"Free servers available for testing purposes" matching MCP servers:

Scans code for exposed secrets, API keys, tokens, and credentials across 69 patterns covering cloud services, AI platforms, payment providers, authentication services, and databases.

Provides penetration testing tools including nmap, nikto, sqlmap, wpscan, and exploit database searches for educational and authorized security testing purposes using Kali Linux tools.

Two-way Burp Suite MCP bridge enabling AI agents to capture traffic, analyze endpoints, queue scans, and send findings back to Burp.

Provides AI assistants with specialized tools to interact with NIST's Open Security Controls Assessment Language (OSCAL) framework. It enables agents to retrieve schemas, explore models, and generate valid OSCAL documentation for security compliance automation.

Turn Claude into an ISO 27001 compliance assistant - controls, risk register, policies, evidence tracking, SoA generation, and full audit workflows in one local encrypted MCP server.

Provides access to over 40 industry-standard penetration testing tools, including Nmap, SQLMap, and Metasploit, within an isolated Kali Linux Docker container. It enables security professionals to perform comprehensive network reconnaissance, web application testing, and vulnerability research through natural language commands.

MCP server with intentionally malicious capabilities for testing Cisco AI Defense supply chain scanning.

Enables AI agents to analyze images from a URL, local path, or Base64 string and determine whether they are AI-generated, including detection of signatures from Flux, Midjourney, DALL·E, and Stable Diffusion. Also inspects cryptographic C2PA provenance manifests, signing certificate authorities, and camera EXIF metadata without requiring API keys or accounts.

Manage a fleet of OPNsense firewalls from an AI agent, inside guardrails it can't drive around. MCP server for central management of OPNsense firewall fleets. 129 tools across devices, config sync, tasks, schedules, templates, backups and remote consoles - destructive actions confirmation-gated, MCP-issued tokens lifetime-bounded, backup and storage secrets excluded from the toolset entirely.

A client-side MCP proxy that injects OAuth 2.0 bearer tokens or API keys into MCP requests, enabling MCP clients to connect to OAuth/API-key-protected MCP servers like Amazon Bedrock AgentCore Gateway. It automatically fetches and refreshes credentials using AgentCore Identity or static values.

Enables AI agents to conduct authorized penetration tests by providing scope-enforced access to Metasploit Framework's RPC, with tools for reconnaissance, exploitation, session management, and post-exploitation.

Enables secure one-time encrypted file and note sharing by encrypting data locally before upload and providing tools for sending, listing, checking, and revoking links.

Enables AI agents to score their outgoing responses against groundedness and prompt-injection risks mid-turn, returning allow, warn, or block verdicts before the response reaches the user.

A safety layer and monitoring copilot for AI agents using Splunk MCP, recording tool calls, enforcing policies, and blocking risky actions.

A remote MCP server that links World ID 4.0 sessions to AI assistants, enabling verified human authentication and tools for claiming Founding Human places, accessing human grants, and interacting with a verified human wall.

Read selected local folders from ChatGPT on macOS, with per-folder read-only or read-write access and hash-checked, recoverable edits. Requires local installation and a private ChatGPT app. The Glama container is a synthetic evaluation demo; it does not connect to files on your Mac.

A reference MCP server that enforces identity-aware tool access using role-based permissions (Reader, Analyst, Auditor) and supports multiple identity routes like Entra RBAC, Copilot Studio, and Okta XAA. It provides read-only access to test evidence with explicit denial paths for unauthorized tools.

Open end-to-end encrypted messaging protocol and MCP server (a4a-mcp) that gives AI agents a cryptographic address (apub1...) to exchange messages, tasks, and signed agreements directly across NAT without port forwarding.

Enables AI-driven SOC investigations by providing automated Splunk querying, threat intelligence enrichment, and response actions through natural language. Includes tools for IP pivoting, lateral movement detection, and label harvesting.

Enables checking npm packages for known security vulnerabilities using the OSV API before installation. Supports both single package checks and bulk vulnerability scanning for multiple packages at once.

Enables LLMs to perform automated penetration testing and Active Directory reconnaissance through Mythic, with tools for executing PowerShell, AD recon, domain user enumeration, and Kerberoasting.

Implements a secure MCP server with API Key and JWT authentication, providing tools like echo, login, secure_action, and admin_action. Includes MCP Inspector integration for testing and debugging.

A generic local MCP plugin base for ChatGPT that ships example status and echo tools, a guided setup wizard for tunnel configuration with DPAPI-protected API keys, and separated persistent versus generated runtime storage. It also provides a bounded metadata-only conditional-read cache that suppresses unchanged read-only responses to save context.

Enables AI agents to query Microsoft Entra data using natural language, converting requests into Microsoft Graph API calls for read-only enterprise IT scenarios.

Enables AI assistants to search Webamon threat intelligence databases, submit URLs for scanning, retrieve scan reports, and browse phishing campaigns and infrastructure clusters using Lucene-powered queries.

A standalone Python/FastAPI server that implements the Model Context Protocol (MCP) for the OPTIX threat intelligence platform. It exposes 26 analyst-friendly tools that AI assistants and programmatic consumers can use to query threat feeds, search documents and indicators, manage watchlists, triage IOCs, generate detection rules, trigger AI research, and produce intelligence reports.

A policy layer between ChatGPT and the official Codex MCP server, adding safety controls like read-only sessions, approval policies, and secret scanning for secure daily use.

Enables agents to use secrets without exposing them, by injecting values into commands and redacting them from all outputs and transcripts.

Manage authentik users and groups via API, including creation, group membership, password reset, and quick provisioning with random passwords.

Enables a sandboxed Claude Code session to see editor selections, review proposed edits as VS Code diffs, and read workspace diagnostics through an MCP-over-WebSocket IDE bridge.