Official
Manage Workers, R2 buckets, DNS, and edge policies on Cloudflare.
cloudflare, edge, workers, dns
Best Security MCP Servers in 2026
Security MCP servers for AI agents: auth, secrets, vulnerability scanning, and security operations — verified for 2026.
Top Security MCPs
- 1.Cloudflare—Manage Workers, R2 buckets, DNS, and edge policies on Cloudflare.
- 2.AWS—AWS's own managed MCP server — run AWS APIs, execute sandboxed scripts, and search AWS documentation under IAM.
- 3.Sentry—Triage errors, inspect traces, and query events from Sentry.
Ranked by top-mcps.com — data verified Sep 2026.
About Security MCP servers
The best MCP servers for security turn an AI agent into a useful security assistant — scanning code with Semgrep, vetting dependencies with Socket, pulling secrets from 1Password, Doppler, or HashiCorp Vault without pasting them into chat, and auditing IAM through the AWS MCP — without handing it the keys to the kingdom. The good ones ship with read-only modes, scoped credentials, and an audit trail so every tool call can be reviewed after the fact.
Choose by which part of the security workflow needs leverage, then by blast radius. For static analysis, Semgrep runs entirely local over stdio with no credential — custom rules, pre-commit scans, third-party PR review — so nothing leaves the machine. For supply-chain risk, Socket (OAuth 2.1, three-minute setup, stdio or streamable-http) scores npm, PyPI, Go, and Maven packages before the agent installs them and catches typosquats. For secrets, the pattern that matters is reference-only injection: 1Password and Doppler resolve secret references inside tool calls so the value never appears in the conversation, while HashiCorp Vault (api-key, self-hosted, about fifteen minutes) goes further with dynamic database credentials and PKI issuance — short-lived by design. For incident work, Sentry (OAuth, three minutes) triages errors, the AWS MCP searches CloudWatch and audits IAM, and Cloudflare (OAuth 2.1) covers the edge: DNS, Workers, and R2 policies. The secret managers carry the highest blast radius — a leaked Vault token or 1Password service account exposes everything in its scope — so restrict them to specific vaults and paths.
Common mistakes: connecting with admin scope when read-only would do, letting an agent auto-remediate findings (a 'fix' that rewrites an IAM policy can lock out the on-call engineer — require human review on anything production), and forgetting that the conversation log itself becomes a security artifact; keep it inside an approved system if it touches sensitive data. Reference-only injection exists because agents will otherwise echo a retrieved secret straight into their reply. Start with Semgrep — no credential, immediate value on the next pull request — then add Socket as a pre-install gate for dependencies, and only then wire in a secrets manager with the smallest credential that still works.
All Security MCPs
8 MCPs ranked by popularity. Filter by attribute or search by name.
8 of 8 MCPs
| # | MCP | Tags | Setup | Complexity | Labels | |
|---|---|---|---|---|---|---|
| 1 | Cloudflare Manage Workers, R2 buckets, DNS, and edge policies on Cloudflare. | cloudflare, edge | 10 min | Medium | Official | |
| 2 | AWS AWS's own managed MCP server — run AWS APIs, execute sandboxed scripts, and search AWS documentation under IAM. | aws, cloud | 10 min | Medium | Official | |
| 3 | Sentry Triage errors, inspect traces, and query events from Sentry. | sentry, errors | 3 min | Low | Official | |
| 4 | Socket Score npm, PyPI, Go, and Maven dependencies for supply-chain and vulnerability risk before an agent installs them. | socket, security | 3 min | Low | Official | |
| 5 | HashiCorp Vault Read dynamic and static secrets from HashiCorp Vault inside agent workflows. | security, secrets | 15 min | Medium | Official | |
| 6 | Doppler Inject secrets from Doppler into agent workflows without exposing values in chat. | security, secrets | 6 min | Low | Official | |
| 7 | Semgrep Open-source SAST scanning against custom rules from an AI agent. | security, sast | 5 min | Low | Official | |
| 8 | 1Password Inject 1Password secrets into an AI agent's tool calls without exposing them in chat. | security, secrets | 8 min | Low | Official |
Choose the right MCP
Quick decision guide based on your use case.
| If you need… | Start with |
|---|---|
| You want static analysis on code before it merges | Use Semgrep |
| Your agent installs dependencies and typosquats worry you | Use Socket as a pre-install gate |
| The agent needs secrets at runtime without seeing their values | Use 1Password; use Doppler for per-environment config |
| You self-host and want short-lived, dynamic credentials | Use HashiCorp Vault |
| You need IAM audits and CloudWatch log search | Use AWS with a read-only principal |
| On-call needs faster error triage | Use Sentry |
Top Security MCPs ranked
Detailed cards with setup time, complexity, and key labels.
2
OfficialAWS's own managed MCP server — run AWS APIs, execute sandboxed scripts, and search AWS documentation under IAM.
aws, cloud, cloudwatch, iam
Official
Triage errors, inspect traces, and query events from Sentry.
sentry, errors, monitoring, observability
Official
Score npm, PyPI, Go, and Maven dependencies for supply-chain and vulnerability risk before an agent installs them.
socket, security, supply-chain, dependencies
Official
Read dynamic and static secrets from HashiCorp Vault inside agent workflows.
security, secrets, vault, hashicorp
Official
Inject secrets from Doppler into agent workflows without exposing values in chat.
security, secrets, doppler, credentials
Official
Open-source SAST scanning against custom rules from an AI agent.
security, sast, semgrep, static-analysis
Official
Inject 1Password secrets into an AI agent's tool calls without exposing them in chat.
security, secrets, 1password, vault
8 minLow
Archived (historical reference)
1 Security entry is archived — the upstream package was deprecated or pulled, or a documented security issue applies. The detail page is preserved for historical reference and migration guidance, but these are NOT current editorial picks.
Also in the ChatGPT Apps directory
2 Security brands are available as one-click ChatGPT Apps. These are not ranked alongside the editorial picks above — they're listings from chatgpt.com/apps surfaced here for brand-search continuity.
FAQ: Security MCPs
Is it safe to give an AI agent access to my secrets manager?
With the right pattern, yes. 1Password and Doppler use reference-only injection: the agent passes a secret reference and the value is resolved inside the tool call, so it never appears in the conversation or the model context. Scope the service account to the specific vaults or configs the agent needs, and prefer HashiCorp Vault's dynamic credentials where possible — they expire on their own.
Which security MCP should I install first?
Semgrep. It needs no credential, runs entirely locally over stdio, and pays off on the next pull request by scanning code against your rules. Socket is the natural second install: OAuth 2.1, about three minutes, and it vets every dependency the agent wants to add.
Can an agent check whether a package is malicious before installing it?
Yes — Socket scores npm, PyPI, Go, and Maven packages for supply-chain risk, including typosquats and install-script malware, before anything hits your lockfile. The useful pattern is a gate: the agent proposes a dependency, calls Socket, and only installs with human sign-off if the score is poor. This matters because agents pick packages by name similarity, which is exactly the pattern typosquats exploit.
Should I let the agent auto-remediate security findings?
No for anything production. Let it draft the fix — a Semgrep finding turned into a proposed patch, an IAM tightening suggested from an AWS audit — and require a human to review and apply. Auto-remediation failure modes are ugly: a rewritten IAM policy that locks out the on-call engineer, or a 'hardened' Cloudflare rule that blocks your own health checks.
What happens if my MCP credential leaks?
It depends on the server. Semgrep has no credential to leak. Sentry and Socket tokens expose read access to error data and scan results. The secret managers are the worst case: a leaked 1Password service-account token or Vault token exposes every secret in its scope. That asymmetry should drive your setup order — restrict secret-manager credentials to specific vaults and paths, keep audit logs on (Doppler logs every access), and rotate on any suspicion.