"Website penetration testing and security vulnerability assessment tools" matching MCP servers:

Provides Claude with live access to multiple vulnerability databases (NVD, OSV, GitHub Advisories, Snyk) for querying CVEs, package vulnerabilities, and remediation guidance.

Provides access to over 40 industry-standard penetration testing tools, including Nmap, SQLMap, and Metasploit, within an isolated Kali Linux Docker container. It enables security professionals to perform comprehensive network reconnaissance, web application testing, and vulnerability research through natural language commands.

Provides security tools (prompt injection detection, CVE lookup, version impact assessment) for MCP clients like Claude.

Provides penetration testing tools including nmap, nikto, sqlmap, wpscan, and exploit database searches for educational and authorized security testing purposes using Kali Linux tools.

Professional vulnerability report generator that creates standardized, well-formatted security reports with AI-generated content, supporting CVSS scoring, evidence management, and markdown export.

Enables scanning IP addresses for vulnerabilities using Nmap and API-based checks, supporting both single and batch scans with detailed reports.

Integrates 193 Kali Linux security tools with AI for intelligent penetration testing, CTF solving, and vulnerability assessment through automated workflows and expert knowledge base.

An MCP server that wraps Trivy and Gitleaks to provide file system vulnerability and secret scanning as tools for AI agents, enabling local, free security analysis.

An MCP server that integrates multiple security and reconnaissance tools (Nmap, Cariddi, ParamSpider, Metasploit, web scraping) for AI systems, enabling automated network scanning, API discovery, vulnerability testing, and remote access via ngrok.

Provides a 'scan_website' tool to analyze target websites for security vulnerabilities by consuming the Website Security Auditor REST API.

Enables ethical security testing and attack surface management through SSL certificate validation, CVE queries, subdomain enumeration, security header analysis, and comprehensive reconnaissance capabilities. Designed for authorized penetration testing workflows with responsible disclosure practices.

14 atomic MCP tools for AppSec and AI Security engineers: source/schema/prompt audit primitives, JWT inspect, HTTP diff, pentest atoms (default creds, GraphQL introspect, phpggc, interactsh OOB), and a defensive helpers library that fixes the bugs the detectors flag. SARIF output, PyPI Trusted Publishing with Sigstore provenance.

Provides security audit primitives for MCP servers, agent tool schemas, and system prompts, along with pentest utilities like JWT inspection and HTTP diffing.

Security scanning, prompt injection detection, secret leak detection, and agent permission auditing for AI agent workflows.

Security scanning for MCP servers from the inside out. Provides runtime inspection, AST-based static analysis, config audit, dependency analysis, and OWASP MCP Top 10 compliance in a single MCP server.

An MCP server that enables AI assistants to analyze Android APK and iOS IPA files for security issues through natural language conversation, including permission auditing, secret detection, and SDK enumeration.

Enables comprehensive vulnerability scanning using Nuclei scanner with support for single targets, network ranges, and cluster-wide security assessments with customizable severity levels and automated scheduling.

Unified MCP server integrating NIST and OWASP security frameworks with live vulnerability data, enabling security searches, compliance mapping, threat modeling, and checklist generation.

Comprehensive DNS security toolkit for AI agents: 103 tools across 13 categories including DNSSEC validation, subdomain takeover detection, email security audit, and more, all running locally with no external API calls required.

MCP server for Appwrite security audits that scans permissions and provides structured fix proposals, with active live leak confirmation via anonymous fetch.