"Capture The Flag (CTF) cybersecurity competitions and challenges" matching MCP servers:

Exposes 11 agent-native QA tools over stdio so coding agents can discover a project, analyze risk, select the smallest relevant test set, generate and dry-run tests, triage failures, propose tiered heals, analyze flakes, generate quality reports, and evaluate release readiness. Planning and healing tools stay read-only or propose-only, while execution defaults to dry-run, keeping agent actions safe and evidence-backed.

Enterprise-grade code intelligence server for AI assistants that analyzes codebases for due diligence, tech debt, security vulnerabilities, and code quality.

Enables agents to audit and safeguard repositories by detecting dependency pinning issues, license compliance problems, hardcoded secrets, and dead code through MCP tools.

An MCP server that lets AI models run code in 31 languages, evaluate symbolic math and logic problems, and measure complexity—exposed as 48 tools for execution, session management, translation, optimization, and more.

Lets AI coding agents read an outline of a large file or a digest of noisy command output instead of the full text, while every hidden line stays retrievable on disk through a run handle. Agents can request only the line ranges, slices, or grep matches they need and list recent runs, cutting token spend without losing information.

Enables coding agents to audit a Next.js codebase read-only, checking routes, Prisma models, environment variables, and locale consistency via MCP tools.

Enables AI agents to analyze and diff binaries by driving Ghidra headless or inside its GUI, exposing native reverse-engineering tools such as listing functions and segments, searching strings, decompiling, disassembling, and following cross-references. Ships with a devcontainer and supports local stdio or remote HTTP deployment.

MCP server for automatic Storybook story generation, component analysis, and validation. Auto-detects React frameworks and syncs component documentation.

Enables MCP clients to load eight on-demand coding skills and inspect project repositories through bounded, read-only map, search, read, diff, checks, and style tools. It keeps context lean by loading skill bodies only when needed and limiting repository scan and output sizes.

Exposes a set of CLI tools (test generation, documentation generation, linting, test running, code search) to AI assistants via MCP, allowing them to perform these tasks through natural language.

Agent-native "safe to ship?" security gate for AI-generated code. Uses real parsers and inter-rocedural taint analysis (JS/TS, Python, Go) to flag the classes AI coding agents get wrong — secrets, SQL injection, SS, SSRF, path traversal, command injection, weak JWT/CORS — and ranks findings by confidence. Exposes a scan tool over MCP.

Enables LLM agents to search, resolve and audit DTCG design tokens — finding the token behind an intent or a hard-coded color/size, checking naming grammar, auditing CSS for hard-coded or unknown tokens, arbitrating semver, and previewing token additions as JSON Patch diffs. Writes are gated behind explicit confirmation plus an opt-in flag, so every change arrives as a reviewable proposal rather than an edit.

14 atomic MCP tools for AppSec and AI Security engineers: source/schema/prompt audit primitives, JWT inspect, HTTP diff, pentest atoms (default creds, GraphQL introspect, phpggc, interactsh OOB), and a defensive helpers library that fixes the bugs the detectors flag. SARIF output, PyPI Trusted Publishing with Sigstore provenance.

locidx

Enables headless control of a DOSBox-X guest, including memory reading and patching, framebuffer capture, input injection, and live code tracing without interfering with the host desktop.

基于Capstone反汇编引擎的MCP服务器，为大语言模型提供多架构二进制反汇编、文件解析、CTF逆向及安全分析工具。

Chrome browser JS reverse engineering MCP tool for CTF/Web security, enabling dynamic analysis and restoration of login encryption logic.

An MCP server for Godot game development that provides 45 tools for reading, analyzing, and editing projects. It enables users to manage scene trees, navigate GDScript symbols, and interact with the Godot runtime for debugging and state capture.

Enables AI assistants to control GDB debugger via MCP protocol for local and remote debugging, supporting CTF Pwn, crash analysis, and ELF inspection.

Provides a high quality cybersecurity tool platform with pay as you go pricing (no subscription).

This MCP server enables automated captcha solving for Cloudflare challenges and provides a comprehensive JSVMP offline replay pipeline for signature recovery and analysis.

Enables AI code reviews through the CodeRabbit CLI by exposing a run_review tool that executes CodeRabbit with full flag coverage for analyzing committed, uncommitted, or all changes in a repository.

Exposes 18 typed tools that drive real static-analysis engines (Ghidra, apktool, WABT, TShark, evmole, Rizin) over a single MCP endpoint to decompile binaries, audit APKs, scan EVM contracts, inspect WebAssembly, firmware, SQLite, and pcap data. Every call returns signed, verifiable evidence with an evidence_id, provider identity, SHA-256 artifact digest, and explicit limitations for security research, malware analysis, forensics, and CTF work.

Enables AI agents to safely execute Python code and shell commands in an ephemeral, isolated scratchpad with pre-execution AST security checks, timeout enforcement, token-shielded output, and file diff tracking. It also exposes static code-security inspection to flag forbidden imports and reflective escape attempts before execution.

Enables AI agents to query X's open-source recommendation algorithm through commit-pinned code search, exact source spans, symbol lookup, parameter histories, and ledger-based claim verification, so answers cite reproducible evidence and flag stale findings.

Enables auditing package.json files for real npm supply-chain attack mechanisms — typosquatted dependency names, malicious preinstall/install/postinstall scripts that pipe downloads into a shell or decode base64 payloads, and unpinned versions — plus live npm registry lookups that flag nonexistent, brand-new, deprecated, or typosquatted packages. It exposes dedicated tools for full manifest audits and single-name typosquat checks.

Enables AI agents to drive Ghidra for static malware analysis, including decompilation, renaming, cross-referencing, and annotated screenshot evidence capture.

Enables deterministic auditing of agent skills, system prompts, and downloaded file collections against eight malicious-skill supply-chain patterns, returning line-numbered findings and pass/flag verdicts without using an LLM or network calls.

MCP server for code and UI safety: provides blast-radius analysis, breaking-change detection, headless UI capture and diffing, and checkpoint/rollback for workspaces.

MCP server for developing Quickshell widgets that lets AI agents render individual widgets to PNG previews offscreen, without screen capture or affecting the live shell.