"Understanding Sequential Thinking in Server Systems" matching MCP servers:

Enables authorized web/API security analysis as a stateful, multi-stage workflow with persistent session state, human-controlled validation, candidate versus confirmed finding tracking, and stop conditions.

GhostHunt is an MCP server that scans your development machine for API keys, tokens, and credentials hiding in places you forgot to check.

Security scanning for MCP servers from the inside out. Provides runtime inspection, AST-based static analysis, config audit, dependency analysis, and OWASP MCP Top 10 compliance in a single MCP server.

Enables AI assistants to run Kali Linux security tools in an isolated Docker container for tasks like network scanning, port checking, and service enumeration.

A real security scanning MCP server for medical information systems, supporting port scanning, vulnerability detection, medical system identification, and compliance report generation.

An MCP server for identifying SQL injection vulnerabilities in web applications using various techniques like error-based, time-based, and union-based scanning. It supports bulk URL processing, WAF bypass strategies, and authenticated testing across multiple database systems.

Connects AI assistants to AttackForge's Self-Service API with full endpoint coverage, response size optimization, and local caching for efficient use in long conversations.

Enables deterministic security testing of AI agents that use tools by serving synthetic MCP environments with poisoned data, fake secrets, and privileged actions. Records agent tool calls and evaluates security invariants (e.g., canary leaks, forbidden access, approval binding) without an LLM judge or real systems.

A deliberately vulnerable MCP server for practicing exploitation of tool poisoning, command injection, and path traversal. Includes fixed versions and an agent demo to reproduce the issues in a controlled environment.

Exposes every operation in the ConnectSecure OpenAPI specification as an MCP tool, enabling vulnerability management, assets, assessments, integrations, and reporting.

Enables scanning a single-file Solidity contract before deployment by running Slither, Aderyn, and rug-pull/centralization heuristics in a sandboxed environment, then returning a Deployable / Fix first / Do not deploy verdict with plain-language explanations. Exposes one tool, scan_contract, with a per-caller daily limit.

Enables running Kali Linux security tools and commands in a containerized environment for semi-automated penetration testing, with background job management and out-of-band interaction detection.

Provides a set of MCP tools to clone and analyze arbitrary MCP server repositories, run static and dynamic security probes in isolated Docker containers, and produce vulnerability verdicts with a human-in-the-loop approval step before filing public reports.

Enables a language model to inspect proxy history, run scoped scans and intruder jobs, and drive a proxied browser through Burp Suite for authorized security testing on test and staging environments. Scope, environment, mode, rate limits, refusals and secret redaction are enforced in gateway code with a tamper-evident audit log.

An MCP server that acts as a boundary agent, giving LLMs and automation systems controlled SSH-based access to remote machines for tasks like administration, diagnostics, and security research.

Enables auditing npm, Yarn, and pnpm lockfiles in local project directories or remote Git repositories to surface dependency vulnerabilities. Exposes a tool that supports severity thresholds, registry overrides, optional dev-dependency skipping, and text or JSON reports.

Automatically generates pocsuite3-compliant POC (Proof of Concept) code from vulnerability information, with built-in safety features to prevent harmful payloads and ensure secure security testing.

MCP servers exposing security operations tools (VirusTotal, MITRE Caldera, LimaCharlie) to AI agents with defense-in-depth safety controls.

Enables auditing npm, Yarn, and pnpm lockfiles in local project directories or remote Git repositories for vulnerabilities, with configurable thresholds, registry, dev-dependency skipping, retries, and text or JSON report output.

Enables auditing npm, Yarn, and pnpm lockfiles from local project directories or remote Git repositories through an MCP tool, returning vulnerability results in text or JSON with configurable thresholds and dev dependency skipping.