"A framework for web penetration testing" matching MCP servers:

Provides access to over 40 industry-standard penetration testing tools, including Nmap, SQLMap, and Metasploit, within an isolated Kali Linux Docker container. It enables security professionals to perform comprehensive network reconnaissance, web application testing, and vulnerability research through natural language commands.

MCP server enabling Claude Code to capture screenshots of Windows applications through WSL2, allowing AI to diagnose UI errors and verify layouts.

A framework for building MCP servers with built-in enterprise capabilities such as authentication, authorization, telemetry, audit logging, and data classification, allowing domain developers to focus on business logic while maintaining governance and compliance.

A minimal MCP server framework for single-owner production deployments using OAuth authorization code flow with PKCE, providing endpoints for MCP, authorization, token, and metadata.

Unified MCP server integrating NIST and OWASP security frameworks with live vulnerability data, enabling security searches, compliance mapping, threat modeling, and checklist generation.

Enables AI agents to request an independent second opinion from a different frontier model, with PII scrubbing before transit, live web search grounding, caching, and multi-provider failover.

This MCP server provides secure access to databases for AI agents, enforcing authentication, authorization, human approval, logging, and notifications to prevent dangerous actions.

An MCP server that lets an AI agent probe a live URL and confirm whether sensitive files (e.g., .git, .env, source maps) are genuinely served by fetching and validating the content, avoiding false positives.

Provides AI assistants with specialized tools to interact with NIST's Open Security Controls Assessment Language (OSCAL) framework. It enables agents to retrieve schemas, explore models, and generate valid OSCAL documentation for security compliance automation.

Enables live website health checks including TLS, HTTPS, and security headers, returning an A-F grade with specific fixes.

A Node.js-based frontend security audit tool that performs comprehensive dependency security audits for both local projects and remote repositories. Generates detailed Markdown reports with vulnerability detection, risk assessment, and fix recommendations.

Enables AI agents to audit URLs for security headers, generate CSP Level 3 policies, compute SRI hashes, evaluate WCAG 2.2 contrast, and remediate headers.

Provides penetration testing tools including nmap, nikto, sqlmap, wpscan, and exploit database searches for educational and authorized security testing purposes using Kali Linux tools.

Two-way Burp Suite MCP bridge enabling AI agents to capture traffic, analyze endpoints, queue scans, and send findings back to Burp.

Enables creation of secure-by-default MCP servers with 5-layer validation to protect against injection, path traversal, and other attack vectors.

A client-side MCP proxy that injects OAuth 2.0 bearer tokens or API keys into MCP requests, enabling MCP clients to connect to OAuth/API-key-protected MCP servers like Amazon Bedrock AgentCore Gateway. It automatically fetches and refreshes credentials using AgentCore Identity or static values.

Enables AI agents to conduct authorized penetration tests by providing scope-enforced access to Metasploit Framework's RPC, with tools for reconnaissance, exploitation, session management, and post-exploitation.

Turn Claude into an ISO 27001 compliance assistant - controls, risk register, policies, evidence tracking, SoA generation, and full audit workflows in one local encrypted MCP server.

Enables AI agents to read any web page as clean Markdown and inspect its metadata, structure and technology stack, plus check redirects, TLS certificates, security headers, robots.txt, sitemaps, feeds, domains, SEO, broken links, email authentication (SPF/DMARC/DKIM) and SSO (SAML/OIDC). It also provides developer utilities such as cron, regex, color, Unicode and time-zone tools along with Hyperliquid perpetuals market data, all hosted remotely on Apify with pay-per-call pricing.

MCP server with intentionally malicious capabilities for testing Cisco AI Defense supply chain scanning.