"Design Resources and Prototyping Best Practices" matching MCP servers:

Free deterministic security scan of a public git repository (GitHub, GitLab, Codeberg, Bitbucket): vulnerable dependencies via OSV.dev, secret patterns, and config lint, returned as structured JSON. Tools: scan_repository(url), audit_pricing(). Runs locally over stdio (python3 web/mcp_stdio.py or the Dockerfile) and is also hosted at https://project-feldspar.com/mcp. MIT licence, stdlib-only. Buil

Enables local, deterministic review of GitHub and GitLab pull request diffs for secret leaks, OWASP injection issues, WCAG 2.2 AA/EU EAA accessibility gaps, EU AI Act transparency, and database RLS risks, producing risk scores, merge decisions, committable suggestions, and SARIF exports.

Enables users to run synthetic support-agent evaluations, preserve and inspect traces, score results deterministically, inject failures, and enforce release review gates through MCP tools, resources, and prompts.

Enables auditing and monitoring of AI agent MCP tool calls, with behavioral anomaly detection, lab-scoped red-team simulation, and Telegram notifications.

MCP server for auditing infrastructure-as-code attack paths, finding multi-hop chains from public internet to sensitive resources.

Enables Claude to scan a website's HTTP security headers and receive an A–F grade against OWASP best practices, including per-header pass/warn/fail results and copy-paste fixes for missing headers.

Enables developers and security teams to run evidence-first Android and iOS security audits, manage jobs and reports, query public vulnerability intelligence, evaluate policies, and plan runtime checks through stdio MCP tools and resources.

Enables AI clients to access a unified gateway of 214+ skills, 237 tools, rules, prompts, and resources for reverse engineering, Frida hooking, APK surgery, web UI cloning, forex data, and sequential reasoning through one MCP connection.

A self-hostable, vulnerable-by-design MCP server for learning how object-level authorization bugs (BOLA/IDOR) appear in multi-tenant tools.

Enables AI agents to inspect APKs and resources, analyze native libraries, trace runtime behavior with Frida, and connect app screen actions to code through ADB.

Enables assistants to interact with Hack The Box by wrapping HTB API operations as MCP tools for querying and operating HTB resources.

Enables LLM clients like Claude to interact with IDA Pro for binary analysis, decompilation, cross-references, patching, and more via 41 MCP tools, 8 resources, and 7 guided prompts.

Enables AI assistants to drive OWASP ZAP for authorized penetration testing and bug-bounty workflows, including authenticated scans and vulnerability triage through 67 curated safety-gated tools.

Security auditor for MCP servers that enumerates tools, resources, and prompts, scans for injection patterns, classifies risk levels, and produces a scored report (0-100, grades A-F).

Passive security scanner that audits a running MCP server against the OWASP MCP Top 10 and grades it A-F. Read-only static analysis of the advertised tools, prompts and resources with console/JSON/SARIF output, and it also runs as an MCP server itself.

Enables agents to analyze software artifacts through 35 tools covering read-only reconnaissance, secret/string/symbol scanning, native and Dart AOT structure checks, exposure tiering, protection planning, attack-simulation design, and an append-only evidence ledger with mechanical verified gates that treat unresolved unknowns as blocking. Gated execution tools apply reviewed transforms only to a managed copy inside an authorized workspace, with one-time approval tokens, independent verification, before/after diffs, and rollback.

Security scanner for MCP servers. Detects prompt injection, command injection, auth bypass, and excessive permissions across tools, resources, and prompts.

Lets an agent inspect and audit MCP servers before connecting to them, checking their exposed tools, prompts and resources for tool poisoning, shadowing, excessive permissions, leaked secrets and unsafe transports against 24 deterministic rules. Results are returned as findings with evidence, remediation and CWE/OWASP references, and can fail CI with SARIF, Markdown or standalone HTML reports.

Integrates ProjectDiscovery's Katana web crawler with Claude Desktop, enabling users to crawl websites, discover endpoints and hidden resources, extract JavaScript files, and perform reconnaissance with customizable depth, scope, and filtering options.

Enables AI agents to control and analyze RFID hardware through natural language: read, crack, emulate, and clone cards via MCP tools, with safety gates, offline dump analysis, and a host-side card library.

Enables AI assistants to perform Volatility 3 memory forensics through natural language, including process and network analysis, injection detection, and shellcode extraction from memory dumps.

Enables agents to operate ARL, ScopeSentry, and XingRin attack surface management platforms through stdio tools for listing resources, testing connections, creating/managing tasks, and retrieving assets.

Enables security testing and reverse engineering through MCP by exposing Nmap, nm, objdump, strings, and tshark for network scanning, symbol/binary analysis, string extraction, and traffic capture/analysis, plus isolated Docker sandbox command execution with configurable resources and file transfer.

Enables AI to scan AWS accounts, analyze attack paths, and verify security fixes on a read-only graph of cloud resources.

A vulnerable-by-design MCP server pair (NotesServer and VaultServer) for testing MCP security tools, featuring confused-deputy, prompt injection, and authorization bypass scenarios.

Manages an authorized proxy pool for security testing, providing MCP tools to select the best available proxy, report status, switch proxies, view pool health, and register nodes, backed by health checks and audit logging.

Enables ethical security testing and attack surface management through SSL certificate validation, CVE queries, subdomain enumeration, security header analysis, and comprehensive reconnaissance capabilities. Designed for authorized penetration testing workflows with responsible disclosure practices.

Exposes AI-augmented network reconnaissance and evasion capabilities as callable FastMCP tools, enabling natural language orchestration of host discovery, service fingerprinting, CVE mapping, and attack chain synthesis.

Enables AI agents to submit npm, PyPI, Go, or Maven packages and manifests to the free OSV.dev database and receive per-package and per-advisory results with CVE mappings, CVSS scores, severities, and the versions that fix each issue. It also supports filtering by minimum severity, de-duplicating alias advisories, and machine-readable error/warning rows for CI gates and upgrade recommendations.

Autonomous AppSec & DAST code and website security scanner across 12 security domains (260+ controls) with 3-Layer Triage.

Enables agents to inspect web pages for Cloudflare Turnstile challenges without an API key, and clear Turnstile or WAF challenges using a SolveGate API key.

Query Microsoft Patch Tuesday security updates from the official MSRC API — monthly rollups, CVE/KB lookups, supersedence chains, and urgency-ranked triage enriched with EPSS scores and the CISA KEV catalog. No API keys required.

An MCP server that scans local codebases for quantum-vulnerable cryptography (secp256k1, Ed25519, RSA, etc.) and CI signing commands, classifying each finding as quantum-broken, post-quantum, or neither. It runs entirely locally with no network calls, providing a deterministic inventory for AI agents.

Enables LLM agents to browse and triage vulnerability observations, manage products, branches and rules, import scan reports and SBOMs, run scans and background jobs, and generate VEX documents via SecObserve's REST API.

Enables AI agents to access VirusTotal intelligence through MCP, supporting file, URL, domain, and IP lookups, plus analysis, via remote HTTP or local stdio.

Enables Android APK reverse engineering and Flutter runtime injection through a six-step pipeline of decompile, analyze, synthesize, inject, patch, and repackage. Provides MCP tools for authorized security research and penetration testing.

SkillTotal is a local stdio MCP server that lets an agent check a component before installing it. It statically analyzes MCP servers, agent skills, npm/PyPI packages and repos for supply-chain risks, dangerous capabilities (shell, filesystem, network, credentials), prompt-injection surfaces like tool poisoning, and exfiltration paths. Each finding cites file, line and snippet.

Connects AI assistants to Solodit's 49,000+ blockchain vulnerability database, enabling search, browse, and lookup of audit findings directly from your AI workflow.

Provides access to Atomic Red Team tests, enabling search, validation, and execution of atomic tests via natural language.

Enables AI agents to perform passive security scans on domains, checking email spoofing (DMARC/SPF/DKIM), TLS weaknesses, security headers, exposed files, and subdomain-takeover risk without needing an API key.