"Notion - Productivity and Note-Taking App" matching MCP servers:

Enables interaction with Hack The Box App services including machines, challenges, sherlocks, and more through the HTB API v4.

Enables an AI agent to reverse-engineer a compiled program with Ghidra — inspecting decompiled code, instructions, callers, memory bytes, and strings — without any source code. Every reply is labelled as fact, computed, or guess, and each claim traces back to hash-checked saved evidence.

Enables local, deterministic review of GitHub and GitLab pull request diffs for secret leaks, OWASP injection issues, WCAG 2.2 AA/EU EAA accessibility gaps, EU AI Act transparency, and database RLS risks, producing risk scores, merge decisions, committable suggestions, and SARIF exports.

Provides AI agents with a hardened code security scanner via scan_code and scan_path, detecting leaked secrets and insecure patterns while enforcing strict path confinement and resource bounds.

Enables users to run synthetic support-agent evaluations, preserve and inspect traces, score results deterministically, inject failures, and enforce release review gates through MCP tools, resources, and prompts.

MCP server that provides AI-native access to BeVigil's OSINT API, enabling mobile app security research and asset discovery through tools for hosts, subdomains, S3 buckets, URLs, wordlists, and multi-step investigations.

Automates Android app analysis using Frida via AI commands, connecting a rooted Android phone to a computer and running dynamic analysis scripts without manual command execution.

Enables scanning Android and iOS app packages from MCP clients for security issues, mapping findings to OWASP MASVS, CWE, and CVSS, and downloading pentest-style reports.

MCP server wrapping Drozer for LLM-driven Android IPC security testing, enabling autonomous enumeration and exploitation of app components via natural language.

Enables AI assistants to execute security testing tools on a Kali Linux machine over SSH, including reconnaissance, web app scanning, and static/dynamic analysis.

Gives MCP clients such as Claude Code and OpenCode a static-analysis toolbox for binaries, executables, DLLs, shared objects, and web-app code, covering file identification and hashing, string extraction, PE/ELF/Mach-O/WASM parsing, disassembly, Ghidra decompilation, YARA scanning, and JavaScript deobfuscation. All inspection is read-only and never executes the target.

Talk to your Flipper Zero from Claude Code — or any MCP client. Storage, app deployment, screen capture, button automation, JavaScript execution on the device, and honest answers about what is nearby.

Enables iOS reverse engineering through MCP tools that connect clients to SSH, Frida, and optional IDA for runtime inspection, app automation, decryption, debugging, and tweak development.

Enables LLMs to query live decompiled Android app context through a JADX plugin, supporting class, method, and field inspection; source and smali retrieval; manifest parsing; vulnerability discovery; and reverse engineering.

Enables AI agents to inspect APKs and resources, analyze native libraries, trace runtime behavior with Frida, and connect app screen actions to code through ADB.

Enables querying SAP Security Note metadata including Patch Day releases, CVSS scores, CVEs, affected components, and actively-exploited status via the Model Context Protocol.

A Python MCP server that decompiles Android APK/XAPK/JAR/AAR files and extracts HTTP APIs used by the app.

Enables AI assistants to drive OWASP ZAP for authorized penetration testing and bug-bounty workflows, including authenticated scans and vulnerability triage through 67 curated safety-gated tools.

Enables AI coding agents to audit websites for PHP runtime vulnerabilities, compile a live Zero-PHP Next.js App Router replacement preview from a WordPress/PHP site, and retrieve remediation guidance.

Exposes the ghostsoc scan engine over MCP so agents can run the ghostsuite security tools against a target and list which adapters are installed. It returns findings normalized across tools, correlated into attack-path chains with lifted severity and a triage note, as one ranked report.

Enables agent-driven service-level capture and review of iPhone app traffic on Windows by coordinating a hotspot, passive packet capture, and an HTTPS interception proxy, with records and reports stored in SQLite.

Enables AI agents to control and analyze RFID hardware through natural language: read, crack, emulate, and clone cards via MCP tools, with safety gates, offline dump analysis, and a host-side card library.

Enables an AI agent to discover JavaScript in a web app, scan it for exposed secrets and known vulnerable libraries, and review verified findings through structured MCP tools and a local dashboard.

Enables AI assistants to perform Volatility 3 memory forensics through natural language, including process and network analysis, injection detection, and shellcode extraction from memory dumps.

HTTP Inspector MCP Server enables sending arbitrary HTTP requests, viewing history via a web panel, and taking screenshots of the panel for AI penetration testing workflows.

Enables a coding agent, over stdio MCP, to scan a project for security flaws, list and explain findings, propose and apply patches, and re-run recorded exploits to prove each fix actually holds on the patched app. Tools include scan_project, list_findings, explain_finding, propose_patch, apply_patch, verify_fix, and full_audit.

Exposes AI-augmented network reconnaissance and evasion capabilities as callable FastMCP tools, enabling natural language orchestration of host discovery, service fingerprinting, CVE mapping, and attack chain synthesis.

Enables AI agents to submit npm, PyPI, Go, or Maven packages and manifests to the free OSV.dev database and receive per-package and per-advisory results with CVE mappings, CVSS scores, severities, and the versions that fix each issue. It also supports filtering by minimum severity, de-duplicating alias advisories, and machine-readable error/warning rows for CI gates and upgrade recommendations.

Autonomous AppSec & DAST code and website security scanner across 12 security domains (260+ controls) with 3-Layer Triage.

Enables agents to inspect web pages for Cloudflare Turnstile challenges without an API key, and clear Turnstile or WAF challenges using a SolveGate API key.

Query Microsoft Patch Tuesday security updates from the official MSRC API — monthly rollups, CVE/KB lookups, supersedence chains, and urgency-ranked triage enriched with EPSS scores and the CISA KEV catalog. No API keys required.

An MCP server that scans local codebases for quantum-vulnerable cryptography (secp256k1, Ed25519, RSA, etc.) and CI signing commands, classifying each finding as quantum-broken, post-quantum, or neither. It runs entirely locally with no network calls, providing a deterministic inventory for AI agents.

Enables LLM agents to browse and triage vulnerability observations, manage products, branches and rules, import scan reports and SBOMs, run scans and background jobs, and generate VEX documents via SecObserve's REST API.

Enables AI agents to access VirusTotal intelligence through MCP, supporting file, URL, domain, and IP lookups, plus analysis, via remote HTTP or local stdio.

Enables Android APK reverse engineering and Flutter runtime injection through a six-step pipeline of decompile, analyze, synthesize, inject, patch, and repackage. Provides MCP tools for authorized security research and penetration testing.

SkillTotal is a local stdio MCP server that lets an agent check a component before installing it. It statically analyzes MCP servers, agent skills, npm/PyPI packages and repos for supply-chain risks, dangerous capabilities (shell, filesystem, network, credentials), prompt-injection surfaces like tool poisoning, and exfiltration paths. Each finding cites file, line and snippet.

Connects AI assistants to Solodit's 49,000+ blockchain vulnerability database, enabling search, browse, and lookup of audit findings directly from your AI workflow.

Provides access to Atomic Red Team tests, enabling search, validation, and execution of atomic tests via natural language.

Enables AI agents to perform passive security scans on domains, checking email spoofing (DMARC/SPF/DKIM), TLS weaknesses, security headers, exposed files, and subdomain-takeover risk without needing an API key.

Enables searching and querying HackTricks pentesting documentation directly from Claude, with tools for quick lookup, grouped search results, page outlines, section extraction, and cheatsheet mode.