"Exploring the word 'Make' and its possible applications" matching MCP servers:

A local MCP daemon that turns an agentic coding client into a bug bounty operator, with 103 tools for offensive security testing including MITM proxy, traffic analysis, and OOB callbacks.

Enables AI assistants to perform password security auditing using John the Ripper on a remote Kali system via SSH, supporting cracking, hash management, and session control.

Living off the Land intelligence for AI agents. GTFOBins, LOLBAS, LOOBins, LOLDrivers, LOLRMM, WADComs, LOLC2 and more — unified into a single MCP server.

Enables authorized web/API security analysis as a stateful, multi-stage workflow with persistent session state, human-controlled validation, candidate versus confirmed finding tracking, and stop conditions.

AI-native security research platform that integrates Claude with MCP to execute real offensive security tools in an isolated Docker container, enabling natural language-driven recon, CVE scanning, Active Directory enumeration, and cryptographic posture assessment.

Enables users to query BloodHound Active Directory graph data using natural language, finding attack paths, Kerberoastable accounts, and other AD security insights.

Enables users to run synthetic support-agent evaluations, preserve and inspect traces, score results deterministically, inject failures, and enforce release review gates through MCP tools, resources, and prompts.

Enables authenticated remote MCP clients to manage a Kali Linux environment, run modular tools in sandboxed or optional host contexts, configure networking, and monitor jobs through a live WebUI.

Provides a generic HTTP client tool allowing AI agents to make arbitrary HTTP requests from their environment, with support for environment-variable placeholders for secrets.

An MCP server that audits zero-knowledge circuits (Circom, Noir, Halo2) for soundness and constraint bugs, powered by the Cysic Minimax model.

Enables interaction with NowSecure Platform for listing applications, retrieving remediation findings, and generating remediation PDFs via REST and GraphQL APIs.

Local-first, zero-egress security scanner for AI-generated / "vibe-coded" JS/TS. Bundles Opengrep, Gitleaks & Trivy behind one CWE-keyed schema and adds AI-code-specific checks (client-side secret exposure, Supabase RLS, prompt-injection & LLM-output XSS sinks). No account, no telemetry.

An MCP server for identifying SQL injection vulnerabilities in web applications using various techniques like error-based, time-based, and union-based scanning. It supports bulk URL processing, WAF bypass strategies, and authenticated testing across multiple database systems.

A comprehensive security testing MCP server providing 51 tools for penetration testing, network forensics, memory analysis, and vulnerability assessment. It enables automated security audits and technical investigations across web applications, cloud environments, and network captures.

Enables AI applications to invoke 58 popular Kali Linux security tools for network scanning, web exploitation, password attacks, reconnaissance, Metasploit, evasion, forensics, post-exploitation, and miscellaneous tasks through the Model Context Protocol.

Enables AI assistants to query RoboShadow's Rubicon Platform Data API for read-only endpoint security, asset inventory, applications, users, vulnerabilities, and remediation status data.

Enables deep security auditing of web applications directly from AI IDEs including Cursor and Claude Code. Scans URLs for vulnerabilities, returns security scores with SHIP/BLOCK verdicts, and provides specific fix prompts for remediation.

An MCP security toolkit that integrates Burp-style HTTP proxying, AI-driven vulnerability hunting, source code auditing, and reporting into AI coding agents, enabling authorized security testing of web applications and source code.

Enables integration with Beagle Security API for managing security testing projects, applications, domain verification, and automated penetration tests. Provides 18 tools for creating, monitoring, and retrieving results from security assessments.

Enables external agents to manage an ARTEX instance over its Web API via stdio, supporting authentication, route discovery and invocation, file transfers, SSE event reading, and optional isolated Chromium UI automation.

Enables AI assistants to manage Empire listeners, stagers, agents, modules, and credentials via the Empire REST API.

Enables read-only interaction with HackerOne, providing tools for searching and analyzing reports, exploring programs and scope, accessing earnings, and retrieving public disclosures.

Community MCP server for the Cymulate security validation platform. It exposes the full Cymulate REST API (337 endpoints) as 106 semantic tools for BAS, exposure validation, attack surface management, and platform administration.

Enables auditing npm, pip, and other package dependencies for known CVEs via the OSV database, with tools to scan manifests, query individual packages, and integrate into CI/CD workflows.

Provides MCP clients like Claude with tools to query and manage security scans, CVEs, assets, findings, threat intel, and generate polished reports by acting as a lightweight adapter over the CVEasy backend API.

MCP server for complyeah that enables AI assistants to list domains and scans, read findings, and start external penetration tests through the complyeah API.

Wraps the ScanMalware.com API to enable phishing triage, malware scanning, and certificate inspection through natural language, allowing users to submit scans, retrieve results, and analyze threats via MCP tools.

Provides security assessment methodology, tool documentation, and step-by-step workflows to guide AI agents through vulnerability scanning, static analysis, and penetration testing of applications and URLs.

Enables AI assistants to perform reconnaissance tasks using the reconFTW framework, supporting full, passive, subdomain, vulnerability, and OSINT scans through MCP tools.

Enables users to statically analyze regular expressions for catastrophic-backtracking (ReDoS) risk through real AST parsing rather than executing the pattern, flagging nested quantifiers, ambiguous alternation, and backreferences. It also generates candidate proof-of-concept attack strings with a timeout-guarded test snippet and suggests JavaScript-safe rewrites.