"Cloning and Accessing the OpenManus GitHub Repository" matching MCP servers:

A local MCP daemon that turns an agentic coding client into a bug bounty operator, with 103 tools for offensive security testing including MITM proxy, traffic analysis, and OOB callbacks.

Scans GitHub repositories for security vulnerabilities by cloning, performing static analysis, secret detection, build verification, and AI-powered OWASP-aligned code review, producing a scored SECURITY.md report.

Enables AI assistants to perform password security auditing using John the Ripper on a remote Kali system via SSH, supporting cracking, hash management, and session control.

This MCP server enables users to sign in with GitHub and use AI agents to scan entire repositories for leaked secrets such as API keys, passwords, and tokens, delivering a report with the exact file and line plus remediation guidance.

Living off the Land intelligence for AI agents. GTFOBins, LOLBAS, LOOBins, LOLDrivers, LOLRMM, WADComs, LOLC2 and more — unified into a single MCP server.

Enables authorized web/API security analysis as a stateful, multi-stage workflow with persistent session state, human-controlled validation, candidate versus confirmed finding tracking, and stop conditions.

Enables AI clients to audit GitHub repositories for Dependabot, code scanning, and secret scanning alerts, generate conservative remediation plans, and execute verified fixes through MCP tools with fail-closed mutation controls.

AI-native security research platform that integrates Claude with MCP to execute real offensive security tools in an isolated Docker container, enabling natural language-driven recon, CVE scanning, Active Directory enumeration, and cryptographic posture assessment.

This server enables AI agents to delegate GitHub pull request diffs for automated security auditing, returning structured vulnerability and architecture feedback while routing requests through a resilient multi-provider fallback pipeline.

Enables users to query BloodHound Active Directory graph data using natural language, finding attack paths, Kerberoastable accounts, and other AD security insights.

Enables users to run synthetic support-agent evaluations, preserve and inspect traces, score results deterministically, inject failures, and enforce release review gates through MCP tools, resources, and prompts.

Enables authenticated remote MCP clients to manage a Kali Linux environment, run modular tools in sandboxed or optional host contexts, configure networking, and monitor jobs through a live WebUI.

Enables LLMs to access realtime CVE intelligence aggregated from NVD, CISA KEV, EPSS, GitHub advisories, PoC discovery, and Metasploit/Nuclei tooling, providing vulnerability details, exploitation signals, and prioritized triage verdicts.

Enables any MCP client (Claude Code, Claude Desktop, Codex, or a custom agent) to fetch the latest CVEs at query time from live sources — NVD, CVE List V5, GitHub Advisory Database, CISA KEV and FIRST EPSS — without a separate API key. Exposes search, filtering (severity, RCE, PoC, KEV, keyword, CPE), per-CVE detail and risk-scored patch prioritization as JSON tools, so answers are grounded in live data rather than model memory.

An MCP server that audits zero-knowledge circuits (Circom, Noir, Halo2) for soundness and constraint bugs, powered by the Cysic Minimax model.

Enables AI assistants to vet open-source repositories and dependencies by running OpenSSF Scorecard, Trivy, and Syft checks for repository health, vulnerabilities, licenses, and SBOMs, with background jobs and status polling.

A local MCP server that scans repository dependencies for known vulnerabilities (CVEs) using OSV.dev, enriches findings with NVD and CISA KEV data, and supports triage, remediation, and accepted risk management directly from an AI coding assistant.

Free deterministic security scan of a public git repository (GitHub, GitLab, Codeberg, Bitbucket): vulnerable dependencies via OSV.dev, secret patterns, and config lint, returned as structured JSON. Tools: scan_repository(url), audit_pricing(). Runs locally over stdio (python3 web/mcp_stdio.py or the Dockerfile) and is also hosted at https://project-feldspar.com/mcp. MIT licence, stdlib-only. Buil

Enables policy-first defensive security operations for MCP, providing repository and web-security analysis with controlled authorization, scoped execution, and auditability.

Exposes an OSINT investigation toolkit to any MCP-compatible AI client, which can drive passive checks such as DNS, WHOIS/RDAP, breach, IP reputation, GitHub and news-geo lookups and chain findings across them. The server lists 20 tools by default (16 passive plus 4 graph and batch helpers) and 25 when active checks are explicitly allowed, running via uvx with no separate install.

Enables MCP-compatible agents to audit an entire repository through one question, detecting stacks and running parallel checks for dead code, dependencies, security, CVEs, complexity, and lint across Laravel/PHP, Python, TypeScript/React, and Flutter/Dart. It returns normalized, severity-sorted findings with false positives flagged and secret values kept out of the output.

A Model Context Protocol (MCP) server for the Ghost Security API, providing secure access to security findings and repository data through standardized tools.

Connects Claude Code to a Latent Defense deployment to map GitHub repositories into an infrastructure graph, discover attack paths using the JEPA energy model, and triage findings from the terminal.

Enables AI assistants to manage Empire listeners, stagers, agents, modules, and credentials via the Empire REST API.

Enables read-only interaction with HackerOne, providing tools for searching and analyzing reports, exploring programs and scope, accessing earnings, and retrieving public disclosures.

Enables read-only, evidence-led security audits of GitHub-hosted source code through explicit workflow primitives: repository reconnaissance, coverage-ledger planning, heuristic candidate leads, structured findings validation, independent verification gates, and JSON/Markdown report generation. It never clones, executes, or probes the target code, and marks runs incomplete until coverage and reviewer-verification gates pass.

Community MCP server for the Cymulate security validation platform. It exposes the full Cymulate REST API (337 endpoints) as 106 semantic tools for BAS, exposure validation, attack surface management, and platform administration.

Enables AI assistants to query and monitor public bug-bounty programs and scopes across major platforms, including new programs, target changes, fee and reward changes, and in-scope repository pushes through 18 tools.

Enables auditing npm, pip, and other package dependencies for known CVEs via the OSV database, with tools to scan manifests, query individual packages, and integrate into CI/CD workflows.

Provides MCP clients like Claude with tools to query and manage security scans, CVEs, assets, findings, threat intel, and generate polished reports by acting as a lightweight adapter over the CVEasy backend API.