"F-Droid" matching MCP servers:

Open behavioral litmus for MCP servers — grades A–F across tool-output injection, egress, sensitive-data, and adversarial-input, with reproducible, content-addressed evidence. Tools: run_litmus, verify_attestation.

Domain security reconnaissance for AI agents — 13 tools (DNS+DNSSEC, SSL/TLS, HTTP security headers, SPF/DKIM/DMARC email auth, port scan, ASN, RDAP/WHOIS) plus a one-shot security_scan returning a 0–100 Health Score (A–F). Free, no API key.

Enables Claude to scan a website's HTTP security headers and receive an A–F grade against OWASP best practices, including per-header pass/warn/fail results and copy-paste fixes for missing headers.

Enables AI agents and developers to audit any URL or domain for seven critical OWASP HTTP security headers, returning an A+ to F grade plus actionable Nginx, Apache, Caddy, and Cloudflare remediation snippets. It also probes /.well-known/security.txt and /security.txt to surface responsible vulnerability disclosure contacts, bug bounty scopes, and PGP keys.

Enables AI agents to analyze memory dumps for forensic investigation, leveraging a fast Rust engine and full Volatility3 plugin coverage via the Model Context Protocol.

Enables AI-driven reverse engineering with x64dbg via 71+ MCP tools for breakpoints, memory, disassembly, tracing, debug control, PE analysis, and anti-anti-debugging, supporting HTTP, SSE, and stdio transports.

Zero-key security toolkit for your AI assistant: grade any website's security A+ to F, check if CVEs are actively exploited via CISA KEV and EPSS, and get MITRE ATT&CK defenses explained in plain English. No API keys, no signup.

Enables MCP-compatible agents to submit source code for automated SAST/SCA security audits paid via x402 USDC micropayments on Base, returning structured vulnerability findings, CWE IDs, and optional remediated code patches.

npm audit for MCP servers. Point it at an MCP server and get a security grade (A–F) covering missing auth, SSRF surface, high-privilege tools, prompt-injection-prone tool descriptions, and leaked secrets.

Security auditor for MCP servers that enumerates tools, resources, and prompts, scans for injection patterns, classifies risk levels, and produces a scored report (0-100, grades A-F).

MCP server that wraps URLFinder and JSFinder to extract URLs, JavaScript files, subdomains, and sensitive information from web pages, with support for batch scanning and deep crawling.

Passive security scanner that audits a running MCP server against the OWASP MCP Top 10 and grades it A-F. Read-only static analysis of the advertised tools, prompts and resources with console/JSON/SARIF output, and it also runs as an MCP server itself.

Enables natural language control of Cobalt Strike (version 4.8) via Claude, supporting beacon listing, command execution, payload generation, and listener management without a GUI.

An MCP server that enables AI agents to drive real Android apps, capture API traffic, and test mobile-native attack surfaces, similar to Playwright for mobile.

Connects AI assistants to a Kali Linux terminal for executing security tools, managing interactive shell sessions, and performing penetration testing, CTF challenges, and security research tasks.

Enables evidence-first binary and firmware analysis through MCP, exposing tools to initialize projects, analyze artifacts, query structured claims, export results, and run evaluations.

AI-powered MCP penetration testing framework with 150+ security tools and 12+ autonomous AI agents, featuring enhanced security and guardrails.

Enables AI assistants to scan and analyze nearby Wi-Fi networks for security vulnerabilities, control an ESP32-CYD device's display and RGB LED, and receive real-time threat alerts via USB serial communication.

Enables AI agents to drive the local Yakit engine for HTTP packet replay, GUI visualization, and screenshotting via CDP. Supports automatic protocol detection, batch replay, history management, and CDP-based GUI automation.

Exposes a hardened Docker container with Kali Linux security tools (nmap, sqlmap, dig, whois, etc.) as MCP tools, enabling network reconnaissance, web analysis, and vulnerability scanning through natural language commands.