"An overview of penetration testing (pentest)" matching MCP servers:

Provides access to over 40 industry-standard penetration testing tools, including Nmap, SQLMap, and Metasploit, within an isolated Kali Linux Docker container. It enables security professionals to perform comprehensive network reconnaissance, web application testing, and vulnerability research through natural language commands.

An automated penetration testing framework that enables intelligent security assessments through reconnaissance, vulnerability scanning, and controlled exploitation. Features AI-driven workflow management with comprehensive reporting for authorized security testing.

AI-powered security scanning MCP server that exposes 25+ professional tools, enabling penetration testing and security assessments through natural language interaction with AI agents like Claude Desktop.

A Model Context Protocol server that integrates essential penetration testing tools (Nmap, Gobuster, Nikto, John the Ripper) into a unified natural language interface, allowing security professionals to execute and chain multiple tools through conversational commands.

Enables professional penetration testers to run authorized reconnaissance, web/content scanning, brute-force checks, traffic capture, extraction sweeps, and reporting workflows through MCP-compatible transports. It supports engagement record management and client report generation with bearer-token/OIDC authentication.

Enables authorized penetration-testing workflows through MCP by exposing tools for network scanning, web fuzzing, subdomain enumeration, vulnerability scanning, brute-force checks, packet capture, and report generation with HTTP/STDIO/SSE transports and bearer/OIDC authentication.

Enables authorized penetration testers to run reconnaissance, scanning, brute-force, exploitation, traffic capture, wordlist generation, and client-report workflows through MCP clients, with stdio/HTTP/SSE transport and OIDC bearer authentication.

Enables professional penetration testers to run reconnaissance, exploitation, brute-force, and credential-cracking tooling (nmap, gobuster, nikto, John the Ripper, hashcat, subfinder, httpx, ffuf, nuclei, hydra, sqlmap, tcpdump) through MCP clients over stdio or HTTP. It also captures engagement records and generates client reports with scope-of-work handling and bearer/OIDC authentication.

Enables professional penetration testers to run reconnaissance, network and web scanning, content fuzzing, vulnerability templates, brute-force checks, SQLi extraction, traffic capture, and engagement report generation through MCP clients.

Enables professional penetration testers to orchestrate reconnaissance, web scanning, brute-force testing, exploitation, traffic capture, hash cracking, wordlist building, privilege escalation audits, and client report generation via STDIO/HTTP/SSE transports with optional bearer/OIDC authentication.

Enables professional penetration testers to run reconnaissance, vulnerability scanning, brute-force checks, traffic capture, exploitation support, and report generation through a unified tool interface. Supports local and networked transports with bearer/OIDC authentication.

Enables professional penetration testers to run reconnaissance and exploitation tooling—nmap, gobuster, nikto, John the Ripper, hashcat, subfinder, httpx, ffuf, nuclei, hydra, and SQLi extraction sweeps—alongside wordlist generation, engagement-record capture, and client report creation. Supports stdio, Streamable HTTP, and legacy SSE transports with bearer-token/OIDC authentication.

Enables professional penetration testers to orchestrate reconnaissance, scanning, brute-force checks, traffic capture, privilege-escalation auditing, and reporting workflows through MCP transports. It integrates tools including nmap, GoBuster, Nikto, John the Ripper, Hashcat, ffuf, Nuclei, Hydra, and sqlmap.

This server enables professional penetration testers to orchestrate reconnaissance, scanning, brute-force, traffic-capture, and reporting workflows over STDIO, HTTP, or SSE using integrated tools such as nmap, gobuster, nikto, John the Ripper, hashcat, and wordlist generation.

Enables professional penetration testers to drive recon and exploitation tooling — nmap, gobuster, nikto, John the Ripper, hashcat, subfinder, httpx, ffuf, nuclei, hydra, sqlmap, and tcpdump — plus wordlist building and traffic capture from an MCP client. It also stores structured engagement records and generates client reports with scope-of-work handling, over stdio or authenticated Streamable HTTP (SSE deprecated).

Enables professional penetration testers to run authorized reconnaissance, scanning, exploitation, and reporting workflows through MCP tools such as nmap, ffuf, nuclei, hashcat, and report generation, with STDIO/HTTP/SSE transport and bearer/OIDC auth support.

Enables authorized penetration testers to run reconnaissance, scanning, brute-force, traffic-capture, and exploitation tools through MCP clients, with authentication, engagement recordkeeping, and client report generation.

Enables professional penetration-testing workflows through MCP, including reconnaissance, web/content scanning, brute-force checks, traffic capture, exploitation sweeps, wordlist generation, and engagement reporting over stdio, Streamable HTTP, and legacy SSE.

A security testing tool that enables automated vulnerability detection including XSS and SQL injection, along with comprehensive browser interaction capabilities for web application penetration testing.

Enables MCP-capable AI agents to run authorization-gated reconnaissance, vulnerability scanning, web application testing, exploitation, CTF tasks, reporting, and integrations with tools such as Burp, ZAP, and DefectDojo.

Enables authorized security assessments by exposing tools for host discovery, web probing and fuzzing, template scanning, brute-force checks, traffic capture, and engagement reporting through configurable transports.

Offline methodology engine and payload workshop for authorized penetration testing, CTF, security research, and education via MCP.

Enables authorized penetration testing and security assessments with CVE monitoring, vulnerability scanning, and reporting features.

An MCP server that integrates various penetration testing tools, enabling security professionals to perform reconnaissance, vulnerability scanning, and API testing through natural language commands in compatible LLM clients like Claude Desktop.

Supply chain risk scoring for npm, PyPI, and GitHub repos

Enables agents to prove and verify that a real, unique human performed an action, issuing machine-readable signed credentials with public verification.

An AI-powered penetration testing server that integrates over 30 security tools with Groq LLM analysis for automated vulnerability scanning, triage, and reporting. It enables users to perform comprehensive security assessments through natural language natively within Claude Desktop.

AI-powered autonomous penetration testing framework with 80+ professional security tools across reconnaissance, web application testing, exploitation, and forensics. Integrates with LM Studio for intelligent vulnerability assessment and automated security testing workflows.

Provides penetration testing tools including nmap, nikto, sqlmap, wpscan, and exploit database searches for educational and authorized security testing purposes using Kali Linux tools.

Enables controlled, evidence-first web application penetration testing and bug bounty workflows, including scope enforcement, reconnaissance, human-approved surface triage, OWASP WSTG test execution, and SHA-256 evidence capture.