What is the best MCP servers and plugin for security review?

By tashan's measured score: Zscaler, GitHub Autopilot, Agentic Security, Jfrog, Shieldcortex. the score combines upkeep and freshness, gated by real adoption — every input is public and linked to its source.

How is the ranking calculated?

From public signal only: npm download volume and publish cadence, GitHub push/release recency, contributor count, registry status, and how often a capability appears in real public agent configs. Nobody can pay to change a score, rank, or listing.

The Index · Security review

Security review

Q: Who does security review as part of their job?

This is a process step performed by Computer Network Support Specialists, Database Administrators, Health Informatics Specialists, Information Security Analysts, Information Security Engineers, Network and Computer Systems Administrators, Web Administrators, per the O*NET 30.3 occupational database.

'AppSec' — reviewing systems and code for exploitable weakness. tashan measures 117 capabilities for this work. Ranked on upkeep, freshness and real adoption, every input public. How we measure ›

#	Capability	tashan	Evidence	Health
1	Zscaler primary plugin deep	63	41 ★	active
2	GitHub Autopilot primary plugin deep	55	23 ★	active
3	Agentic Security primary plugin deep	50	73 ★	active
4	Jfrog primary plugin deep	47	4 ★	active
5	Shieldcortex primary npm solid	69	2k/wk	active
6	Js Reverse primary npm solid	69	1k/wk	active
7	Sonarqube primary plugin solid	65	98 ★	active
8	Qodo primary plugin solid	64	44 ★	active
9	Offensive Claude primary plugin solid	62	326 ★	active
10	NPM Sentinel primary npm solid	62	924/wk	active
11	Crowdstrike Falcon Foundry primary plugin solid	60	22 ★	active
12	Armorclaude primary plugin solid	60	44 ★	active
13	AI Agent Firewall primary npm solid	60	454/wk	active
14	Nist Nvd primary npm solid	59	728/wk	active
15	Crowdsec primary plugin solid	55	21 ★	active
16	Healthclaw Guardrails primary plugin solid	55	27 ★	active
17	Malchela primary plugin solid	55	114 ★	active
18	Descope Skills primary plugin solid	49	12 ★	active
19	Onepassword Agent primary npm solid	49	90/wk	active
20	Fort primary plugin solid	45	73 ★	active
21	Nightvision primary plugin solid	44	2 ★	active
22	Usap Skills primary plugin solid	44	3 ★	active
23	Kernel Vuln Analyzer primary plugin solid	44	39 ★	active
24	Dotsecenv primary plugin solid	43	5 ★	active
25	Dreamforge Audit primary plugin solid	43	6 ★	active
26	Secure Sdlc Agents primary plugin solid	41	12 ★	active
27	Rugproof primary plugin solid	38	9 ★	active
28	Prodsec Skills Ge Core primary plugin	55	43 ★	active
29	Stackhawk Skills For Claude primary plugin	51	12 ★	active
30	Clawvet Guard primary plugin	51	11 ★	active
31	Vanta MCP Plugin primary plugin	50	4 marketplaces	—
32	42crunch API Security Testing primary plugin	47	1 ★	active
33	Claude Security primary plugin	46	2 marketplaces	—
34	Security Guidance primary plugin	46	2 marketplaces	—
35	Stackhawk Hawkscan primary plugin	45	3 marketplaces	active
36	Stackhawk API primary plugin	45	3 marketplaces	active
37	Gomboc AI Community primary plugin	43	6 ★	active
38	Fresh Eyes Review primary plugin	42	1 marketplaces	—
39	Clover primary plugin	40	0 ★	active
40	Optibot · Optimal-AI primary plugin	40	1 ★	active
41	Keyward primary plugin	33	1 ★	active
42	Codeguard Security primary plugin thin	66	276 ★	active
43	Aikido primary plugin thin	56	11 ★	active
44	Semgrep primary plugin thin	55	10 ★	active
45	Openzeppelin Skills primary plugin thin	55	202 ★	active
46	Apiiro primary plugin thin	43	3 ★	active
·	Wooyun Legacy primary plugin thin	not scored yet	2k ★	abandoned
48	Observatory supporting npm deep	69	1k/wk	active
49	Nsauditor AI supporting npm deep	66	536/wk	active
50	Codeinspectus supporting npm deep	61	520/wk	active
51	Guardvibe supporting npm deep	55	251/wk	active
52	Safeinstall supporting npm deep	48	94/wk	active
53	Scan · CodingSelim supporting npm deep	42	75/wk	active
54	Judges Panel supporting npm deep	38	97/wk	active
55	GitHub Security supporting npm deep	35	886/wk	abandoned
56	Agent Security Scanner supporting npm solid	65	508/wk	active
57	Black Duck Security Scanner supporting npm solid	61	302/wk	active
58	Verglos supporting npm solid	61	277/wk	active
59	Node9 AI supporting npm solid	59	524/wk	active
60	Seatbelt supporting npm solid	56	450/wk	active
61	Raziel supporting npm solid	56	344/wk	active
62	Bastion supporting npm solid	55	328/wk	active
63	Sparda supporting npm solid	52	124/wk	active
64	Panguard supporting npm solid	49	80/wk	active
65	Customs supporting npm solid	48	172/wk	active
66	Virustotal supporting npm solid	47	396/wk	active
67	Cyberaudit Skill supporting npm solid	46	37/wk	active
68	Solana Security supporting npm solid	44	86/wk	active
69	Checker supporting npm solid	43	67/wk	active
70	Opzyai Security Check supporting npm solid	42	67/wk	active
71	Pop Pay supporting npm solid	40	129/wk	active
72	Inkog IO supporting npm solid	39	42/wk	active
73	Fullcourtdefense CLI supporting npm	71	3k/wk	active
74	Prodcheck supporting npm	69	2k/wk	active
75	Repo Forensics supporting plugin	62	165 ★	active
76	Nel Veil supporting npm	62	1k/wk	active
77	Npmjs supporting npm	62	383/wk	active
78	Electron supporting npm	60	489/wk	active
79	Rad Security supporting npm	60	394/wk	active
80	Arko supporting npm	59	316/wk	active
81	WARDEN — MCP Security Firewall supporting npm	57	255/wk	active
82	Everything Claude Code supporting plugin	56	2k ★	stable
83	Sentinel Scan CLI supporting npm	55	136/wk	active
84	Mcplookup supporting npm	54	527/wk	active
85	Security · paretools supporting npm	53	77/wk	active
86	Calllint supporting npm	52	65/wk	active
87	Argusqa OS supporting npm	51	134/wk	active
88	Auditx supporting npm	51	91/wk	active
89	Mcptrustchecker supporting npm	50	114/wk	active
90	Agentscore Xyz supporting npm	49	121/wk	active
91	Security · myer-2000 supporting npm	48	67/wk	active
92	Agent Security Lens supporting npm	47	111/wk	active
93	Reputa supporting npm	46	73/wk	active
94	Guardian · @mcp-guardian supporting npm	45	93/wk	active
95	Scanpay supporting npm	45	37/wk	active
96	Inner Security supporting npm	45	20/wk	active
97	Ecc Agentshield supporting npm	44	7k/wk	active
98	Mcpskillsio supporting npm	44	123/wk	active
99	Scannd supporting npm	44	76/wk	active
100	Kernlang supporting npm	44	38/wk	active
101	Secure Coding supporting plugin	43	2 ★	active
102	Agent Toolkit · white-hat-lab supporting npm	43	26/wk	active
103	Dryrun Remediation supporting plugin	42	1 marketplaces	—
104	Staff Code Review supporting plugin	42	1 marketplaces	—
105	Vet supporting npm	42	87/wk	active
106	Mcpgrade supporting npm	42	50/wk	active
107	Firewalla supporting npm	42	46/wk	active
108	Edamame supporting plugin	40	0 ★	active
109	Edamame Desktop supporting plugin	39	0 ★	active
110	Improve Vibe Code supporting plugin	39	0 ★	active
111	Vwf supporting plugin	37	1 marketplaces	active
112	Vaspera Hardening supporting npm	37	140/wk	active
113	Ecc · edp43273-glitch supporting plugin	36	0 ★	active
114	AI Review Arena supporting plugin	31	1 ★	active
·	Vanta · @vantasdk supporting npm	not scored yet	16k/wk	abandoned
116	Netintel supporting npm thin	58	430/wk	active
117	Code Guard supporting npm thin	53	348/wk	active

Who does this work

O*NET records this as a core process step for 7 occupations, including Computer Network Support Specialists, Database Administrators, Health Informatics Specialists, Information Security Analysts, Information Security Engineers, Network and Computer Systems Administrators, Web Administrators.

Recorded there as: "Analyze security of systems, network, or data" / "Develop computer or information security policies or procedures" / "Implement security measures for computer or information systems". We publish it under the name practitioners use.

Recently changed in Security review

83 changes recorded here in the last 45 days, newest and most serious first.

2026-08-10 Agent Security Scanner — agent-security-scanner-mcp now runs a script when it installs
2026-08-10 Verglos — verglos now reaches filesystem
2026-08-10 Inkog IO — @inkog-io/mcp now reaches filesystem
2026-08-10 Guardian · @mcp-guardian — @mcp-guardian/server now reaches database, filesystem, network

This page cannot know what you run. tashan doctor reads your own config and names which of these you have — Pro adds the history behind each, and what to move to.

tashan Pro — $6/mo ›

Other work

Agent configuration Agent development Animation and generated imagery Application development Attribution Audio production Audit Bookkeeping Browser automation CAD modelling Career development Code review Content marketing Contract review Copy editing Copywriting Customer support Dashboards and reporting Data pipelines Data quality Database access Debugging Design critique Document production Exploratory data analysis Financial modelling Hardware design Incident response Infrastructure and deployment Knowledge management Literature review Logistics and fulfilment ML engineering Market analysis Messaging and email Model evaluation Observability PRDs and specs Performance optimisation Process automation Product strategy Project management Prompt engineering Query optimisation Recruiting and hiring Regulatory compliance Retrieval systems Risk assessment SEO Sales pipeline Scientific research Software architecture Statistical modelling Technical documentation Test automation Training material User research Version control Video editing Visual design Web development Web research Web scraping

Occupational data from the O*NET 30.3 Database by the U.S. Department of Labor, Employment and Training Administration, used under CC BY 4.0. tashan consolidated its process steps into the terms practitioners use; O*NET does not endorse this site.

See the full Index ›

tashan Pro$6/mo

83 changes across Security review in the last 45 days. A new advisory, an install script appearing, a maintainer leaving. All listed free above. Pro keeps the series behind each row, so a number today comes with a direction.

The whole series behind any row, back to the first day we measured it
The replacement, named — not just the news that something died
tashan doctor over your own config, on your own machine

Start a 7-day trial › Everything measured on this page stays free.