Skip to main content
Glama
118,203 servers. Updated
20 Best Security MCP Servers: compared and ranked, November 2026Ranked from 4,472 matching servers on stars, growth, downloads and maintenance. Updated .

Matching MCP tools:

Matching MCP Connectors:

"Information on Penetration Testing (Pentest)" matching MCP servers:

GET /v1/servers – MCP directory API reference
  • F
    license
    Not graded
    quality
    D
    maintenance
    Provides access to over 40 industry-standard penetration testing tools, including Nmap, SQLMap, and Metasploit, within an isolated Kali Linux Docker container. It enables security professionals to perform comprehensive network reconnaissance, web application testing, and vulnerability research through natural language commands.
    -
  • A
    license
    A
    quality
    B
    maintenance
    Enables MCP-compatible agents to query structured penetration testing engagement state captured from tmux sessions, including credentials, hosts, and command provenance with exact source bytes.
    15
    MIT
  • A
    license
    C
    quality
    D
    maintenance
    An automated penetration testing framework that enables intelligent security assessments through reconnaissance, vulnerability scanning, and controlled exploitation. Features AI-driven workflow management with comprehensive reporting for authorized security testing.
    27
    25 npm
    7
    BSD 3-Clause
  • A
    license
    C
    quality
    D
    maintenance
    Enables AI agents to orchestrate 25+ security tools for penetration testing through natural language, automating scans, vulnerability detection, and report generation.
    31
    MIT
  • F
    license
    Not graded
    quality
    D
    maintenance
    Unified penetration testing MCP server for Claude Desktop providing 34 security tools for reconnaissance, web scanning, code analysis, and authenticated testing.
    1
    -
  • A
    license
    A
    quality
    B
    maintenance
    Enables AI assistants to write and debug integration tests by providing live access to DOM structure and executing code directly in test environments.
    5
    281 npm
    10
    MIT
  • A
    license
    A
    quality
    D
    maintenance
    A lightweight, local-first MCP server for executing HTTP requests and managing API collections and environments without cloud dependencies. It enables testing APIs, handling authentication, and importing OpenAPI specifications directly within MCP-compatible workflows.
    42
    103 npm
    13
    MIT
  • A
    license
    B
    quality
    F
    maintenance
    A security testing tool that enables automated vulnerability detection including XSS and SQL injection, along with comprehensive browser interaction capabilities for web application penetration testing.
    12
    462 npm
    22
    MIT
  • A
    license
    C
    quality
    B
    maintenance
    Enables MCP-capable AI agents to run authorization-gated reconnaissance, vulnerability scanning, web application testing, exploitation, CTF tasks, reporting, and integrations with tools such as Burp, ZAP, and DefectDojo.
    80
    2
    MIT
  • A
    license
    C
    quality
    D
    maintenance
    AI-powered security scanning MCP server that exposes 25+ professional tools, enabling penetration testing and security assessments through natural language interaction with AI agents like Claude Desktop.
    31
    MIT
  • A
    license
    D
    quality
    C
    maintenance
    A Model Context Protocol server that integrates essential penetration testing tools (Nmap, Gobuster, Nikto, John the Ripper) into a unified natural language interface, allowing security professionals to execute and chain multiple tools through conversational commands.
    9
    165 npm
    149
    AGPL 3.0
  • A
    license
    Not graded
    quality
    A
    maintenance
    Autonomous pentests from one command: real security tools, working PoCs, and audit-ready reports, all driven via MCP.
    451 PyPI
    1,807
    MIT
  • A
    license
    Not graded
    quality
    D
    maintenance
    Enables authorized penetration testing and security assessments with CVE monitoring, vulnerability scanning, and reporting features.
    MIT
  • F
    license
    Not graded
    quality
    D
    maintenance
    Wraps common web penetration testing tools in a Docker container and exposes them as Claude tools for educational use in controlled lab environments.
    -
  • -
    license
    Not graded
    quality
    Not graded
    maintenance
    Enables automated testing and coverage reporting for MCP services with test execution, file generation, and mock service creation. Provides comprehensive testing infrastructure including Jest integration, coverage reports, and health checks for the MCP ecosystem.
    -
  • A
    license
    B
    quality
    B
    maintenance
    Enables AI coding assistants to perform authorized attack-surface reconnaissance and vulnerability intelligence through stdio JSON-RPC tools for HTTP probing, TCP port scanning, directory discovery, template checks, and CISA KEV/cve.now lookups.
    5
    MIT
  • F
    license
    Not graded
    quality
    D
    maintenance
    A Model Context Protocol server for automated security vulnerability assessment, combining OWASP Dependency-Check dependency scanning with custom code vulnerability detection, and generating detailed HTML and JSON reports.
    -
  • F
    license
    Not graded
    quality
    D
    maintenance
    An MCP server that extends kali-mcp with cloud (AWS/Azure/GCP), API/GraphQL/JWT, OSINT, container/K8s, IaC/SAST, mobile, binary analysis, and reporting tools, all accessible via an HTTP MCP endpoint.
    -
  • F
    license
    Not graded
    quality
    D
    maintenance
    Enables natural-language-driven security testing by orchestrating multiple pen-testing tools through MCP, with automated scan execution and AI-assisted vulnerability summarization.
    -
  • F
    license
    Not graded
    quality
    D
    maintenance
    An MCP server that integrates various penetration testing tools, enabling security professionals to perform reconnaissance, vulnerability scanning, and API testing through natural language commands in compatible LLM clients like Claude Desktop.
    7
    -
  • A
    license
    A
    quality
    C
    maintenance
    Enables AI agents and MCP hosts to drive a persistent headless Chromium browser through Playwright, navigating pages, mapping visible fields and actions, clicking, typing, scrolling, and capturing screenshots via stdio tool calls. It also powers a local AI Test Studio dashboard that generates and runs structured end-to-end test plans with assertions, per-step timing, and screenshot evidence.
    4
    1
    MIT
  • A
    license
    Not graded
    quality
    B
    maintenance
    Bridges the ChatGPT web UI to a local development environment over MCP, letting the model read and patch files, run real shell commands and terminals, execute tests, and control the desktop (screen, mouse, keyboard, clipboard) within user-approved folders. It adds parallel workers, goal/loop long-task control, plugin tools, and a security-hardening layer with risk-tiered shell policy, audit logging, and credential sanitization.
    MIT
  • A
    license
    Not graded
    quality
    D
    maintenance
    A universal AI-powered testing server built on the Model Context Protocol (MCP). Allows AI agents to inspect, execute, test, monitor, debug, and report on software projects.
    3
    GNU Lesser General Public v2.1 only