"An overview of REST (Representational State Transfer)" matching MCP servers:

Enables users to audit EVM, Solana, and Move smart contracts and assess Web3 security risks through tools for honeypot detection, SPL token risk, MEV sandwich exposure, address poisoning, HTTP 402 invoice fraud, UTXO consolidation planning, and cross-chain bridge quotes.

Enables LLM agents to browse and triage vulnerability observations, manage products, branches and rules, import scan reports and SBOMs, run scans and background jobs, and generate VEX documents via SecObserve's REST API.

Connects AI assistants to Solodit's 49,000+ blockchain vulnerability database, enabling search, browse, and lookup of audit findings directly from your AI workflow.

An MCP server that lets an AI agent probe a live URL and confirm whether sensitive files (e.g., .git, .env, source maps) are genuinely served by fetching and validating the content, avoiding false positives.

Captures formatted screenshots of Caido Replay request/response pairs by driving the Screenshot Mode plugin via Chrome DevTools Protocol.

GhostHunt is an MCP server that scans your development machine for API keys, tokens, and credentials hiding in places you forgot to check.

Self-hosted MCP engine for private code reviews, providing deterministic static analysis and AST-level search over diffs, with findings passed to a review agent of your choice.

Connects an AI assistant to an already-running mitmweb session so it can read, search, diff, replay, and generate code from the same network flows shown in the UI.

An MCP server that audits zero-knowledge circuits (Circom, Noir, Halo2) for soundness and constraint bugs, powered by the Cysic Minimax model.

Enables interaction with NowSecure Platform for listing applications, retrieving remediation findings, and generating remediation PDFs via REST and GraphQL APIs.

Publishes four flat, schema-light tools that let AI agents (including strict providers) search, describe, and invoke any of 139 reverse-engineering capabilities behind a persistent REA server. Enables file fingerprinting, inspection, and evidence-linked investigation of shipped software through plain-English requests, read-only by default.

Lets an AI assistant drive a self-hosted Sn1per install over local stdio, launching orchestrated scans and reading back structured findings, ports, subdomains and technologies. Enforces configured target scope, redacts secrets, and writes an audit log of every scan, cancel, delete and export request.

Enables dynamic instrumentation of processes by attaching Frida, loading JavaScript scripts, calling RPC methods, and retrieving script output through MCP.

A scope-aware bug-bounty & reconnaissance MCP server that works out of the box on the Python standard library and augments itself with your favourite CLI tools when they're present.

Enables sudo-free management of /etc/hosts entries for Hack The Box and lab work, with a zero-dependency MCP server for AI coding agents.

Enables AI assistants to perform reverse engineering and debugging of Windows executables through x64dbg, with tools for loading executables, controlling execution, analyzing memory and security, and generating reports.

Enables dynamic management and execution of proxy chains on a remote Linux host via SSH, allowing AI assistants to route network traffic through proxies for privacy and security testing.

Enables AI assistants to run Kali Linux security tools in an isolated Docker container for tasks like network scanning, port checking, and service enumeration.

An MCP server that exposes Prof. Null, an uncensored cybersecurity professor, as a set of specialized tools for learning hacking, CTFs, and security concepts through Q\&A, roadmaps, cheatsheets, labs, and more.

Exposes a pentest toolbox (sqlmap, nuclei, ffuf, etc.) via Docker to an LLM orchestrator for authorized security audits, with strict whitelisting and timeout controls.

Enables security analysis of code and infrastructure files via MCP, using Symbiotic CLI for scanning vulnerabilities.

Enables users to deterministically audit MCP servers for security issues across manifests, source, runtime responses, multi-call state, identity, and install scripts, and to run an inline gateway that gates tool calls and scans responses before returning them.

Chrome browser JS reverse engineering MCP tool for CTF/Web security, enabling dynamic analysis and restoration of login encryption logic.

A read-only MCP server that lets an agent browse the HackerOne Hacker API using an authenticated hacker account, exposing programs, policies, scope, reports, and payments. It cannot create, update, or submit reports.

MCP server wrapping Drozer for LLM-driven Android IPC security testing, enabling autonomous enumeration and exploitation of app components via natural language.

Performs static security analysis of Solana programs and generates x402 payment invoices for automated agent-to-agent audit workflows.

Enables AI agents to interact with the FlagForge REST API, allowing them to search solved CTF challenges, work on live event challenges, record evidence, submit flag candidates, and write markdown writeups.

Provides an MCP interface to a full Kali Linux environment running in Docker, enabling AI assistants to execute security tools like nmap, sqlmap, and metasploit. It allows users to start/stop the container, run shell commands, and transfer files for security testing and educational purposes.

Exposes Burp Suite's REST API to AI assistants, enabling users to trigger vulnerability scans, monitor progress, and manage security tasks through natural language. It also provides programmatic access to Burp's security knowledge base for querying vulnerability definitions and remediation advice.

Enables security inspection of MCP tool metadata by analyzing tool names, descriptions, and input schemas, and returning SAFE, REVIEW, or HIGH RISK verdicts through the analyze_tools tool.