"Damn Vulnerable MCP" matching MCP servers:

An MCP server that scans local codebases for quantum-vulnerable cryptography (secp256k1, Ed25519, RSA, etc.) and CI signing commands, classifying each finding as quantum-broken, post-quantum, or neither. It runs entirely locally with no network calls, providing a deterministic inventory for AI agents.

MCP server for Cursor that scans codebases for security issues including hardcoded secrets, SAST, vulnerable dependencies, and IaC misconfigurations.

Enables developers to check for vulnerable dependencies in npm, Maven, and Python projects and query GitHub Security Advisories for a package without leaving their editor.

Automatically detects security vulnerabilities in AI-generated code, scanning for hardcoded secrets, injection flaws, XSS, weak cryptography, authentication issues, path traversal, and vulnerable dependencies across JavaScript, Python, Java, and Go.

Provides AI assistants with progressive code intelligence to explore repository structure, find symbols, and assess the impact of changes using ast-grep.

Enables querying any GitHub, GitLab, or Bitbucket repository and getting AI-generated answers about the codebase, powered by Gemini.

MCP server for AI-assisted development on the Lampa open-source TV app, providing read-only access to the source tree with 41 tools and 5 resources for structured analysis, planning, editing, and validation.

Enables AI coding agents to list, read, create, update, delete, and render PlantUML and Mermaid diagrams, and check them against the actual codebase to detect architecture drift.

Offline MCP server for SAP ABAP static analysis, ABAP Cloud readiness scoring, and RAP scaffolding. It enables AI agents to lint ABAP source, compare reworks, check released APIs, and generate RAP business objects without needing an SAP system.

Enables asking natural-language questions about any GitHub repository and receiving answers grounded in the actual code, with read-only enforcement and automatic repository fetching.

Connects AI assistants like Claude to PHP's XDebug debugger for runtime inspection, breakpoint control, and variable tracking, enabling natural language debugging of PHP applications.

Verificate combines 17 applications each designed to address a separate issue with AI Coding supported with a Frontier AI Model. This allows you to Vibe Code with confidence and even dropped down to a more basic model with a better outcome.

MCP server that provides AI assistants with structured access to codebases via LogicStamp Context, enabling component analysis, dependency graphs, drift detection, and token-optimized context delivery.

Enables LLMs to apply Martin Fowler's 71+ refactoring patterns to codebases through a pluggable, language-agnostic architecture. Supports previewing and applying refactorings, analyzing code smells, and inspecting code structure with safe-by-default operations.

Provides TypeScript and JavaScript code refactoring operations using ts-morph, allowing AST-based symbol renaming, file/folder renaming, reference searching, and path alias removal when integrated with editor extensions like Cursor.

Enables read-only access to the canonical-vault GitHub repository through MCP, letting clients list files, retrieve file contents and history, inspect commits, and search code.

Enables Android APK reverse engineering and Flutter runtime injection through a six-step pipeline of decompile, analyze, synthesize, inject, patch, and repackage. Provides MCP tools for authorized security research and penetration testing.

Gives OpenAI Codex behavioral history from workspace.json, exposing file fragility and co-change partners as tools to enforce safer edits and block incomplete patches.

Enables automatic generation of explicit boilerplate methods (getter/setter/equals/hashCode/toString/constructors) for Java entity classes, replacing Lombok dependencies with visible, reviewable code.

Scans code strings for hardcoded secrets (AWS keys, tokens, private keys, etc.) and returns redacted findings, helping AI coding agents catch secrets before writing or committing code.