"Tor Project" matching MCP servers:

Two-way Burp Suite MCP bridge enabling AI agents to capture traffic, analyze endpoints, queue scans, and send findings back to Burp.

Free deterministic security scan of a public git repository (GitHub, GitLab, Codeberg, Bitbucket): vulnerable dependencies via OSV.dev, secret patterns, and config lint, returned as structured JSON. Tools: scan_repository(url), audit_pricing(). Runs locally over stdio (python3 web/mcp_stdio.py or the Dockerfile) and is also hosted at https://project-feldspar.com/mcp. MIT licence, stdlib-only. Buil

Enables MCP clients to work with DefAudit, supporting project and scan listing, starting scans, retrieving results, and marking or unmarking false positives.

MCP server providing diagnostic tools to analyze software architecture, security, REST API compliance, and dependencies for multiple programming languages. Enables AI agents to run scans and audits on codebases.

Enables security auditing, penetration testing, and compliance validation with tools like Semgrep, Trivy, Gitleaks, and OWASP ZAP. Features strict project boundary enforcement and supports OWASP, CIS, and NIST compliance frameworks.

Enables security analysts to carry structured investigation state across sessions by storing typed observations, hypotheses, tasks, evidence and versioned decisions in a local SQLite graph with full-text search. It also enforces authorized scope and request controls, redacted and content-hashed evidence, duplicate-test signatures and validation gates that leave findings in draft until reproducibly confirmed, then produces technical and executive reports for Antigravity, Codex and other stdio MCP clients.

Enables reverse engineering and binary analysis using Ghidra, YARA, Radare2, and other tools, plus backend development assistance like project analysis, security scanning, and scaffolding.

Integrates Snyk security scanning with MCP clients like Claude Code, enabling listing of projects, querying issues by severity, and filtering by project or scope.

Enables MCP clients to carry out a compliant, non-destructive, auditable authorized security-testing workflow — project intake, scope reading, asset discovery, non-destructive verification, evidence collection, and report-draft generation with manual submission tracking — where every outbound action is gated by scope checks, one-time human confirmation tokens, rate limits, and append-only audit logging.

Enables AI editors such as Cursor, Claude Code, Windsurf and VS Code to scan a project for common AI-introduced security mistakes — leaked keys, open Supabase/Firebase data, missing auth, unverified Stripe webhooks, SQL injection and more — and return findings with exact fix instructions. It also provides a guided prompt that walks an agent through fixing critical issues one by one and verifying each fix by re-scanning, without ever editing files or rotating keys itself.

Audits AI agent skills for safety using static, semantic, adversarial, and supply-chain analysis, providing scores and risk flags. Can be run via CLI, CI, or as an MCP tool from Claude Code, Cursor, and Codex.

Enables auditing npm, Yarn, and pnpm lockfiles in local project directories or remote Git repositories to surface dependency vulnerabilities. Exposes a tool that supports severity thresholds, registry overrides, optional dev-dependency skipping, and text or JSON reports.

Enables auditing npm, Yarn, and pnpm lockfiles from local project directories or remote Git repositories for dependency vulnerabilities, with configurable severity thresholds, dev-dependency skipping, and text or JSON reporting.

Enables auditing npm, Yarn, and pnpm lockfiles in local project directories or remote Git repositories for vulnerabilities, with configurable thresholds, registry, dev-dependency skipping, retries, and text or JSON report output.

Enables auditing npm, Yarn, and pnpm lockfiles from local project directories or remote Git repositories through an MCP tool, returning vulnerability results in text or JSON with configurable thresholds and dev dependency skipping.

Enables autonomous AI agents and penetration testers to conduct authorized security audits with persistent cross-session memory, zero-trust secret scrubbing, dynamic OWASP/ASVS checklists, and hallucination-free exploit PoC generation from captured traffic.

Enables MCP-compatible AI applications to perform read-only npm package and project dependency safety scans, returning proceed, caution, or block verdicts without executing package code.

Enables auditing npm, Yarn, and pnpm lockfiles from local project directories or remote Git repositories via an MCP tool, returning vulnerability results in text or JSON with configurable thresholds, registry, dev-dependency skipping, and retries.

Enables auditing npm, Yarn, and pnpm lockfiles from local project directories or remote Git repositories through an MCP tool, returning vulnerability results with configurable thresholds, registry, dev-dependency skipping, retries, and text or JSON output.

Enables auditing npm, Yarn, and pnpm lockfiles from local project directories or remote Git repositories, returning vulnerability results in text or JSON with configurable thresholds and dev dependency skipping.