"QA review sentinel test marker" matching MCP servers:

Enables passive security scanning of HAR files from QA test automation to detect missing security headers, insecure cookies, CORS misconfigurations, and leaked secrets, without making any live requests.

Enables MCP clients to run security and code review on pull requests and diffs, exposing review_pr and review_diff capabilities with local-first analyzers and LLM explanations.

test

An MCP server that runs curated adversarial prompts against local Ollama models to test guardrails, scoring responses with heuristic verdicts for human review.

Connects MCP clients to pre-submission review that argues against a draft bug-bounty report or smart-contract finding the way a triager would, tying every claim to a supplied file and line and returning a submit, rewrite-then-submit, prove-first, hold-duplicate or drop verdict. Exposes tools to list review profiles, prepare reviews for the agent's own model, build hash-verified review packets, and — with a connection token — run hosted profiles on your own provider key.

Self-hosted MCP engine for private code reviews, providing deterministic static analysis and AST-level search over diffs, with findings passed to a review agent of your choice.

MCP server for TurboPentest — run AI-powered penetration tests and review findings from your coding assistant.

MCP server that guides LLM security reviews step-by-step, tracking progress and ensuring all assigned source code is read before completing each plan step.

Local-first security scanner for AI agent skills, plugins, hooks and MCP servers. Read-only, offline tools to scan a skill or MCP server before installing it, audit the installed setup and review proxy pins.

Enables searching and analyzing CVEs and vulnerabilities from multiple sources, optimized for PR review scenarios to help developers identify the latest security issues.

Enables AI assistants to perform authorized web security assessments through MCP tools and a guided review prompt, including passive and full scans, WAF detection, remediation fixes, report export, triage, scan comparison, and proof-of-control verification.

Enables an LLM to author, validate, and test Wirefilter WAF and Smart Firewall rules using live schema and real CVE exploit templates.

Enables auditing a Supabase project's security beyond the dashboard's Security Advisor, checking anonymous access, RLS policies, and cross-tenant data leaks via read-only probes and a two-account test.

Enables security inspection of MCP tool metadata by analyzing tool names, descriptions, and input schemas, and returning SAFE, REVIEW, or HIGH RISK verdicts through the analyze_tools tool.

Provides 28 MCP tools across 16 analysis engines for comprehensive Python code quality assessment, including complexity scoring, security scanning, dead code detection, dependency auditing, and test quality analysis.

Enables controlled, evidence-first web application penetration testing and bug bounty workflows, including scope enforcement, reconnaissance, human-approved surface triage, OWASP WSTG test execution, and SHA-256 evidence capture.

Enables testing API authentication and authorization by probing endpoints with and without Authorization headers, suggesting auth test matrices for roles, and showing current test configuration.

A comprehensive MCP server for Frida dynamic instrumentation, enabling AI agents to manage devices, processes, scripts, memory, and ADB operations.

A security scanner for AI coding agents and autonomous assistants that scans code for vulnerabilities, detects hallucinated packages, blocks prompt injection, and provides LLM-powered semantic code review via MCP or CLI.

A local, read-only MCP server that connects your HackerOne researcher account to Claude Desktop and Claude Code, helping you find targets, analyze program scopes, review reports and earnings, and draft bug reports.

Enables coding assistants to sign in to a user's account, scan source code with static analysis, and review findings through a shared chat thread from Claude Code, Codex, or VS Code.

Enables security researchers to evaluate AI system defenses against prompt injection attacks through a comprehensive set of test vectors and analysis tools.

Enables structured robustness and security testing by scanning text for policy/safety issues and generating test suite outlines.

Enables local, evidence-first triage of native binaries by extracting bounded symbols, strings, sections, call sites, gadget candidates, and mitigation signals as MCP tools for agent-guided manual review. It also provides metadata-only inspection for carriers such as archives, WebAssembly, firmware, and scripts without claiming verified vulnerabilities.

Enables scanning OpenAPI specifications for security gaps and generating security test checklists for APIs.

Enables AI agents to audit web headers and DOM code, API routes, and database queries for vulnerabilities such as XSS, BOLA/IDOR, and SQL/NoSQL injection, returning scored CWE findings. It also automatically synthesizes secure drop-in replacement code with unified git diffs for review.

Read-only security audit for Supabase. Surfaces RLS gaps, permissive policies, exposed functions and grants, and returns scored findings with fix SQL that is never executed.

Enables security analysts to carry structured investigation state across sessions by storing typed observations, hypotheses, tasks, evidence and versioned decisions in a local SQLite graph with full-text search. It also enforces authorized scope and request controls, redacted and content-hashed evidence, duplicate-test signatures and validation gates that leave findings in draft until reproducibly confirmed, then produces technical and executive reports for Antigravity, Codex and other stdio MCP clients.

Enables AI-powered automated testing, security scanning, code review, and maintenance tasks directly within Claude Code or desktop.

Provides a container-native offensive security MCP toolkit that runs 179 tools — executable-backed scanners plus deterministic, evidence-first vulnerability probes — against authorized engagement targets. Enables scope-guarded pentesting workflows with persisted JSON evidence artifacts and high-confidence versus review-only findings.