Best Security MCP Servers

MCPpedia tracks 1,431 security MCP servers. 347 of them score at least 50 out of 100, and 180 clear 70 - about 13% of what has been published in this space. The remaining 1,084 are thinner: registry entries with no description, no published tool schema, or no commit in the last year. They are all still listed here, because knowing a server exists and is unmaintained is worth as much as knowing a good one exists.

io.github.vmoranv/jshookmcp leads the list at 93/100. Ida Pro MCP (92) and io.github.KryptosAI/mcp-observatory (92) follow. Every score is the same five weighted inputs: security (CVE scanning, tool-poisoning detection, and whether the server authenticates at all), maintenance (commit recency, release cadence, and download trend), documentation, client compatibility, and token efficiency - how much of your context window the tool definitions consume before you have asked anything.

13 of these servers are published by the vendor behind the underlying API rather than by a third party, which is usually the difference between an integration that tracks upstream changes and one that quietly stops working. 3 currently carry an open CVE; those are flagged on the server's own page with the advisory and its severity.

Also see: All Security servers, Best Productivity, Best Developer Tools, Best Data, Best Finance

Last updated September 29, 2026