"A guide to Python dependency resolution and package management" matching MCP servers:

Enables auditing npm, pip, and other package dependencies for known CVEs via the OSV database, with tools to scan manifests, query individual packages, and integrate into CI/CD workflows.

Enables MCP clients to query projects, fetch findings, trigger analysis, upload CycloneDX BOMs, and check async token status against an OWASP Dependency-Track instance via stdio.

Enables AI agents to submit npm, PyPI, Go, or Maven packages and manifests to the free OSV.dev database and receive per-package and per-advisory results with CVE mappings, CVSS scores, severities, and the versions that fix each issue. It also supports filtering by minimum severity, de-duplicating alias advisories, and machine-readable error/warning rows for CI gates and upgrade recommendations.

Read-only MCP server for precise lookup, search, and versioned retrieval of OWASP testing guides (WSTG, MASTG, ISTG, AITG) with full provenance on every result.

Enables asynchronous OWASP Dependency-Check vulnerability scanning of allowlisted repositories via three narrow tools for starting scans, checking status, and retrieving structured findings.

Enables AI coding agents to audit websites for PHP runtime vulnerabilities, compile a live Zero-PHP Next.js App Router replacement preview from a WordPress/PHP site, and retrieve remediation guidance.

Enables users to run synthetic support-agent evaluations, preserve and inspect traces, score results deterministically, inject failures, and enforce release review gates through MCP tools, resources, and prompts.

Wraps Kali Linux penetration testing tools for authorized security assessments, driven by a local LLM via LM Studio.

Enables MCP-compatible AI applications to perform read-only npm package and project dependency safety scans, returning proceed, caution, or block verdicts without executing package code.

Enables prioritizing vulnerabilities by real-world exploitation evidence, combining CISA KEV, EPSS, CVSS, and SSVC to rank CVEs and package versions, and providing fix recommendations.

Agent-native "safe to ship?" security gate for AI-generated code. Uses real parsers and inter-rocedural taint analysis (JS/TS, Python, Go) to flag the classes AI coding agents get wrong — secrets, SQL injection, SS, SSRF, path traversal, command injection, weak JWT/CORS — and ranks findings by confidence. Exposes a scan tool over MCP.

A minimal, dependency-free MCP server that gives AI agents three real, read-only security-orchestration tools: cve_lookup, shodan_host_lookup, and nuclei_scan.

Enables AI agents to run reconnaissance tasks such as DNS, WHOIS, certificate transparency, TLS certificate, HTTP header, and limited port checks against explicitly authorized domains and IPs. Scope permissions, deny rules, default-deny resolution pinning, rate budgets, and append-only audit logging are all enforced inside the server so an out-of-scope request cannot be expressed.

Enables coding agents and CI/CD pipelines to audit untrusted code by detecting Python sandbox escapes, SQL injection taint, ReDoS regex vulnerabilities, and CORS misconfigurations, while generating Seccomp BPF filters for safer execution.

Enables AI assistants to scan websites, public repositories, and OpenClaw/CLAW skills for security vulnerabilities, including local skill-package analysis before installation, cloud scans, and remediation guidance.

A scope-aware bug-bounty & reconnaissance MCP server that works out of the box on the Python standard library and augments itself with your favourite CLI tools when they're present.

Connects MCP-compatible AI clients to a MITRE Caldera adversary emulation platform, enabling natural language construction of attack scenarios, agent inspection, and operation management.

This server enables AI-assisted APK reverse-engineering entirely on-device, orchestrating jadx, apktool, adb, frida, and APKiD through a job/workflow engine, and exposing those agents as native MCP tools for Claude without any cloud dependency.

A local MCP server that scans repository dependencies for known vulnerabilities (CVEs) using OSV.dev, enriches findings with NVD and CISA KEV data, and supports triage, remediation, and accepted risk management directly from an AI coding assistant.

Enables interaction with Picus Security's Breach & Attack Simulation API, allowing natural language queries for simulations, threat library searches, and agent management through MCP-compatible clients.