"API Documentation Resources" matching MCP servers:

Enables Android APK reverse engineering and Flutter runtime injection through a six-step pipeline of decompile, analyze, synthesize, inject, patch, and repackage. Provides MCP tools for authorized security research and penetration testing.

Enables searching and querying HackTricks pentesting documentation directly from Claude, with tools for quick lookup, grouped search results, page outlines, section extraction, and cheatsheet mode.

Offers a control surface for AI agent security with four independent checks: source-code scanning, tenant isolation, LLM content verification, and deploy gating. Currently in pre-release, with no functional scanning engines yet.

MCP server for auditing infrastructure-as-code attack paths, finding multi-hop chains from public internet to sensitive resources.

Unified MCP server that gives AI agents security tools to audit MCP configs, redact secrets/PII, vet skills, check dependencies, and scan networks.

Free deterministic security scan of a public git repository (GitHub, GitLab, Codeberg, Bitbucket): vulnerable dependencies via OSV.dev, secret patterns, and config lint, returned as structured JSON. Tools: scan_repository(url), audit_pricing(). Runs locally over stdio (python3 web/mcp_stdio.py or the Dockerfile) and is also hosted at https://project-feldspar.com/mcp. MIT licence, stdlib-only. Buil

Two-way Burp Suite MCP bridge enabling AI agents to capture traffic, analyze endpoints, queue scans, and send findings back to Burp.

MCP server that exposes 31 OSINT checks from Lissy93/web-check as tools for website analysis, including SSL, DNS, headers, WHOIS, and security presets. Enables natural-language-driven web recon and health checks.

Enables querying the WPScan API for WordPress plugin, theme, core vulnerabilities, and specific vulnerability lookups through MCP tools.

Enables AI assistants to natively execute and manage 600+ Kali Linux security, penetration testing, and forensic tools, including search, help documentation, structured scanners, and workspace management.

Enables AI agents to interact with the FlagForge REST API, allowing them to search solved CTF challenges, work on live event challenges, record evidence, submit flag candidates, and write markdown writeups.

Enables AI assistants to query RoboShadow's Rubicon Platform Data API for read-only endpoint security, asset inventory, applications, users, vulnerabilities, and remediation status data.

Enables testing API authentication and authorization by probing endpoints with and without Authorization headers, suggesting auth test matrices for roles, and showing current test configuration.

A comprehensive HTTP client MCP server for security testing, API testing, and web automation that provides full-featured HTTP tools with detailed logging capabilities.

Enables management of penetration testing reports and vulnerabilities through a REST API, supporting CVSS 3.1 scoring, HTML formatting, and secure JWT authentication for comprehensive security assessment documentation.

Enables developers and security teams to run evidence-first Android and iOS security audits, manage jobs and reports, query public vulnerability intelligence, evaluate policies, and plan runtime checks through stdio MCP tools and resources.

MCP server for AI-driven VAPT orchestration, enabling agents to plan and execute authorized security scans through a control plane that enforces scope, sanitization, budget, rate limits, human approval, and audit logging.

Provides access to Shodan API functionality, enabling AI assistants to query information about internet-connected devices for cybersecurity research and threat intelligence.

An authorization-first MCP-governed control plane for executing security-tool workflows in explicitly approved, sandboxed environments with auditable campaigns and AI collaboration boundaries.

Enables red-team and blue-team security workflows on BlackArch Linux by wrapping local tools like nmap, gobuster, nikto, and hydra as MCP tools, with scope-gating that prevents unauthorized scanning against any target not explicitly listed in a local scope.yaml file.