Security

Local cognitive identity engine with traits, behavioral evidence, and revision history.

MCP multiplexor for Locus — tools hard-scoped to the active pin so agents cannot act in the wrong tenant.

MCP OAuth compatibility adapter (spec 277 §6-§8,§15): protected-resource metadata, scopes, WWW-Authenticate, bearer-token claim validation, and the Agentic Grant Bundle bridge. OAuth is ingress-compat only, not the vault authority.

BRANTECT MCP CLI — OAuth setup and stdio bridge for AI clients (Claude Code, Gemini CLI, ChatGPT)

Enterpret's fork of onlyflowstech/servicenow-mcp. 17 tools over the ServiceNow Table API; adds a SERVICENOW_OAUTH_BEARER env mode so a broker-supplied (Nango) OAuth token is used for auth.

Local Sapiom developer MCP for authoring, testing, deploying, and inspecting agents.

desktop-mcp: an MCP server that lets an AI use your computer (shell, files, clipboard, mouse, keyboard, screen OCR/image search, windows) with per-feature permission flags. Runs entirely locally. Use: npx desktop-mcp --allow-all

Ory plugin for Amp (Sourcegraph's coding agent): a permission delegate that authorizes every tool call plus an in-process plugin for session auth and activity auditing

Clonable MCP server skeleton on the official @modelcontextprotocol/server SDK v2 (protocol 2026-07-28 + 2025 legacy, stdio + stateless Streamable HTTP), with its own OAuth 2.1 authorization server (Clerk person + organisation, cloud-identity), MCP Apps UI

Suveren gateway — local agent gateway built in compliance with the Human Agency Protocol (HAP). Runs the UI, control plane, and MCP server in one Node process.

The most feature-complete MCP server for Obsidian vaults — search, read, write, tag, link analysis, graph traversal, canvas support, and more.

Scans MCP server auth code for OAuth 2.1 anti-patterns: token passthrough, missing audience

Test any MCP server: connection, tools, security, login, resources and prompts. Hard facts, no AI judging.

Model Context Protocol server for the FerrVault API: vaults, environments, secrets and service tokens

Transparent egress secret masking for pi coding-agent sessions

Scan your locally-running apps with MURK's local runner and run MURK's MCP server for your AI agent — findings stream to the dashboard; the model key never leaves MURK's servers.

Manage Keycloak users, groups, roles and realms through the Keycloak Admin REST API.

Put a limit in front of any MCP server: caps per action, approval before irreversible calls, and a hash-chained receipt of every decision.

Scans RAG content/scraped pages for indirect prompt injection

Capxul MCP server for auth, Account readiness, identity, Organizations, relationships, requests, destinations, and testnet funding over Streamable HTTP.