"Using Google Scholar for Conducting Deep and Critical Literature Reviews" matching MCP servers:

Multi-language SAST and AI-powered fuzzing MCP server for Claude Code integration, enabling static and dynamic security analysis of code.

Enables Claude Code to leverage OpenAI models for expert code review, deep architecture analysis, and security audits, with automatic markdown report generation.

Two-way Burp Suite MCP bridge enabling AI agents to capture traffic, analyze endpoints, queue scans, and send findings back to Burp.

An MCP server providing AI-powered cybersecurity, penetration testing, reconnaissance, vulnerability assessment, and security automation tools through the Model Context Protocol.

GDB Enhanced Features MCP server for remote debugging and CTF exploitation with 41 specialized tools including ROP search, format-string detection, and memory patching.

Provides deterministic, 100%-file-coverage security findings by running Semgrep, gitleaks, and osv-scanner on code repositories, enabling thorough security assessment of every file.

Enables LLMs to perform automated penetration testing and Active Directory reconnaissance through Mythic, with tools for executing PowerShell, AD recon, domain user enumeration, and Kerberoasting.

Enables users to run synthetic support-agent evaluations, preserve and inspect traces, score results deterministically, inject failures, and enforce release review gates through MCP tools, resources, and prompts.

Enables agents to inspect web pages for Cloudflare Turnstile challenges without an API key, and clear Turnstile or WAF challenges using a SolveGate API key.

Connects MCP clients to pre-submission review that argues against a draft bug-bounty report or smart-contract finding the way a triager would, tying every claim to a supplied file and line and returning a submit, rewrite-then-submit, prove-first, hold-duplicate or drop verdict. Exposes tools to list review profiles, prepare reviews for the agent's own model, build hash-verified review packets, and — with a connection token — run hosted profiles on your own provider key.

Self-hosted MCP engine for private code reviews, providing deterministic static analysis and AST-level search over diffs, with findings passed to a review agent of your choice.

MCP server that guides LLM security reviews step-by-step, tracking progress and ensuring all assigned source code is read before completing each plan step.

Provides passive OSINT reconnaissance for domains and IPs using public sources, with tools for WHOIS/RDAP, DNS, subdomain enumeration, Wayback Machine, HTTP headers, Shodan InternetDB, email security, TLS certificates, and ASN lookups, all without requiring API keys.

MCP server for Android APK triage, providing tools to parse APK headers, list DEX classes, and decode AndroidManifest.xml using apktool or androguard backends.

Automates Android app analysis using Frida via AI commands, connecting a rooted Android phone to a computer and running dynamic analysis scripts without manual command execution.

A local MCP server that scans repository dependencies for known vulnerabilities (CVEs) using OSV.dev, enriches findings with NVD and CISA KEV data, and supports triage, remediation, and accepted risk management directly from an AI coding assistant.

Enables AI assistants and agents to search bug bounty programs, retrieve policies and scopes, and check targets against active scope across HackerOne, YesWeHack, and Intigriti using personal API credentials.

Scans MCP servers for prompt-injection, tool-poisoning, and SSRF vulnerabilities using 30+ canonical rules across 5 severity tiers, with optional signed safety reports for procurement.

Enables an LLM to author, validate, and test Wirefilter WAF and Smart Firewall rules using live schema and real CVE exploit templates.

Enables AI agents to perform passive reconnaissance, vulnerability intelligence, DNS analysis, and device search using Shodan's database of internet-connected devices, all from within your IDE.

Enables comprehensive vulnerability scanning using Nuclei scanner with support for single targets, network ranges, and cluster-wide security assessments with customizable severity levels and automated scheduling.

Enables security analysis of code and infrastructure files via MCP, using Symbiotic CLI for scanning vulnerabilities.

Enables MCP-native multi-agent security audits for Google Antigravity, orchestrating subagents for 0day research, static analysis, PoC verification, exploit chaining, reporting, and code remediation.

Enables AI assistants to perform Active Directory reconnaissance by enumerating users, groups, computers, trusts, and password policies using ldapdomaindump on a remote Kali host via SSH.

Enables AI assistants to perform domain reconnaissance using theHarvester OSINT tool, including email harvesting, subdomain discovery, DNS brute force, and Shodan integration, via SSH on a Kali Linux host.

AI-powered penetration testing reasoning engine (MCP server) for attack path planning, step scoring, and tool recommendations using Beam Search and Monte Carlo Tree Search.

Enables AI assistants to perform web content discovery scans using feroxbuster on a remote system via SSH, with support for recursive scanning, filtering, and background execution.

Enables AI coding assistants to run pre-publish security and code-quality scans across 17 categories, generate a 0–100 security score and Markdown report, quickly check critical vulnerabilities, and receive fix/refactor suggestions by finding ID.

An MCP server for identifying SQL injection vulnerabilities in web applications using various techniques like error-based, time-based, and union-based scanning. It supports bulk URL processing, WAF bypass strategies, and authenticated testing across multiple database systems.

Enables AI agents and developers to audit any URL or domain for seven critical OWASP HTTP security headers, returning an A+ to F grade plus actionable Nginx, Apache, Caddy, and Cloudflare remediation snippets. It also probes /.well-known/security.txt and /security.txt to surface responsible vulnerability disclosure contacts, bug bounty scopes, and PGP keys.