Best Security MCP Servers

MCPpedia tracks 1,939 security MCP servers. 458 of them score at least 50 out of 100, and 249 clear 70 - about 13% of what has been published in this space. The remaining 1,481 are thinner: registry entries with no description, no published tool schema, or no commit in the last year. They are all still listed here, because knowing a server exists and is unmaintained is worth as much as knowing a good one exists.

io.github.vmoranv/jshookmcp leads the list at 95/100. io.github.KryptosAI/mcp-observatory (92) and io.github.CakeRepository/1password (92) follow. Every score is the same five weighted inputs: security (CVE scanning, tool-poisoning detection, and whether the server authenticates at all), maintenance (commit recency, release cadence, and download trend), documentation, client compatibility, and token efficiency - how much of your context window the tool definitions consume before you have asked anything.

13 of these servers are published by the vendor behind the underlying API rather than by a third party, which is usually the difference between an integration that tracks upstream changes and one that quietly stops working. 3 currently carry an open CVE; those are flagged on the server's own page with the advisory and its severity.

Also see: All Security servers, Best Productivity, Best Developer Tools, Best Data, Best Finance

Last updated November 13, 2026