"Origin" matching MCP servers:

Wraps the recon CLIs security researchers already use (subfinder, httpx, nmap, ffuf, nuclei) into a single MCP server so an LLM agent can plan and execute reconnaissance itself — passive subdomain/DNS/wayback discovery, active port scanning, WAF detection and origin-bypass checks, endpoint fuzzing, and nuclei scans. Structured JSON results carry scan tokens that let the agent chain one step's output into the next without re-typing targets.