidence-backed AppSec for AI applications and agents. 14,709 installs/mo · 1 release/90d · no env vars documented $ npx -y ai-appsec 14 Virustotal ★ 149 · commit 2026-09-08 A Model Context Protocol (MCP) server for querying the VirusTotal API. 1,473 installs/mo · needs 2 env vars $ npx -y @burtthecoder/mcp-virustotal 15 Agent Bom ★ 31 · commit 2026-09-18 Open security scanner and self-hosted control plane for AI, MCP, and cloud infrastructure. 1,883 installs/mo · 10+ releases/90d · no env vars documented $ uvx agent-bom

How to choose between them

Snyk MCP Server tops the list - the most installs (2,686,402 last month) and actively maintained. All 15 run locally as stdio servers. 8 document no required env vars - paste the config and go; the others need env vars set first (each page lists exactly which). Where we've compared two of these head-to-head, the comparison is linked on each one's page.

Quick answers

Which security MCP server is most installed?

Snyk MCP Server, with 2,686,402 installs in the last month (as of September 2026). By GitHub stars the leader is HOL Guard (625).

How many security MCP servers exist?

We track 1,358 security MCP servers in the official registry. The 15 above are the actively-maintained ones with real adoption - ranked by monthly installs, GitHub stars, and commit recency.

All 199 security MCP servers

Ranked 16 onward, same order as above. Status checked last night.

How this list is ranked

Ranked from live registry + GitHub data: monthly installs (npm/PyPI), GitHub stars, and commit recency - recomputed nightly. No pay-to-rank, ever. The 15 above lead the full list of 199, all of which you can see on this page. The other 1,159 we track have stopped being maintained, or nobody is using them yet. Full recipe: how we verify.