"A guide to implementing web browser control functionality" matching MCP servers:

Enables AI coding assistants to run pre-publish security and code-quality scans across 17 categories, generate a 0–100 security score and Markdown report, quickly check critical vulnerabilities, and receive fix/refactor suggestions by finding ID.

Read-only MCP server for precise lookup, search, and versioned retrieval of OWASP testing guides (WSTG, MASTG, ISTG, AITG) with full provenance on every result.

Enables AI agents to control a local Chromium browser via CDP for page snapshots, screenshots, human-like interactions, autonomous crawling, API/GraphQL reconnaissance, authenticated differential testing, and Burp-like intercept, repeater, and intruder workflows with scope enforcement and audit logging.

An MCP server that lets an AI agent probe a live URL and confirm whether sensitive files (e.g., .git, .env, source maps) are genuinely served by fetching and validating the content, avoiding false positives.

MCP server that exposes 31 OSINT checks from Lissy93/web-check as tools for website analysis, including SSL, DNS, headers, WHOIS, and security presets. Enables natural-language-driven web recon and health checks.

Security-focused Firefox browser MCP server for penetration testing, built on Playwright, enabling vulnerability scanning, session manipulation, network inspection, and reconnaissance.

Read-only observation of a single live URL: parses static HTML to report security posture, forms, links, accessibility signals, and leaks, with described fixes. SSRF-gated and safe, never executes JavaScript.

Enables AI agents to audit URLs for security headers, generate CSP Level 3 policies, compute SRI hashes, evaluate WCAG 2.2 contrast, and remediate headers.

Enables AI coding agents to audit websites for PHP runtime vulnerabilities, compile a live Zero-PHP Next.js App Router replacement preview from a WordPress/PHP site, and retrieve remediation guidance.

Enables controlled, evidence-first web application penetration testing and bug bounty workflows, including scope enforcement, reconnaissance, human-approved surface triage, OWASP WSTG test execution, and SHA-256 evidence capture.

Connects AI coding assistants to Snyk API & Web for onboarding scan targets, configuring authentication, running DAST scans, and triaging findings through natural language.

Wraps Kali Linux penetration testing tools for authorized security assessments, driven by a local LLM via LM Studio.

Enables proof-backed code audit via MCP tools for AST-based code maps, symbol lookup, callers, audit commands, and persistent verdict memory.

MCP server that bridges opencode into Firefox, enabling page reading, JavaScript execution, and security auditing directly from the terminal.

Enables AI agents to perform security testing on web applications by controlling a Firefox browser with 39 security tools, including injection testing and access control analysis.

Enables agents to inspect web pages for Cloudflare Turnstile challenges without an API key, and clear Turnstile or WAF challenges using a SolveGate API key.

Offers a control surface for AI agent security with four independent checks: source-code scanning, tenant isolation, LLM content verification, and deploy gating. Currently in pre-release, with no functional scanning engines yet.

Free deterministic security scan of a public git repository (GitHub, GitLab, Codeberg, Bitbucket): vulnerable dependencies via OSV.dev, secret patterns, and config lint, returned as structured JSON. Tools: scan_repository(url), audit_pricing(). Runs locally over stdio (python3 web/mcp_stdio.py or the Dockerfile) and is also hosted at https://project-feldspar.com/mcp. MIT licence, stdlib-only. Buil

Enables AI assistants to perform authorized web security assessments through MCP tools and a guided review prompt, including passive and full scans, WAF detection, remediation fixes, report export, triage, scan comparison, and proof-of-control verification.

Gives AI agents a browser that bypasses bot detection, a MITM proxy for traffic interception, and a Python sandbox to autonomously write and execute security exploits.