Skip to content
Agentmart
Submit a tool

AI agent tools for security scanning

In this catalog, a security scanning tool is one that finds vulnerabilities, secrets or misconfigurations in code, dependencies or systems. Our enrichment pass tags 331 listings with it: 88 MCP servers, 115 agent skills, 23 plugins, 1 agent framework, 103 AI agents and 1 no-code agent builder. By listing rank, the top MCP server is REA, the top agent skill is security-advisory and the top AI agent is Shannon. 47 of the 331 are published by the vendor behind the product, and 223 were active in the last 30 days. 7 of the 88 MCP servers run only as remote servers, with nothing to install locally. Each entry below links to its listing page, with grades, install commands and sources.

Updated Oct 26, 2026 · Built from catalog data; how we rank and grade

What the job is

Tagged listings
331
By type
88 MCP servers, 115 agent skills, 23 plugins, 1 agent framework, 103 AI agents and 1 no-code agent builder
Published by the vendor
47 of 331
Active in the last 30 days
223 of 331
Open source
224 of 331
MCP servers that run only remotely
7 of 88
Hosts named by the MCP servers
Claude Code (85), Cursor (85), VS Code (85)

Building blocks by type

The top entries of each type, by listing rank. Open a listing for its install command, grades and sources.

MCP servers 88 tagged

  1. 1
    REA

    morluto

    Reverse engineer anything from your terminal or agent with one CLI and MCP server.

    • Most GitHub stars here (377,435)
    • Active in the last 30 days
    • Open source (MIT)

    ★ 377.4KLast active Oct 25, 2026Local (stdio)Claude Code, Codex, VS Code, Cursor +2

  2. 2
    SafeDep Vet MCP

    safedep

    Protect your AI agents and IDEs from malicious open-source packages.

    • 1.1K GitHub stars
    • Active in the last 30 days
    • Open source (Apache-2.0)

    ★ 1.1KLast active Oct 24, 2026Local (stdio)Claude Code, Codex, VS Code, Cursor +2

  3. 3
    HOL Guard

    hashgraph-online

    Local-first AI agent security evidence and approval workflows through HOL Guard's stdio MCP server.

    • Most weekly downloads here (8.4K)
    • Active in the last 30 days
    • Open source (Apache-2.0)

    ★ 975↓ 8.4K/wkLast active Oct 24, 2026Local (stdio)Claude Code, Codex, VS Code, Cursor +2

  4. 4
    SonarQube MCP Server

    SonarSourceOfficial

    Analyze code quality and security with SonarQube Server or Cloud directly in AI assistants.

    • Published by the vendor
    • Active in the last 30 days

    ★ 671Last active Oct 23, 2026Local (stdio)Claude Code, Codex, VS Code, Cursor +2

  5. 5
    Parse-DMARC MCP Server

    meysam81

    Lightweight DMARC parser: auto-fetch email reports, visualize compliance in a single all-in-one app

    • Active in the last 30 days
    • Open source (Apache-2.0)

    ★ 219Last active Oct 23, 2026Local (stdio)Claude Code, Codex, VS Code, Cursor +2

Search MCP servers for security scanning → All connectors

Agent skills 115 tagged

  1. 1
    security-advisory

    modelcontextprotocolOfficial

    Take a privately reported vulnerability through this repo's security advisory flow: board it as a draft card, check whether the code is this repo's server or…

    • Published by the vendor
    • Largest repository here (91,544 stars)
    • Active in the last 30 days

    ★ 91.5KLast active Oct 19, 2026Claude Code, Claude apps, Codex, Cursor +6

  2. 2
    ai-coding-agent-guardrails

    devops-skills

    Secure AI coding agents (Claude Code, Cursor, Codex, Copilot) with permission boundaries, secret protection, code review gates, and safe sandbox…

    • Repository has 48.4K stars
    • Active in the last 30 days
    • Open source (MIT)

    ★ 48.4KLast active Oct 24, 2026Claude Code, Claude apps, Codex, Cursor +6

  3. 3
    safety

    langchain-aiOfficial

    Check secret handling, staged changes and push targets, destructive Git operations, Docker image hygiene, and new dependencies before consequential coding…

    • Published by the vendor
    • Repository has 30.6K stars
    • Active in the last 30 days

    ★ 30.6KLast active Oct 23, 2026Claude Code, Claude apps, Codex, Cursor +6

  4. 4
    secops-hunt

    Google LLCOfficial

    Expert guidance for proactive threat hunting in Google SecOps.

    • Published by the vendor
    • Repository has 21.5K stars
    • Active in the last 30 days

    ★ 21.5KLast active Oct 22, 2026Claude Code, Claude apps, Codex, Cursor +6

  5. 5
    attack-surface-recon

    AIPentest

    侦察/攻击面测绘:被动whois/amass/crt.sh/FOFA/Shodan,主动subfinder/httpx/naabu/katana/nuclei,DNS地域/CDN/Nginx catch-all/宝塔/UniApp指纹。开局第一动作,认知写入项目黑板。Use when starting recon…

    • Repository has 8K stars
    • Active in the last 30 days
    • Open source (Apache-2.0)

    ★ 8KLast active Oct 16, 2026Claude Code, Claude apps, Codex, Cursor +6

Search agent skills for security scanning → All skills

Plugins 23 tagged

  1. 1
    Gen Sage

    Gen

    Safety for Agents — protects AI agent tool calls against dangerous commands, malicious URLs, and harmful file writes.

    • Most GitHub stars here (320)
    • Active in the last 30 days
    • Open source (Apache-2.0)

    ★ 320Last active Oct 12, 2026VS Code, Cursor, Windsurf, VSCodium

  2. 2
    SecureFlow Code Reviewer

    Code Pathfinder

    AI-powered security copilot that analyzes your code for vulnerabilities, performs threat modeling, and provides real-time security recommendations

    • Open source (AGPL-3.0)

    ★ 143Last active May 23, 2026VS Code, Cursor, Windsurf, VSCodium

  3. 3
    VibeCheck — AI Code Safety Layer

    Vibecheck-AI

    Stop shipping AI slop.

    VS Code, Cursor, Windsurf, VSCodium

  4. 4
    Navy AI Coder

    Zrnge

    Local-first AI coding agent that asks before it acts: approve every diff and command, zero runtime dependencies, /audit supply-chain scans and /playthrough…

    • Active in the last 30 days
    • Open source (MIT)

    Last active Oct 17, 2026VS Code, Cursor, Windsurf, VSCodium

Search plugins for security scanning → All plugins

Agent frameworks 1 tagged

  1. 1
    agent-governance-toolkit

    microsoft

    Policy enforcement, identity, sandboxing and reliability tooling for autonomous AI agents, installable with one pip command.

    • 6.5K GitHub stars
    • Active in the last 30 days
    • Open source (MIT)

    ★ 6.5K↓ 28.3K/wkLast active Oct 23, 2026

Search agent frameworks for security scanning → All harnesses & sdks

AI agents 103 tagged

  1. 1
    Shannon

    Keygraph

    Open-source AI pentester that reads web app source code and proves vulnerabilities with working exploits

    • 49.3K GitHub stars
    • Active in the last 30 days
    • Open source (AGPL-3.0)

    ★ 49.3KLast active Oct 15, 2026

  2. 2
    PentAGI

    VXControl

    Self-hosted multi-agent system that runs penetration tests with common security tools inside a Docker sandbox

    • 32.3K GitHub stars
    • Active in the last 30 days
    • Open source (MIT)

    ★ 32.3KLast active Oct 22, 2026

  3. 3
    Strix

    Strix

    Open-source autonomous pentesting agents that run your app, find vulnerabilities and validate them with working proofs of concept.

    • Most GitHub stars here (71,585)
    • Active in the last 30 days
    • Open source (Apache-2.0)

    ★ 71.6KLast active Oct 23, 2026

  4. 4
    CyberStrikeAI

    AIPentest

    Self-hosted Go workspace where AI agents run security tools through MCP for authorized testing.

    • 8K GitHub stars
    • Active in the last 30 days
    • Open source (Apache-2.0)

    ★ 8KLast active Oct 23, 2026

  5. 5
    Decepticon

    BitterSecurity

    Autonomous red-team agent with a Docker stack, terminal CLI, web dashboard and hosted option.

    • 6.4K GitHub stars
    • Active in the last 30 days
    • Open source (Apache-2.0)

    ★ 6.4KLast active Oct 24, 2026

Search AI agents for security scanning → All agents

No-code builders 1 tagged

  1. 1
    Tines

    Tines

    Workflow platform where any team can build automations and AI agents while IT and security keep visibility and control over them

Search no-code builders for security scanning → All no-code builders

Example stacks

Combinations the catalog links as working together. These are examples built from public relations between listings, not recommendations by any vendor.

For business buyers: agents with stated pricing

Only agents whose listing states pricing are shown, with what the listing says. Check the publisher's pricing page before you buy.

AgentPricing in its listingSource
StrixStrixFreemium with a free tier; $29 per month; pricing page checked Oct 2026Pricing page
GitLab Duo Agent PlatformGitLabPaid; $0 to $29 per month; pricing page checked Oct 2026Pricing page
SourcerySourceryFreemium with a free tier; $0 to $30 per month; pricing page checked Oct 2026Pricing page

Questions

What are the top tools for security scanning?
By listing rank, the top MCP server is REA, the top agent skill is security-advisory and the top AI agent is Shannon. Rank weighs adoption, freshness, documentation and publisher identity; money never changes it.
How many tools does the catalog list for security scanning?
331 listings are tagged for it: 88 MCP servers, 115 agent skills, 23 plugins, 1 agent framework, 103 AI agents and 1 no-code agent builder. Tags come from an automated enrichment pass over the top-ranked listings, so tools outside that pass are not counted.
Which AI apps do the MCP servers work with?
Of the 88 MCP servers, 85 list Claude Code, 85 list Cursor and 85 list VS Code as a supported host. Open a listing for its install command and the other hosts it names.
Do the AI agents for security scanning cost money?
Pricing is stated for 3 of the 103 agents: Strix (freemium with a free tier), GitLab Duo Agent Platform (paid), Sourcery (freemium with a free tier). The other agents state no pricing in their listings.

331 listings are tagged for this use case; the lists above show the top entries.

Related