"Cash App" matching MCP servers:

Enables interaction with Hack The Box App services including machines, challenges, sherlocks, and more through the HTB API v4.

Enables Android APK reverse engineering and Flutter runtime injection through a six-step pipeline of decompile, analyze, synthesize, inject, patch, and repackage. Provides MCP tools for authorized security research and penetration testing.

MCP server that provides AI-native access to BeVigil's OSINT API, enabling mobile app security research and asset discovery through tools for hosts, subdomains, S3 buckets, URLs, wordlists, and multi-step investigations.

Automates Android app analysis using Frida via AI commands, connecting a rooted Android phone to a computer and running dynamic analysis scripts without manual command execution.

Provides AI agents with a hardened code security scanner via scan_code and scan_path, detecting leaked secrets and insecure patterns while enforcing strict path confinement and resource bounds.

MCP server wrapping Drozer for LLM-driven Android IPC security testing, enabling autonomous enumeration and exploitation of app components via natural language.

Enables AI assistants to execute security testing tools on a Kali Linux machine over SSH, including reconnaissance, web app scanning, and static/dynamic analysis.

Gives MCP clients such as Claude Code and OpenCode a static-analysis toolbox for binaries, executables, DLLs, shared objects, and web-app code, covering file identification and hashing, string extraction, PE/ELF/Mach-O/WASM parsing, disassembly, Ghidra decompilation, YARA scanning, and JavaScript deobfuscation. All inspection is read-only and never executes the target.

Enables testing API authentication and authorization by probing endpoints with and without Authorization headers, suggesting auth test matrices for roles, and showing current test configuration.

Talk to your Flipper Zero from Claude Code — or any MCP client. Storage, app deployment, screen capture, button automation, JavaScript execution on the device, and honest answers about what is nearby.

Enables local-first static and optional controlled dynamic analysis of Android APK artifacts, with provenance-aware downloads, Markdown reports, and structured security findings via MCP stdio tools.

Enables iOS reverse engineering through MCP tools that connect clients to SSH, Frida, and optional IDA for runtime inspection, app automation, decryption, debugging, and tweak development.

Enables scanning OpenAPI specifications for security gaps and generating security test checklists for APIs.

Enables AI assistants to perform automated security audits on APIs, detecting BOLA/IDOR vulnerabilities by comparing responses across user tokens.

Scan-as-a-Service for MCP servers. Wraps the compuute-scan static security scanner with HTTP and MCP endpoints to analyze public GitHub repos for MCP-specific vulnerabilities.

Enables an AI agent to reverse-engineer a compiled program with Ghidra — inspecting decompiled code, instructions, callers, memory bytes, and strings — without any source code. Every reply is labelled as fact, computed, or guess, and each claim traces back to hash-checked saved evidence.

A Python MCP server that decompiles Android APK/XAPK/JAR/AAR files and extracts HTTP APIs used by the app.

Enables AI coding agents to audit websites for PHP runtime vulnerabilities, compile a live Zero-PHP Next.js App Router replacement preview from a WordPress/PHP site, and retrieve remediation guidance.

Enables a coding agent, over stdio MCP, to scan a project for security flaws, list and explain findings, propose and apply patches, and re-run recorded exploits to prove each fix actually holds on the patched app. Tools include scan_project, list_findings, explain_finding, propose_patch, apply_patch, verify_fix, and full_audit.

Provides a one-stop automated solution for Android APK security analysis by integrating tools like JEB, JADX, APKTOOL, FlowDroid, and MobSF into unified MCP standard API interfaces.