awesome-mcp-security
🔥🔒 Awesome MCP (Model Context Protocol) Security 🖥️
No outside reports on file
This list itself is safe, but each MCP server it points to carries its own risks—you must carefully evaluate any security tool you actually install and give it only the minimum permissions it needs.
Based on public adoption and transparency signals as of Oct 27, 2026. Our opinion, not a code audit or security guarantee.
What it can access
- Local filesNo local folder access notedLOW
- Command executionNo shell command runner notedLOW
- Network reachConnects to outside service APINOTED
- CredentialsRequires API key or tokenREVIEW
- Package sourceGitHub (Puliczek/awesome-mcp-security)PUBLIC
Inferred from this listing’s public package details and description. Check the project’s source before installing.
Install
No npm or PyPI package is listed. Install from source: github.com/Puliczek/awesome-mcp-security ↗
Everything known
We found nothing about this project in the sources we read (last checked 2026-10-30). That does not mean it has no problems.
0 incidents · 0 advisories · 0 news articles · 0 community threads · checked 2026-10-30
Popularity grade: C (from public signals such as stars and downloads, not a code review). Graded 2026-10-27.
Sources we read: OSV, GitHub Advisory Database, CISA Known Exploited Vulnerabilities, 44 security news feeds and our incident library. Last checked 2026-10-30.
About Awesome MCP Security
This is a curated collection of MCP (Model Context Protocol) servers and tools focused on security. It appears to be a list or resource guide rather than a working tool itself—think of it like a catalog that points to other security-related MCP connectors you could use with AI assistants.
Who it’s for
Security researchers, developers, and AI system administrators who want to find MCP servers that help with security tasks. People building AI agents that need to perform security checks or access security tools.
Alternatives
- Official MCP servers by Anthropic: Vetted tools for common tasks
- Security-focused tool lists on OWASP or GitHub: Curated by established security communities
- Individual MCP servers for specific needs: Rather than a large collection, pick one verified tool per task (e.g., one for scanning, one for reporting)
Setup
Check these steps against the project’s own instructions before running anything.
This is a collection/list repository, not an installable package. Follow the project's README on GitHub for links to the individual MCP servers it recommends.
Why this grade
Signal-based grade (3/7 points): well starred on GitHub, public source code. This reflects adoption and transparency, not a code review.
Popularity and upkeep
- GitHub stars
- 744
- Listing last refreshed
- 2026-10-30
These are public popularity signals, not a maintenance check. Look at the repository’s commit history and open issues.
Risks to watch for
- It's a curated list only: This repository doesn't run code itself; risk depends on which MCP servers from the list you actually install and use
- Unverified recommendations: The collection may include MCP servers created by unknown developers with unknown security practices
- Misleading descriptions: Security tool descriptions could hide what data they actually access (like API keys, credentials, or logs)
- Supply chain risk: If you add multiple security MCP servers, any one compromised tool could spy on all your other tools and data
- Privilege escalation: Security-focused MCP servers often request broad permissions; an attacker-controlled one could abuse this
How to lower the risk
Least-privilege permissions
- Only install MCP servers you actively need right now
- Grant each security tool the minimum scopes (read-only when possible)
Network isolation
- Run security MCP servers in sandboxed environments if they access external APIs
- Monitor outbound network calls to detect data exfiltration
Monitoring
- Audit which servers access credentials, logs, or config files
- Review GitHub repos for recent updates and security issues before installing
Red flags to watch for
- Servers with few stars or infrequent updates
- No clear documentation of what permissions they need
- Requests for broad file system or credential access without clear justification
Questions
How do I install Awesome MCP Security?
Awesome MCP Security does not publish a standalone npm or PyPI package. Clone or follow the setup instructions in its source repository at github.com/Puliczek/awesome-mcp-security.
Are there security reports about Awesome MCP Security?
No reports found for this package in our research (last checked 2026-10-30). Awesome MCP Security currently holds Grade C (Moderate risk signals) based on public adoption and transparency signals. Key risk areas to watch include it's a curated list only, unverified recommendations, misleading descriptions.
Is Awesome MCP Security actively maintained?
Awesome MCP Security has 744 GitHub stars. Our directory data was last refreshed on 2026-10-30. Check recent commit activity, release tags, and open issues at github.com/Puliczek/awesome-mcp-security before pinning it in production.
What are alternatives to Awesome MCP Security?
Notable alternatives to Awesome MCP Security include Official MCP servers by Anthropic (Vetted tools for common tasks), Security-focused tool lists on OWASP or GitHub (Curated by established security communities), Individual MCP servers for specific needs (Rather than a large collection, pick one review tool per task (e.g., one for review, one for reporting)). You can also compare Awesome MCP Security side by side with other MCP servers in the Related tools section on this page.
README badge and team notes
Maintain or use Awesome MCP Security? Show its live grade in your GitHub README, docs site, or run a check from the terminal before you install.
GitHub README Markdown:
[](https://agentarmorhq.com/skills/puliczek-awesome-mcp-security)HTML embed:
<a href="https://agentarmorhq.com/skills/puliczek-awesome-mcp-security"><img src="https://agentarmorhq.com/api/badge/puliczek-awesome-mcp-security" alt="AgentArmorHQ Risk Grade for Awesome MCP Security" height="20" /></a>Terminal check:
curl -fsSL https://agentarmorhq.com/api/cli | node --input-type=module - check "puliczek-awesome-mcp-security"- Compare Awesome MCP Security →
- Add to a team allowlist
- Claude and terminal guide →
- Download the PDF guide
Share with your security lead
Need sign-off to use awesome-mcp-security? Copy this note for Slack, a ticket or a pull request.
### AgentArmorHQ Security Review Memo: awesome-mcp-security
- **Listing URL:** https://agentarmorhq.com/skills/puliczek-awesome-mcp-security
- **Type:** App connector
- **Risk Grade:** Grade C (Moderate risk signals)
- **Outside Security Advisories on File:** 0
- **Public Adoption:** 744 GitHub stars
#### Permission & Blast-Radius Signals
- **Local files:** No local folder access noted
- **Command execution:** No shell command runner noted
- **Network reach:** Connects to outside service API
- **Credentials:** Requires API key or token
- **Package source:** GitHub (Puliczek/awesome-mcp-security)
#### Recommended Hardened Setup
- **Source Repo:** https://github.com/Puliczek/awesome-mcp-security
- **Controls:** Pin an exact version in `.mcp.json`, scope access to a single workspace folder, and use a least-privilege read-only token where supported.
_Based on public adoption and transparency signals as of Oct 27, 2026. Our opinion, not a code audit or security guarantee._Key facts
- Type
- App connector
- Publisher
- Puliczek
- Source code
- github.com/Puliczek/awesome-mcp-security
- Est. context load
- ~700 tokens / turn (~4 tool schemas, 0.35% of 200k context)
- Popularity
- 744 GitHub stars
- Last updated
- 2026-10-30
- Last graded
- 2026-10-27
Community
Discussions for Awesome MCP Security
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.
Check before you install, in Claude
Your assistant answers Block, Review or No known issues for any package before it installs it.
Get this check inside Claude