"Resources for Learning Coding Library Documentation" matching MCP servers:

Two-way Burp Suite MCP bridge enabling AI agents to capture traffic, analyze endpoints, queue scans, and send findings back to Burp.

Enables Claude Code to leverage OpenAI models for expert code review, deep architecture analysis, and security audits, with automatic markdown report generation.

GDB Enhanced Features MCP server for remote debugging and CTF exploitation with 41 specialized tools including ROP search, format-string detection, and memory patching.

Free deterministic security scan of a public git repository (GitHub, GitLab, Codeberg, Bitbucket): vulnerable dependencies via OSV.dev, secret patterns, and config lint, returned as structured JSON. Tools: scan_repository(url), audit_pricing(). Runs locally over stdio (python3 web/mcp_stdio.py or the Dockerfile) and is also hosted at https://project-feldspar.com/mcp. MIT licence, stdlib-only. Buil

Enables AI assistants to perform penetration testing and security assessments by exposing 60+ Kali Linux security tools including network scanning, web security testing, password cracking, exploitation frameworks, and OSINT capabilities through an AI-friendly interface.

Enables LLMs to perform automated penetration testing and Active Directory reconnaissance through Mythic, with tools for executing PowerShell, AD recon, domain user enumeration, and Kerberoasting.

Enables searching and querying HackTricks pentesting documentation directly from Claude, with tools for quick lookup, grouped search results, page outlines, section extraction, and cheatsheet mode.

Agent-native "safe to ship?" security gate for AI-generated code. Uses real parsers and inter-rocedural taint analysis (JS/TS, Python, Go) to flag the classes AI coding agents get wrong — secrets, SQL injection, SS, SSRF, path traversal, command injection, weak JWT/CORS — and ranks findings by confidence. Exposes a scan tool over MCP.

MCP server for auditing infrastructure-as-code attack paths, finding multi-hop chains from public internet to sensitive resources.

Enables AI coding assistants to scan projects for security issues such as leaked API keys, missing Supabase RLS, open Firebase rules, unauthenticated routes, and hallucinated packages, then fix and verify the results.

14 atomic MCP tools for AppSec and AI Security engineers: source/schema/prompt audit primitives, JWT inspect, HTTP diff, pentest atoms (default creds, GraphQL introspect, phpggc, interactsh OOB), and a defensive helpers library that fixes the bugs the detectors flag. SARIF output, PyPI Trusted Publishing with Sigstore provenance.

Security checks for apps built with AI: Trivy and Opengrep findings explained in plain English, with a fix request for your coding agent. Hosted scan by default (only files Git would commit, never secret files) or fully local.

Enables AI coding agents to search a security corpus, scan Terraform plan JSON for cited findings, and list sources via MCP tools grounded in CIS AWS Foundations and OWASP Top 10 CI/CD risks.

MCP server for TurboPentest — run AI-powered penetration tests and review findings from your coding assistant.

MCP server that enables AI coding tools to scan projects for security vulnerabilities, secret leaks, and compliance issues, generating Korean-language audit reports.

Scan a deployed site for an exposed Supabase service_role key and audit Row Level Security from your AI coding agent.

Enables coding agents and CI/CD pipelines to audit untrusted code by detecting Python sandbox escapes, SQL injection taint, ReDoS regex vulnerabilities, and CORS misconfigurations, while generating Seccomp BPF filters for safer execution.

A scope-aware bug-bounty & reconnaissance MCP server that works out of the box on the Python standard library and augments itself with your favourite CLI tools when they're present.

Integrates Checkov, Semgrep, Bandit, and ASH to provide comprehensive code security analysis for AI coding assistants.

A local MCP server that scans repository dependencies for known vulnerabilities (CVEs) using OSV.dev, enriches findings with NVD and CISA KEV data, and supports triage, remediation, and accepted risk management directly from an AI coding assistant.

Enables sudo-free management of /etc/hosts entries for Hack The Box and lab work, with a zero-dependency MCP server for AI coding agents.

Enables interaction with Picus Security's Breach & Attack Simulation API, allowing natural language queries for simulations, threat library searches, and agent management through MCP-compatible clients.

Enables AI coding tools to unpack WeChat Mini Program packages, capture requests, analyze signature and encryption parameters, and export self-contained local Node.js signing scripts for authorized security analysis and API integration.

An MCP server that exposes Prof. Null, an uncensored cybersecurity professor, as a set of specialized tools for learning hacking, CTFs, and security concepts through Q\&A, roadmaps, cheatsheets, labs, and more.

Enables AI assistants to search TryHackMe rooms and extract room overviews, task instructions, commands, and questions as clean Markdown for training and reference. Supports session-cookie authentication for subscriber content and includes curated foundational cybersecurity and Linux learning tracks.

Security scanning for AI coding tools (Claude Code, Cursor, Windsurf) including secrets detection, MCP config vulnerabilities, agent instruction checks, threat modeling, prompt injection testing, pre-commit security checks, and dependency vulnerability scanning.

Enables AI assistants to natively execute and manage 600+ Kali Linux security, penetration testing, and forensic tools, including search, help documentation, structured scanners, and workspace management.

Enables AI coding assistants to inspect ELF, PE, and Mach-O binaries for hardening mitigations and high-risk symbols, and to triage source or decompiled code against MITRE CWE patterns through MCP tools.

Security scanner for vibe coders that checks npm packages for known vulnerabilities before installation, integrating with AI coding tools like Claude Code and Cursor.

An MCP security toolkit that integrates Burp-style HTTP proxying, AI-driven vulnerability hunting, source code auditing, and reporting into AI coding agents, enabling authorized security testing of web applications and source code.

A security scanner for AI coding agents and autonomous assistants that scans code for vulnerabilities, detects hallucinated packages, blocks prompt injection, and provides LLM-powered semantic code review via MCP or CLI.

Enables management of penetration testing reports and vulnerabilities through a REST API, supporting CVSS 3.1 scoring, HTML formatting, and secure JWT authentication for comprehensive security assessment documentation.

Enables coding assistants to sign in to a user's account, scan source code with static analysis, and review findings through a shared chat thread from Claude Code, Codex, or VS Code.

Exposes seven MCP tools that let an AI coding agent detect a project's stack, fetch the priority security checks for that platform, search 2,057 OWASP-derived check cards with file-and-commit provenance, and record evidence-backed pass/fail results in a report.

Provides local, dependency-free security scanning tools for LLM configurations, prompts, RAG sources, and more, enabling AI coding agents to detect prompt injections and other vulnerabilities without external network access.

Enables developers and security teams to run evidence-first Android and iOS security audits, manage jobs and reports, query public vulnerability intelligence, evaluate policies, and plan runtime checks through stdio MCP tools and resources.

MCP server toolkit with payload library, WAF bypass generator, rate limiter, plugin system, and inter-MCP bridge for security testing.

Enables AI coding assistants to perform authorized attack-surface reconnaissance and vulnerability intelligence through stdio JSON-RPC tools for HTTP probing, TCP port scanning, directory discovery, template checks, and CISA KEV/cve.now lookups.

Enables AI clients to access a unified gateway of 214+ skills, 237 tools, rules, prompts, and resources for reverse engineering, Frida hooking, APK surgery, web UI cloning, forex data, and sequential reasoning through one MCP connection.

A self-hostable, vulnerable-by-design MCP server for learning how object-level authorization bugs (BOLA/IDOR) appear in multi-tenant tools.