"Accessing Hevy workout tracking app data" matching MCP servers:

Enables interaction with Hack The Box App services including machines, challenges, sherlocks, and more through the HTB API v4.

Enables an AI agent to reverse-engineer a compiled program with Ghidra — inspecting decompiled code, instructions, callers, memory bytes, and strings — without any source code. Every reply is labelled as fact, computed, or guess, and each claim traces back to hash-checked saved evidence.

Provides AI agents with a hardened code security scanner via scan_code and scan_path, detecting leaked secrets and insecure patterns while enforcing strict path confinement and resource bounds.

MCP server that provides AI-native access to BeVigil's OSINT API, enabling mobile app security research and asset discovery through tools for hosts, subdomains, S3 buckets, URLs, wordlists, and multi-step investigations.

Enables AI agents to check industrial and IT devices by vendor, product, and firmware version, returning affecting CVEs, fixes, vendor advisories, fix plans, and change tracking through read-only tools.

MCP server that guides LLM security reviews step-by-step, tracking progress and ensuring all assigned source code is read before completing each plan step.

Automates Android app analysis using Frida via AI commands, connecting a rooted Android phone to a computer and running dynamic analysis scripts without manual command execution.

Enables AI assistants to run Offensive360 SAST scans on local codebases, returning security findings with file/line, severity, and fixes, plus scan status tracking.

Enables scanning Android and iOS app packages from MCP clients for security issues, mapping findings to OWASP MASVS, CWE, and CVSS, and downloading pentest-style reports.

MCP server wrapping Drozer for LLM-driven Android IPC security testing, enabling autonomous enumeration and exploitation of app components via natural language.

Enables AI assistants to execute security testing tools on a Kali Linux machine over SSH, including reconnaissance, web app scanning, and static/dynamic analysis.

Gives MCP clients such as Claude Code and OpenCode a static-analysis toolbox for binaries, executables, DLLs, shared objects, and web-app code, covering file identification and hashing, string extraction, PE/ELF/Mach-O/WASM parsing, disassembly, Ghidra decompilation, YARA scanning, and JavaScript deobfuscation. All inspection is read-only and never executes the target.

Enables AI assistants to query RoboShadow's Rubicon Platform Data API for read-only endpoint security, asset inventory, applications, users, vulnerabilities, and remediation status data.

A comprehensive reconnaissance toolset that provides AI agents with 37 tools across 12 data sources like Shodan and VirusTotal for automated intelligence gathering. It enables agents to perform domain reconnaissance, attack surface mapping, and cross-platform data correlation within a single conversational interface.

Talk to your Flipper Zero from Claude Code — or any MCP client. Storage, app deployment, screen capture, button automation, JavaScript execution on the device, and honest answers about what is nearby.

Enables iOS reverse engineering through MCP tools that connect clients to SSH, Frida, and optional IDA for runtime inspection, app automation, decryption, debugging, and tweak development.

Enables LLMs to query live decompiled Android app context through a JADX plugin, supporting class, method, and field inspection; source and smali retrieval; manifest parsing; vulnerability discovery; and reverse engineering.

Enables vulnerability lookup and triage across NVD, EPSS, CISA KEV, OSV, and many other sources, while tracking an estate's exposure changes from SBOMs and lockfiles through snapshots and prioritized diffs.

Enables read-only interaction with HackerOne, providing tools for searching and analyzing reports, exploring programs and scope, accessing earnings, and retrieving public disclosures.

Enables AI agents to inspect APKs and resources, analyze native libraries, trace runtime behavior with Frida, and connect app screen actions to code through ADB.

A Model Context Protocol server designed for testing backend APIs for security vulnerabilities like authentication bypass, injection attacks, and data leakage.

Enables MCP clients to carry out a compliant, non-destructive, auditable authorized security-testing workflow — project intake, scope reading, asset discovery, non-destructive verification, evidence collection, and report-draft generation with manual submission tracking — where every outbound action is gated by scope checks, one-time human confirmation tokens, rate limits, and append-only audit logging.

Enables authorized web/API security analysis as a stateful, multi-stage workflow with persistent session state, human-controlled validation, candidate versus confirmed finding tracking, and stop conditions.

Enables LLMs to manage workspaces, load and run recon modules, install marketplace modules, and query reconnaissance data, exposing the full recon-ng OSINT framework.

Exposes 18 typed tools that drive real static-analysis engines (Ghidra, apktool, WABT, TShark, evmole, Rizin) over a single MCP endpoint to decompile binaries, audit APKs, scan EVM contracts, inspect WebAssembly, firmware, SQLite, and pcap data. Every call returns signed, verifiable evidence with an evidence_id, provider identity, SHA-256 artifact digest, and explicit limitations for security research, malware analysis, forensics, and CTF work.

Enables AI agents to query the Shodan API and Shodan CVEDB for internet-connected device reconnaissance, including open ports, banners, TLS certificates, DNS records and subdomains, plus CVE/CPE vulnerability intelligence with CVSS, EPSS and KEV data. Supports credit-aware searching, faceted counts, and both stdio and HTTP streaming transports.

Enables scanning of AI agent code for security vulnerabilities such as prompt injection, tool abuse, and data exfiltration, directly from MCP-compatible clients like Claude Code.

MCP server for CDN source origin tracing and IP intelligence, enabling DNS resolution, CNAME tracking, C-segment scanning, web fingerprinting, and host collision detection for asset reconnaissance.

Enables agents to inspect and automate Caido web-audit data through MCP tools, including request history, WebSockets, sitemap entries, and environments, with grouped permissions, bounded confirmations, and credential redaction for controlled operation.

MCP server for SUSE NeuVector container security, exposing inventory, vulnerability, compliance, event, and policy data as 72 typed tools. Read-only by default, with optional mutating toolsets behind a confirmation handshake.

Routes reverse-engineering requests by intent and target type (native binaries, Android apps, web/JS, Electron, .NET, firmware, protocols, archives, processes, UI, vulnerabilities) to the right analysis chain, orchestrating real backends such as Ghidra, JADX, apktool, adb, Frida, x64dbg, and pe-sieve with capability fallbacks and task-state tracking. Records evidence and claims in a ledger and applies three-layer verification (execution, fact, delivery), backed by an on-demand, book-style skill for guidance.

Deterministic, local-first MCP server for IDA Pro and IDA Home, exposing 109 strict-schema operations for reverse engineering with policy-gated mutations, evidence tracking, and broad AI-client support.

A Python MCP server that decompiles Android APK/XAPK/JAR/AAR files and extracts HTTP APIs used by the app.

Enables querying CVE vulnerability data from the NIST National Vulnerability Database, including CVE lookup, product/version search via CPE filters, CVSS severity scores, and recent high-severity disclosures.

Connects AI assistants to the watchTowr Platform for real-time access to external attack surface data, findings, and threat intelligence. Provides 113 tools for querying and managing assets, findings, hunts, and more.

Enables automated LLM red teaming by submitting asynchronous test runs, retrieving aggregated metrics, and accessing artifacts.

Enables LLMs and MCP clients to autonomously reverse engineer applications by exposing core Ghidra functionality, including decompiling and analyzing binaries, renaming methods and data, and listing methods, classes, imports, and exports.

Scans MCP tool descriptions for prompt injection attacks, including cross-tool instructions, privilege escalation, and data exfiltration patterns. It can be used as a CLI scanner or integrated as an MCP server itself.

Exposes the crackweb scanner's own commands as MCP tools, letting a client run vulnerability scans and crawls, drive an intercepting proxy, run an out-of-band callback listener, and perform offline JWT and hash analysis without shell quoting or managing background processes. Results return as structured data, including findings streamed while a proxy or listener is still running.

Enables AI assistants to query vulnerability management, security center, identity exposure, and cloud security data read-only, and to export Active Directory data from identity exposure into a BloodHound attack graph.