"Website penetration testing and security vulnerability assessment tools" matching MCP servers:

Code-aware browser testing agent — reads your codebase, understands functionality, tests every element, reports with screenshots. Works as MCP server for Cursor/Claude Code or standalone CLI.

Checks public IPs, domains, CVE IDs and software versions for confirmed vulnerabilities and exposure, using NVD version ranges, CISA KEV, EPSS, distro backports and published exploits. All API keys are optional.

Risk Assessment AI - MCP server providing AI-powered tools and automation by MEOK AI Labs

Provides AI-visibility scoring and site auditing capabilities for websites, enabling agents to check how sites appear in AI engines like ChatGPT and Perplexity, run full SEO/security audits, and monitor changes over time.

Reads a small-business website like a customer would and shows where they get stuck. Every AI answer has to quote the page, and the server checks the quote before it counts.

Vulnerability intelligence for AI agents that enables CVE lookup, package vulnerability checks, and dependency auditing without API keys.

Gives AI agents ten website and domain research tools, including full domain reports, readable page extraction, DNS lookups, feed and sitemap parsing, link and metadata extraction, site checks, and redirect tracing. Calls are paid per use in USDC on Base via x402 from a configured wallet, so no account, API key, or subscription is required.

A lightweight MCP server for security reviews that injects security requirements before code generation, scans dependencies for CVEs, and verifies generated code without disrupting workflow.

Zero-key security toolkit for your AI assistant: grade any website's security A+ to F, check if CVEs are actively exploited via CISA KEV and EPSS, and get MITRE ATT&CK defenses explained in plain English. No API keys, no signup.

Official Model Context Protocol server exposing static AST security tools (audit_mcp_repository, audit_local_directory) to scan MCP tools for vulnerabilities before connecting them to Claude or Cursor.

Read-only CVE intelligence, remediation playbooks, and agent setup guides. Not a scanner.

Zero-execution static AST security scanner and vulnerability auditor for MCP servers. Detects Command Injection (CWE-78), Path Traversal (CWE-22), Hardcoded Secrets (CWE-798), and Unauthenticated Transports (CWE-306).

Provides deterministic, standards-based calculations for data center critical power infrastructure. Enables site selection, generator sizing, UPS sizing, NFPA 110 compliance, and more via 50+ AI agents and 8 compound chains.

Detect live website vulnerabilities and security flaws in GitHub repositories using automated DAST and SAST scanning. Safeguard applications by identifying exposed secrets, insecure dependencies, and common code patterns prone to exploitation. Receive structured fix plans with precise code remediation steps to resolve identified risks and improve security posture.

Search and pull 620+ React and Tailwind sections into your project over MCP.

Enables ethical security testing and attack surface management through SSL certificate validation, CVE queries, subdomain enumeration, security header analysis, and comprehensive reconnaissance capabilities. Designed for authorized penetration testing workflows with responsible disclosure practices.

Enables AI agents to submit npm, PyPI, Go, or Maven packages and manifests to the free OSV.dev database and receive per-package and per-advisory results with CVE mappings, CVSS scores, severities, and the versions that fix each issue. It also supports filtering by minimum severity, de-duplicating alias advisories, and machine-readable error/warning rows for CI gates and upgrade recommendations.

Autonomous AppSec & DAST code and website security scanner across 12 security domains (260+ controls) with 3-Layer Triage.

Enables deterministic calculations for AI API and subscription costs, meeting time zones, recurring schedules, and cron next-run previews, returning normalized inputs, units, assumptions, dated sources, and links to results.

Free church website audit: an MCP server that checks a church homepage for mobile, speed, SEO and first-time-visitor basics.

Classifies company sites as B2B or B2C and as SaaS, online store, agency, manufacturer, wholesaler, distributor, or marketplace, while matching your own buyer phrases and returning the quoted text and page as evidence. Runs deterministically on Apify, giving one row per domain with grace-free status rows for unreachable, blocked, or empty sites.

Official MCP server for Safe Mind, the German platform for the legally required psychological risk assessment (Gefährdungsbeurteilung psychischer Belastung). 12 tools: account onboarding, departments and locations, survey drafts, and anonymity-protected aggregated analytics that never return groups below the minimum size.

Educational tools agent by Birkan Yavuz — an A2A + MCP server for classroom tools, with creator attribution in every result. It offers a catalog of 24 real classroom activities, including math visualizers and reading and sight-word tools.

MCP server for the Mamba Labs Website Traffic Rank Estimator actor on Apify. Get a research grade Tranco popularity rank and trend for any company domain.

MCP server that lets AI coding agents (Claude Code, Cursor, Cline) audit Supabase projects for security misconfigurations AND apply the fixes — without leaving the agent. Tools: audit_project, list_findings, preview_fix (BEGIN/ROLLBACK safety), apply_fix (with confirmation), apply_all_fixes (transactional bulk). Closes the audit-fix loop entirely in the agent — other Supabase scanners only report.

Security for the MCP servers you use: detects tool poisoning, rug pulls, shadowing, secrets and supply-chain risk (OWASP MCP Top 10), with runtime guards and approved-server policy. Runs locally.

Enables auditing a Supabase project's security beyond the dashboard's Security Advisor, checking anonymous access, RLS policies, and cross-tenant data leaks via read-only probes and a two-account test.

MCP server for Appwrite security audits that scans permissions and provides structured fix proposals, with active live leak confirmation via anonymous fetch.

Zero-trust safety & settlement rail for autonomous AI agents. Sub-10ms deterministic guardrails, secret leak defense, bounded wallet controls, and on-chain Proof-of-Safety attestations via x402.

Security Scanner AI - MCP server providing AI-powered tools and automation by MEOK AI Labs