What is the best security MCP server?

By tashan's measured score, the highest-ranked are ALTWEB Context Loader, MuPag Sandbox Payments, Sparda, Agentpay, Kit · paybond. the score combines upkeep and freshness, gated by real adoption — every input is public and linked to its source.

How many security MCP servers are there?

tashan currently measures 120 capabilities in this category out of its full tracked corpus. The count moves as servers are published and as adoption changes.

How is the ranking calculated?

From public signal only: npm download volume and publish cadence, GitHub push/release recency, contributor count, registry status, and how often the server appears in real public agent configs. Nobody can pay to change a score, rank, or listing.

The Index · Security

Security MCP servers & plugins, ranked

Auth, secrets, scanning, identity. tashan measures 120 capabilities here. Ranked on upkeep, freshness and real adoption, every input public. How we measure ›

#	Capability	tashan	Evidence	Health
1	ALTWEB Context Loader npm	52	148/wk	active
2	MuPag Sandbox Payments npm	52	140/wk	active
3	Sparda npm solid	52	124/wk	active
4	Agentpay npm	52	108/wk	active
5	Kit · paybond npm solid	52	103/wk	active
6	Agentguard npm	52	90/wk	active
7	Base Image Eol Lint npm	52	86/wk	active
8	Ratchet npm	52	75/wk	active
9	Calllint npm	52	65/wk	active
10	Heartflow npm	52	60/wk	active
11	ComplyEdge TrustLint — offline EU AI Act compliance checks npm	52	58/wk	active
12	Claude Deep Review plugin	51	11 ★	active
13	Stackhawk Skills For Claude plugin	51	12 ★	active
14	Superpowers Optimized plugin solid	51	128 ★	active
15	Covenant Guard plugin	51	11 ★	active
16	Clawvet Guard plugin	51	11 ★	active
17	Bullshit Detector plugin thin	51	111 ★	active
18	Moodle Dev plugin	51	33 ★	active
19	Anaydhawan Oss Launch plugin	51	11 ★	active
20	Whats Allowed npm solid	51	348/wk	active
21	Pylos npm	51	274/wk	active
22	Workplace Program Detector npm	51	212/wk	active
23	GitHub Organization Signal Scanner npm	51	179/wk	active
24	Trustcard npm solid	51	177/wk	active
25	Moneolabs npm solid	51	171/wk	active
26	X MCP AI npm	51	167/wk	active
27	Rune npm	51	158/wk	active
28	Rubric Protocol npm thin	51	152/wk	active
29	Pulsefeed X402 npm	51	134/wk	active
30	Email Guard npm thin	51	132/wk	active
31	WordPress · adsim npm	51	122/wk	active
32	Ipgeolocation IO npm deep	51	119/wk	active
33	Vikunja npm	51	97/wk	active
34	Umbra npm solid	51	96/wk	active
35	Auditx npm	51	91/wk	active
36	Neither npm	51	79/wk	active
37	Vanta MCP Plugin plugin	50	4 marketplaces	—
38	Agentic Security plugin deep	50	73 ★	active
39	Akf plugin solid	50	13 ★	active
40	Sigma Skills plugin	50	11 ★	active
41	Bash Classify Hook plugin	50	7 ★	active
42	Session Sitter plugin	50	7 ★	active
43	Positif npm	50	191/wk	active
44	Lazaretto npm	50	191/wk	active
45	Funding Press Signal Scanner npm solid	50	169/wk	active
46	Toolfunnel npm solid	50	167/wk	active
47	Laguarde npm	50	163/wk	active
48	Blackwall npm deep	50	161/wk	active
49	Thesmos Governance npm solid	50	150/wk	active
50	Atlas npm solid	50	114/wk	active
51	Mcptrustchecker npm	50	114/wk	active
52	Tokei Agent npm solid	50	111/wk	active
53	Securityscorecard npm solid	50	100/wk	active
54	Fullstackgtm npm	50	99/wk	active
55	GIA — Governed Intelligence Architecture npm deep	50	95/wk	active
56	Viberevert npm	50	89/wk	active
57	Hammerspoon npm	50	84/wk	active
58	Cinema4d npm	50	77/wk	active
59	Osint Agent Skills npm	50	73/wk	active
60	Hol Guard plugin	49	4 ★	active
61	Budgetclaw plugin deep	49	8 ★	active
62	Onepassword npm	49	394/wk	active
63	Security Scanner npm	49	146/wk	active
64	Wjttc npm	49	143/wk	active
65	Legal Doc Analyzer npm	49	139/wk	active
66	Looppause npm solid	49	134/wk	active
67	Vanta npm	49	130/wk	active
68	4da npm thin	49	123/wk	active
69	AI Tooling Detector npm	49	123/wk	active
70	Agentscore Xyz npm	49	121/wk	active
71	Agentic Sdlc npm deep	49	104/wk	active
72	Onepassword Agent npm solid	49	90/wk	active
73	Package Guard npm thin	49	86/wk	active
74	Panguard npm solid	49	80/wk	active
75	Unmarking npm	49	67/wk	active
76	Assistantmail npm	49	46/wk	active
77	Open Kioku npm	49	44/wk	active
78	Nxtg Forge plugin thin	48	5 ★	active
79	Tool Gates plugin solid	48	5 ★	active
80	Agent Sanitizer plugin	48	3 ★	active
81	Vaara Governance plugin solid	48	10 ★	active
82	Customs npm solid	48	172/wk	active
83	Proofslip npm solid	48	143/wk	active
84	Leakrank Guard npm	48	108/wk	active
85	Lucairn npm solid	48	100/wk	active
86	Safeinstall npm deep	48	94/wk	active
87	DNS Doctor npm solid	48	94/wk	active
88	Rules npm	48	94/wk	active
89	Creedspace npm solid	48	91/wk	active
90	Runcycles npm	48	90/wk	active
91	Dingdawg Compliance npm deep	48	88/wk	active
92	Fractascan npm	48	80/wk	active
93	T Rush npm thin	48	79/wk	active
94	Sima npm	48	79/wk	active
95	Secret npm	48	78/wk	active
96	Audrey npm deep	48	73/wk	active
97	Security · myer-2000 npm	48	67/wk	active
98	Gblin npm solid	48	66/wk	active
99	Litmus npm	48	64/wk	active
100	Regixo npm	48	63/wk	active
101	Trustmodel npm	48	59/wk	active
102	Keyring npm	48	49/wk	active
103	Regionfetch npm	48	49/wk	active
104	42crunch API Security Testing plugin	47	1 ★	active
105	Flexcompute plugin solid	47	5 ★	active
106	Jfrog plugin deep	47	4 ★	active
107	Pactkit plugin	47	5 ★	active
108	Virustotal npm solid	47	396/wk	active
109	I1n npm solid	47	182/wk	active
110	Slim Guard npm solid	47	173/wk	active
111	Agent Memory · xultrax-web npm	47	118/wk	active
112	Agent Security Lens npm	47	111/wk	active
113	Chainweb API npm solid	47	102/wk	active
114	AI Proof Of Us npm thin	47	98/wk	active
115	Davinci npm solid	47	87/wk	active
116	Yifangyun npm	47	76/wk	active
117	Zapret2 npm solid	47	66/wk	active
118	Tie npm	47	55/wk	active
119	Arc Control (macOS) npm	47	48/wk	active
120	Hscli npm	47	45/wk	active

Recently changed in Security

94 changes recorded here in the last 45 days, newest and most serious first.

2026-08-05 GIA — Governed Intelligence Architecture — gia-mcp-server now reaches database
2026-08-11 Fractascan — fractascan-mcp now reaches network
2026-08-11 Keyring — @basedagents/keyring now reaches browser, network
2026-08-11 Yifangyun — yifangyun-mcp-server now reaches network

This page cannot know what you run. tashan doctor reads your own config and names which of these you have — Pro adds the history behind each, and what to move to.

tashan Pro — $6/mo ›

50 of these are graded against their own documentation. The rest carry adoption and upkeep signal only. We publish what is measured and name what is not.

Head to head

The question people actually ask, answered with two measurements taken the same day by the same scorer.

Assessment vs Consent Auth0 vs Consent Preflight vs Consent Accessibility Scanner vs Consent Ghl Command vs Consent Fullcourtdefense CLI vs Consent Agent Hooks vs Consent Auth0 vs Assessment Preflight vs Assessment Accessibility Scanner vs Assessment Ghl Command vs Assessment Fullcourtdefense CLI vs Assessment

Other categories

Browser & Web Search Database Dev Tools & CI Cloud & Infra Files & Memory Data & Analytics Docs & Knowledge Communication Design AI & Agents Finance & Crypto Productivity Other

See the full Index ›

tashan Pro$6/mo

94 changes across Security capabilities in the last 45 days. A new advisory, an install script appearing, a maintainer leaving. All listed free above. Pro keeps the series behind each row, so a number today comes with a direction.

The whole series behind any row, back to the first day we measured it
The replacement, named — not just the news that something died
tashan doctor over your own config, on your own machine

Start a 7-day trial › Everything measured on this page stays free.