"A service for document recognition, assessment, and filling in evaluations" matching MCP servers:

Two-way Burp Suite MCP bridge enabling AI agents to capture traffic, analyze endpoints, queue scans, and send findings back to Burp.

Enables authorized web/API security analysis as a stateful, multi-stage workflow with persistent session state, human-controlled validation, candidate versus confirmed finding tracking, and stop conditions.

Enables Claude Code to leverage OpenAI models for expert code review, deep architecture analysis, and security audits, with automatic markdown report generation.

GDB Enhanced Features MCP server for remote debugging and CTF exploitation with 41 specialized tools including ROP search, format-string detection, and memory patching.

Enables local, deterministic review of GitHub and GitLab pull request diffs for secret leaks, OWASP injection issues, WCAG 2.2 AA/EU EAA accessibility gaps, EU AI Act transparency, and database RLS risks, producing risk scores, merge decisions, committable suggestions, and SARIF exports.

Enables users to run synthetic support-agent evaluations, preserve and inspect traces, score results deterministically, inject failures, and enforce release review gates through MCP tools, resources, and prompts.

Enables LLMs to perform automated penetration testing and Active Directory reconnaissance through Mythic, with tools for executing PowerShell, AD recon, domain user enumeration, and Kerberoasting.

Exposes AI-augmented network reconnaissance and evasion capabilities as callable FastMCP tools, enabling natural language orchestration of host discovery, service fingerprinting, CVE mapping, and attack chain synthesis.

Enables AI assistants to scan Terraform and Dockerfiles for security misconfigurations, returning structured Checkov findings that can be explained in plain language.

Offers a control surface for AI agent security with four independent checks: source-code scanning, tenant isolation, LLM content verification, and deploy gating. Currently in pre-release, with no functional scanning engines yet.

GhostHunt is an MCP server that scans your development machine for API keys, tokens, and credentials hiding in places you forgot to check.

Security checks for apps built with AI: Trivy and Opengrep findings explained in plain English, with a fix request for your coding agent. Hosted scan by default (only files Git would commit, never secret files) or fully local.

Enables AI coding agents to search a security corpus, scan Terraform plan JSON for cited findings, and list sources via MCP tools grounded in CIS AWS Foundations and OWASP Top 10 CI/CD risks.

A production-ready MCP server that wraps Nmap to enable AI agents to perform automated network security assessments, including port scanning, host discovery, service detection, OS fingerprinting, and vulnerability scanning.

Enables Claude to scan a website's HTTP security headers and receive an A–F grade against OWASP best practices, including per-header pass/warn/fail results and copy-paste fixes for missing headers.

Enables sudo-free management of /etc/hosts entries for Hack The Box and lab work, with a zero-dependency MCP server for AI coding agents.

Security scanning for MCP servers from the inside out. Provides runtime inspection, AST-based static analysis, config audit, dependency analysis, and OWASP MCP Top 10 compliance in a single MCP server.

Enables AI agents to query yamory vulnerability management for vulnerability detection, risk assessment, and remediation guidance.

A Model Context Protocol (MCP) server for Gobuster that enables AI assistants to perform directory/file, DNS, virtual host, S3 bucket, and TFTP enumeration on a remote Kali Linux host via SSH.

Enables dynamic management and execution of proxy chains on a remote Linux host via SSH, allowing AI assistants to route network traffic through proxies for privacy and security testing.

A security gate MCP server that audits agent extensions (skills, MCP servers, tools) by scanning for risks, adversarial analysis, and sandbox execution, returning a trust verdict of allow, quarantine, or block.

A universal digital fingerprinting MCP server that combines 103 techniques across TCP, TLS, SSH, HTTP, DNS, and more into a single interface for AI agents, enabling full-spectrum fingerprinting on demand.

Enables AI assistants to run Kali Linux security tools in an isolated Docker container for tasks like network scanning, port checking, and service enumeration.

Exposes a pentest toolbox (sqlmap, nuclei, ffuf, etc.) via Docker to an LLM orchestrator for authorized security audits, with strict whitelisting and timeout controls.

Enables Solidity developers and security auditors to decode EVM calldata, pinpoint revert locations in debug traces, calculate storage slot layouts, and scan contracts for reentrancy and Yul assembly issues.

Enables comprehensive security reconnaissance, vulnerability assessment, and threat intelligence gathering by integrating Shodan's API. It provides tools for searching internet-connected devices, performing DNS operations, and querying the Shodan exploit database.

Enables AI assistants to perform web content discovery scans using feroxbuster on a remote system via SSH, with support for recursive scanning, filtering, and background execution.

Provides an MCP interface to a full Kali Linux environment running in Docker, enabling AI assistants to execute security tools like nmap, sqlmap, and metasploit. It allows users to start/stop the container, run shell commands, and transfer files for security testing and educational purposes.

A comprehensive security testing MCP server providing 51 tools for penetration testing, network forensics, memory analysis, and vulnerability assessment. It enables automated security audits and technical investigations across web applications, cloud environments, and network captures.

This local MCP server keeps vulnerability intelligence, research scope, scanner results, evidence receipts, Bugcrowd VRT assessments, and report drafts in one SQLite ledger. It is built for authorized defensive research and does not scan, exploit, or submit reports.