"How to break tasks into smaller steps" matching MCP servers:

MCP server for security analysis, reverse engineering, and penetration testing, providing 70+ tools (nmap, sqlmap, hydra, frida, etc.) with configurable backends (Docker Kali, WSL, SSH).

Wraps Kali Linux penetration testing tools for authorized security assessments, driven by a local LLM via LM Studio.

Privacy-first OSINT scanning MCP server that aggregates ~25 sources into a risk report, running locally with no data leaving your machine.

Exports vulnerability and asset data from Rapid7 Command Platform via the Bulk Export API into a local DuckDB database, enabling AI assistants to run natural language queries and SQL analysis with sandboxed security.

Enables AI assistants to perform cybersecurity tasks including hash analysis, CVE lookup, HTTP header auditing, WHOIS/OSINT, payload decoding, password strength evaluation, and threat report generation.

Converts Claude into a cybersecurity assistant by exposing 17 tools for network reconnaissance, cryptography, and security analysis, enabling users to perform tasks like SSL certificate checking, port scanning, and JWT analysis directly within conversations.

Enables interaction with the APVISO AI-powered penetration testing platform to manage targets, initiate scans, and retrieve vulnerability findings. It allows developers to integrate security testing workflows directly into MCP-compatible tools like Claude Code and Cursor.

A universal digital fingerprinting MCP server that combines 103 techniques across TCP, TLS, SSH, HTTP, DNS, and more into a single interface for AI agents, enabling full-spectrum fingerprinting on demand.

Enables AI assistants to run Kali Linux security tools in an isolated Docker container for tasks like network scanning, port checking, and service enumeration.

Exposes Burp Suite's REST API to AI assistants, enabling users to trigger vulnerability scans, monitor progress, and manage security tasks through natural language. It also provides programmatic access to Burp's security knowledge base for querying vulnerability definitions and remediation advice.

Enables AI applications to invoke 58 popular Kali Linux security tools for network scanning, web exploitation, password attacks, reconnaissance, Metasploit, evasion, forensics, post-exploitation, and miscellaneous tasks through the Model Context Protocol.

Turns Claude into a penetration testing copilot with 80 security tools, safety controls, and automatic reporting.

Integrates ProjectDiscovery security tools to perform automated reconnaissance, subdomain discovery, and vulnerability scanning. It enables comprehensive bug hunting workflows by chaining tools like subfinder, naabu, and nuclei into a unified pipeline.

A self-contained stdio JSON-RPC 2.0 server that brings AI capabilities to any MCP client, primarily for Pentool, enabling tasks like picking checks, bypassing WAF, and finding non-obvious endpoints.

An MCP security toolkit that integrates Burp-style HTTP proxying, AI-driven vulnerability hunting, source code auditing, and reporting into AI coding agents, enabling authorized security testing of web applications and source code.

Provides programmatic access to Mimikatz for credential extraction, Kerberos attacks, SAM/LSA dumping, and other Windows security assessment tasks through natural language.

Connects Claude Code to a Latent Defense deployment to map GitHub repositories into an infrastructure graph, discover attack paths using the JEPA energy model, and triage findings from the terminal.

Living off the Land intelligence for AI agents. GTFOBins, LOLBAS, LOOBins, LOLDrivers, LOLRMM, WADComs, LOLC2 and more — unified into a single MCP server.

MCP server for iOS reverse engineering, enabling static analysis of IPA/Mach-O binaries and dynamic instrumentation via Frida for tasks like IAP interception and FairPlay decryption.

Wraps the recon CLIs security researchers already use (subfinder, httpx, nmap, ffuf, nuclei) into a single MCP server so an LLM agent can plan and execute reconnaissance itself — passive subdomain/DNS/wayback discovery, active port scanning, WAF detection and origin-bypass checks, endpoint fuzzing, and nuclei scans. Structured JSON results carry scan tokens that let the agent chain one step's output into the next without re-typing targets.