What is the best MCP servers and plugin for a security engineer?

By tashan's measured score the highest-ranked for this work are Korean Law, Zscaler, Openstates, GitHub Autopilot, Ato. The score combines upkeep and freshness, gated by real adoption; every input is public and linked to its source.

What work does this cover?

A security engineer here is the union of the tasks that job performs — security review, regulatory compliance, risk assessment — so a capability appears if it is measured against any of them. 184 capabilities qualify today.

Are these audited for security?

Every capability tashan measures is checked against the OSV advisory database at the version you would install today, for install-time scripts, for build provenance, and for the permission surface its declared dependencies reach. The existence of a finding is always free to see. The audit reads public evidence only and never executes anything, so an empty result means nothing was declared, never that nothing is possible.

The Index · By job · Security engineer

MCP servers & plugins for security engineer, ranked

tashan measures 184 capabilities against the work a security engineer actually does: security review, regulatory compliance, risk assessment. Ranked on public evidence alone: upkeep, freshness and real adoption. How we measure ›

The stack for this job

One pick per task, taken from the ranking below. Best fit first, then how well it documents itself, then the tashan score.

Security reviewShieldcortex69 Regulatory complianceKorean Law72 Risk assessmentScf69

#	Capability	tashan	Evidence	Health
1	Korean Law primary npm deep	72	5k/wk	active
2	Zscaler primary plugin deep	63	41 ★	active
3	Openstates primary npm deep	60	317/wk	active
4	GitHub Autopilot primary plugin deep	55	23 ★	active
5	Ato primary npm deep	53	389/wk	active
6	Courtlistener primary npm deep	53	157/wk	active
7	Agentic Security primary plugin deep	50	73 ★	active
8	Jfrog primary plugin deep	47	4 ★	active
9	Shieldcortex primary npm solid	69	2k/wk	active
10	Js Reverse primary npm solid	69	1k/wk	active
11	Scf primary npm solid	69	923/wk	active
12	Sonarqube primary plugin solid	65	98 ★	active
13	Qodo primary plugin solid	64	44 ★	active
14	Offensive Claude primary plugin solid	62	326 ★	active
15	NPM Sentinel primary npm solid	62	924/wk	active
16	Crowdstrike Falcon Foundry primary plugin solid	60	22 ★	active
17	Armorclaude primary plugin solid	60	44 ★	active
18	AI Agent Firewall primary npm solid	60	454/wk	active
19	Nist Nvd primary npm solid	59	728/wk	active
20	Architecture Studio primary plugin solid	59	284 ★	active
21	Crowdsec primary plugin solid	55	21 ★	active
22	Healthclaw Guardrails primary plugin solid	55	27 ★	active
23	Malchela primary plugin solid	55	114 ★	active
24	Akf primary plugin solid	50	13 ★	active
25	Descope Skills primary plugin solid	49	12 ★	active
26	Onepassword Agent primary npm solid	49	90/wk	active
27	Ris Austria primary npm solid	49	82/wk	active
28	Fort primary plugin solid	45	73 ★	active
29	Nightvision primary plugin solid	44	2 ★	active
30	Usap Skills primary plugin solid	44	3 ★	active
31	Kernel Vuln Analyzer primary plugin solid	44	39 ★	active
32	Dotsecenv primary plugin solid	43	5 ★	active
33	Dreamforge Audit primary plugin solid	43	6 ★	active
34	Secure Sdlc Agents primary plugin solid	41	12 ★	active
35	Tax Law primary npm solid	41	2k/wk	abandoned
36	Rugproof primary plugin solid	38	9 ★	active
37	Labor Law primary npm solid	38	3k/wk	abandoned
38	Prodsec Skills Ge Core primary plugin	55	43 ★	active
39	L4 Computational Law primary plugin	55	37 ★	active
40	Stackhawk Skills For Claude primary plugin	51	12 ★	active
41	Clawvet Guard primary plugin	51	11 ★	active
42	Vanta MCP Plugin primary plugin	50	4 marketplaces	—
43	42crunch API Security Testing primary plugin	47	1 ★	active
44	Claude Security primary plugin	46	2 marketplaces	—
45	Security Guidance primary plugin	46	2 marketplaces	—
46	Stackhawk Hawkscan primary plugin	45	3 marketplaces	active
47	Stackhawk API primary plugin	45	3 marketplaces	active
48	Gomboc AI Community primary plugin	43	6 ★	active
49	Langguard Scope primary plugin	43	5 ★	active
50	Fianu Skills primary plugin	43	1 ★	active
51	Fresh Eyes Review primary plugin	42	1 marketplaces	—
52	Clover primary plugin	40	0 ★	active
53	Optibot · Optimal-AI primary plugin	40	1 ★	active
54	Bubble Shield primary plugin	40	0 ★	active
55	Keyward primary plugin	33	1 ★	active
56	Codeguard Security primary plugin thin	66	276 ★	active
57	Aikido primary plugin thin	56	11 ★	active
58	Semgrep primary plugin thin	55	10 ★	active
59	Openzeppelin Skills primary plugin thin	55	202 ★	active
60	Apiiro primary plugin thin	43	3 ★	active
·	Wooyun Legacy primary plugin thin	not scored yet	2k ★	abandoned
62	Observatory supporting npm deep	69	1k/wk	active
63	Marrow supporting npm deep	69	1k/wk	active
64	Governance SDK supporting npm deep	68	3k/wk	active
65	Nsauditor AI supporting npm deep	66	536/wk	active
66	Codeinspectus supporting npm deep	61	520/wk	active
67	Guardvibe supporting npm deep	55	251/wk	active
68	GIA — Governed Intelligence Architecture supporting npm deep	50	95/wk	active
69	Safeinstall supporting npm deep	48	94/wk	active
70	Dingdawg Compliance supporting npm deep	48	88/wk	active
71	Scan · CodingSelim supporting npm deep	42	75/wk	active
72	Judges Panel supporting npm deep	38	97/wk	active
73	GitHub Security supporting npm deep	35	886/wk	abandoned
74	Agent Security Scanner supporting npm solid	65	508/wk	active
75	Black Duck Security Scanner supporting npm solid	61	302/wk	active
76	Verglos supporting npm solid	61	277/wk	active
77	Node9 AI supporting npm solid	59	524/wk	active
78	Agent Passport System — Cryptographic Identity for AI Agents supporting npm solid	57	325/wk	active
79	Seatbelt supporting npm solid	56	450/wk	active
80	Raziel supporting npm solid	56	344/wk	active
81	Bastion supporting npm solid	55	328/wk	active
82	SWT3 AI Witness supporting npm solid	54	241/wk	active
83	Nexus Agents supporting npm solid	53	194/wk	active
84	Sparda supporting npm solid	52	124/wk	active
85	Thesmos Governance supporting npm solid	50	150/wk	active
86	Panguard supporting npm solid	49	80/wk	active
87	Lexvibe supporting npm solid	49	81/wk	active
88	Customs supporting npm solid	48	172/wk	active
89	Virustotal supporting npm solid	47	396/wk	active
90	Graph Aave supporting npm solid	47	154/wk	active
91	Cyberaudit Skill supporting npm solid	46	37/wk	active
92	Kasbah supporting npm solid	45	94/wk	active
93	Solana Security supporting npm solid	44	86/wk	active
94	Checker supporting npm solid	43	67/wk	active
95	Zentric Protocol supporting npm solid	43	108/wk	active
96	Opzyai Security Check supporting npm solid	42	67/wk	active
97	Defi Guard supporting npm solid	42	60/wk	active
98	Pop Pay supporting npm solid	40	129/wk	active
99	Inkog IO supporting npm solid	39	42/wk	active
100	Audit Trail · piqrypt supporting npm solid	39	91/wk	active
101	Korext: AI Code Governance supporting npm solid	37	54/wk	active
·	Company Gi supporting npm solid deprecated	not scored yet	55/wk	abandoned
103	Ifixai supporting plugin	79	13k ★	active
104	Fullcourtdefense CLI supporting npm	71	3k/wk	active
105	Prodcheck supporting npm	69	2k/wk	active
106	Ges supporting npm	63	649/wk	active
107	Grc supporting npm	63	239/wk	active
108	Repo Forensics supporting plugin	62	165 ★	active
109	Nel Veil supporting npm	62	1k/wk	active
110	Npmjs supporting npm	62	383/wk	active
111	H1veframework supporting npm	62	488/wk	active
112	Electron supporting npm	60	489/wk	active
113	Rad Security supporting npm	60	394/wk	active
114	Compliance supporting npm	60	519/wk	active
115	Arko supporting npm	59	316/wk	active
116	WARDEN — MCP Security Firewall supporting npm	57	255/wk	active
117	Everything Claude Code supporting plugin	56	2k ★	stable
118	Deadchannel supporting npm	56	353/wk	active
119	Sentinel Scan CLI supporting npm	55	136/wk	active
120	Compliance · yaktool-compliance-mcp supporting npm	55	187/wk	active
121	Crypto Signals supporting npm	55	186/wk	active
122	Mcplookup supporting npm	54	527/wk	active
123	VITNA — Agent Compliance Preflight supporting npm	54	317/wk	active
124	Epa supporting npm	54	172/wk	active
125	Security · paretools supporting npm	53	77/wk	active
126	Calllint supporting npm	52	65/wk	active
127	ComplyEdge TrustLint — offline EU AI Act compliance checks supporting npm	52	58/wk	active
128	Argusqa OS supporting npm	51	134/wk	active
129	Auditx supporting npm	51	91/wk	active
130	Mcptrustchecker supporting npm	50	114/wk	active
131	Walletbureau supporting npm	50	152/wk	active
132	Agentscore Xyz supporting npm	49	121/wk	active
133	Legal Doc Analyzer supporting npm	49	139/wk	active
134	Security · myer-2000 supporting npm	48	67/wk	active
135	Regixo supporting npm	48	63/wk	active
136	Trustmodel supporting npm	48	59/wk	active
137	Agent Security Lens supporting npm	47	111/wk	active
138	Evolith Architecture Governance supporting npm	47	32/wk	active
139	Reputa supporting npm	46	73/wk	active
140	Privacypage supporting npm	46	41/wk	active
141	Guardian · @mcp-guardian supporting npm	45	93/wk	active
142	Scanpay supporting npm	45	37/wk	active
143	Inner Security supporting npm	45	20/wk	active
144	Aga supporting npm	45	76/wk	active
145	Sentrik supporting npm	45	52/wk	active
146	Ecc Agentshield supporting npm	44	7k/wk	active
147	Mcpskillsio supporting npm	44	123/wk	active
148	Scannd supporting npm	44	76/wk	active
149	Kernlang supporting npm	44	38/wk	active
150	Governance supporting npm	44	61/wk	active

Recently changed in Security engineer

142 changes recorded here in the last 45 days, newest and most serious first.

2026-08-05 GIA — Governed Intelligence Architecture — gia-mcp-server now reaches database
2026-08-10 Korean Law — korean-law-mcp now reaches credentials
2026-08-10 Agent Security Scanner — agent-security-scanner-mcp now runs a script when it installs
2026-08-10 Verglos — verglos now reaches filesystem

This page cannot know what you run. tashan doctor reads your own config and names which of these you have — Pro adds the history behind each, and what to move to.

tashan Pro — $6/mo ›

Showing the top 150 of 184 — the rest are on the Index, filterable by this job.

88 of these are graded against their own documentation. The rest carry adoption and upkeep signal only. We publish what is measured and name what is not.

The work behind this job

Security review Regulatory compliance Risk assessment

Other jobs

Open this job on the Index ›

tashan Pro$6/mo

142 changes across Security engineer in the last 45 days. A new advisory, an install script appearing, a maintainer leaving. All listed free above. Pro keeps the series behind each row, so a number today comes with a direction.

The whole series behind any row, back to the first day we measured it
The replacement, named — not just the news that something died
tashan doctor over your own config, on your own machine

Start a 7-day trial › Everything measured on this page stays free.