"Agent File Control MCP Server" matching MCP servers:

Security scanning, prompt injection detection, secret leak detection, and agent permission auditing for AI agent workflows.

Enables users to scan AI agent skills and configuration files for hidden Unicode instructions, prompt injection, download-and-execute payloads, exfiltration patterns, and overly broad permissions before installation. It provides static audit tools for skill files, agent configs, and revealing hidden text without executing or fetching the input.

SkillTotal is a local stdio MCP server that lets an agent check a component before installing it. It statically analyzes MCP servers, agent skills, npm/PyPI packages and repos for supply-chain risks, dangerous capabilities (shell, filesystem, network, credentials), prompt-injection surfaces like tool poisoning, and exfiltration paths. Each finding cites file, line and snippet.

Enables AI agents to access VirusTotal intelligence through MCP, supporting file, URL, domain, and IP lookups, plus analysis, via remote HTTP or local stdio.

An MCP server that lets an AI agent probe a live URL and confirm whether sensitive files (e.g., .git, .env, source maps) are genuinely served by fetching and validating the content, avoiding false positives.

Agent-native "safe to ship?" security gate for AI-generated code. Uses real parsers and inter-rocedural taint analysis (JS/TS, Python, Go) to flag the classes AI coding agents get wrong — secrets, SQL injection, SS, SSRF, path traversal, command injection, weak JWT/CORS — and ranks findings by confidence. Exposes a scan tool over MCP.

Offers a control surface for AI agent security with four independent checks: source-code scanning, tenant isolation, LLM content verification, and deploy gating. Currently in pre-release, with no functional scanning engines yet.

Self-hosted MCP engine for private code reviews, providing deterministic static analysis and AST-level search over diffs, with findings passed to a review agent of your choice.

Agent-PLC MCP Server: auto-detect, probe, read, write and diagnose Modbus TCP / FINS / MELSEC / Siemens S7comm PLCs, with transparent proxy and fault-injection listener.

Provides security audit primitives for MCP servers, agent tool schemas, and system prompts, along with pentest utilities like JWT inspection and HTTP diffing.

Scan a deployed site for an exposed Supabase service_role key and audit Row Level Security from your AI coding agent.

Publishes four flat, schema-light tools that let AI agents (including strict providers) search, describe, and invoke any of 139 reverse-engineering capabilities behind a persistent REA server. Enables file fingerprinting, inspection, and evidence-linked investigation of shipped software through plain-English requests, read-only by default.

Two-way Burp Suite MCP bridge enabling AI agents to capture traffic, analyze endpoints, queue scans, and send findings back to Burp.

Enables AI assistants to run Offensive360 SAST scans on local codebases, returning security findings with file/line, severity, and fixes, plus scan status tracking.

Connects MCP-compatible AI clients to a MITRE Caldera adversary emulation platform, enabling natural language construction of attack scenarios, agent inspection, and operation management.

Enables interaction with Picus Security's Breach & Attack Simulation API, allowing natural language queries for simulations, threat library searches, and agent management through MCP-compatible clients.

Enables AI assistants to perform authorized web security assessments through MCP tools and a guided review prompt, including passive and full scans, WAF detection, remediation fixes, report export, triage, scan comparison, and proof-of-control verification.

Provides anonymous, privacy-preserving tools for AI agents, including prompt-injection scanning, site file validation, endpoint liveness checks, attestation, and risk-pattern analysis.

A Model Context Protocol (MCP) server for Gobuster that enables AI assistants to perform directory/file, DNS, virtual host, S3 bucket, and TFTP enumeration on a remote Kali Linux host via SSH.

A security gate MCP server that audits agent extensions (skills, MCP servers, tools) by scanning for risks, adversarial analysis, and sandbox execution, returning a trust verdict of allow, quarantine, or block.

Enables MCP-native multi-agent security audits for Google Antigravity, orchestrating subagents for 0day research, static analysis, PoC verification, exploit chaining, reporting, and code remediation.

A read-only MCP server that lets an agent browse the HackerOne Hacker API using an authenticated hacker account, exposing programs, policies, scope, reports, and payments. It cannot create, update, or submit reports.

Performs static security analysis of Solana programs and generates x402 payment invoices for automated agent-to-agent audit workflows.

Security scanning for AI coding tools (Claude Code, Cursor, Windsurf) including secrets detection, MCP config vulnerabilities, agent instruction checks, threat modeling, prompt injection testing, pre-commit security checks, and dependency vulnerability scanning.

Adds security capabilities like port scanning, TLS inspection, DNS enumeration, process monitoring, secrets scanning, HTTP header auditing, and CVE checking to Claude Code and Cursor.

A MCP-enabled asset mapping and vulnerability scanning agent with AI self-reflection, allowing natural language queries and automated scanning decisions.

Enables AI coding assistants to run pre-publish security and code-quality scans across 17 categories, generate a 0–100 security score and Markdown report, quickly check critical vulnerabilities, and receive fix/refactor suggestions by finding ID.

AI-native HTTP security testing MCP server — 18 tools with raw HTTP/1.1 + HTTP/2 control

Enables AI agents to interact with a local Metasploit Framework instance through the Model Context Protocol for AI-driven red teaming, exposing RPC calls, persistent consoles, native process execution, interactive terminals, and local file access through 23 tools.

Enables structured HTTP request creation and local file ingestion for LLM integration with Burp Suite, reducing malformed requests and token costs.