"A guide to creating software project documentation" matching MCP servers:

MCP server providing diagnostic tools to analyze software architecture, security, REST API compliance, and dependencies for multiple programming languages. Enables AI agents to run scans and audits on codebases.

Read-only MCP server for precise lookup, search, and versioned retrieval of OWASP testing guides (WSTG, MASTG, ISTG, AITG) with full provenance on every result.

Enables autonomous AI agents and penetration testers to conduct authorized security audits with persistent cross-session memory, zero-trust secret scrubbing, dynamic OWASP/ASVS checklists, and hallucination-free exploit PoC generation from captured traffic.

Wraps Kali Linux penetration testing tools for authorized security assessments, driven by a local LLM via LM Studio.

Free deterministic security scan of a public git repository (GitHub, GitLab, Codeberg, Bitbucket): vulnerable dependencies via OSV.dev, secret patterns, and config lint, returned as structured JSON. Tools: scan_repository(url), audit_pricing(). Runs locally over stdio (python3 web/mcp_stdio.py or the Dockerfile) and is also hosted at https://project-feldspar.com/mcp. MIT licence, stdlib-only. Buil

Enables searching and querying HackTricks pentesting documentation directly from Claude, with tools for quick lookup, grouped search results, page outlines, section extraction, and cheatsheet mode.

Enables AI assistants to natively execute and manage 600+ Kali Linux security, penetration testing, and forensic tools, including search, help documentation, structured scanners, and workspace management.

A security-focused server that integrates with Cursor IDE to provide real-time vulnerability detection, exploit generation, and security insights during software development.

Enables management of penetration testing reports and vulnerabilities through a REST API, supporting CVSS 3.1 scoring, HTML formatting, and secure JWT authentication for comprehensive security assessment documentation.

Provides a Model Context Protocol server implementation that allows AI agents and other MCP clients to programmatically interact with DefectDojo, a vulnerability management tool, for managing findings, products, and engagements.

Enables security auditing, penetration testing, and compliance validation with tools like Semgrep, Trivy, Gitleaks, and OWASP ZAP. Features strict project boundary enforcement and supports OWASP, CIS, and NIST compliance frameworks.

Enables users to interact with AFL++ for fuzzing workflows, including creating workspaces, instrumenting targets, starting/stopping fuzzing jobs, and triaging findings.

Enables reverse engineering and binary analysis using Ghidra, YARA, Radare2, and other tools, plus backend development assistance like project analysis, security scanning, and scaffolding.

Enables LLMs to perform Active Directory penetration testing using tools like NetExec, Bloodhound, Nmap, Certipy, and John the Ripper. Automates vulnerability discovery, attack path analysis, and documentation generation for security assessments.

Integrates Snyk security scanning with MCP clients like Claude Code, enabling listing of projects, querying issues by severity, and filtering by project or scope.

Enables AI assistants to execute security testing tools on a Kali Linux machine over SSH, including reconnaissance, web app scanning, and static/dynamic analysis.

Provides security assessment methodology, tool documentation, and step-by-step workflows to guide AI agents through vulnerability scanning, static analysis, and penetration testing of applications and URLs.

Enables AI-assisted penetration testing by connecting MCP clients to execute terminal commands on a Kali Linux machine, supporting tools like Nmap, Metasploit, and custom commands.

Enables MCP clients to drive IDA Pro through a stability-hardened server that hosts multiple headless idalib instances, with per-session isolation, configurable HTTP/stdio transports, and API-key authentication.

Read-only observation of a single live URL: parses static HTML to report security posture, forms, links, accessibility signals, and leaks, with described fixes. SSRF-gated and safe, never executes JavaScript.