"All MCP servers available on the site" matching MCP servers:

A local MCP daemon that turns an agentic coding client into a bug bounty operator, with 103 tools for offensive security testing including MITM proxy, traffic analysis, and OOB callbacks.

Enables AI assistants to perform password security auditing using John the Ripper on a remote Kali system via SSH, supporting cracking, hash management, and session control.

An MCP Server that enables users to interact with Google's On-Demand Scanning API (v1beta1) through natural language, likely providing capabilities for vulnerability scanning and security analysis of containers and artifacts.

Living off the Land intelligence for AI agents. GTFOBins, LOLBAS, LOOBins, LOLDrivers, LOLRMM, WADComs, LOLC2 and more — unified into a single MCP server.

Enables authorized web/API security analysis as a stateful, multi-stage workflow with persistent session state, human-controlled validation, candidate versus confirmed finding tracking, and stop conditions.

AI-native security research platform that integrates Claude with MCP to execute real offensive security tools in an isolated Docker container, enabling natural language-driven recon, CVE scanning, Active Directory enumeration, and cryptographic posture assessment.

Enables plain-English website security checks from an MCP client, offering tools to assess site findings, explain individual issues, and list all available security checks.

Enables users to query BloodHound Active Directory graph data using natural language, finding attack paths, Kerberoastable accounts, and other AD security insights.

Enables authenticated remote MCP clients to manage a Kali Linux environment, run modular tools in sandboxed or optional host contexts, configure networking, and monitor jobs through a live WebUI.

Enables AI agents to perform passive security scans on domains, checking email spoofing (DMARC/SPF/DKIM), TLS weaknesses, security headers, exposed files, and subdomain-takeover risk without needing an API key.

Enables users to scan MCP servers for security threats, check installed servers, and analyze config files for risks, all from AI assistants like Claude, Cursor, or Windsurf.

MCP server that guides LLM security reviews step-by-step, tracking progress and ensuring all assigned source code is read before completing each plan step.

Provides passive OSINT reconnaissance for domains and IPs using public sources, with tools for WHOIS/RDAP, DNS, subdomain enumeration, Wayback Machine, HTTP headers, Shodan InternetDB, email security, TLS certificates, and ASN lookups, all without requiring API keys.

Enables bug bounty hunters to browse programs, inspect scope details, track scope changes over time, and receive personalized, recency-boosted program recommendations based on their skill profile.

An MCP server that audits zero-knowledge circuits (Circom, Noir, Halo2) for soundness and constraint bugs, powered by the Cysic Minimax model.

Static security scanner for AI-generated (vibe-coded) Supabase and Next.js apps. Runs as an MCP server so an LLM can scan, explain findings, and produce fixes while it writes code, all locally and offline.

A blast-radius auditor for AI agents that computes combined effective permissions across all connected MCP tools, detects dangerous capability combinations deterministically, and provides a live risk graph and one-click policy fixes.

Scan a deployed site for an exposed Supabase service_role key and audit Row Level Security from your AI coding agent.

Enables AI agents to run reconnaissance tasks such as DNS, WHOIS, certificate transparency, TLS certificate, HTTP header, and limited port checks against explicitly authorized domains and IPs. Scope permissions, deny rules, default-deny resolution pinning, rate budgets, and append-only audit logging are all enforced inside the server so an out-of-scope request cannot be expressed.

Gives AI agents threat-intelligence verdicts for IPs, domains, URLs and hashes, CVE lookups with EPSS and CISA KEV data, and a prompt-injection gate that scans untrusted text before the agent acts on it. Agents can also batch-check up to 100 indicators, hunt brand-lookalike domains, and track scan and request quotas.

Enables coding agents to perform network diagnostics and lookups, including subnet calculations, port and MAC vendor information, DNS and blocklist checks, TLS certificate inspection, and public IP discovery, all without needing an account or sending telemetry.

The js hook toolkit that all you need

Lets MCP clients browse bug bounty programmes, manage reports, and triage issues on BugSecure with user-approved OAuth permissions, including read-only mode.

Reduces thousands of security findings to the smallest set of high-impact remediation actions, with fail-closed safety gates, typed execution plans, and verification that refuses false all-cleans.

Enables agents and CI pipelines to audit MCP servers and agent tool-chains by statically scanning repositories, local checkouts, tools/list exports, or live endpoints for risks such as destructive actions without confirmation, mismatched safety annotations, injection surfaces, credential or PII exposure, and unguarded command, path, or URL sinks. All checks are read-only and never execute the scanned code or call tools/call.

Enables AI assistants and CLI users to run automated bytecode security audits of EVM smart contracts on Base Mainnet, detecting risky opcodes and interface signatures, scoring risk, and unlocking verified results via x402 USDC micropayments.

A scope-aware bug-bounty & reconnaissance MCP server that works out of the box on the Python standard library and augments itself with your favourite CLI tools when they're present.

Enables AI assistants to run Offensive360 SAST scans on local codebases, returning security findings with file/line, severity, and fixes, plus scan status tracking.

Provides anonymous, privacy-preserving tools for AI agents, including prompt-injection scanning, site file validation, endpoint liveness checks, attestation, and risk-pattern analysis.

Enables AI agents to perform passive reconnaissance, vulnerability intelligence, DNS analysis, and device search using Shodan's database of internet-connected devices, all from within your IDE.