AI · alternatives · 2026
24 alternatives to MCPScan
Discover & audit shadow Model Context Protocol servers
Below are 24 products that do a similar job, ranked by how close each is in meaning and then by launch-day votes.
- 1
I noticed the growing security concerns around MCP (https://news.ycombinator.com/item?id=43600192) and built an open source tool that can detect several patterns of tool poisoning attacks, exfiltration channels and cross-origin manipulations. MCP-Shield scans your installed servers (Cursor, Claude Desktop, etc.) and shows what each tool is trying to do at the instruction level, beyond just the API surface. It catches hidden instructions that try to read sensitive files, shadow other tools' behavior, or exfiltrate data. Example of what it detects: - Hidden instructions…
2025 · github.com · its alternatives →
- 2
- 3MT
https://github.com/mcp-shark/mcp-shark Site: https://mcpshark.sh/ I built MCPShark, a traffic inspector for the Model Context Protocol (MCP). It sits between your editor/LLM client and MCP servers so you can: • See all MCP traffic (requests, responses, tools, resources) in one place • Debug sessions when tools don’t behave as expected • Optionally run “Smart Scan” checks to flag risky tools / configs
Dec 2025 · its alternatives →
- 4
Hey HN, I built pg-mcp, a Model Context Protocol (MCP) server for PostgreSQL that provides structured schema inspection and query execution for LLMs and agents. It's multi-tenant and runs over HTTP/SSE (not stdio) Features - Supports multiple database connections from multiple agents - Schema Introspection: Returns table structures, types, indexes and constraints; enriched with descriptions from pg_catalog. (for well documented databases) - Read-Only Queries: Controlled execution of queries via MCP. - EXPLAIN Tool: Helps smart agents optimize queries before execution. - Extension…
2025 · github.com · its alternatives →
- 5OS
Large Language Models (LLMs) are powerful, but they’re limited by fixed context windows and outdated knowledge. What if your AI could access live search, structured data extraction, OCR, and more—all through a standardized interface? We built the JigsawStack MCP Server, an open-source implementation of the Model Context Protocol (MCP) that lets any AI model call external tools effortlessly. Here’s what it unlocks: - Web Search & Scraping: Fetch live information and extract structured data from web pages. - OCR & Structured Data Extraction: Process images, receipts, invoices, and handwritten…
2025 · its alternatives →
- 6
0xAudit▲110The security layer for AI agents to scan, fix verify via MCP
Feb 2026 · 0-x-audit.com · its alternatives →
- 7
MCP Playground▲160MCP Playground is a Postman-style tool for MCP — inspect servers, execute tools live, test your client, all from the browser. Four things in one place: 1. Free hosted MCP servers — four public test servers anyone can point their client at: Echo (connectivity), Auth (Bearer token flow), Error (error handling), Complex (multi-tool schemas).No sign-up, just use the URL. 2. Server inspector — paste any remote MCP server URL, see all its tools/resources/prompts, execute them live, inspect the full JSON-RPC log. HTTP, SSE, and WebSocket all supported. 3. Registry — 10,000+ servers…
Nov 2025 · mcpplayground.io · its alternatives →
- 8
Directory of MCPs (Model Context Protocol)
2025 · findmcpservers.com · its alternatives →
- 9
Hi HN! We kept seeing devs get pwned through MCP tools in ways that security scanners completely miss. So we built an open-source analyzer to catch these attacks. Our first OSS by Mighty team. The problem: At Defcon, we saw MCP exploits with 100% success rate against Claude and Llama. Three attack patterns: Hidden Unicode in "error messages" - Paste a colleague's error into Claude, your SSH keys get exfiltrated Trusted tool updates - That database tool you've used for months? Last week's update added credential theft Tool redefinition - Malicious tool redefines "deploy to prod" to run…
2025 · github.com · its alternatives →
- 10
This is an open‑source Model Context Protocol (MCP) server that gives any LLM a sense of the passage of time. Most MCP demos wire LLMs to external data stores. That’s useful, but MCP is also a chance to give models perception — extra senses beyond the prompt text. Six functions (`current_datetime`, `time_difference`, `timestamp_context`, etc.) give Claude/GPT real temporal awareness: It can spot pauses, reason about rhythms, and even label a chat’s “three‑act structure”. Runs locally in <60 s (Python) or via a hosted demo. If time works, what else could we surface? - Location /…
2025 · github.com · its alternatives →
- 11
Free MCP for security AI: live BGP, DNS, threat graph
May 2026 · whisper.security · its alternatives →
- 12
Scan MCP▲7MCP scanning & threat observability for AI-native tools
2025 · scanmcp.com · its alternatives →
- 13
Wireshark for MCP. A transparent proxy that shows every real tool call between your AI client and your MCP servers, live in your terminal. - kerlenton/mcpsnoop
Jul 2026 · github.com · its alternatives →
- 14
- 15
Find hidden risks in agent-to-tool communications
Nov 2025 · github.com · its alternatives →
- 16
MCPSafe▲6We've been scanning MCP (Model Context Protocol) servers to understand the security posture of the ecosystem. After 306 servers and 1,211 vulnerabilities, here's what we found: - 69 critical vulnerabilities - 32 servers using eval() on untrusted input - 31 SQL injection vulnerabilities - 32 servers with hardcoded API credentials 10.5% of servers have at least one critical vulnerability. MCP servers run with your permissions. AI agents trust them implicitly. A prompt injection can exploit them remotely. MCPSafe (https://mcpsafe.org) lets you scan before you connect. Free tier…
Feb 2026 · mcpsafe.org · its alternatives →
- 17
ContextGuard▲12I built ContextGuard after discovering that 43% of MCP servers have critical security vulnerabilities. MCP (Model Context Protocol) is the new standard that lets Claude Clients(Desktop, Windsurf, Cursor, etc.) access external tools and data sources - think of it as a plugin system for AI assistants. The problem: When you give those clients access to your filesystem, databases, or APIs through MCP servers, you're opening up serious attack vectors. Prompt injection, data leakage, and path traversal attacks are all possible. Most developers building MCP servers don't have security expertise,…
2025 · github.com · its alternatives →
- 18MV
A few days ago I posted MCPShark (a traffic inspector for the Model Context Protocol). I just shipped a VS Code / Cursor extension that lets you view MCP traffic directly in the editor, so you’re not jumping between terminals, logs, and "I think this is what got sent". VS Code Marketplace: https://marketplace.visualstudio.com/items?itemName=MCPShark... Main repo: https://github.com/mcp-shark/mcp-shark Feature requests / issues: https://github.com/mcp-shark/mcp-shark/issues Site: https://mcpshark.sh/ If…
Dec 2025 · its alternatives →
- 19
SerpApi MCP Server for Google and other search engine results - serpapi/serpapi-mcp
Dec 2025 · github.com · its alternatives →
- 20
Audit MCPs for security vulnerabilities.
May 2026 · mcpscanner.yxsh.in · its alternatives →
- 21
Find MCP servers that are actually maintained
Aug 2026 · mcpradars.com · its alternatives →
- 22
MCPAGENTSEEK▲14Global search engine for model context protocol tools
2025 · mcpagentseek.com · its alternatives →
- 23
Hey everyone, I've wanted an easy way to control which mcp server tools are available to clients. So for example, I might want a gmail server to only expose the read tool (but not send, delete etc). I figured if I create a cli for spawning mcp servers, I could intercept the stdin, stdout, stderr etc and modify what the clients see when they are making calls to list tools, resources, and prompts. Well it worked! In the initial version you can easily add a server to claude with a safe list of tools: npx -y mcpgod add @modelcontextprotocol/server-everything --client claude --tools=echo,add…
2025 · github.com · its alternatives →
- 24
Hey everyone! We've been working with several MCP server maintainers and we noticed some difficulties getting drop-in logging and identity attribution working out of the box with existing vendors. A couple of challenges we hoped to solve were: - Baseline piping of tool calls to traditional vendors - How to tie tool calls to a “user session” - Understanding the context behind tool calls made by agents So we built something. :) The MCPcat library is completely free to use, MIT licensed, and provides a one-line solution for adding logging and observability to any vendor that supports…
2025 · github.com · its alternatives →
Also compare
Ranked by how close each launch is in meaning, then by votes. Prices were read from each product’s own site when checked and can change. Refine with your own description →