"JSON Web Tokens" matching MCP servers:

MCP server that exposes 31 OSINT checks from Lissy93/web-check as tools for website analysis, including SSL, DNS, headers, WHOIS, and security presets. Enables natural-language-driven web recon and health checks.

Enables AI agents to audit JSON Web Tokens (JWTs) and other token formats for security vulnerabilities, including HMAC secret cracking, live JWKS verification, and CVE fingerprinting.

An MCP server that lets an AI agent probe a live URL and confirm whether sensitive files (e.g., .git, .env, source maps) are genuinely served by fetching and validating the content, avoiding false positives.

MCP server providing safe, structured network and security reconnaissance tools for AI agents, with graded JSON results.

GhostHunt is an MCP server that scans your development machine for API keys, tokens, and credentials hiding in places you forgot to check.

Enables AI coding agents to search a security corpus, scan Terraform plan JSON for cited findings, and list sources via MCP tools grounded in CIS AWS Foundations and OWASP Top 10 CI/CD risks.

Free deterministic security scan of a public git repository (GitHub, GitLab, Codeberg, Bitbucket): vulnerable dependencies via OSV.dev, secret patterns, and config lint, returned as structured JSON. Tools: scan_repository(url), audit_pricing(). Runs locally over stdio (python3 web/mcp_stdio.py or the Dockerfile) and is also hosted at https://project-feldspar.com/mcp. MIT licence, stdlib-only. Buil

Enables policy-first defensive security operations for MCP, providing repository and web-security analysis with controlled authorization, scoped execution, and auditability.

Enables Solidity developers and security auditors to decode EVM calldata, pinpoint revert locations in debug traces, calculate storage slot layouts, and scan contracts for reentrancy and Yul assembly issues.

Chrome browser JS reverse engineering MCP tool for CTF/Web security, enabling dynamic analysis and restoration of login encryption logic.

Enables AI assistants to perform web content discovery scans using feroxbuster on a remote system via SSH, with support for recursive scanning, filtering, and background execution.

Enables AI assistants to execute security testing tools on a Kali Linux machine over SSH, including reconnaissance, web app scanning, and static/dynamic analysis.

A comprehensive MCP server for web security reconnaissance, providing tools for passive and active information gathering, DNS analysis, network scanning, and web application analysis.

Enables AI applications to invoke 58 popular Kali Linux security tools for network scanning, web exploitation, password attacks, reconnaissance, Metasploit, evasion, forensics, post-exploitation, and miscellaneous tasks through the Model Context Protocol.

MCP server that enables LLMs to operate Acunetix/Invicti web vulnerability scanners through 15 tools, covering authentication, target management, scanning, vulnerability retrieval, and reporting via GraphQL and REST APIs.

Enables deep security auditing of web applications directly from AI IDEs including Cursor and Claude Code. Scans URLs for vulnerabilities, returns security scores with SHIP/BLOCK verdicts, and provides specific fix prompts for remediation.

A comprehensive HTTP client MCP server for security testing, API testing, and web automation that provides full-featured HTTP tools with detailed logging capabilities.

A self-contained stdio JSON-RPC 2.0 server that brings AI capabilities to any MCP client, primarily for Pentool, enabling tasks like picking checks, bypassing WAF, and finding non-obvious endpoints.

An MCP security toolkit that integrates Burp-style HTTP proxying, AI-driven vulnerability hunting, source code auditing, and reporting into AI coding agents, enabling authorized security testing of web applications and source code.

Wraps the recon CLIs security researchers already use (subfinder, httpx, nmap, ffuf, nuclei) into a single MCP server so an LLM agent can plan and execute reconnaissance itself — passive subdomain/DNS/wayback discovery, active port scanning, WAF detection and origin-bypass checks, endpoint fuzzing, and nuclei scans. Structured JSON results carry scan tokens that let the agent chain one step's output into the next without re-typing targets.