"Using mcp-proxy to bridge a remote SSE server to a stdio server" matching MCP servers:

Enables AI coding agents to audit websites for PHP runtime vulnerabilities, compile a live Zero-PHP Next.js App Router replacement preview from a WordPress/PHP site, and retrieve remediation guidance.

Gives AI agents a browser that bypasses bot detection, a MITM proxy for traffic interception, and a Python sandbox to autonomously write and execute security exploits.

Manages an authorized proxy pool for security testing, providing MCP tools to select the best available proxy, report status, switch proxies, view pool health, and register nodes, backed by health checks and audit logging.

A lightweight MCP server that wraps OWASP ZAP's REST API as Model Context Protocol tools, enabling AI agents to perform automated security scanning.

A cross-chain bridge security auditing toolkit that exposes tools for analyzing, fuzzing, and simulating bridge contracts via natural language, enabling users to detect vulnerabilities like centralization risks and replay attacks.

MCP server that bridges opencode into Firefox, enabling page reading, JavaScript execution, and security auditing directly from the terminal.

Simulates sensitive internal tools as a honeypot to detect unauthorized access and AI agent behaviors using Canarytokens, deployed as a serverless Cloudflare Worker with MCP protocol support.

Enables auditing and monitoring of AI agent MCP tool calls, with behavioral anomaly detection, lab-scoped red-team simulation, and Telegram notifications.

Enables MCP clients to inspect and automate a running binary-analysis session, with tools for program, memory, function, and listing operations.

Wraps Kali Linux penetration testing tools for authorized security assessments, driven by a local LLM via LM Studio.

Enables AI assistants to autonomously inspect and control IDA Pro via MCP, providing tools for decompilation, disassembly, cross-references, renaming, typing, patching, searching, debugging, and arbitrary IDAPython execution.

Provides a security proxy that sits between MCP clients and servers to inspect and filter traffic. Guards MCP sessions against leaked secrets, vulnerable dependencies, misconfigured DNS/TLS, and non-compliant data exposure.

A PyGhidra-based MCP server that exposes Ghidra's reverse engineering capabilities to AI agents, enabling binary analysis via tools like overview, search, view, list, edit, script execution, and version control.

Enables secure execution of penetration testing commands on Kali Linux through Server-Sent Events with intelligent command validation, real-time monitoring, and comprehensive audit logging. Designed for authorized security research and penetration testing workflows.

Enables auditing cross-chain bridge token reserve invariants and monitoring outflow spikes for LayerZero and Wormhole bridges, helping detect reserve anomalies and potential vulnerabilities.

Enables out-of-band interaction testing by integrating ProjectDiscovery's interactsh service as an MCP server. Allows AI agents to create callback domains, send probes, and capture DNS/HTTP interactions for security testing and verification workflows.

MCP server that runs offensive security testing tools (nmap, sqlmap, hydra, nuclei, etc.) inside an isolated Kali Linux Docker container, with allowlist, rate limiting, and audit logging.

Enables coding agents to run security scans on repositories through a local stdio bridge to a hosted endpoint. Includes browser-based OAuth sign-in and local token storage.

Enables agents to inspect web pages for Cloudflare Turnstile challenges without an API key, and clear Turnstile or WAF challenges using a SolveGate API key.

Enables AI agents to access VirusTotal intelligence through MCP, supporting file, URL, domain, and IP lookups, plus analysis, via remote HTTP or local stdio.

MCP security firewall (stdio): vet advertised tool definitions through static-scan → threat-feed → origin → pinning before they reach the model. Zero npm runtime deps. No secrets.

SkillTotal is a local stdio MCP server that lets an agent check a component before installing it. It statically analyzes MCP servers, agent skills, npm/PyPI packages and repos for supply-chain risks, dangerous capabilities (shell, filesystem, network, credentials), prompt-injection surfaces like tool poisoning, and exfiltration paths. Each finding cites file, line and snippet.

Agent-native "safe to ship?" security gate for AI-generated code. Uses real parsers and inter-rocedural taint analysis (JS/TS, Python, Go) to flag the classes AI coding agents get wrong — secrets, SQL injection, SS, SSRF, path traversal, command injection, weak JWT/CORS — and ranks findings by confidence. Exposes a scan tool over MCP.

Connects MCP clients to pre-submission review that argues against a draft bug-bounty report or smart-contract finding the way a triager would, tying every claim to a supplied file and line and returning a submit, rewrite-then-submit, prove-first, hold-duplicate or drop verdict. Exposes tools to list review profiles, prepare reviews for the agent's own model, build hash-verified review packets, and — with a connection token — run hosted profiles on your own provider key.

Self-hosted MCP engine for private code reviews, providing deterministic static analysis and AST-level search over diffs, with findings passed to a review agent of your choice.

Provides a generic HTTP client tool allowing AI agents to make arbitrary HTTP requests from their environment, with support for environment-variable placeholders for secrets.

Enables AI coding agents to search a security corpus, scan Terraform plan JSON for cited findings, and list sources via MCP tools grounded in CIS AWS Foundations and OWASP Top 10 CI/CD risks.

Agent-PLC MCP Server: auto-detect, probe, read, write and diagnose Modbus TCP / FINS / MELSEC / Siemens S7comm PLCs, with transparent proxy and fault-injection listener.

A production-ready MCP server that wraps Nmap to enable AI agents to perform automated network security assessments, including port scanning, host discovery, service detection, OS fingerprinting, and vulnerability scanning.

Enables AI agents to run read-only static reverse-engineering tasks — binary triage, symbol and import inventory, per-function decompilation, and Android native-lib analysis — with untrusted samples confined to a no-network bubblewrap chamber that never executes the target.