Best MCP Servers for Security & Authentication
Top-ranked MCP servers for secrets management, auth integration, compliance scanning, and security tooling. Scored from the AgentRank index.
Security and authentication MCP servers give agents controlled access to secrets managers, identity providers, vulnerability scanners, and compliance tools. They are essential for any agent that operates in production environments where credentials, permissions, and audit trails matter.
This guide ranks the top security-focused MCP servers from the AgentRank index — covering HashiCorp Vault, AWS Secrets Manager, OAuth integrations, SAST/DAST scanning tools, and compliance automation.
Top Security & Authentication MCP servers
Ranked by the composite AgentRank score — a weighted blend of stars (10%), freshness (20%), issue health (20%), contributors (8%), and inbound dependents (22%). Average score across these 8 tools: 94.8.
| # | Repository | Score | Stars | Lang | Updated |
|---|---|---|---|---|---|
| 1 | arcjet/arcjet-js Runtime security for AI apps and agents: prompt injection detection, tool-call authorizati… | 98.1 | 692 | TypeScript | 12d ago |
| 2 | itechmeat/open-second-brain Local-first 🧠memory for Hermes Agent that lives in your Obsidian vault and remembers pro… | 96.4 | 476 | TypeScript | 7d ago |
| 3 | Auriti-Labs/geo-optimizer-skill Open-source Answer Engine Optimization (AEO) & Generative Engine Optimization (GEO) toolki… | 96.2 | 1.1k | Python | 7d ago |
| 4 | luckyPipewrench/pipelock Open-source AI agent firewall for MCP security and agent egress. Scans mediated HTTP, MCP,… | 95.0 | 922 | Go | 7d ago |
| 5 | agentic-community/mcp-gateway-registry Enterprise-ready MCP Gateway & Registry that centralizes AI development tools with secure … | 93.8 | 972 | Python | 7d ago |
| 6 | istefox/obsidian-mcp-connector Your Obsidian vault, exposed to Claude and any MCP client. Runs inside Obsidian, on-device… | 93.0 | 101 | TypeScript | 7d ago |
| 7 | aaronsb/obsidian-mcp-plugin High-performance Model Context Protocol (MCP) server for Obsidian that provides AI tools w… | 92.9 | 466 | TypeScript | 7d ago |
| 8 | enowdev/antares Antares: a self-hosted AI pentest agent and assistant in one binary. Authorized penetratio… | 92.6 | 85 | Go | 7d ago |
Choosing by use case
- Secrets management (Vault, AWS Secrets)
- Read secrets, rotate credentials, and manage secret versions — without hardcoding credentials.
- Identity & auth (OAuth, SAML, Okta)
- Integrate with identity providers for agent authentication and user context.
- Vulnerability scanning
- Run SAST/DAST scans, check for known CVEs, and surface security issues in automated agent loops.
- Compliance & audit
- Generate audit logs, check compliance posture, and track access patterns across agent operations.
Quick setup
Most MCP servers follow the same config pattern. Add this to your Claude Desktop, Cursor, or Windsurf MCP config file:
{
"mcpServers": {
"secrets": {
"command": "npx",
"args": ["-y", "@modelcontextprotocol/server-aws-secrets"],
"env": { "AWS_REGION": "us-east-1" }
}
}
}See the integrations page for platform-specific setup guides for Claude Code, Cursor, VS Code, Windsurf, and Cline.
Reading the AgentRank signals
Each tool in this guide is scored on the core signals that predict long-term reliability:
| Signal | Weight | What it means |
|---|---|---|
| Stars | 15% | Raw popularity — how many developers have found and bookmarked this tool |
| Freshness | 25% | Days since last commit — tools with no recent commits decay hard after 90 days |
| Issue health | 25% | Ratio of closed to total issues — measures maintainer responsiveness |
| Contributors | 10% | More contributors = less bus-factor risk, broader review surface |
| Dependents | 25% | How many other repos depend on this — the strongest signal of real-world adoption |
Query this live from your editor: Install AgentRank in Cursor, VS Code, or Claude Code — your AI agent can query live rankings on demand.
Missing a tool? Submit it to the index — new tools are scored in the next nightly crawl.
Get the weekly AgentRank digest
Top movers, new tools, ecosystem insights — straight to your inbox.