"Resources and tips for high-quality web design, UI, and UX optimization" matching MCP servers:

An MCP server that lets an AI agent probe a live URL and confirm whether sensitive files (e.g., .git, .env, source maps) are genuinely served by fetching and validating the content, avoiding false positives.

MCP server that exposes 31 OSINT checks from Lissy93/web-check as tools for website analysis, including SSL, DNS, headers, WHOIS, and security presets. Enables natural-language-driven web recon and health checks.

Enables users to run synthetic support-agent evaluations, preserve and inspect traces, score results deterministically, inject failures, and enforce release review gates through MCP tools, resources, and prompts.

Enables AI agents to audit URLs for security headers, generate CSP Level 3 policies, compute SRI hashes, evaluate WCAG 2.2 contrast, and remediate headers.

Two-way Burp Suite MCP bridge enabling AI agents to capture traffic, analyze endpoints, queue scans, and send findings back to Burp.

Enables Claude Code to leverage OpenAI models for expert code review, deep architecture analysis, and security audits, with automatic markdown report generation.

GDB Enhanced Features MCP server for remote debugging and CTF exploitation with 41 specialized tools including ROP search, format-string detection, and memory patching.

Free deterministic security scan of a public git repository (GitHub, GitLab, Codeberg, Bitbucket): vulnerable dependencies via OSV.dev, secret patterns, and config lint, returned as structured JSON. Tools: scan_repository(url), audit_pricing(). Runs locally over stdio (python3 web/mcp_stdio.py or the Dockerfile) and is also hosted at https://project-feldspar.com/mcp. MIT licence, stdlib-only. Buil

Enables controlled, evidence-first web application penetration testing and bug bounty workflows, including scope enforcement, reconnaissance, human-approved surface triage, OWASP WSTG test execution, and SHA-256 evidence capture.

Connects AI coding assistants to Snyk API & Web for onboarding scan targets, configuring authentication, running DAST scans, and triaging findings through natural language.

Enables proof-backed code audit via MCP tools for AST-based code maps, symbol lookup, callers, audit commands, and persistent verdict memory.

Enables interacting with HackerOne through the official REST API for managing reports, earnings, and programs, plus browser automation to read disclosed reports, search hacktivity writeups, and view program policies even behind Cloudflare.

Exposes AI-augmented network reconnaissance and evasion capabilities as callable FastMCP tools, enabling natural language orchestration of host discovery, service fingerprinting, CVE mapping, and attack chain synthesis.

Enables AI assistants and CLI users to run automated bytecode security audits of EVM smart contracts on Base Mainnet, detecting risky opcodes and interface signatures, scoring risk, and unlocking verified results via x402 USDC micropayments.

Enables LLMs to perform automated penetration testing and Active Directory reconnaissance through Mythic, with tools for executing PowerShell, AD recon, domain user enumeration, and Kerberoasting.

Enables auditing and monitoring of AI agent MCP tool calls, with behavioral anomaly detection, lab-scoped red-team simulation, and Telegram notifications.

Enables agents to inspect web pages for Cloudflare Turnstile challenges without an API key, and clear Turnstile or WAF challenges using a SolveGate API key.

A read-only MCP server for the Qualys PCI Merchant API that lets LLM assistants answer questions about PCI compliance posture, such as which hosts are failing PCI or listing high findings.

MCP server for auditing infrastructure-as-code attack paths, finding multi-hop chains from public internet to sensitive resources.

Connects an AI assistant to an already-running mitmweb session so it can read, search, diff, replay, and generate code from the same network flows shown in the UI.

Provides Claude Code with access to a comprehensive bug bounty knowledge base including techniques, payloads, wordlists, and real-world reports through 14 tools for searching, retrieving payloads, and assessing report quality.

Reduces thousands of security findings to the smallest set of high-impact remediation actions, with fail-closed safety gates, typed execution plans, and verification that refuses false all-cleans.

Enables AI assistants to perform authorized web security assessments through MCP tools and a guided review prompt, including passive and full scans, WAF detection, remediation fixes, report export, triage, scan comparison, and proof-of-control verification.

Enables policy-first defensive security operations for MCP, providing repository and web-security analysis with controlled authorization, scoped execution, and auditability.

Runs WCAG accessibility, SEO, performance, and security audits on URLs or raw HTML via SiteLint Auditor. Enables LLM agents to audit web pages and check WCAG criteria through MCP tools.

Chrome browser JS reverse engineering MCP tool for CTF/Web security, enabling dynamic analysis and restoration of login encryption logic.

Enables AI assistants to perform web content discovery scans using feroxbuster on a remote system via SSH, with support for recursive scanning, filtering, and background execution.

Enables AI coding assistants to run pre-publish security and code-quality scans across 17 categories, generate a 0–100 security score and Markdown report, quickly check critical vulnerabilities, and receive fix/refactor suggestions by finding ID.

An MCP server for identifying SQL injection vulnerabilities in web applications using various techniques like error-based, time-based, and union-based scanning. It supports bulk URL processing, WAF bypass strategies, and authenticated testing across multiple database systems.

Enables security inspection of MCP tool metadata by analyzing tool names, descriptions, and input schemas, and returning SAFE, REVIEW, or HIGH RISK verdicts through the analyze_tools tool.