"Using code execution to replace native tooling" matching MCP servers:

An AI-native code security audit MCP server that supports multi-language AST analysis, call graph analysis, vulnerability detection, and AI deep audit.

Enables automated security code auditing using LLM and MCP, including AST parsing, taint analysis, dataflow tracing, and automated PoC generation for multi-language codebases.

Multi-language SAST and AI-powered fuzzing MCP server for Claude Code integration, enabling static and dynamic security analysis of code.

Enables security testing of MCP guardrails and SAST scanners by exposing intentionally vulnerable code patterns that are inert by default and make no network calls.

MCP server that guides LLM security reviews step-by-step, tracking progress and ensuring all assigned source code is read before completing each plan step.

Enables coding agents and CI/CD pipelines to audit untrusted code by detecting Python sandbox escapes, SQL injection taint, ReDoS regex vulnerabilities, and CORS misconfigurations, while generating Seccomp BPF filters for safer execution.

Enables MCP-compatible agents to audit an entire repository through one question, detecting stacks and running parallel checks for dead code, dependencies, security, CVEs, complexity, and lint across Laravel/PHP, Python, TypeScript/React, and Flutter/Dart. It returns normalized, severity-sorted findings with false positives flagged and secret values kept out of the output.

Provides 28 MCP tools across 16 analysis engines for comprehensive Python code quality assessment, including complexity scoring, security scanning, dead code detection, dependency auditing, and test quality analysis.

Enables AI-powered automated testing, security scanning, code review, and maintenance tasks directly within Claude Code or desktop.

Enables AI coding assistants to run static analysis on GitHub repositories, raw code snippets, or local directories to detect cloud cost leaks in Terraform/AWS configs, PostgreSQL migration table-lock hazards, and OWASP/Next.js API security gaps. Each finding returns structured severity, line-level detail, and drop-in fixes.

Enables AI coding agents to audit websites for PHP runtime vulnerabilities, compile a live Zero-PHP Next.js App Router replacement preview from a WordPress/PHP site, and retrieve remediation guidance.

Code review as an MCP server — structured code quality reviews with OWASP security scanning.

Wraps Kali Linux penetration testing tools for authorized security assessments, driven by a local LLM via LM Studio.

An MCP server that provides passive and low-impact active reconnaissance tools for authorized bug bounty and security assessments, enabling LLMs to perform structured recon and generate reports.

Enables MCP clients to run security and code review on pull requests and diffs, exposing review_pr and review_diff capabilities with local-first analyzers and LLM explanations.

Autonomous penetration testing powered by a local LLM, automating tool chaining for recon, vulnerability scanning, exploit research, and reporting.

Enables scanning of Claude Code skills, plugins, or MCP servers for malware before installation via static analysis.

Provides access to Atomic Red Team tests, enabling search, validation, and execution of atomic tests via natural language.

MCP server that provides AI-native access to BeVigil's OSINT API, enabling mobile app security research and asset discovery through tools for hosts, subdomains, S3 buckets, URLs, wordlists, and multi-step investigations.

Agent-native "safe to ship?" security gate for AI-generated code. Uses real parsers and inter-rocedural taint analysis (JS/TS, Python, Go) to flag the classes AI coding agents get wrong — secrets, SQL injection, SS, SSRF, path traversal, command injection, weak JWT/CORS — and ranks findings by confidence. Exposes a scan tool over MCP.