# Security MCP servers in 2026: Vibe Shipped directory

> Remote MCP servers (streamable HTTP) from the official MCP Registry, probed daily.

14 entries. Last verification run: 2026-10-27.

## MCP servers / Security

- [Verity](https://vibeshipped.io/directory/mcp-servers/verity) (Verified working on 2026-10-27): Cited product-compliance ground truth for AI agents. Never generates; always cites.
- [tech-risk](https://vibeshipped.io/directory/mcp-servers/tech-risk) (Verified working on 2026-10-27): MCP security scanner: tool-poisoning & prompt-injection audit (OWASP LLM01/08) + Base data
- [VerifyPulse Email Verification & DNS Security](https://vibeshipped.io/directory/mcp-servers/verifypulse) (Verified working on 2026-10-27): Real-time RFC 5322 email verification, SPF/DMARC DNS audits & B2B leads (x402 Base USDC).
- [sectora](https://vibeshipped.io/directory/mcp-servers/sectora) (Verified working on 2026-10-27): Threat intel + your scans/findings/Shield posture. CVE, EPSS, KEV, package vuln lookup, DAST.
- [MCP Marketplace](https://vibeshipped.io/directory/mcp-servers/io-mcp-marketplace-search) (Verified working on 2026-10-27): Search and install 4,000+ security-scanned MCP servers from inside any MCP-aware AI client.
- [Toolcall](https://vibeshipped.io/directory/mcp-servers/toolcall) (Verified working on 2026-10-27): 30 pay-per-call APIs for AI agents: compliance, trade, safety, web, data. USDC on Base via x402.
- [VITNA – Containment for rogue AI agents](https://vibeshipped.io/directory/mcp-servers/vitna-compliance-preflight) (Verified working on 2026-10-27): Guard wraps stdio MCP servers: risky calls wait for a person; no answer, no run. Remote: cooperative
- [Electronic Compliance Objects (49 markets)](https://vibeshipped.io/directory/mcp-servers/eco) (Verified working on 2026-10-27): Each market's disclosure regime as one sourced, signed object, with the issuer's ACM-68000 signal.
- [HoneyLabs](https://vibeshipped.io/directory/mcp-servers/net-honeylabs-mcp) (Verified working on 2026-10-27): Honeypot probe data: IP reputation, scanners, CVE probing, TLS and SSH fingerprints.
- [KarmaDue](https://vibeshipped.io/directory/mcp-servers/karmadue) (Verified working on 2026-10-27): Pre-install safety check for agents: known traps, tested fixes, malware reports. No account.
- [gateway](https://vibeshipped.io/directory/mcp-servers/gateway) (Reachable on 2026-10-27: sign-in required, tools not listed): MCP gateway with runtime security policy, tool-call-level control, and audit of agent actions.
- [kanonik](https://vibeshipped.io/directory/mcp-servers/kanonik) (Reachable on 2026-10-27: sign-in required, tools not listed): Governance runtime for compliance: verified, human-approved writes to a tamper-evident record.
- [mlab.sh](https://vibeshipped.io/directory/mcp-servers/sh-mlab-mcp) (Reachable on 2026-10-27: sign-in required, tools not listed): Threat intelligence: enrich IOCs (IP, domain, URL, hash), search CVEs and actors, scan SBOMs.
- [TAP](https://vibeshipped.io/directory/mcp-servers/tap) (Reachable on 2026-10-27: sign-in required, tools not listed): Credential isolation for AI agents: placeholder secrets, policy checks, optional human approval.

Ranking rule: Within a category, entries sort by (1) latest verification: verified working, then reachable but sign-in required, then failing; (2) share of daily checks that passed; (3) number of sourced facts attached to the entry; (4) median response time of passing checks; (5) name. Nothing else counts. Rankings are never for sale: sponsors and paid plans cannot change an entry's position.