"Travis CI" matching MCP servers:

Enables AI agents to submit npm, PyPI, Go, or Maven packages and manifests to the free OSV.dev database and receive per-package and per-advisory results with CVE mappings, CVSS scores, severities, and the versions that fix each issue. It also supports filtering by minimum severity, de-duplicating alias advisories, and machine-readable error/warning rows for CI gates and upgrade recommendations.

An MCP server that scans local codebases for quantum-vulnerable cryptography (secp256k1, Ed25519, RSA, etc.) and CI signing commands, classifying each finding as quantum-broken, post-quantum, or neither. It runs entirely locally with no network calls, providing a deterministic inventory for AI agents.

A read-only MCP server for the Qualys PCI Merchant API that lets LLM assistants answer questions about PCI compliance posture, such as which hosts are failing PCI or listing high findings.

Offers a control surface for AI agent security with four independent checks: source-code scanning, tenant isolation, LLM content verification, and deploy gating. Currently in pre-release, with no functional scanning engines yet.

Enables AI coding agents to search a security corpus, scan Terraform plan JSON for cited findings, and list sources via MCP tools grounded in CIS AWS Foundations and OWASP Top 10 CI/CD risks.

Enables coding agents and CI/CD pipelines to audit untrusted code by detecting Python sandbox escapes, SQL injection taint, ReDoS regex vulnerabilities, and CORS misconfigurations, while generating Seccomp BPF filters for safer execution.

Two-way Burp Suite MCP bridge enabling AI agents to capture traffic, analyze endpoints, queue scans, and send findings back to Burp.

Enables agents and CI pipelines to audit MCP servers and agent tool-chains by statically scanning repositories, local checkouts, tools/list exports, or live endpoints for risks such as destructive actions without confirmation, mismatched safety annotations, injection surfaces, credential or PII exposure, and unguarded command, path, or URL sinks. All checks are read-only and never execute the scanned code or call tools/call.

Audits AI agent skills for safety using static, semantic, adversarial, and supply-chain analysis, providing scores and risk flags. Can be run via CLI, CI, or as an MCP tool from Claude Code, Cursor, and Codex.

Privacy-preserving authentication cookie security auditing for AI browser agents, MCP clients, and automated testing. Detects missing HttpOnly, Secure, SameSite, and other cookie protections, and returns structured security findings without exposing raw cookie values.

MCP server that exposes 31 OSINT checks from Lissy93/web-check as tools for website analysis, including SSL, DNS, headers, WHOIS, and security presets. Enables natural-language-driven web recon and health checks.

MCP server for AI-driven VAPT orchestration, enabling agents to plan and execute authorized security scans through a control plane that enforces scope, sanitization, budget, rate limits, human approval, and audit logging.

An authorization-first MCP-governed control plane for executing security-tool workflows in explicitly approved, sandboxed environments with auditable campaigns and AI collaboration boundaries.

Enables red-team and blue-team security workflows on BlackArch Linux by wrapping local tools like nmap, gobuster, nikto, and hydra as MCP tools, with scope-gating that prevents unauthorized scanning against any target not explicitly listed in a local scope.yaml file.

Enables structured robustness and security testing by scanning text for policy/safety issues and generating test suite outlines.

Enables auditing npm, pip, and other package dependencies for known CVEs via the OSV database, with tools to scan manifests, query individual packages, and integrate into CI/CD workflows.

Provides AI coding assistants with real-time security scanning superpowers, including SAST, secrets detection, dependency CVE scanning, and web vulnerability assessment.

Provides on-machine security scanning for Copilot-generated code, including SAST, secrets, dependency, container, and configuration checks, plus AI-specific risk detection, with findings and fixes available via MCP tools.

Lets MCP-compatible AI clients read your getdebug projects, findings, and proposed fixes using your existing bearer token.

Enables comprehensive TLS security audits for any domain, including certificate validity, expiry warnings, cipher suite weaknesses, deprecated protocols, and HSTS checks. Supports single and bulk domain inspection via MCP tools or a CLI for CI/CD integration.

Security Scanner AI - MCP server providing AI-powered tools and automation by MEOK AI Labs

The Checkmarx Security MCP server bridges your AI assistant (Claude, Cursor, Copilot, etc.) with Checkmarx One's enterprise application security platform. It exposes security workflows as natural-language-accessible MCP tools, allowing developers to scan code, investigate findings, and receive context-aware fixes without leaving their development environment.

Enables users to connect an AI agent to a deliberately hostile MCP server, run trigger prompts, and score whether the agent falls for tool poisoning, prompt injection, and rug-pull attacks, with canary-leak detection and CI-friendly reports.

Read-only observation of a single live URL: parses static HTML to report security posture, forms, links, accessibility signals, and leaks, with described fixes. SSRF-gated and safe, never executes JavaScript.

Enables agents to run static heuristic scans over a repository path via stdio, surfacing review candidates with file:line evidence for web3 auth and payment vulnerability patterns. Results can be used as CI-style gates or triage input without any dataflow analysis or external dependencies.

Enables AI agents to analyze memory dumps for forensic investigation, leveraging a fast Rust engine and full Volatility3 plugin coverage via the Model Context Protocol.

Enables AI agents to autonomously run over 150 cybersecurity tools for penetration testing, vulnerability discovery, bug bounty automation, and security research through MCP.

Exposes an assess_repo tool that scans a repository, local folder, or npm/PyPI package and returns supply-chain risk findings with file, line, and code evidence — install-time scripts, dangerous patterns, secrets, AI-agent manipulation, impersonation and published-artifact mismatches — while never executing the target's code. Findings carry severities from info to critical so results can gate installs and CI jobs.

Connects AI assistants to the Tenable VM API to evaluate PCI quarterly external scan readiness with deterministic filtering, a readiness score, and dispute worksheets.

Voyager-net is a read-only, authorized network auditing MCP server that scans a single host or domain for DNS, port, TLS, and HTTP hygiene issues, returning findings with severity and suggested fixes. It enables AI agents to audit infrastructure safely without mutation, requiring explicit authorization.

Offline, dependency-free transport-layer hardening auditor for MCP Streamable HTTP endpoints, probing for DNS rebinding, CORS, session-ID, cleartext, and protocol conformance defects with a severity-weighted score and CI gate.

A Model Context Protocol server that enables AI assistants to search and retrieve information about security exploits and vulnerabilities from the Exploit Database, enhancing cybersecurity research capabilities.

Enables AI agents to conduct authorized mobile banking reverse engineering and security research through 50+ MCP tools spanning APK analysis, Frida instrumentation, malware detection, Play Integrity bypass detection, no-root traffic interception, and evidence reporting.

An intelligent layered port scanning service based on MCP protocol, designed for AI assistants and development tools to perform network security analysis with real-time feedback.

Enables natural language control of Cobalt Strike (version 4.8) via Claude, supporting beacon listing, command execution, payload generation, and listener management without a GUI.

An MCP server that turns Kali Linux into an AI-driven penetration testing powerhouse, enabling control of 40+ offensive security tools via natural language.

Enables AI agents to plan and run authorized offensive security assessments across 150+ integrated tools, with full activity logging of every scan.

Enables an AI agent to audit an untrusted repository through eight parameterless MCP tools that run ten pinned security scanners inside a hardened container, returning native scanner reports, a run manifest tied to the scanned tree, and an audit log. The agent gets no shell, no target path, and no way to build or execute the audited code, so hostile repositories cannot steer the analysis.

Autonomous pentests from one command: real security tools, working PoCs, and audit-ready reports, all driven via MCP.

Security scanner for MCP servers — vet an MCP before you wire it into an agent. Detects prompt-injection, credential exfiltration (via taint analysis), RCE, and supply-chain risks, and catches cross-server exfil chains no single server reveals. Zero-dependency local CLI, SARIF output, CI-gateable, no account.