"A guide to conducting market research" matching MCP servers:

Read-only MCP server for precise lookup, search, and versioned retrieval of OWASP testing guides (WSTG, MASTG, ISTG, AITG) with full provenance on every result.

This local MCP server keeps vulnerability intelligence, research scope, scanner results, evidence receipts, Bugcrowd VRT assessments, and report drafts in one SQLite ledger. It is built for authorized defensive research and does not scan, exploit, or submit reports.

Enables AI coding agents to audit websites for PHP runtime vulnerabilities, compile a live Zero-PHP Next.js App Router replacement preview from a WordPress/PHP site, and retrieve remediation guidance.

Wraps Kali Linux penetration testing tools for authorized security assessments, driven by a local LLM via LM Studio.

A local-first MCP attack kit for authorized security research and red teaming, demonstrating exfiltration, agent manipulation, and other abuse patterns via pluggable cases.

Enables MCP clients to drive the complete mobile security toolkit—static/dynamic analysis, Frida hooks, runtime exploration, traffic interception, network setup, and IoT scans—through engine-exposed tools.

Enables Android APK reverse engineering and Flutter runtime injection through a six-step pipeline of decompile, analyze, synthesize, inject, patch, and repackage. Provides MCP tools for authorized security research and penetration testing.

Enables AI assistants to search and analyze vulnerabilities and exploits from multiple intelligence sources, including NVD, CISA KEV, ExploitDB, Metasploit, and more, with tools for CVE research, exploit analysis, and report generation.

MCP server that provides AI-native access to BeVigil's OSINT API, enabling mobile app security research and asset discovery through tools for hosts, subdomains, S3 buckets, URLs, wordlists, and multi-step investigations.

A Model Context Protocol (MCP) server for interacting with the Intigriti bug bounty platform's Researcher API. It enables AI assistants to manage bug bounty programs, submissions, and research workflow.

Enables AI agents to orchestrate security research workflows by connecting to containerized security tools via MCP, allowing automated vulnerability analysis and pipeline execution.

A Model Context Protocol (MCP) server for Gobuster that enables AI assistants to perform directory/file, DNS, virtual host, S3 bucket, and TFTP enumeration on a remote Kali Linux host via SSH.

Enables MCP-native multi-agent security audits for Google Antigravity, orchestrating subagents for 0day research, static analysis, PoC verification, exploit chaining, reporting, and code remediation.

Enables LLMs to conduct passive attack-surface research by collecting public information, referencing saved reports, and verifying evidence through MCP tools.

GDB MCP server for binary security research (reverse engineering / PWN) with first-class pwndbg integration, enabling heap analysis, cyclic pattern, checksec, ROP gadgets, and more via MCP protocol.

An MCP server that enables AI-assisted mobile security testing by exposing Frida functionality for Android application research. It provides tools for hooking Java methods, manipulating memory, managing device processes, and executing custom Frida scripts.

Provides access to Shodan API functionality, enabling AI assistants to query information about internet-connected devices for cybersecurity research and threat intelligence.

A security research MCP server for testing tool call safety with deterministic policies like allowlists, path boundary enforcement, SSRF prevention, output redaction, and prompt injection detection, without requiring external LLMs or API keys.

A community security-research MCP server providing Browser Session and OIDC authentication for Okta workspaces, enabling read-only exploration of Okta organizations and user identity.

MCP server that connects WinDbg, IDA Pro, and x64dbg to AI assistants for reverse engineering and Windows security research, offering 160+ tools for debugging, analysis, and cross-debugger workflows.

Provides a Model Context Protocol server implementation that allows AI agents and other MCP clients to programmatically interact with DefectDojo, a vulnerability management tool, for managing findings, products, and engagements.

A Frida MCP server for authorized dynamic analysis and application security research, exposing device/session management, script injection, process and memory inspection, and platform-specific workflows.

Provides MCP clients like Claude with tools to query and manage security scans, CVEs, assets, findings, threat intel, and generate polished reports by acting as a lightweight adapter over the CVEasy backend API.

A Model Context Protocol (MCP) server for integrating with StackHawk's security scanning platform. Helps developers set up StackHawk, run security scans, and triage findings to fix vulnerabilities — all from within an LLM-powered IDE or chat.

Enables coding agents to run security scans on repositories through a local stdio bridge to a hosted endpoint. Includes browser-based OAuth sign-in and local token storage.

Provides security assessment methodology, tool documentation, and step-by-step workflows to guide AI agents through vulnerability scanning, static analysis, and penetration testing of applications and URLs.

Enables AI agents to perform pay-per-call security verification of wallets, tokens, contracts, dApps, agents, and more via a remote endpoint with no installation.

A TypeScript MCP server delivering a vendored 'dangerous skills' corpus and adversarial fixtures over MCP for security-research testing, supporting SEP-2640 skill delivery with archive-safety hardening.

Enables users to statically analyze regular expressions for catastrophic-backtracking (ReDoS) risk through real AST parsing rather than executing the pattern, flagging nested quantifiers, ambiguous alternation, and backreferences. It also generates candidate proof-of-concept attack strings with a timeout-guarded test snippet and suggests JavaScript-safe rewrites.

Enables running Kali Linux security tools and commands in a containerized environment for semi-automated penetration testing, with background job management and out-of-band interaction detection.