"How to run a Windows command" matching MCP servers:

Enables evidence-first binary and firmware analysis through MCP, exposing tools to initialize projects, analyze artifacts, query structured claims, export results, and run evaluations.

Demonstrates deceptive tool naming and unsanitized shell execution by exposing tools that perform OS fingerprinting and run local system commands through MCP. Intended for security research on vulnerabilities in the MCP ecosystem.

Enables LLM agents to browse and triage vulnerability observations, manage products, branches and rules, import scan reports and SBOMs, run scans and background jobs, and generate VEX documents via SecObserve's REST API.

Exports vulnerability and asset data from Rapid7 Command Platform via the Bulk Export API into a local DuckDB database, enabling AI assistants to run natural language queries and SQL analysis with sandboxed security.

Agent-native "safe to ship?" security gate for AI-generated code. Uses real parsers and inter-rocedural taint analysis (JS/TS, Python, Go) to flag the classes AI coding agents get wrong — secrets, SQL injection, SS, SSRF, path traversal, command injection, weak JWT/CORS — and ranks findings by confidence. Exposes a scan tool over MCP.

Offers a control surface for AI agent security with four independent checks: source-code scanning, tenant isolation, LLM content verification, and deploy gating. Currently in pre-release, with no functional scanning engines yet.

Enables passive security scanning of HAR files from QA test automation to detect missing security headers, insecure cookies, CORS misconfigurations, and leaked secrets, without making any live requests.

Connects MCP clients to pre-submission review that argues against a draft bug-bounty report or smart-contract finding the way a triager would, tying every claim to a supplied file and line and returning a submit, rewrite-then-submit, prove-first, hold-duplicate or drop verdict. Exposes tools to list review profiles, prepare reviews for the agent's own model, build hash-verified review packets, and — with a connection token — run hosted profiles on your own provider key.

MCP server for TurboPentest — run AI-powered penetration tests and review findings from your coding assistant.

A production-ready MCP server that wraps Nmap to enable AI agents to perform automated network security assessments, including port scanning, host discovery, service detection, OS fingerprinting, and vulnerability scanning.

Enables AI agents to run read-only static reverse-engineering tasks — binary triage, symbol and import inventory, per-function decompilation, and Android native-lib analysis — with untrusted samples confined to a no-network bubblewrap chamber that never executes the target.

Provides Claude Code with access to a comprehensive bug bounty knowledge base including techniques, payloads, wordlists, and real-world reports through 14 tools for searching, retrieving payloads, and assessing report quality.

Two-way Burp Suite MCP bridge enabling AI agents to capture traffic, analyze endpoints, queue scans, and send findings back to Burp.

Enables MCP clients to launch authorized autonomous penetration tests, monitor run status, list campaigns, and retrieve vulnerability findings and severity statistics from a self-hosted dashboard API.

Enables AI assistants to scan websites, public repositories, and OpenClaw/CLAW skills for security vulnerabilities, including local skill-package analysis before installation, cloud scans, and remediation guidance.

Enables agents and CI pipelines to audit MCP servers and agent tool-chains by statically scanning repositories, local checkouts, tools/list exports, or live endpoints for risks such as destructive actions without confirmation, mismatched safety annotations, injection surfaces, credential or PII exposure, and unguarded command, path, or URL sinks. All checks are read-only and never execute the scanned code or call tools/call.

Automates Android app analysis using Frida via AI commands, connecting a rooted Android phone to a computer and running dynamic analysis scripts without manual command execution.

Enables AI assistants to run Offensive360 SAST scans on local codebases, returning security findings with file/line, severity, and fixes, plus scan status tracking.

Enables users to retrieve and display CVE vulnerability information from the National Vulnerability Database (NVD) with support for keyword search and detailed lookup.

Enables AI assistants to perform reverse engineering and debugging of Windows executables through x64dbg, with tools for loading executables, controlling execution, analyzing memory and security, and generating reports.