20 Semgrep MCP alternatives
Semgrep MCP: Semgrep's official MCP server — scan code for security vulnerabilities, write and test custom rules, and pull findings from Semgrep Cloud, from inside an agent session. 20 MCP servers do similar work, most sharing Security, Code Review and Static Analysis, ranked by how much they have in common with Semgrep MCP.
-
by Aikido Security
Runs Aikido's code and secrets scan as a tool inside your coding agent, returning machine-readable findings the agent can triage, fix or ignore in place.
Also: Code Review, SAST, Security
-
by Snyk
Snyk's official MCP server, shipped inside the Snyk CLI: scan code, dependencies, containers and IaC for vulnerabilities, generate SBOMs and monitor projects from your agent.
Also: Security, Vulnerabilities
-
by SonarSource
Official SonarSource MCP server — pull code-quality issues, security hotspots, quality gates and rule explanations from SonarQube Cloud or Server into your agent.
Also: Security, Static Analysis
-
by Red Hat
Red Hat's zero-dependency C++23 code-context engine — ranked call graphs and blast-radius analysis, indexing a repo in under half a second with no server and no database.
Also: Static Analysis
-
by GitLab
GitLab's own MCP server — issues, merge requests, CI/CD pipelines, job logs, wikis and semantic code search over an OAuth-authorised HTTP endpoint.
Also: Code Review
-
by GitHub
GitHub's official MCP server — manage issues, pull requests, repositories, code search, and Actions from your agent.
Also: Code Review
-
by HackerOne
Official read-only MCP server for HackerOne bug bounty reports, programs, and remediation data.
Also: Security
-
by E2B
Run AI-generated code safely in an isolated cloud sandbox, with results returned as data rather than text.
Also: Security
-
by duty1g
A native x64dbg plugin exposing 84 debugging tools and 22 event callbacks over HTTP, so an AI assistant can drive breakpoints, memory and disassembly directly.
Also: Security
-
by JFrog
JFrog's official remote MCP server: 100+ tools across Artifactory, Xray and Curation, hosted on JFrog Cloud with OAuth and no client install.
Also: Security
-
by mukul975
Vulnerability triage for AI agents: 28 security tools across 24 free intelligence sources — NVD, EPSS, CISA KEV, MITRE ATT&CK, Shodan and VirusTotal — behind a single triage_cve call.
Also: Security
-
by Cloudsmith
Cloudsmith's official MCP server, built into its CLI: manage artifact repositories, packages and policies through an agent, with write operations off by default.
Also: Security
-
by PortSwigger
PortSwigger's official Burp Suite extension exposing proxy history, Repeater and scanning to AI agents over MCP.
Also: Security
-
by Doppler
Doppler's official MCP server — let an agent list projects, read and write secrets, manage configs and review activity logs, scoped by the token you give it.
Also: Security
-
by OpenAI
OpenAI's customer-run tunnel client: reach a localhost or private-network MCP server from ChatGPT, Codex, the Responses API and AgentKit without opening an inbound firewall rule.
Also: Security
-
by 1Password
1Password's official local MCP server for dev secrets: the agent manages Environments and .env mounts by name, and never sees a secret value.
Also: Security
-
by HashiCorp
HashiCorp's official MCP server for Vault: manage secret engine mounts, read and write KV secrets, and drive the PKI engine — issuers, roles and certificates — from an agent.
Also: Security
-
by Okta
Okta's official open-source MCP server: manage users, groups, apps, policies and branding in your Okta org from an AI agent, with scope-gated tools and confirmation on destructive actions.
Also: Security
-
by Bitwarden
Bitwarden's official MCP server — unlock the vault, read and edit items, generate passwords and TOTP codes, and run organisation administration. Local use only.
Also: Security
-
by Docker
Docker's official CLI plugin that runs MCP servers in isolated containers behind one gateway — secrets management, OAuth flows and a single config every client shares.
Also: Security
