"An open-source penetration testing framework" matching MCP servers:

Code-aware browser testing agent — reads your codebase, understands functionality, tests every element, reports with screenshots. Works as MCP server for Cursor/Claude Code or standalone CLI.

Exposes structured Microsoft Dynamics 365 Business Central source code (versions 23-29, 47 localizations) to AI agents via MCP, enabling fast lookups, searches, and code analysis.

MCP server for searching, browsing, and analyzing decompiled Minecraft source code locally. Supports symbol lookup, text search, reference lookup, and lightweight RAG.

Remote MCP server that gives coding agents verified, version-pinned answers about fast-moving frameworks, starting with Expo SDK 54.

An MCP server that enables AI assistants to navigate, search, and analyze local Keycloak source code to support developer customizations like SPIs and authenticators. It provides tools for searching classes, generating boilerplate code, detecting breaking changes between versions, and tracing dependencies.

Indexes Unreal Engine source code into a local database, providing AI coding assistants with deep structural queries like class hierarchies, call graphs, and full-text search across all engine source files.

Provides coding agents with visibility into test health through tools for flaky test detection, test quality linting, and LLM evaluation harness, enabling them to triage failures, review test quality, and check prompt changes for regressions.

Open Kioku is the local-first code intelligence and evidence layer for AI coding agents (Claude, Cursor, Codex, Zed, and other MCP clients). Instead of letting agents blindly crawl files, guess blast radius, or read the entire repository repeatedly, Open Kioku gives them a precise, pre-indexed code index to build evidence-backed plans before they edit, and verify boundary limits after they edit.

Enables mapping JavaScript error stack traces back to original source code, extracting context information to help developers locate and fix issues.

Provides on-demand access to AOSP and Jetpack source code to help AI understand Android framework internals. It features a hybrid architecture using Tree-sitter and LSP for precise code extraction, cross-file navigation, and local source indexing.

Analyzes source code dependencies across multiple programming languages in the specified directory to identify file relationships, assisting in dependency management and project structure understanding.

MCP server that builds a deterministic, source-traceable knowledge index of any codebase, enabling glossary lookup, code graphs, and exact-token search with every fact linked to its source file and line.

Contract-driven test enforcement and reporting for LLM-generated code via MCP, VS Code, Copilot CLI, Claude, Cursor, or Python SDK.

AI-powered code review tool that detects AI-generated code defects invisible to traditional linters — hallucinated packages, deprecated APIs, cross-file contradictions, hidden security anti-patterns, and over-engineering. Works as a standalone CLI, GitHub Action, or MCP server. Supports TypeScript, Python, Java, Go, and Kotlin. Free for individuals, no API key required.

A universal AI-powered testing server built on the Model Context Protocol (MCP). Allows AI agents to inspect, execute, test, monitor, debug, and report on software projects.

Enables exploration and decompilation of Minecraft source code, allowing users to list versions, search classes, and decompile .class files on-the-fly.

Provides a real API for coding agents to look up design system components, props, and tokens, preventing guessed answers.

Enables static AST-based dataflow analysis to trace untrusted sources to sensitive sinks, supporting automated code review and security auditing through MCP.

Enables static AST-based taint flow tracing from untrusted sources to sensitive sinks, supporting AI code review and security analysis via MCP.

Provides GDB and clangd-based tools for debugging C++ programs, enabling step execution, variable inspection, diagnostics, and combined runtime-static analysis.