all tools / security

Most reliable security AI agent tools

As of the latest check, Glimind tracks 200 security AI agent (MCP) tools, of which 0 are healthy right now. The table below ranks them live-first by real-time reliability.

toolstatuswhat it does
list_account_users
linkedin-ads-mcp
unknownUser → role assignmentsalternatives
fetch_certificate_network_resources
@pkistudio/pkistudiomcp
unknownFetch network resources (CDP, AIA, OCSP) for a certificate.alternatives
mask_card
ekaone/ekaone/mcp-tools
unknownMasks credit/debit card numbers (PCI DSS compliant)alternatives
mask_email
ekaone/ekaone/mcp-tools
unknownMasks email addresses for privacy protectionalternatives
validate_access_token
usegranthq/mcp-server
unknownValidate an access token for a tenantalternatives
create_access_token
usegranthq/mcp-server
unknownCreate a new access token for a clientalternatives
health_auth_status
eryk-mazus/google-health-training-mcp
unknownCheck whether credentials exist and optionally verify them onlinealternatives
roastify_receive_patron_credentials
lonniev/roastify-mcp
unknownReceive and vault patron credentialsalternatives
key_locker
Harusame64/desktop-touch-mcp
unknownManage credentials the terminal autofills for you (SSH key passphrases, sudo/login passwords).alternatives
verify_agent_name_token
idin/ix-memory
unknownCheck a name and token against records without revealing.alternatives
authenticate_mcp_session
nelladath/EndpointRead-MCP
unknownAuthenticates the MCP session with Microsoft Entra ID.alternatives
manage_intune_rbac
nelladath/EndpointRead-MCP
unknownManages Intune RBAC with read-only operations.alternatives
manage_conditional_access
nelladath/EndpointRead-MCP
unknownManages conditional access with read-only operations.alternatives
manage_identity_protection
nelladath/EndpointRead-MCP
unknownManages identity protection with read-only operations.alternatives
compliance
pmat
unknownRun compliance governance checks (157 checks)alternatives
pmat_compliance
pmat
unknownPerform compliance governance checks (157 checks)alternatives
solve_datadome
disasm-dev/disasm.dev MCP server
unknownSolve a DataDome interstitial, captcha, or tags challenge. Returns the payload and client-hint headers to replay.alternatives
solve_incapsula
disasm-dev/disasm.dev MCP server
unknownSolve an Incapsula (Imperva) reese84 or utmvc challenge.alternatives
list_api_keys
disasm-dev/disasm.dev MCP server
unknownYour API keys (metadata only).alternatives
scopegate_request_capability
scopegate
unknownRequest a capability before privileged actions; returns a TTL grant or pending human approval with approval_id; supports wait and execute_onalternatives
scopegate_request_capabilities
scopegate
unknownBatch request up to 20 capabilities in one call with per-item outcomes.alternatives
scopegate_list_capabilities
scopegate
unknownList active grants and remaining TTL.alternatives
scopegate_register_upstream
scopegate
unknownConnect a new service using secretRef names (never secret values) or from registry.alternatives
scopegate_diagnose
scopegate
unknownDiagnose auth/connection errors and provide self-repair hints.alternatives
scopegate_propose_policy
scopegate
unknownPropose a policy when a capability is denied; lands in pending policies for human review.alternatives
scopegate_vault_status
scopegate
unknownList secretRef names in the vault (never values).alternatives
scopegate_collect
scopegate
unknownCollect an approval-continuation outcome.alternatives
scopegate_renew_capability
scopegate
unknownRenew an agent-driven grant.alternatives
scopegate_can_i
scopegate
unknownRead-only policy preflight check.alternatives
scopegate_delegate
scopegate
unknownCreate attenuated sub-grants for subagents.alternatives
register_agent
agenttown/Agent-Town
unknownCreates a persistent identity and returns a secret token for authentication.alternatives
check_auth_status
robcerda/oura-mcp-server
unknownReport whether a session is stored, its scopes, and when it expiresalternatives
qradar_discover
caohonghoa98/qradar-mcp-server-docker
unknownDiscover available QRadar API endpoints and capabilitiesalternatives
qradar_get
caohonghoa98/qradar-mcp-server-docker
unknownPerform GET requests to QRadar REST API endpointsalternatives
qradar_execute
caohonghoa98/qradar-mcp-server-docker
unknownPerform POST/PUT requests to QRadar REST API endpointsalternatives
qradar_delete
caohonghoa98/qradar-mcp-server-docker
unknownPerform DELETE requests to QRadar REST API endpointsalternatives
gate
shitianfang/jev-use
unknownGates a shell command or action, deciding whether it is safe to proceed, with credential redaction.alternatives
jev_gate
shitianfang/jev-use
unknownGate a shell command or action: Jev decides if it is safe to allow, deny, or escalatealternatives
vitniToolResult
@daily-nerd/veritrail
unknownCo-signs an MCP tool result with a signed, tamper-evident receiptalternatives
verify
@daily-nerd/veritrail
unknownVerifies a signed receipt independently, offlinealternatives
delego_propose_action
io.github.Delego-Dev/delego
unknownSubmit an action; returns allow / deny / needs_approvalalternatives
delego_resolve_action
io.github.Delego-Dev/delego
unknownComplete an approved action (fingerprint must match)alternatives
delego_pending
io.github.Delego-Dev/delego
unknownList actions awaiting approvalalternatives
delego_deny
io.github.Delego-Dev/delego
unknownDeny a pending actionalternatives
delego_log
io.github.Delego-Dev/delego
unknownRead recent receipts from the audit logalternatives
delego_verify
io.github.Delego-Dev/delego
unknownCheck the audit chain (hashes, linkage, signatures)alternatives
verify_attestation
paulos-sudo/Attest402
unknownVerify an attestation and optionally the response body.alternatives
attest_web_response
paulos-sudo/Attest402
unknownCreate a cryptographically signed and timestamped evidence package for a public web or API response.alternatives
login_user
toxicaj/Toxy Insecure MCP Lab
unknownLogin with username and passwordalternatives
get_sensitive_logs
toxicaj/Toxy Insecure MCP Lab
unknownGet sensitive logs (requires Basic Auth)alternatives
list_keychains
bootpay/bootpay-mcp
unknown키체인 목록 조회 (API 키 자동 조회)alternatives
appRisk
agenthub-algo
unknownReturns a static structural screen with explicit limitations for an application.alternatives
walletRisk
agenthub-algo
unknownReturns a 0–100 risk score, level, and the six on-chain signals behind it for a given address.alternatives
assetRisk
agenthub-algo
unknownReturns a scam/rug screen: clawback, freeze, mutable supply, holder concentration for an ASA.alternatives
secrets_scan
LuGuBo/aevum-kyber
unknownScans the codebase for potential secrets (API keys, passwords, tokens) and returns a report of findings.alternatives
attest_passport_verify
srotzin/hive-mcp-attest
unknownVerify a passport manifest (signature + temporal + inputs hash)alternatives
attest_custody_proof
srotzin/hive-mcp-attest
unknownGet a Merkle inclusion proof for a custody nodealternatives
attest_cargo_register
srotzin/hive-mcp-attest
unknownRegister a versioned cargo type (definition_hash pinned)alternatives
attest_cargo_validate
srotzin/hive-mcp-attest
unknownValidate a payload against a registered cargo schemaalternatives
attest_cargo_snapshot
srotzin/hive-mcp-attest
unknownRegistry snapshot with Merkle root for version pinningalternatives
attest_warranty_issue
srotzin/hive-mcp-attest
unknownIssue a signed warranty committing an agent to a claimalternatives
attest_warranty_breach
srotzin/hive-mcp-attest
unknownReport a breach — signed breach record returnedalternatives
attest_gate_evaluate
srotzin/hive-mcp-attest
unknownGate evaluation with signed C18 receiptalternatives
attest_inspect_sample
srotzin/hive-mcp-attest
unknownProbabilistic secondary inspection, signed inspection recordalternatives
attest_smsh_verify
srotzin/hive-mcp-attest
unknownVerify a SMSH-Stamp v1 receiptalternatives
attest_custody_append
srotzin/hive-mcp-attest
unknownAppend a signed node to a custody chain (taint propagation)alternatives
attest_custody_verify
srotzin/hive-mcp-attest
unknownVerify hash linkage, signatures, and taint propagationalternatives
attest_passport_issue
srotzin/hive-mcp-attest
unknownIssue a Pre-Action Attestation Manifest (Ed25519 signed)alternatives
attest_absence_verify
srotzin/hive-mcp-attest
unknownVerify a non-membership proof against a rootalternatives
solve_captcha
razavioo/crawlemoon
unknownSolves CAPTCHA challenges.alternatives
analyze_auth
razavioo/crawlemoon
unknownAnalyzes authentication mechanisms on a web page.alternatives
detect_protection
razavioo/crawlemoon
unknownDetects anti-bot protection measures.alternatives
get_flag
@greenflags/mcp
unknownGet a flag by key or idalternatives
send_otp
n4ouri/envoisms-mcp-server
unknownGenerate and send a one-time verification code (OTP) over SMS or WhatsApp through EnvoiSMS's shared sender — no WhatsApp connection needed. alternatives
check_otp
n4ouri/envoisms-mcp-server
unknownValidate an OTP code against a pending verification session.alternatives
entity_risk
ColinHughes2121/gocreative-mcp
unknownGet a risk dossier for an entity (sanctions, adverse media, etc.).alternatives
sanctions_pep_screen
ColinHughes2121/gocreative-mcp
unknownScreen an individual or entity against sanctions, PEP, and watchlists.alternatives
ofac_screen_wallet
ColinHughes2121/gocreative-mcp
unknownScreen a crypto wallet address against OFAC sanctions lists.alternatives
nmap
the-artist111/NeuralReaper
unknownService/version detection, full-range port sweepsalternatives
gobuster
the-artist111/NeuralReaper
unknownDirectory/DNS brute-forcealternatives
ping
the-artist111/NeuralReaper
unknownHost reachability checkalternatives
GetNPUsers.py
the-artist111/NeuralReaper
unknownAS-REProast detectionalternatives
masscan
the-artist111/NeuralReaper
unknownFull-range port sweepsalternatives
whois
the-artist111/NeuralReaper
unknownWHOIS enumerationalternatives
dig
the-artist111/NeuralReaper
unknownDNS enumerationalternatives
openssl
the-artist111/NeuralReaper
unknownTLS/certificate validationalternatives
ffuf
the-artist111/NeuralReaper
unknownHigh-speed fuzzingalternatives
dirb
the-artist111/NeuralReaper
unknownDirectory brute-forcealternatives
nuclei
the-artist111/NeuralReaper
unknownAuto-CVE engine with 12,000+ templatesalternatives
nikto
the-artist111/NeuralReaper
unknownWeb server misconfiguration checksalternatives
curl
the-artist111/NeuralReaper
unknownHTTP header inspection and requestsalternatives
xsstrike
the-artist111/NeuralReaper
unknownXSS detection with WAF fingerprintingalternatives
wpscan
the-artist111/NeuralReaper
unknownWordPress core/plugin/theme vulnerability enumerationalternatives
certipy
the-artist111/NeuralReaper
unknownADCS misconfiguration detection (ESC1–16)alternatives
bloodhound-python
the-artist111/NeuralReaper
unknownActive Directory data collectionalternatives
bloodyAD
the-artist111/NeuralReaper
unknownActive Directory ACL/object enumerationalternatives
GetUserSPNs.py
the-artist111/NeuralReaper
unknownKerberoast detectionalternatives
cve_watchlist_scan
the-artist111/NeuralReaper
unknownLookup-only orchestration of Nuclei + ExploitDB against curated CVE IDsalternatives
sqlmap
the-artist111/NeuralReaper
unknownSQL injection detection with WAF fingerprintingalternatives
traceroute
the-artist111/NeuralReaper
unknownNetwork path tracingalternatives
threat_intelligence_update
the-artist111/NeuralReaper
unknownSynchronizes the latest intelligence from all configured sources and updates the local threat intelligence database.alternatives
threat_intelligence_status
the-artist111/NeuralReaper
unknownDisplays the current intelligence database status, including the last synchronization time, the number of tracked security articles, and thealternatives
permission
Duro02/devin-subagents
unknownAdjudicate a pending permission requestalternatives
set_mode
Duro02/devin-subagents
unknownSwitch session permission modealternatives
dl_auth_probe
ADIKANT/datalens-dev-mcp
unknownPerforms a minimal real check of DataLens access.alternatives
list_users
clue2solve/clue2app-user-mcp
unknownList all users via GET /api/usersalternatives
resolve_duplicate_users
clue2solve/clue2app-user-mcp
unknownResolve duplicate users via POST /api/users/resolve-duplicatesalternatives
grant_role
clue2solve/clue2app-user-mcp
unknownGrant a role to a user via POST /api/users/{id}/rolesalternatives
revoke_role
clue2solve/clue2app-user-mcp
unknownRevoke a role from a user via DELETE /api/users/{id}/roles/{role}alternatives
disable_user
clue2solve/clue2app-user-mcp
unknownDisable a user via POST /api/users/{id}/disablealternatives
enable_user
clue2solve/clue2app-user-mcp
unknownEnable a user via POST /api/users/{id}/enablealternatives
check_domain
aloth/cred-1
unknownCheck a single domain (score, category, level, metadata)alternatives
batch_check
aloth/cred-1
unknownCheck up to 100 domains at oncealternatives
hash_text
KbnCodes/MCP Server Hub
unknownHash text using a specified algorithmalternatives
base64
KbnCodes/MCP Server Hub
unknownEncode or decode base64alternatives
shortest_paths_to_tier0
iabdullah215/pathhound-mcp
unknownFind shortest attack paths to Tier 0 / high-value targets from a given principal or all owned principals.alternatives
reachable_from
iabdullah215/pathhound-mcp
unknownCompute blast radius from a principal, summarized by node type, highlighting Tier 0 reachability.alternatives
find_choke_points
iabdullah215/pathhound-mcp
unknownIdentify edges appearing in the most distinct shortest paths to Tier 0, with count of paths broken if removed.alternatives
remediation_for_path
iabdullah215/pathhound-mcp
unknownGenerate remediation steps for a given attack path (specified as a read-only Cypher query returning a path).alternatives
mark_owned
iabdullah215/pathhound-mcp
unknownSet BloodHound owned marker on a principal (only available when allow_writes is true).alternatives
set_high_value
iabdullah215/pathhound-mcp
unknownSet BloodHound high-value marker on a principal (only available when allow_writes is true).alternatives
list_sessions
guangda88/Ling-term-mcp
unknownList all active sessionsalternatives
verify_proof
forcedreamai/forcedream-mcp
unknownIndependently verify a ForceDream proof by task ID. The Ed25519 signature is checked locally against the published public key — ForceDream ialternatives
forcedream_security_scan
forcedreamai/forcedream-mcp
unknownReal security scanning using OSV.dev and GitGuardian.alternatives
forcedream_verify_proof
forcedreamai/forcedream-mcp
unknownIndependently verify a ForceDream proof by task ID.alternatives
forcedream_check_fraud
forcedreamai/forcedream-mcp
unknownReal-time fraud risk scoring using IP reputation and behavioural signals.alternatives
ecz_check_target
io.github.Ecocitizenz/ecz-id-mcp-verifier
unknownClassify a target and return the canonical result contract.alternatives
check
io.github.Ecocitizenz/ecz-id-mcp-verifier
unknownClassify a target, check its public ECZ-ID Resolver posture where applicable, and return a deterministic result with routing information.alternatives
assay_mcp_wrap
io.github.Rul1an/assay
unknownDeterministic allow/deny gate for MCP tools/call requests before they run, with the reason for each decision.alternatives
verify_registration
io.github.Edward-CH-Wang/fondue-city-mcp
unknownVerify registration with the 6-digit code to get an API key.alternatives
whoami
Sponsored-Code/sponsored-code-mcp
unknownThe team and scopes your key resolves to.alternatives
create_agent_token
tg-account-mcp
unknownIssues a new scoped agent token with configurable permissions, account/bot IDs, and chat allowlists.alternatives
revoke_agent_token
tg-account-mcp
unknownRevokes an existing agent token by its token hash.alternatives
evermint_verify
io.github.EverMint-app/evermint-mcp
unknownVerify a single record by Record ID.alternatives
evermint_list_records
io.github.EverMint-app/evermint-mcp
unknownList records for the authenticated org with optional filters. Returns metadata only.alternatives
evermint_get_record
io.github.EverMint-app/evermint-mcp
unknownFetch the full contents of a single record, including its original payload.alternatives
evermint_mint
io.github.EverMint-app/evermint-mcp
unknownMint a tamper-evident, cryptographically timestamped record of an action.alternatives
ssh_polling_detector
anirudhprashant/agent-vitals
unknownFinds repeated SSH commands to the same host.alternatives
verify_source
Deus-corp/cks-mcp
unknownPerforms a real HTTP check on a source and cryptographically signs the resultalternatives
get-account
redirhub/mcp-server
unknownGet the signed-in user's profile.alternatives
update-account
redirhub/mcp-server
unknownUpdate profile settings.alternatives
get_env_keys
than/secure-api-mcp
unknownReturns key names from .env. No values exposed.alternatives
security_audit
vdalhambra/siteaudit-mcp
unknownSecurity headers, HTTPS, HSTS, CSP, SSL certificate check, cookie flagsalternatives
confirm_action
NSK-394/SchoolBridge
unknownConfirm a pending action (write) by an admin.alternatives
get_risk_badge
zw008/VMware-Aria
unknownGet risk badge for a resourcealternatives
profile_list
woof-xyz/workiva-mcp
unknownList credential profiles with the active one marked.alternatives
profile_use
woof-xyz/workiva-mcp
unknownSwitch the active credential profile for subsequent API calls.alternatives
update_alert_rule
Makhsum/httptrafficmonitr
unknownUpdate an alert rulealternatives
delete_alert_rule
Makhsum/httptrafficmonitr
unknownDelete an alert rulealternatives
get_alert_events
Makhsum/httptrafficmonitr
unknownGet alert eventsalternatives
toggle_alert_sound
Makhsum/httptrafficmonitr
unknownToggle alert soundalternatives
list_alert_rules
Makhsum/httptrafficmonitr
unknownList alert rulesalternatives
create_alert_rule
Makhsum/httptrafficmonitr
unknownCreate an alert rulealternatives
get_tls_info
Makhsum/httptrafficmonitr
unknownGet TLS informationalternatives
aip_whoami
aip-mcp-server
unknownShow your current AIP identity (DID, public key)alternatives
aip_trust_score
aip-mcp-server
unknownGet trust score and vouch chain for an agentalternatives
aip_register
aip-mcp-server
unknownRegister a new AIP identityalternatives
aip_sign
aip-mcp-server
unknownCryptographically sign content to prove authorshipalternatives
aip_verify_signature
aip-mcp-server
unknownVerify a signature against a DID's public keyalternatives
aip_verify
aip-mcp-server
unknownVerify another agent's identity via challenge-responsealternatives
lms_auth_get_status
arythmatic-lms-mcp
unknownRetrieve active session status, base URL, and active tenant domain.alternatives
lms_auth_refresh_token
arythmatic-lms-mcp
unknownExchange a refresh token for a fresh access token.alternatives
generate_otp
plural-pinelabs/pinelabs-mcp
unknownGenerate an OTP for a card payment authentication flowalternatives
submit_otp
plural-pinelabs/pinelabs-mcp
unknownSubmit an OTP to complete a card payment authenticationalternatives
resend_otp
plural-pinelabs/pinelabs-mcp
unknownResend an OTP for a card payment authenticationalternatives
powhttp_get_tls
usestring/powhttp-mcp
unknownGet TLS handshake events for a connectionalternatives
powhttp_fingerprint
usestring/powhttp-mcp
unknownGenerate HTTP, TLS, and HTTP/2 fingerprintsalternatives
generate_pin
pipeworx-io/mcp-passwordgen
unknownGenerate a cryptographically-random numeric PIN (keyless, offline).alternatives
generate_password
pipeworx-io/mcp-passwordgen
unknownGenerate cryptographically-random password(s) (keyless, offline, CSPRNG).alternatives
gatekeeper
wnkinc/claude-custom-connector-server
unknownThe control plane: per-tool permissions via the in-chat panelalternatives
get_agent_status
RezzFayyazi/AI4IA-MCP-Server
unknownMonitor the health and status of all Wazuh agents.alternatives
get_alerts
RezzFayyazi/AI4IA-MCP-Server
unknownRetrieve Wazuh security alerts with flexible filtering.alternatives
analyze_vulnerability
RezzFayyazi/AI4IA-MCP-Server
unknownDeep analysis of detected vulnerabilities with CVE details.alternatives
correlate_alerts
RezzFayyazi/AI4IA-MCP-Server
unknownFind related alerts that may indicate a coordinated attack.alternatives
get_alert_statistics
RezzFayyazi/AI4IA-MCP-Server
unknownGenerate comprehensive statistical reports on alert patterns.alternatives
login
@perfai/mcp
unknownAuthenticate with PerfAI via Auth0 OAuth. Opens browser.alternatives
auth_status
@perfai/mcp
unknownCheck current authentication status and user info.alternatives
user_info
@perfai/mcp
unknownGet detailed information about the authenticated user.alternatives
logout
@perfai/mcp
unknownClear authentication session.alternatives
show_security_issues
@perfai/mcp
unknownList security vulnerabilities with filters.alternatives
key_protect_list_keys
io.github.ExpertVagabond/ibmz
unknownList encryption keys in Key Protectalternatives
key_protect_create_key
io.github.ExpertVagabond/ibmz
unknownCreate root or standard keysalternatives
key_protect_get_key
io.github.ExpertVagabond/ibmz
unknownGet key details and metadataalternatives
key_protect_wrap_key
io.github.ExpertVagabond/ibmz
unknownWrap (encrypt) DEKs with a root keyalternatives
key_protect_rotate_key
io.github.ExpertVagabond/ibmz
unknownRotate a root keyalternatives
key_protect_get_key_policies
io.github.ExpertVagabond/ibmz
unknownGet key policiesalternatives
key_protect_unwrap_key
io.github.ExpertVagabond/ibmz
unknownUnwrap (decrypt) wrapped DEKsalternatives
key_protect_delete_key
io.github.ExpertVagabond/ibmz
unknownDelete a key (irreversible)alternatives
verify_hash
io.github.csolomon0704-prog/verify-proof
unknownVerify a known hash against inline or file-based proof dataalternatives
create_proof
io.github.csolomon0704-prog/verify-proof
unknownAnchor a file's hash on ProofLedger to create a new proof. The only tool that uses the network, and the only one needing an API keyalternatives
get_hayabusa_rules
chiomao23/mcp-hayabusa
unknownReturns Hayabusa rules filtered by keyword and limit, sorted by severity.alternatives
scan_evtx
chiomao23/mcp-hayabusa
unknownScans a single EVTX file using Hayabusa and returns detections filtered by minimum severity.alternatives
getSecret
ConjureGanja/DevVault MCP
unknownEscape hatch that returns a secret's plaintext value; off by default, only available if allowPlaintextReads is true.alternatives
listSecrets
ConjureGanja/DevVault MCP
unknownLists metadata (names, project, timestamps) of stored secrets; does not reveal values.alternatives
deleteSecret
ConjureGanja/DevVault MCP
unknownSoft-deletes a secret (recoverable); does not reveal the value.alternatives
rotateSecret
ConjureGanja/DevVault MCP
unknownReplaces an existing secret's value in place; value is never echoed back.alternatives
storeSecret
ConjureGanja/DevVault MCP
unknownStores a secret value under a given name; value is never echoed back to the AI.alternatives
oci_iam_list_users
io.github.ExpertVagabond/oracle-cloud
unknownList IAM usersalternatives
oci_iam_list_groups
io.github.ExpertVagabond/oracle-cloud
unknownList IAM groupsalternatives
oci_iam_list_compartments
io.github.ExpertVagabond/oracle-cloud
unknownList compartmentsalternatives

FAQ

What are the most reliable security MCP tools right now?

As of the latest check, Glimind tracks 200 security AI agent (MCP) tools, of which 0 are healthy right now. The table below ranks them live-first by real-time reliability. Glimind rates each neutrally (0–100) from safe liveness probes plus privacy-clean real-usage outcomes — see each tool's live page for its current score and a working alternative if it's down.

How does Glimind rank security tools?

Ranked live-first by current verdict (healthy → degraded → down), then by the neutral reliability score. Glimind sells no tools, so the ranking is unconflicted.

What if a security tool I need is down?

Every tool here links to its live alternatives — capability-matched substitutes that are healthy now. Or query https://glimind.com/v1/alternatives/{toolId}.

Live data via MCP/REST. Neutral ratings — Glimind only measures.