"Shell" matching MCP servers:

SkillTotal is a local stdio MCP server that lets an agent check a component before installing it. It statically analyzes MCP servers, agent skills, npm/PyPI packages and repos for supply-chain risks, dangerous capabilities (shell, filesystem, network, credentials), prompt-injection surfaces like tool poisoning, and exfiltration paths. Each finding cites file, line and snippet.

Provides an MCP interface to a full Kali Linux environment running in Docker, enabling AI assistants to execute security tools like nmap, sqlmap, and metasploit. It allows users to start/stop the container, run shell commands, and transfer files for security testing and educational purposes.

A Codex-style MCP server providing 126 tools to operate a Kali Linux machine from ChatGPT or any compatible MCP client, including shell execution, filesystem operations, Git, Docker, browser automation, and security tool wrappers.

Enables an AI agent to perform authorized penetration testing through raw HTTP interaction, Python scripting, and shell commands, while providing an authorization wrapper to keep actions within an approved engagement context.

Exposes AntSword (蚁剑) shell management capabilities as an MCP server via SSE, enabling AI clients to execute commands, manage files, databases, and shells.

Enables an agent or MCP client to scan MCP server configs and AI-agent tool manifests on demand, exposing tools that list detection rules and report hidden prompt injections, data-exfiltration attempts, embedded secrets, deceptive Unicode, unpinned packages and shell-launching tools. Each finding comes with a severity and location so risky tool descriptions can be caught before an attacker exploits them.

Enables AI agents to run ProjectDiscovery reconnaissance tools — subdomain discovery, DNS resolution, HTTP probing, port scanning, crawling, template scanning, and chained bounty workflows — through MCP under alternate tool names, so the underlying binary names never appear in the tool catalog. Includes confirm gates for intrusive scans and no-shell argument-array spawning.

Exposes the crackweb scanner's own commands as MCP tools, letting a client run vulnerability scans and crawls, drive an intercepting proxy, run an out-of-band callback listener, and perform offline JWT and hash analysis without shell quoting or managing background processes. Results return as structured data, including findings streamed while a proxy or listener is still running.

Connects AI assistants to a Kali Linux terminal for executing security tools, managing interactive shell sessions, and performing penetration testing, CTF challenges, and security research tasks.

Enables an AI agent to audit an untrusted repository through eight parameterless MCP tools that run ten pinned security scanners inside a hardened container, returning native scanner reports, a run manifest tied to the scanned tree, and an audit log. The agent gets no shell, no target path, and no way to build or execute the audited code, so hostile repositories cannot steer the analysis.

Vets MCP servers, Claude Code skills, or plugins for unsafe behavior like shell execution, secret access, data exfiltration, prompt injection, and remote code before installation, returning a graded verdict with findings.

SecHelix is an evidence-first AppSec MCP server for reviewing repositories you own or are authorized to test. It verifies candidate findings, refutes false positives, and exposes a root-confined local MCP interface with no shell or arbitrary command execution.

Enables AI agents to run bounded security reconnaissance tools against a local OWASP Juice Shop target via MCP, including HTTP checks, header inspection, Nmap scanning, and web enumeration, without granting arbitrary shell access.

Demonstrates deceptive tool naming and unsanitized shell execution by exposing tools that perform OS fingerprinting and run local system commands through MCP. Intended for security research on vulnerabilities in the MCP ecosystem.

Enables guardrail and trust testing by exposing realistic malicious tool patterns such as shell execution, credential dumping, and data exfiltration, all without network access.

Provides essential security and CTF tools including hash identification, encoding/decoding, XOR bruteforce, JWT decoding, reverse shell generation, SQL injection payloads, CVE lookup, and port service identification for learning security concepts and solving challenges.

Enables MCP clients to invoke common Kali Linux pentesting tools directly as tool calls, with each binary executed safely without a shell.