"A guide to PostgreSQL architecture and internals" matching MCP servers:

Read-only MCP server for precise lookup, search, and versioned retrieval of OWASP testing guides (WSTG, MASTG, ISTG, AITG) with full provenance on every result.

Enables AI coding agents to audit websites for PHP runtime vulnerabilities, compile a live Zero-PHP Next.js App Router replacement preview from a WordPress/PHP site, and retrieve remediation guidance.

Enables local, deterministic review of GitHub and GitLab pull request diffs for secret leaks, OWASP injection issues, WCAG 2.2 AA/EU EAA accessibility gaps, EU AI Act transparency, and database RLS risks, producing risk scores, merge decisions, committable suggestions, and SARIF exports.

Enables users to run synthetic support-agent evaluations, preserve and inspect traces, score results deterministically, inject failures, and enforce release review gates through MCP tools, resources, and prompts.

Wraps Kali Linux penetration testing tools for authorized security assessments, driven by a local LLM via LM Studio.

MCP server providing diagnostic tools to analyze software architecture, security, REST API compliance, and dependencies for multiple programming languages. Enables AI agents to run scans and audits on codebases.

An MCP server that provides AI assistants with real-time access to Windows internals including processes, kernel traces, event logs, services, drivers, and PE analysis.

Enables AI agents to perform comprehensive, zero-infrastructure codebase analysis through 24 MCP tools, covering security, quality, architecture, type safety, git history, and dead code detection with high precision and local privacy.

AI-powered bug bounty hunting platform that integrates security tools (OWASP ZAP, Caido, Burp Suite) for automated reconnaissance, vulnerability testing, JavaScript analysis, and finding management with PostgreSQL storage.

Provides a Model Context Protocol server implementation that allows AI agents and other MCP clients to programmatically interact with DefectDojo, a vulnerability management tool, for managing findings, products, and engagements.

Provides MCP clients like Claude with tools to query and manage security scans, CVEs, assets, findings, threat intel, and generate polished reports by acting as a lightweight adapter over the CVEasy backend API.

A Model Context Protocol (MCP) server for integrating with StackHawk's security scanning platform. Helps developers set up StackHawk, run security scans, and triage findings to fix vulnerabilities — all from within an LLM-powered IDE or chat.

Enables coding agents to run security scans on repositories through a local stdio bridge to a hosted endpoint. Includes browser-based OAuth sign-in and local token storage.

Provides security assessment methodology, tool documentation, and step-by-step workflows to guide AI agents through vulnerability scanning, static analysis, and penetration testing of applications and URLs.

Bridges AI agents with SafeBreach's Breach and Attack Simulation platform, enabling natural language queries and seamless integration through a multi-server architecture with specialized domains.

Enables AI agents to perform pay-per-call security verification of wallets, tokens, contracts, dApps, agents, and more via a remote endpoint with no installation.

Cyber Host Artificial Intelligence (C.H.A.I) An autonomous penetration testing MCP (Model Context Protocol) server with an integrated AI decision engine, multi-provider LLM support, and an extensible plugin architecture.

A TypeScript MCP server delivering a vendored 'dangerous skills' corpus and adversarial fixtures over MCP for security-research testing, supporting SEP-2640 skill delivery with archive-safety hardening.

Enables running Kali Linux security tools and commands in a containerized environment for semi-automated penetration testing, with background job management and out-of-band interaction detection.

It enables AI agents to connect to a live Chrome browser for automation and authorized security testing, including session-aware tab control, network capture and replay, DOM inspection, screenshots, and background workflows.

Enables AI-assisted penetration testing by connecting MCP clients to execute terminal commands on a Kali Linux machine, supporting tools like Nmap, Metasploit, and custom commands.

Enables MCP clients to drive IDA Pro through a stability-hardened server that hosts multiple headless idalib instances, with per-session isolation, configurable HTTP/stdio transports, and API-key authentication.

Enables a language model to inspect proxy history, run scoped scans and intruder jobs, and drive a proxied browser through Burp Suite for authorized security testing on test and staging environments. Scope, environment, mode, rate limits, refusals and secret redaction are enforced in gateway code with a tamper-evident audit log.

Connects AI assistants to HackerOne to pull bug bounty history, program scopes, and report details into a local SQLite database, exposing tools for searching, analyzing, and generating attack briefings using both personal and public disclosed reports.

Read-only observation of a single live URL: parses static HTML to report security posture, forms, links, accessibility signals, and leaks, with described fixes. SSRF-gated and safe, never executes JavaScript.

A cross-chain bridge security auditing toolkit that exposes tools for analyzing, fuzzing, and simulating bridge contracts via natural language, enabling users to detect vulnerabilities like centralization risks and replay attacks.

Enables authorized web/API security analysis as a stateful, multi-stage workflow with persistent session state, human-controlled validation, candidate versus confirmed finding tracking, and stop conditions.

Gorgon Scout is a Windows web-application and API security scanner (DAST). This connector exposes it as MCP tools, so your AI assistant can record a target you are authorised to test, run the scan, stream findings, and produce a report. Capture needs no proxy or certificate setup, and it intercepts HTTP/1.1, HTTP/2, and HTTP/3 (QUIC). Works with the free Claude Desktop plan.

Enables auditing npm, Yarn, and pnpm lockfiles in local project directories or remote Git repositories to surface dependency vulnerabilities. Exposes a tool that supports severity thresholds, registry overrides, optional dev-dependency skipping, and text or JSON reports.

Exposes 18 typed tools that drive real static-analysis engines (Ghidra, apktool, WABT, TShark, evmole, Rizin) over a single MCP endpoint to decompile binaries, audit APKs, scan EVM contracts, inspect WebAssembly, firmware, SQLite, and pcap data. Every call returns signed, verifiable evidence with an evidence_id, provider identity, SHA-256 artifact digest, and explicit limitations for security research, malware analysis, forensics, and CTF work.