"A guide on how to deploy a web app" matching MCP servers:

Read-only MCP server for precise lookup, search, and versioned retrieval of OWASP testing guides (WSTG, MASTG, ISTG, AITG) with full provenance on every result.

Enables interaction with Hack The Box App services including machines, challenges, sherlocks, and more through the HTB API v4.

An MCP server that lets an AI agent probe a live URL and confirm whether sensitive files (e.g., .git, .env, source maps) are genuinely served by fetching and validating the content, avoiding false positives.

MCP server that exposes 31 OSINT checks from Lissy93/web-check as tools for website analysis, including SSL, DNS, headers, WHOIS, and security presets. Enables natural-language-driven web recon and health checks.

Enables AI agents to audit URLs for security headers, generate CSP Level 3 policies, compute SRI hashes, evaluate WCAG 2.2 contrast, and remediate headers.

An MCP Server that enables users to interact with Google's On-Demand Scanning API (v1beta1) through natural language, likely providing capabilities for vulnerability scanning and security analysis of containers and artifacts.

Connects AI coding assistants to Snyk API & Web for onboarding scan targets, configuring authentication, running DAST scans, and triaging findings through natural language.

Wraps Kali Linux penetration testing tools for authorized security assessments, driven by a local LLM via LM Studio.

Provides AI agents with a hardened code security scanner via scan_code and scan_path, detecting leaked secrets and insecure patterns while enforcing strict path confinement and resource bounds.

Enables AI assistants to execute security testing tools on a Kali Linux machine over SSH, including reconnaissance, web app scanning, and static/dynamic analysis.

Enables proof-backed code audit via MCP tools for AST-based code maps, symbol lookup, callers, audit commands, and persistent verdict memory.

Enables agents to inspect web pages for Cloudflare Turnstile challenges without an API key, and clear Turnstile or WAF challenges using a SolveGate API key.

Enables AI agents to perform passive security scans on domains, checking email spoofing (DMARC/SPF/DKIM), TLS weaknesses, security headers, exposed files, and subdomain-takeover risk without needing an API key.

Free deterministic security scan of a public git repository (GitHub, GitLab, Codeberg, Bitbucket): vulnerable dependencies via OSV.dev, secret patterns, and config lint, returned as structured JSON. Tools: scan_repository(url), audit_pricing(). Runs locally over stdio (python3 web/mcp_stdio.py or the Dockerfile) and is also hosted at https://project-feldspar.com/mcp. MIT licence, stdlib-only. Buil

MCP server that provides AI-native access to BeVigil's OSINT API, enabling mobile app security research and asset discovery through tools for hosts, subdomains, S3 buckets, URLs, wordlists, and multi-step investigations.

Agent-native "safe to ship?" security gate for AI-generated code. Uses real parsers and inter-rocedural taint analysis (JS/TS, Python, Go) to flag the classes AI coding agents get wrong — secrets, SQL injection, SS, SSRF, path traversal, command injection, weak JWT/CORS — and ranks findings by confidence. Exposes a scan tool over MCP.

Domain security reconnaissance for AI agents — 13 tools (DNS+DNSSEC, SSL/TLS, HTTP security headers, SPF/DKIM/DMARC email auth, port scan, ASN, RDAP/WHOIS) plus a one-shot security_scan returning a 0–100 Health Score (A–F). Free, no API key.

Offers a control surface for AI agent security with four independent checks: source-code scanning, tenant isolation, LLM content verification, and deploy gating. Currently in pre-release, with no functional scanning engines yet.

This server enables AI-assisted APK reverse-engineering entirely on-device, orchestrating jadx, apktool, adb, frida, and APKiD through a job/workflow engine, and exposing those agents as native MCP tools for Claude without any cloud dependency.

Connects MCP clients to pre-submission review that argues against a draft bug-bounty report or smart-contract finding the way a triager would, tying every claim to a supplied file and line and returning a submit, rewrite-then-submit, prove-first, hold-duplicate or drop verdict. Exposes tools to list review profiles, prepare reviews for the agent's own model, build hash-verified review packets, and — with a connection token — run hosted profiles on your own provider key.