"Understanding Boss Mode" matching MCP servers:

Enables AI agents to reverse-engineer binaries, APKs, and firmware through a sandboxed Code Mode interface, filtering large disassembly, import, and string outputs before they reach the model context.

Enables searching and querying HackTricks pentesting documentation directly from Claude, with tools for quick lookup, grouped search results, page outlines, section extraction, and cheatsheet mode.

Captures formatted screenshots of Caido Replay request/response pairs by driving the Screenshot Mode plugin via Chrome DevTools Protocol.

MCP server that guides LLM security reviews step-by-step, tracking progress and ensuring all assigned source code is read before completing each plan step.

Enables coding agents and CI/CD pipelines to audit untrusted code by detecting Python sandbox escapes, SQL injection taint, ReDoS regex vulnerabilities, and CORS misconfigurations, while generating Seccomp BPF filters for safer execution.

Lets MCP clients browse bug bounty programmes, manage reports, and triage issues on BugSecure with user-approved OAuth permissions, including read-only mode.

Enables MCP-compatible agents to audit an entire repository through one question, detecting stacks and running parallel checks for dead code, dependencies, security, CVEs, complexity, and lint across Laravel/PHP, Python, TypeScript/React, and Flutter/Dart. It returns normalized, severity-sorted findings with false positives flagged and secret values kept out of the output.

Provides 28 MCP tools across 16 analysis engines for comprehensive Python code quality assessment, including complexity scoring, security scanning, dead code detection, dependency auditing, and test quality analysis.

An AI-native code security audit MCP server that supports multi-language AST analysis, call graph analysis, vulnerability detection, and AI deep audit.

Enables AI-powered automated testing, security scanning, code review, and maintenance tasks directly within Claude Code or desktop.

Enables a language model to inspect proxy history, run scoped scans and intruder jobs, and drive a proxied browser through Burp Suite for authorized security testing on test and staging environments. Scope, environment, mode, rate limits, refusals and secret redaction are enforced in gateway code with a tamper-evident audit log.

Enables automated security code auditing using LLM and MCP, including AST parsing, taint analysis, dataflow tracing, and automated PoC generation for multi-language codebases.

Audits MCP server configurations for security risks including capability inventory, SSRF, prompt injection, and drift detection. Works in read-only mode and can also be used as an MCP server to let AI agents audit their own attack surface.

Enables LLM clients to conduct authorized penetration testing and CTF challenges through a multi-mode agent with evidence-chain anti-hallucination, skill evolution, and MCP tool orchestration.

Multi-language SAST and AI-powered fuzzing MCP server for Claude Code integration, enabling static and dynamic security analysis of code.

Enables coding agents to scan a public URL in passive or authorized mode and receive only bounded, sanitized structured findings (severity, confidence, standard, evidence, remediation) with quarantined evidence instead of raw page dumps. A second tool lets agents inspect the scanner's safety boundaries and coverage without making any network request.

Enables AI coding assistants to run static analysis on GitHub repositories, raw code snippets, or local directories to detect cloud cost leaks in Terraform/AWS configs, PostgreSQL migration table-lock hazards, and OWASP/Next.js API security gaps. Each finding returns structured severity, line-level detail, and drop-in fixes.

Connects AI assistants to a Kali Linux terminal for executing security tools, managing interactive shell sessions, and performing penetration testing, CTF challenges, and security research tasks.

Enables AI agents to drive wireless penetration testing end-to-end through MCP, including monitor mode, network scanning, handshake and PMKID capture, WPS attacks, deauthentication, and password cracking. It exposes all h4kfi tools to MCP-compatible clients like OpenCode and Claude Code.

Enables enterprise MCP security auditing through 12 deterministic no-LLM tools for evidence-gated claims, skill/prompt supply-chain audits, token profiling, and server auth-mode checks.

An enhanced MCP server for IDA Pro that integrates bulk binary export, multi-instance management via Broker mode, and 80+ analysis tools for AI-assisted reverse engineering.

Enables MCP clients to run security and code review on pull requests and diffs, exposing review_pr and review_diff capabilities with local-first analyzers and LLM explanations.

Code review as an MCP server — structured code quality reviews with OWASP security scanning.

Enables security testing of MCP guardrails and SAST scanners by exposing intentionally vulnerable code patterns that are inert by default and make no network calls.

Autonomous penetration testing powered by a local LLM, automating tool chaining for recon, vulnerability scanning, exploit research, and reporting.

Domain security reconnaissance for AI agents — 13 tools (DNS+DNSSEC, SSL/TLS, HTTP security headers, SPF/DKIM/DMARC email auth, port scan, ASN, RDAP/WHOIS) plus a one-shot security_scan returning a 0–100 Health Score (A–F). Free, no API key.

An MCP server that provides passive and low-impact active reconnaissance tools for authorized bug bounty and security assessments, enabling LLMs to perform structured recon and generate reports.

Enables authenticated remote MCP clients to manage a Kali Linux environment, run modular tools in sandboxed or optional host contexts, configure networking, and monitor jobs through a live WebUI.