"The most widely used models" matching MCP servers:

An MCP server that runs curated adversarial prompts against local Ollama models to test guardrails, scoring responses with heuristic verdicts for human review.

An MCP server that audits zero-knowledge circuits (Circom, Noir, Halo2) for soundness and constraint bugs, powered by the Cysic Minimax model.

Enables AI models to search and retrieve offline security knowledge from over 20 curated sources including HackTricks, PayloadsAllTheThings, and OWASP guides, via the Model Context Protocol.

Enables AI assistants to perform password security auditing using John the Ripper on a remote Kali system via SSH, supporting cracking, hash management, and session control.

Living off the Land intelligence for AI agents. GTFOBins, LOLBAS, LOOBins, LOLDrivers, LOLRMM, WADComs, LOLC2 and more — unified into a single MCP server.

The most comprehensive steganography analysis toolkit for AI agents, providing 60 tools across 7 categories for detecting and extracting hidden data from images, audio, text, and files, all running 100% offline.

Enables AI assistants to manage Empire listeners, stagers, agents, modules, and credentials via the Empire REST API.

Enables users to query BloodHound Active Directory graph data using natural language, finding attack paths, Kerberoastable accounts, and other AD security insights.

Community MCP server for the Cymulate security validation platform. It exposes the full Cymulate REST API (337 endpoints) as 106 semantic tools for BAS, exposure validation, attack surface management, and platform administration.

Enables large language models to read and write IDA Pro databases through structured tool calls for reverse engineering, binary analysis, and hook development. Provides broker-based routing, SQLite-backed static caching, multi-instance analysis, and both cached and live IDA API queries.

Provides MCP clients like Claude with tools to query and manage security scans, CVEs, assets, findings, threat intel, and generate polished reports by acting as a lightweight adapter over the CVEasy backend API.

MCP server for security-testing AI models, exposing garak vulnerability scanning and URL/MCP-endpoint scanning as callable tools. It lets agents probe LLM endpoints for jailbreaks, prompt injection, and data leakage, and classify URLs or screen remote MCP endpoints for prompt-injection payloads.

Bridges large language models with the Cobalt Strike C2 framework, enabling AI assistants to control adversary simulation workflows through natural language.

Enables AI assistants to perform reconnaissance tasks using the reconFTW framework, supporting full, passive, subdomain, vulnerability, and OSINT scans through MCP tools.

Exposes the ASC APK-as-database analysis engine as MCP tools, enabling AI clients to run fast cross-reference searches, string/secret recon, class and member inspection, manifest and component extraction, and parallel batch queries across many APKs without full decompilation. All tools are stateless and process-isolated, so multiple clients can query single or multiple APK analysis sessions concurrently.

Enables querying SAP Security Note metadata including Patch Day releases, CVSS scores, CVEs, affected components, and actively-exploited status via the Model Context Protocol.

Enables agents to run static heuristic scans over a repository path via stdio, surfacing review candidates with file:line evidence for web3 auth and payment vulnerability patterns. Results can be used as CI-style gates or triage input without any dataflow analysis or external dependencies.

Enables authorized web/API security analysis as a stateful, multi-stage workflow with persistent session state, human-controlled validation, candidate versus confirmed finding tracking, and stop conditions.

Gorgon Scout is a Windows web-application and API security scanner (DAST). This connector exposes it as MCP tools, so your AI assistant can record a target you are authorised to test, run the scan, stream findings, and produce a report. Capture needs no proxy or certificate setup, and it intercepts HTTP/1.1, HTTP/2, and HTTP/3 (QUIC). Works with the free Claude Desktop plan.

Enables assistants to interact with Hack The Box by wrapping HTB API operations as MCP tools for querying and operating HTB resources.