"Origin" matching MCP servers:

MCP security firewall (stdio): vet advertised tool definitions through static-scan → threat-feed → origin → pinning before they reach the model. Zero npm runtime deps. No secrets.

Wraps the recon CLIs security researchers already use (subfinder, httpx, nmap, ffuf, nuclei) into a single MCP server so an LLM agent can plan and execute reconnaissance itself — passive subdomain/DNS/wayback discovery, active port scanning, WAF detection and origin-bypass checks, endpoint fuzzing, and nuclei scans. Structured JSON results carry scan tokens that let the agent chain one step's output into the next without re-typing targets.

MCP server for CDN source origin tracing and IP intelligence, enabling DNS resolution, CNAME tracking, C-segment scanning, web fingerprinting, and host collision detection for asset reconnaissance.