"A system or program using SSE instead of STDIO" matching MCP servers:

Enables secure execution of penetration testing commands on Kali Linux through Server-Sent Events with intelligent command validation, real-time monitoring, and comprehensive audit logging. Designed for authorized security research and penetration testing workflows.

Provides 180+ tools for full system control including terminal, Git, Docker, Kubernetes, VMs, BIOS, kernel, cybersecurity, AI, and cloud, designed to work with MCP clients like Cursor and Claude Desktop.

Enables professional penetration testers to run reconnaissance, scanning, brute-force, exploitation, traffic capture, and reporting workflows through stdio, Streamable HTTP, or legacy SSE with bearer/OIDC auth.

Enables agents to inspect web pages for Cloudflare Turnstile challenges without an API key, and clear Turnstile or WAF challenges using a SolveGate API key.

An MCP server that scans local codebases for quantum-vulnerable cryptography (secp256k1, Ed25519, RSA, etc.) and CI signing commands, classifying each finding as quantum-broken, post-quantum, or neither. It runs entirely locally with no network calls, providing a deterministic inventory for AI agents.

Enables scanning of Claude Code skills, plugins, or MCP servers for malware before installation via static analysis.

Enables AI agents to access VirusTotal intelligence through MCP, supporting file, URL, domain, and IP lookups, plus analysis, via remote HTTP or local stdio.

Enables Android APK reverse engineering and Flutter runtime injection through a six-step pipeline of decompile, analyze, synthesize, inject, patch, and repackage. Provides MCP tools for authorized security research and penetration testing.

Connects AI assistants to Solodit's 49,000+ blockchain vulnerability database, enabling search, browse, and lookup of audit findings directly from your AI workflow.

A read-only MCP server for the Qualys PCI Merchant API that lets LLM assistants answer questions about PCI compliance posture, such as which hosts are failing PCI or listing high findings.

MCP security firewall (stdio): vet advertised tool definitions through static-scan → threat-feed → origin → pinning before they reach the model. Zero npm runtime deps. No secrets.

Captures formatted screenshots of Caido Replay request/response pairs by driving the Screenshot Mode plugin via Chrome DevTools Protocol.

Connects MCP clients to pre-submission review that argues against a draft bug-bounty report or smart-contract finding the way a triager would, tying every claim to a supplied file and line and returning a submit, rewrite-then-submit, prove-first, hold-duplicate or drop verdict. Exposes tools to list review profiles, prepare reviews for the agent's own model, build hash-verified review packets, and — with a connection token — run hosted profiles on your own provider key.

Self-hosted MCP engine for private code reviews, providing deterministic static analysis and AST-level search over diffs, with findings passed to a review agent of your choice.

Provides security audit primitives for MCP servers, agent tool schemas, and system prompts, along with pentest utilities like JWT inspection and HTTP diffing.

Enables bug bounty hunters to browse programs, inspect scope details, track scope changes over time, and receive personalized, recency-boosted program recommendations based on their skill profile.

MCP server for Android APK triage, providing tools to parse APK headers, list DEX classes, and decode AndroidManifest.xml using apktool or androguard backends.

SkillTotal is a local stdio MCP server that lets an agent check a component before installing it. It statically analyzes MCP servers, agent skills, npm/PyPI packages and repos for supply-chain risks, dangerous capabilities (shell, filesystem, network, credentials), prompt-injection surfaces like tool poisoning, and exfiltration paths. Each finding cites file, line and snippet.

Free deterministic security scan of a public git repository (GitHub, GitLab, Codeberg, Bitbucket): vulnerable dependencies via OSV.dev, secret patterns, and config lint, returned as structured JSON. Tools: scan_repository(url), audit_pricing(). Runs locally over stdio (python3 web/mcp_stdio.py or the Dockerfile) and is also hosted at https://project-feldspar.com/mcp. MIT licence, stdlib-only. Buil

Enables agents and CI pipelines to audit MCP servers and agent tool-chains by statically scanning repositories, local checkouts, tools/list exports, or live endpoints for risks such as destructive actions without confirmation, mismatched safety annotations, injection surfaces, credential or PII exposure, and unguarded command, path, or URL sinks. All checks are read-only and never execute the scanned code or call tools/call.