"All items" matching MCP servers:

Enables users to scan MCP servers for security threats, check installed servers, and analyze config files for risks, all from AI assistants like Claude, Cursor, or Windsurf.

MCP server that guides LLM security reviews step-by-step, tracking progress and ensuring all assigned source code is read before completing each plan step.

Provides passive OSINT reconnaissance for domains and IPs using public sources, with tools for WHOIS/RDAP, DNS, subdomain enumeration, Wayback Machine, HTTP headers, Shodan InternetDB, email security, TLS certificates, and ASN lookups, all without requiring API keys.

Static security scanner for AI-generated (vibe-coded) Supabase and Next.js apps. Runs as an MCP server so an LLM can scan, explain findings, and produce fixes while it writes code, all locally and offline.

A blast-radius auditor for AI agents that computes combined effective permissions across all connected MCP tools, detects dangerous capability combinations deterministically, and provides a live risk graph and one-click policy fixes.

Enables coding agents to perform network diagnostics and lookups, including subnet calculations, port and MAC vendor information, DNS and blocklist checks, TLS certificate inspection, and public IP discovery, all without needing an account or sending telemetry.

The js hook toolkit that all you need

Reduces thousands of security findings to the smallest set of high-impact remediation actions, with fail-closed safety gates, typed execution plans, and verification that refuses false all-cleans.

Enables agents and CI pipelines to audit MCP servers and agent tool-chains by statically scanning repositories, local checkouts, tools/list exports, or live endpoints for risks such as destructive actions without confirmation, mismatched safety annotations, injection surfaces, credential or PII exposure, and unguarded command, path, or URL sinks. All checks are read-only and never execute the scanned code or call tools/call.

Enables AI agents to perform passive reconnaissance, vulnerability intelligence, DNS analysis, and device search using Shodan's database of internet-connected devices, all from within your IDE.

Enables interactive Ghidra reverse-engineering inside an AI client by rendering live decompiler, function browser, and call graph views. Users can click symbols to rename them and follow calls to navigate, all without leaving the conversation.

Enables plain-English website security checks from an MCP client, offering tools to assess site findings, explain individual issues, and list all available security checks.

Gives MCP clients such as Claude Code and OpenCode a static-analysis toolbox for binaries, executables, DLLs, shared objects, and web-app code, covering file identification and hashing, string extraction, PE/ELF/Mach-O/WASM parsing, disassembly, Ghidra decompilation, YARA scanning, and JavaScript deobfuscation. All inspection is read-only and never executes the target.

Comprehensive DNS security toolkit for AI agents: 103 tools across 13 categories including DNSSEC validation, subdomain takeover detection, email security audit, and more, all running locally with no external API calls required.

Enables an AI agent to statically triage local binaries and APKs by extracting and classifying strings, flagging hardcoded secrets, detecting file types, checking exploit-mitigation flags, and auditing Android manifests. Results from all tools can be merged into a single structured report with a summary findings list.

Enterprise-grade Azure security assessment toolkit with multi-location scanning, IMDS exploitation, attack path analysis, and compliance reporting. Enables authorized penetration testing and compliance audits across all Azure regions.

Enables MCP-capable LLM agents to control YADS queues, manage tags, and trigger scans through YADS's API-authenticated /api/v1 interface without dashboard access. All actions respect tenant isolation and scan limits.

The most comprehensive steganography analysis toolkit for AI agents, providing 60 tools across 7 categories for detecting and extracting hidden data from images, audio, text, and files, all running 100% offline.

Enables cyber defenders to query ATT\&CK techniques, list tactics, map incidents to techniques, look up threat actor groups and mitigations, all via the MCP protocol.

A Model Context Protocol (MCP) server for integrating with StackHawk's security scanning platform. Helps developers set up StackHawk, run security scans, and triage findings to fix vulnerabilities — all from within an LLM-powered IDE or chat.

Exposes the ASC APK-as-database analysis engine as MCP tools, enabling AI clients to run fast cross-reference searches, string/secret recon, class and member inspection, manifest and component extraction, and parallel batch queries across many APKs without full decompilation. All tools are stateless and process-isolated, so multiple clients can query single or multiple APK analysis sessions concurrently.

Enables AI clients to submit files, hashes, and URLs for malware analysis, retrieve results, search across AssemblyLine indices, and triage alerts, all through the Model Context Protocol.

An MCP server that lets AI agents manage a local watchlist of the software and exact versions you run, then check them against vulnerability and exploitation data. It enables adding, updating and listing watched items, pulling current alerts or recent findings, and asking whether a given CVE affects anything on the list.

An MCP server for AI security analysis, enabling vulnerability scanning, sensitive information leak detection, and GitHub code leak monitoring via 48 tools.

Enables AI assistants to control the x64dbg debugger through natural language, providing tools for breakpoints, memory, disassembly, tracing, PE dumping, and anti-debug bypass, all locally via stdio.

Autonomous pentests from one command: real security tools, working PoCs, and audit-ready reports, all driven via MCP.

Enables AI agents to drive wireless penetration testing end-to-end through MCP, including monitor mode, network scanning, handshake and PMKID capture, WPS attacks, deauthentication, and password cracking. It exposes all h4kfi tools to MCP-compatible clients like OpenCode and Claude Code.

Enables agents to reverse engineer native binaries, JavaScript/Electron applications, .NET assemblies, web captures, EVM bytecode, and process behavior through a provider-neutral MCP interface. Every result is an evidence envelope stating what was observed, derived, unexamined, or unprovable, with all capabilities gated by a deterministic fail-closed policy engine.

Enables AI coding tools to scan projects for security vulnerabilities, hardcoded secrets, injection flaws, and privacy violations with 699 rules and 76 MCP tools, all running locally with zero telemetry.

Enables running expert-level build, ship, and scale workflows from Claude Code, with 40+ audit tools covering SEO/GEO/AEO readiness, accessibility, secrets and vibe-coding security, penetration testing, code quality, bundle size, evals, and dependency health. A blocking ship-gate scores all auditors against configurable thresholds and fails the deploy on critical findings or leaked secrets.