"Local" matching MCP servers:

Enables AI agents to access VirusTotal intelligence through MCP, supporting file, URL, domain, and IP lookups, plus analysis, via remote HTTP or local stdio.

Local-first, zero-egress security scanner for AI-generated / "vibe-coded" JS/TS. Bundles Opengrep, Gitleaks & Trivy behind one CWE-keyed schema and adds AI-code-specific checks (client-side secret exposure, Supabase RLS, prompt-injection & LLM-output XSS sinks). No account, no telemetry.

Enables AI assistants to run Offensive360 SAST scans on local codebases, returning security findings with file/line, severity, and fixes, plus scan status tracking.

Enables structured HTTP request creation and local file ingestion for LLM integration with Burp Suite, reducing malformed requests and token costs.

Connects AI assistants to AttackForge's Self-Service API with full endpoint coverage, response size optimization, and local caching for efficient use in long conversations.

Provides local, dependency-free security scanning tools for LLM configurations, prompts, RAG sources, and more, enabling AI coding agents to detect prompt injections and other vulnerabilities without external network access.

Manual listener MCP server that bridges OpenCode with local security tools via a Flask HTTP service, enabling AI-assisted security operations.

Config-driven MCP server that exposes Kali Linux penetration testing tools to AI agents, with automatic tool discovery, man page integration, and local/remote execution modes.

Connects AI assistants to HackerOne to pull bug bounty history, program scopes, and report details into a local SQLite database, exposing tools for searching, analyzing, and generating attack briefings using both personal and public disclosed reports.

Exposes Burp Suite operations through a local authenticated HTTP server and an MCP stdio bridge, enabling tools like burp_proxy_history via MCP.

An MCP server that wraps Trivy and Gitleaks to provide file system vulnerability and secret scanning as tools for AI agents, enabling local, free security analysis.

Deterministic, local-first MCP server for IDA Pro and IDA Home, exposing 109 strict-schema operations for reverse engineering with policy-gated mutations, evidence tracking, and broad AI-client support.

A collection of MCP tools for cybersecurity threat intelligence and local network hacking, integrating APIs like GreyNoise, Malpedia, OpenCTI, and more.

Enables AI agents to securely invoke only allowlisted, read-only tools on a local Kali Linux host over an encrypted network with OAuth2 authentication and least-privilege enforcement.

A high-performance local and public webhook inspector for testing SSRF, APIs, and out-of-band interactions with Cloudflare Quick Tunnel, dynamic mocks, and callback polling for AI agents.

Enables AI agents to control a local Chromium browser via CDP for page snapshots, screenshots, human-like interactions, autonomous crawling, API/GraphQL reconnaissance, authenticated differential testing, and Burp-like intercept, repeater, and intruder workflows with scope enforcement and audit logging.

Enables AI agents to inspect local GGUF model files for structural, template-security, companion-file, and runtime-advisory risks before deployment, returning machine-readable verdicts via seven MCP tools.

Security scanner for MCP servers — vet an MCP before you wire it into an agent. Detects prompt-injection, credential exfiltration (via taint analysis), RCE, and supply-chain risks, and catches cross-server exfil chains no single server reveals. Zero-dependency local CLI, SARIF output, CI-gateable, no account.

A local MCP daemon that turns an agentic coding client into a bug bounty operator, with 103 tools for offensive security testing including MITM proxy, traffic analysis, and OOB callbacks.

Enables coding agents to interact with Frida for reverse engineering: connect to local, USB, and remote devices; inspect apps and processes; manage sessions; and load, evaluate, and exchange messages with JavaScript instrumentation scripts, including fetching community scripts from Frida CodeShare.