"SWC" matching MCP servers:

Enables passive security scanning of HAR files from QA test automation to detect missing security headers, insecure cookies, CORS misconfigurations, and leaked secrets, without making any live requests.

Enables AI-driven SOC investigations by providing automated Splunk querying, threat intelligence enrichment, and response actions through natural language. Includes tools for IP pivoting, lateral movement detection, and label harvesting.

Unified SIEM MCP gateway for AI-driven SOC operations and threat hunting across Azure Sentinel, Splunk, Wazuh, IBM QRadar, and Securonix.

Enables AI agents to interact with Splunk SIEM and TheHive SOAR through a unified MCP interface, providing 12 tools for alert triage, case management, and security operations.

Enables deterministic auditing of agent skills, system prompts, and downloaded file collections against eight malicious-skill supply-chain patterns, returning line-numbered findings and pass/flag verdicts without using an LLM or network calls.

Automated SOC orchestration server integrating Wazuh, TheHive, Cortex, and MISP for AI-driven incident response and SOAR playbooks.

A Cloudflare Workers MCP server that puts a SOC analyst's enrichment, investigation, and detection-context workflow behind a single endpoint. It aggregates over 20 threat-intel sources into 18 MCP tools for IP, domain, URL, hash, and CVE lookups.

Enables LLMs and AI agents to perform defensive security posture assessments, privilege escalation surface audits, and post-quantum cryptography readiness checks through read-only diagnostic tools.

Self-hostable MCP server for WhisperGraph — a graph of 7.39B nodes / 39B edges mapping DNS, BGP, GeoIP, WHOIS, and threat intelligence. Six read-only tools (Cypher query + schema introspection + threat assessment), six resources, eight investigation prompts. stdio and Streamable HTTP transports.

Enables AI assistants to perform password security auditing using John the Ripper on a remote Kali system via SSH, supporting cracking, hash management, and session control.

A Model Context Protocol (MCP) server for Kerberos abuse operations using Rubeus on Windows or Impacket on Linux/macOS.

An MCP server that provides AI assistants with access to CrackMapExec/NetExec network penetration testing capabilities via SSH to a Kali Linux host, supporting multiple protocols for enumeration, credential dumping, and command execution.

Provides programmatic access to Mimikatz for credential extraction, Kerberos attacks, SAM/LSA dumping, and other Windows security assessment tasks through natural language.

MCP server for Technical SEO DNS record auditing, SOA expiry health checks, SSL/TLS inspection, and HTTP security header analysis. Enables comprehensive security audits and scoring via 10 tools.

Provides a zero-install security baseline for AI coding agents, with tools to retrieve curated security rules and check actions against them for self-correction.

Exposes Lacework API v2 alert operations as MCP tools, allowing AI agents to list, search, and manage alerts with flexible time ranges and authentication.

Provides agent certification and trust verification tools for AI agents, enabling certification checks, trust score calculations, audit ticket issuance, and emergency kill switch activation through the A-SOC trust network.

MCP server for searching NIST's National Vulnerability Database, enabling retrieval of recent CVEs, keyword/CPE/CWE searches, and detailed CVE information.

Enables Windows-native malware analysis and reverse engineering inside Flare-VM by exposing 50 tools for static and dynamic analysis, memory injection scanning, debugging, network simulation, and automated triage playbooks without requiring a Kali Linux host, WinRM, or SMB shares.

An AI-powered security operations platform that integrates with SIEM, EDR, and case management systems via MCP to automate incident response and investigation workflows. It provides specialized tools for alert triage, threat intelligence enrichment, and endpoint remediation across vendor-neutral APIs.