"sage active" matching MCP servers:

An MCP server that enables AI agents to securely add secrets to .env files by prompting the user to input the value through a local masked dialog, ensuring the agent never sees the secret.

Analyzes a wallet's active ERC-20 token approvals and provides prioritized risk assessment along with revoke calldata.

Provides real-time threat intelligence including IP risk scores, CVE lookups, and malware hash analysis without requiring an API key. It enables users to monitor active threats, predict CISA KEV additions, and detect pre-attack infrastructure staging through natural language.

Lets an AI agent read and change on-premises Active Directory by writing short JavaScript scripts that run in a network-isolated sandbox against a chosen domain. Runs on Windows as the logged-on user, over Kerberos, with tools for executing scripts, searching the domain's schema catalogue, querying Microsoft Learn docs, and managing domain connections and Group Policy objects.

Connects LLMs to BloodHound Enterprise for natural language attack path analysis, Cypher queries, and exploration of Active Directory, Azure/Entra ID, and OpenGraph environments.

A security audit server for Laravel projects that performs static code analysis, dependency CVE checks, and configuration audits. It enables developers to detect vulnerabilities like SQL injection and XSS while providing active attack simulations directly within MCP-compatible IDEs.

An MCP server for the Cortex observable analysis and active response engine. It enables LLMs to automate security investigations by running analyzers on observables like IPs and URLs and executing automated response actions.

An AppSec-focused MCP server that performs static analysis scans on C/C++ source code for memory-safety vulnerabilities and parses compiled PE/ELF binary headers locally to audit active defensive compiler mitigations (ASLR, DEP/NX, PIE).

Enables AI agents to list, retrieve, add, and audit credentials from an encrypted vault during an active human-unlocked session, while providing no tool to unlock the vault itself.

MCP server for Appwrite security audits that scans permissions and provides structured fix proposals, with active live leak confirmation via anonymous fetch.

An MCP server that provides passive and low-impact active reconnaissance tools for authorized bug bounty and security assessments, enabling LLMs to perform structured recon and generate reports.

Provides AI assistants with unified access to on-prem Active Directory via LDAP and Azure AD / Entra ID through the Microsoft Graph API. It enables comprehensive management and search of users, groups, computers, and cloud devices using 18 specialized tools.

Enables LLMs to perform automated penetration testing and Active Directory reconnaissance through Mythic, with tools for executing PowerShell, AD recon, domain user enumeration, and Kerberoasting.

Enables security professionals to query and analyze Active Directory attack paths from BloodHound Community Edition data using natural language through Claude Desktop's Model Context Protocol interface.

Enables users to query BloodHound Active Directory graph data using natural language, finding attack paths, Kerberoastable accounts, and other AD security insights.

Enables LLMs to perform Active Directory penetration testing using tools like NetExec, Bloodhound, Nmap, Certipy, and John the Ripper. Automates vulnerability discovery, attack path analysis, and documentation generation for security assessments.

Exposes Wazuh SIEM data and actions—including agents, alerts, vulnerabilities, rules, decoders, active response, and Wazuh 5 Sigma rules, Detectors, and content promotion—as Model Context Protocol tools that LLM clients can call over HTTP.

Enables MCP clients to query and manipulate a Wazuh SIEM deployment through its manager, Indexer, and dashboard REST APIs, covering agents, alerts, vulnerabilities, rules, decoders, active response, and content promotion.

Passive external attack-surface mapping server that discovers subdomains, DNS records, TLS posture, HTTP headers, and registration data via public sources like CT logs, Shodan, and RDAP/WHOIS, enabling security reconnaissance without active scanning.

MCP server that enables AI-powered assessment of Active Directory on-premises environments by exposing AD data as queryable tools for LLMs like Claude.