"Super User" matching MCP servers:

Enables AI agents to drive live Hack The Box labs through the real HTB Labs API — spawning, resetting and extending machines, submitting user and root flags with difficulty ratings, browsing challenges, and switching or downloading VPN configurations for the authenticated account. Every call hits the live API rather than cached content, with destructive actions annotated so hosts can gate them behind consent.

Lets MCP clients browse bug bounty programmes, manage reports, and triage issues on BugSecure with user-approved OAuth permissions, including read-only mode.

Enables AI assistants and the WYRE Conduit gateway to access Telivy's security assessment data for MSPs, including external scans, deep-scan risk assessments, device inventory, M365/Google Workspace user exposure, PII summaries, and finding-level details.

Enables LLMs to perform automated penetration testing and Active Directory reconnaissance through Mythic, with tools for executing PowerShell, AD recon, domain user enumeration, and Kerberoasting.

A community security-research MCP server providing Browser Session and OIDC authentication for Okta workspaces, enabling read-only exploration of Okta organizations and user identity.

Enables AI assistants to perform automated security audits on APIs, detecting BOLA/IDOR vulnerabilities by comparing responses across user tokens.

Enables AI agents to directly control Roblox, reverse engineer games, intercept network traffic, simulate user input, and manipulate game state through 150+ MCP tools.

Enables AI assistants to query Microsoft Defender XDR telemetry for read-only threat hunting, incident triage, and vulnerability discovery using delegated per-user authentication and production guardrails.

Enables agents to rebuild a single-page app's full hidden API surface from stripped JavaScript bundles, diff it across attacker and victim identities to isolate role-gated routes, and then deterministically confirm cross-user access-control breaks (BOLA/IDOR) using the app's own sibling endpoints as the ownership oracle. Exposes six tools that return compact summaries plus artifact paths for fingerprinting, reconstruction, oracle discovery, diffing, proving, and reporting.

Enables coding agents to interact with Frida for reverse engineering: connect to local, USB, and remote devices; inspect apps and processes; manage sessions; and load, evaluate, and exchange messages with JavaScript instrumentation scripts, including fetching community scripts from Frida CodeShare.

Enables Active Directory enumeration and abuse operations through the bloodyAD tool. Supports LDAP queries, user/group management, DNS operations, and security testing directly from AI assistants.

Enables AI agents to perform offline cybersecurity research and penetration testing by querying a local knowledge base of curated security data, with tools for searching, answering, and status checking.