Secure Your AI with Security MCP Servers
Connect HashiCorp Vault MCP, 1Password MCP, and OAuth MCP to Claude. Secure secrets management, authentication, and vulnerability scanning for enterprise AI workflows.
PDF & Word Metadata Cleaner — Apify
Inspect PDF and DOCX metadata, then create a verified cleaned copy from your AI assistant. Free MCPize listing; Apify usage charges apply.
LeakGuard
Stop agents leaking secrets: checks text before it reaches an LLM, tool or webhook for seed phrases (BIP39 checksum), EVM/Solana private keys, WIF, xprv, API keys (GitHub, AWS, Stripe, OpenAI, Slack...), JWTs, PEM keys and PII. Free preview tools are free; paid tools charge per call in USDC over x402 (Base, Polygon, Arbitrum or Solana) directly to the publisher. MCPize does not bill for this server.
SignCheck
Pre-sign safety check for AI agent wallets: decodes a transaction, EIP-712 request (Permit, Permit2, EIP-3009, Seaport), EIP-7702 delegation or x402 payment and returns SAFE/CAUTION/DANGER with risk flags (unlimited approvals, setApprovalForAll, fake USDC domains, x402 overpay, OFAC SDN). Read-only. Tool: check_signature. Free preview tools are free; paid tools charge per call in USDC over x402 (Base, Polygon, Arbitrum or Solana) directly to the publisher. MCPize does not bill for this server.
PkgGuard
Free tier: 30 calls/day, then $0.001/package or $0.003/scan in USDC. Safety check only. Checks package.json, lockfiles, requirements.txt, go.mod, Cargo.lock, poetry.lock or composer.lock (or a package list) against OSV.dev for known vulnerabilities and confirmed-malicious packages. Tools: scan_dependencies, check_package. Free preview tools are free; paid tools charge per call in USDC over x402 (Base, Polygon, Arbitrum or Solana) directly to the publisher. MCPize does not bill for this server.
DomainCheck
Check a domain before your agent trusts a link, a sender or a counterparty: does it exist, where does its mail go, SPF and DMARC policy, nameservers, DNSSEC. Tools: check_domain, check_email. Free preview tools are free; paid tools charge per call in USDC over x402 (Base, Polygon, Arbitrum or Solana) directly to the publisher. MCPize does not bill for this server.
InjectScan
Free tier: 30 calls/day, then $0.003 per call in USDC. Full prompt-injection scans (scan_text, scan_url, scan_tools). Safety check only. Check text your agent is about to read (a web page, email, document, tool result or another agent's message) for prompt injection before acting on it. Tool: scan_text. Free preview tools are free; paid tools charge per call in USDC over x402 (Base, Polygon, Arbitrum or Solana) directly to the publisher. MCPize does not bill for this server.
CounterpartyCheck
Pre-payment due diligence for AI agents: before paying or approving an EVM (Base, Ethereum, Polygon, Arbitrum) or Solana address, get a risk verdict covering sanctions, contract vs wallet, age and activity, ENS/Basename and wrong-chain traps. Free preview tools are free; paid tools charge per call in USDC over x402 (Base, Polygon, Arbitrum or Solana) directly to the publisher. MCPize does not bill for this server.
PayGuard
Free tier: 30 calls/day, then $0.001 per call in USDC (x402, on Base, Polygon, Arbitrum One or Solana). Full OFAC SDN results on every free call. Check whether a crypto address (EVM, BTC, TRX, SOL, LTC, XMR and more) is on the US Treasury OFAC SDN sanctions list before your agent pays it. Free preview tools are free; paid tools charge per call in USDC over x402 (Base, Polygon, Arbitrum or Solana) directly to the publisher. MCPize does not bill for this server.
Featured Security MCP Servers
Enterprise-grade security integrations for AI workflows
HashiCorp Vault MCP
Securely access secrets, tokens, and credentials from HashiCorp Vault
1Password MCP Server
OAuth MCP Server
Handle OAuth 2.0 flows and token management for API authentication
AWS Secrets Manager MCP
Retrieve secrets from AWS Secrets Manager for secure credential access
Authentication & Identity
Handle OAuth flows, manage sessions, and integrate with identity providers
OAuth MCP Server
Auth0 MCP
Okta MCP Server
Clerk MCP
Firebase Auth MCP
Supabase Auth MCP
Secrets Management
Securely access API keys, credentials, and tokens from enterprise vaults
HashiCorp Vault MCP
1Password MCP
AWS Secrets Manager MCP
Google Secret Manager MCP
Azure Key Vault MCP
Doppler MCP Server
Security Scanning
Scan code, dependencies, and containers for vulnerabilities
Snyk MCP Server
SonarQube MCP
Semgrep MCP
Trivy MCP Server
What Can Security MCP Servers Do?
Retrieve Secrets
Access API keys, tokens, and credentials from secure vaults.
Handle OAuth
Manage OAuth flows, token exchange, and refresh cycles.
Scan Vulnerabilities
Detect security issues in code, dependencies, and containers.
Manage Identity
Integrate with Auth0, Okta, and other identity providers.
Security Best Practices
- • Least privilege: Grant only the permissions needed for the task
- • Short-lived tokens: Use tokens with expiration rather than long-lived credentials
- • Audit logging: Enable logging on both the MCP server and secrets manager
- • Separate environments: Use different credentials for dev, staging, and production
- • Rotate regularly: Set up automatic credential rotation where possible
- • Review access: Regularly audit which MCP servers have access to what secrets
Compare Secrets Managers
Choose the right secrets management solution for your workflow
| Feature | Vault | 1Password | AWS SM | Doppler |
|---|---|---|---|---|
| Dynamic Secrets | ✓ | — | ✓ | — |
| Auto Rotation | ✓ | — | ✓ | ✓ |
| Team Sharing | ✓ | ✓ | IAM | ✓ |
| Multi-Cloud | ✓ | ✓ | AWS | ✓ |
| CLI Tool | ✓ | ✓ | ✓ | ✓ |
| Official MCP | ✓ | ✓ | Community | Community |
Frequently Asked Questions
How do I securely manage API keys with MCP?
Use a security MCP server like 1Password MCP or Vault MCP to store and retrieve API keys. Never hardcode credentials. MCP servers can fetch secrets at runtime from secure stores, keeping your configuration files clean.
Can Claude access secrets from Vault?
Yes! Install the Vault MCP server, configure your Vault address and authentication method, and add it to Claude Desktop. Claude can then securely retrieve secrets using natural language requests.
What is the best MCP server for authentication?
For secrets management, 1Password MCP and Vault MCP are top choices. For OAuth flows, use the OAuth MCP server. For enterprise SSO, consider Auth0 MCP or Okta MCP servers.
How do I connect 1Password to Claude Desktop?
Install 1Password MCP server from the official 1Password developer portal. Configure your 1Password account credentials and add the server to your Claude Desktop MCP configuration. Restart Claude to activate.
Is it safe to use MCP servers with sensitive data?
Yes, when properly configured. Use read-only access, limit scope to specific secrets, enable audit logging, and prefer short-lived tokens. Security MCP servers like Vault and 1Password have enterprise-grade security built-in.
How do OAuth MCP servers work?
OAuth MCP servers handle the complete OAuth 2.0 flow — authorization, token exchange, and refresh. They support PKCE for security and can manage tokens for multiple providers, letting Claude authenticate to APIs on your behalf.
Build a Custom Security MCP Server
Create custom security integrations. Build an MCP server, publish to the marketplace, and earn 80% of every sale.