"A query about frontend development or technologies" matching MCP servers:

Enables agents to inspect web pages for Cloudflare Turnstile challenges without an API key, and clear Turnstile or WAF challenges using a SolveGate API key.

Query Microsoft Patch Tuesday security updates from the official MSRC API — monthly rollups, CVE/KB lookups, supersedence chains, and urgency-ranked triage enriched with EPSS scores and the CISA KEV catalog. No API keys required.

An MCP server that scans local codebases for quantum-vulnerable cryptography (secp256k1, Ed25519, RSA, etc.) and CI signing commands, classifying each finding as quantum-broken, post-quantum, or neither. It runs entirely locally with no network calls, providing a deterministic inventory for AI agents.

Enables scanning of Claude Code skills, plugins, or MCP servers for malware before installation via static analysis.

Enables AI agents to access VirusTotal intelligence through MCP, supporting file, URL, domain, and IP lookups, plus analysis, via remote HTTP or local stdio.

A read-only MCP server for the Qualys PCI Merchant API that lets LLM assistants answer questions about PCI compliance posture, such as which hosts are failing PCI or listing high findings.

Connects MCP clients to pre-submission review that argues against a draft bug-bounty report or smart-contract finding the way a triager would, tying every claim to a supplied file and line and returning a submit, rewrite-then-submit, prove-first, hold-duplicate or drop verdict. Exposes tools to list review profiles, prepare reviews for the agent's own model, build hash-verified review packets, and — with a connection token — run hosted profiles on your own provider key.

GhostHunt is an MCP server that scans your development machine for API keys, tokens, and credentials hiding in places you forgot to check.

Enables LLM agents to query SecurityTrails for DNS history, subdomain enumeration, WHOIS (current and historical), SSL certificates, and IPv4 intelligence via 17 read-only tools.

MCP server for Android APK triage, providing tools to parse APK headers, list DEX classes, and decode AndroidManifest.xml using apktool or androguard backends.

Free deterministic security scan of a public git repository (GitHub, GitLab, Codeberg, Bitbucket): vulnerable dependencies via OSV.dev, secret patterns, and config lint, returned as structured JSON. Tools: scan_repository(url), audit_pricing(). Runs locally over stdio (python3 web/mcp_stdio.py or the Dockerfile) and is also hosted at https://project-feldspar.com/mcp. MIT licence, stdlib-only. Buil

Enables agents and CI pipelines to audit MCP servers and agent tool-chains by statically scanning repositories, local checkouts, tools/list exports, or live endpoints for risks such as destructive actions without confirmation, mismatched safety annotations, injection surfaces, credential or PII exposure, and unguarded command, path, or URL sinks. All checks are read-only and never execute the scanned code or call tools/call.

Enables AI agents to query yamory vulnerability management for vulnerability detection, risk assessment, and remediation guidance.

A security gate MCP server that audits agent extensions (skills, MCP servers, tools) by scanning for risks, adversarial analysis, and sandbox execution, returning a trust verdict of allow, quarantine, or block.

A Model Context Protocol (MCP) server for the YesWeHack bug bounty platform that lets Claude query private and public programs, reports, and the hacktivity feed directly from a conversation.

A read-only MCP server that lets an agent browse the HackerOne Hacker API using an authenticated hacker account, exposing programs, policies, scope, reports, and payments. It cannot create, update, or submit reports.

Enables security inspection of MCP tool metadata by analyzing tool names, descriptions, and input schemas, and returning SAFE, REVIEW, or HIGH RISK verdicts through the analyze_tools tool.

Enables MCP-compatible agents to query structured penetration testing engagement state captured from tmux sessions, including credentials, hosts, and command provenance with exact source bytes.

Enables agents to inventory the Windows software installed on a machine and match it against current CVE sources (cvelistV5, CISA KEV, EPSS, NVD), turning the hits into a persistent to-do list prioritized by exploitation and severity. It also produces an AI effort assessment for each entry, either by sampling the client or by returning an evidence package the client writes back.

Enables AI assistants to query RoboShadow's Rubicon Platform Data API for read-only endpoint security, asset inventory, applications, users, vulnerabilities, and remediation status data.