"Understanding Attack Surface Management" matching MCP servers:

• attack-surface-mcp-server

  cyanheads

  A

  license

  -

  quality

  C

  maintenance

  Passive external attack-surface mapping server that discovers subdomains, DNS records, TLS posture, HTTP headers, and registration data via public sources like CT logs, Shodan, and RDAP/WHOIS, enabling security reconnaissance without active scanning.

  Last updated 2026-06-14

  73

  1

  Apache 2.0

• MITRE ATT&CK Mapper MCP

  CSOAI-ORG

  A

  license

  B

  quality

  B

  maintenance

  Enables cyber defenders to query ATT\&CK techniques, list tactics, map incidents to techniques, look up threat actor groups and mitigations, all via the MCP protocol.

  Last updated 2026-06-26

  5

  MIT

• ScopePilot MCP

  rens1215

  A

  license

  -

  quality

  B

  maintenance

  A safe and bounded AI-agent security testing framework that enables authorized web security testing tasks like reconnaissance, attack surface inventory, and report drafting through MCP tools.

  Last updated 2026-06-07

  MIT

• GDA-MCP-Server

  autozw

  A

  license

  -

  quality

  B

  maintenance

  Enables Android APK static analysis in Cursor/Claude via GDA CLI Server, supporting reconnaissance, attack surface scanning, and code decompilation through natural language.

  Last updated 2026-07-17

  4

  GPL 3.0

• asi-mcp

  deruke

  F

  license

  -

  quality

  D

  maintenance

  AI-powered Attack Surface Intelligence server that exposes industry-standard penetration testing tools via MCP, enabling AI agents to perform comprehensive security assessments.

  Last updated 2026-01-24

  3

• MCP Security Tools Suite

  Ap6pack

  -

  license

  -

  quality

  -

  maintenance

  Enables ethical security testing and attack surface management through SSL certificate validation, CVE queries, subdomain enumeration, security header analysis, and comprehensive reconnaissance capabilities. Designed for authorized penetration testing workflows with responsible disclosure practices.

  Last updated 2025-08-30

• caldera-mcp

  cowboy-samurai

  A

  license

  A

  quality

  B

  maintenance

  Connects MCP-compatible AI clients to a MITRE Caldera adversary emulation platform, enabling natural language construction of attack scenarios, agent inspection, and operation management.

  Last updated 2026-05-15

  18

  Apache 2.0

• Picus Security MCP Server

  BeardedInfoSec

  A

  license

  A

  quality

  B

  maintenance

  Enables interaction with Picus Security's Breach & Attack Simulation API, allowing natural language queries for simulations, threat library searches, and agent management through MCP-compatible clients.

  Last updated 2026-07-15

  23

  MIT

• Blackveil DNS

  MadaBurns

  A

  license

  A

  quality

  B

  maintenance

  A DNS and email security scanner with 77 MCP tools for assessing SPF, DMARC, DKIM, DNSSEC, SSL/TLS, and more, providing guided remediation and attack path simulation.

  Last updated 2026-07-26

  80

  98

  8

  Business Source 1.1

• Shannon Lite MCP

  devinoldenburg

  A

  license

  A

  quality

  C

  maintenance

  MCP server for Shannon Lite security workflows, enabling configuration, scan orchestration, workspace management, and report reading.

  Last updated 2026-06-16

  11

  1

  MIT

• Xploit47

  aloc999

  A

  license

  A

  quality

  C

  maintenance

  AI-powered penetration testing reasoning engine (MCP server) for attack path planning, step scoring, and tool recommendations using Beam Search and Monte Carlo Tree Search.

  Last updated 2026-07-17

  1

  1

  MIT

• OSINT MCP Server

  Krisparenthetic284

  A

  license

  A

  quality

  C

  maintenance

  A comprehensive reconnaissance toolset that provides AI agents with 37 tools across 12 data sources like Shodan and VirusTotal for automated intelligence gathering. It enables agents to perform domain reconnaissance, attack surface mapping, and cross-platform data correlation within a single conversational interface.

  Last updated 2026-06-16

  2

  37

  281

  2

  MIT

• osint-mcp-server

  badchars

  A

  license

  A

  quality

  C

  maintenance

  Provides AI agents with 37 OSINT tools and 12 data sources to perform unified reconnaissance, domain analysis, and attack surface mapping. It enables agents to query, correlate, and reason across platforms like Shodan, VirusTotal, and Censys in parallel.

  Last updated 2026-03-17

  37

  281

  34

  MIT

• PyPen MCP

  D4D25A

  F

  license

  A

  quality

  D

  maintenance

  Enables LLM-powered browser automation and security testing with features like browser management, network monitoring, DOM manipulation, and captcha handling.

  Last updated 2026-02-13

  52

  1

• Stratos

  h4cd0c

  A

  license

  A

  quality

  C

  maintenance

  Enterprise-grade Azure security assessment toolkit with multi-location scanning, IMDS exploitation, attack path analysis, and compliance reporting. Enables authorized penetration testing and compliance audits across all Azure regions.

  Last updated 2026-03-18

  43

  7

  MIT
• 

  Latent Defense MCP Serverofficial

  latent-defense

  A

  license

  B

  quality

  C

  maintenance

  Connects Claude Code to a Latent Defense deployment to map GitHub repositories into an infrastructure graph, discover attack paths using the JEPA energy model, and triage findings from the terminal.

  Last updated 2026-06-22

  85

  Apache 2.0

• BountyProof MCP

  skyxtools

  A

  license

  B

  quality

  C

  maintenance

  An MCP server for authorized bug bounty work that enforces an evidence-driven workflow with session management, preflight checks, surface discovery, and verified scanning.

  Last updated 2026-07-11

  12

  MIT

• BloodHound MCP Server

  mwnickerson

  A

  license

  B

  quality

  B

  maintenance

  Enables security professionals to query and analyze Active Directory attack paths from BloodHound Community Edition data using natural language through Claude Desktop's Model Context Protocol interface.

  Last updated 2026-07-22

  79

  118

  GPL 3.0

• DefectDojo MCP Server

  jamiesonio

  A

  license

  B

  quality

  D

  maintenance

  Provides a Model Context Protocol server implementation that allows AI agents and other MCP clients to programmatically interact with DefectDojo, a vulnerability management tool, for managing findings, products, and engagements.

  Last updated 2025-04-01

  11

  14

  MIT

• PentestThinkingMCP

  LT7T

  A

  license

  C

  quality

  D

  maintenance

  An AI-powered penetration testing reasoning engine that provides automated attack path planning, step-by-step guidance for CTFs/HTB challenges, and tool recommendations using Beam Search and MCTS algorithms.

  Last updated 2025-05-27

  1

  MIT