"The most downloaded Minecraft Plugin (MCP) right now" matching MCP servers:

A local MCP daemon that turns an agentic coding client into a bug bounty operator, with 103 tools for offensive security testing including MITM proxy, traffic analysis, and OOB callbacks.

Enables AI assistants to perform password security auditing using John the Ripper on a remote Kali system via SSH, supporting cracking, hash management, and session control.

Living off the Land intelligence for AI agents. GTFOBins, LOLBAS, LOOBins, LOLDrivers, LOLRMM, WADComs, LOLC2 and more — unified into a single MCP server.

Enables authorized web/API security analysis as a stateful, multi-stage workflow with persistent session state, human-controlled validation, candidate versus confirmed finding tracking, and stop conditions.

AI-native security research platform that integrates Claude with MCP to execute real offensive security tools in an isolated Docker container, enabling natural language-driven recon, CVE scanning, Active Directory enumeration, and cryptographic posture assessment.

Enables users to query BloodHound Active Directory graph data using natural language, finding attack paths, Kerberoastable accounts, and other AD security insights.

Provides on-machine security scanning for Copilot-generated code, including SAST, secrets, dependency, container, and configuration checks, plus AI-specific risk detection, with findings and fixes available via MCP tools.

Captures formatted screenshots of Caido Replay request/response pairs by driving the Screenshot Mode plugin via Chrome DevTools Protocol.

An MCP server that audits zero-knowledge circuits (Circom, Noir, Halo2) for soundness and constraint bugs, powered by the Cysic Minimax model.

Enables querying the WPScan API for WordPress plugin, theme, core vulnerabilities, and specific vulnerability lookups through MCP tools.

Exposes Tenable security operations as MCP tools for AI-powered security workflows, enabling asset, vulnerability, scan, plugin, and tag management via natural language.

The most comprehensive steganography analysis toolkit for AI agents, providing 60 tools across 7 categories for detecting and extracting hidden data from images, audio, text, and files, all running 100% offline.

Enables LLMs to query live decompiled Android app context through a JADX plugin, supporting class, method, and field inspection; source and smali retrieval; manifest parsing; vulnerability discovery; and reverse engineering.

Enables AI assistants to manage Empire listeners, stagers, agents, modules, and credentials via the Empire REST API.

MCP server toolkit with payload library, WAF bypass generator, rate limiter, plugin system, and inter-MCP bridge for security testing.

Fully automated MCP server built to communicate with JADX-AI-MCP Plugin to analyze Android APKs using LLMs like Claude — uncover vulnerabilities, parse manifests, and reverse engineer effortlessly.

Community MCP server for the Cymulate security validation platform. It exposes the full Cymulate REST API (337 endpoints) as 106 semantic tools for BAS, exposure validation, attack surface management, and platform administration.

Provides MCP clients like Claude with tools to query and manage security scans, CVEs, assets, findings, threat intel, and generate polished reports by acting as a lightweight adapter over the CVEasy backend API.

Cyber Host Artificial Intelligence (C.H.A.I) An autonomous penetration testing MCP (Model Context Protocol) server with an integrated AI decision engine, multi-provider LLM support, and an extensible plugin architecture.

Enables AI assistants to perform reconnaissance tasks using the reconFTW framework, supporting full, passive, subdomain, vulnerability, and OSINT scans through MCP tools.

Exposes the ASC APK-as-database analysis engine as MCP tools, enabling AI clients to run fast cross-reference searches, string/secret recon, class and member inspection, manifest and component extraction, and parallel batch queries across many APKs without full decompilation. All tools are stateless and process-isolated, so multiple clients can query single or multiple APK analysis sessions concurrently.

Enables querying SAP Security Note metadata including Patch Day releases, CVSS scores, CVEs, affected components, and actively-exploited status via the Model Context Protocol.

Gorgon Scout is a Windows web-application and API security scanner (DAST). This connector exposes it as MCP tools, so your AI assistant can record a target you are authorised to test, run the scan, stream findings, and produce a report. Capture needs no proxy or certificate setup, and it intercepts HTTP/1.1, HTTP/2, and HTTP/3 (QUIC). Works with the free Claude Desktop plan.

Enables assistants to interact with Hack The Box by wrapping HTB API operations as MCP tools for querying and operating HTB resources.

Enables LLMs to manage workspaces, load and run recon modules, install marketplace modules, and query reconnaissance data, exposing the full recon-ng OSINT framework.

Enables AI agents to analyze memory dumps for forensic investigation, leveraging a fast Rust engine and full Volatility3 plugin coverage via the Model Context Protocol.

MCP Server for Adversarial Co-Generation Engine Generates code and adversarial attacks from the same specification, at the same time — before a commit exists.

Enables running unknown binaries inside a maximum-hardening, no-network Docker sandbox with fixed containment, and inspecting the exact security boundary and past evidence records.

Enables AI agents to query the VirusTotal v3 API for detection reports and analyst-style pivots on files, URLs, IPs, and domains, including contacted hosts, dropped files, resolutions, and threat actors. Provides relationship paging, corpus search with VTI-style modifiers, sandbox behaviour summaries, and supports both stdio and HTTP streaming transports.

Exposes an assess_repo tool that scans a repository, local folder, or npm/PyPI package and returns supply-chain risk findings with file, line, and code evidence — install-time scripts, dangerous patterns, secrets, AI-agent manipulation, impersonation and published-artifact mismatches — while never executing the target's code. Findings carry severities from info to critical so results can gate installs and CI jobs.