your ad here · $149/weekyour ad here · $149/weekyour ad here · $149/weekyour ad here · $149/weekyour ad here · $149/weekyour ad here · $149/weekyour ad here · $149/weekyour ad here · $149/weekyour ad here · $149/weekyour ad here · $149/weekyour ad here · $149/weekyour ad here · $149/week

MCP servers

Security MCP servers

Static analysis, dependency checks and security testing tools an agent can call on its own code. 6 servers, 5 of them official, with the command to add each one, GitHub stars and the last push. Updated 2026-10-20.

Security & code quality

6

6 of 6 servers

  • Burp SuiteOfficial · PortSwigger

    Use Burp Suite from an agent: send requests, read proxy history and scanner issues.

    ★ 1.2kpushed 2026-10-16GPL-3.0

    See docs

    Setup is in the README (it needs a build step, an app plugin or your account details).

  • SonarQubeOfficial · Sonar

    Code quality and security issues, quality gates and metrics from SonarQube Cloud or Server.

    ★ 665pushed 2026-10-20

    Local (stdio)
    claude mcp add --env SONARQUBE_TOKEN=... --transport stdio sonarqube -- docker run -i --rm -e SONARQUBE_TOKEN docker.io/sonarsource/sonarqube-mcp

    Needs SONARQUBE_TOKEN

  • SocketOfficial · Socket

    Check npm, PyPI and other packages for supply-chain risk before the agent installs them.

    ★ 139pushed 2026-10-14MIT

    Remote
    claude mcp add --transport http socket https://mcp.socket.dev/
  • TrivyOfficial · Aqua Security

    Scan filesystems, images and repos for vulnerabilities and misconfigurations with Trivy.

    ★ 53pushed 2025-12-17MITAqua Security on DevHunt

    See docs

    Setup is in the README (it needs a build step, an app plugin or your account details).

  • SnykOfficial · Snyk

    Snyk code, dependency, container and IaC scans, built into the Snyk CLI.

    on DevHunt

    Local (stdio)
    claude mcp add snyk -- npx -y snyk@latest mcp -t stdio
  • GhidraMCPCommunity

    Reverse engineering with Ghidra: decompile, rename and inspect binaries.

    ★ 11kpushed 2026-10-10Apache-2.0

    See docs

    Setup is in the README (it needs a build step, an app plugin or your account details).

Using Cursor, VS Code or Claude Desktop? How to add an MCP server to each client. Read a server's permissions before you connect it to real accounts, and start with read-only or test keys.

FAQ

What is the best security MCP server?+

Start with the official server for the product you use: Burp Suite, SonarQube, Socket, Trivy, Snyk. Popular community options: GhidraMCP.

Which security MCP servers are official?+

5 of the 6 here are built by the vendor or the MCP project: Burp Suite, SonarQube, Socket, Trivy, Snyk.

Which security MCP servers need no install?+

Socket run as hosted remote servers: add the URL to your client and sign in. The rest run locally with npx, uvx or Docker.

How do I add a security MCP server to Claude Code or Cursor?+

In Claude Code, run the command shown next to the server (claude mcp add ...). In Cursor, VS Code or Claude Desktop, add the same URL or command to the client’s mcp.json; the MCP servers hub has a snippet for each client.

More MCP servers: Databases · Browser automation & web scraping · Dev tools & Git · Docs & code context · Cloud & DevOps · Monitoring & analytics · Search & web data · Files & documents · Productivity & project management · Messaging & email · Design & frontend · Payments & commerce · AI, memory & reasoning · MCP tools launched on DevHunt