"Website penetration testing and security vulnerability assessment tools" matching MCP servers:

Provides testing and quality assurance tools for AI agents via MCP, enabling generation of test cases, mock data, API mocks, coverage analysis, and assertions.

A Model Context Protocol (MCP) server that provides testing and debugging tools for Stripe integrations, including test clock management, customer and product management, and subscription testing.

An MCP server that exposes a legacy vulnerability database as tools for LLM clients, enabling security analysts to query vulnerabilities using natural language through six specialized tools for vendor lookup, vulnerability search, and risk analysis.

Code-aware browser testing agent — reads your codebase, understands functionality, tests every element, reports with screenshots. Works as MCP server for Cursor/Claude Code or standalone CLI.

Enables querying and analyzing a legacy, file-based vulnerability registry via MCP tools for CVE lookup, search, vendor navigation, and aggregate statistics.

Enables AI assistants to write and debug integration tests by providing live access to DOM structure and executing code directly in test environments.

Enables scanning IP addresses for vulnerabilities using Nmap and API-based checks, supporting both single and batch scans with detailed reports.

Enables security analysts and risk managers to query a legacy CVE registry via natural language, providing tools for searching vulnerabilities, retrieving details, and obtaining statistics.

An LLM-driven API testing platform exposed over MCP, enabling declarative test definition and DAG-based execution.

Provides AI-visibility scoring and site auditing capabilities for websites, enabling agents to check how sites appear in AI engines like ChatGPT and Perplexity, run full SEO/security audits, and monitor changes over time.

Provides coding agents with visibility into test health through tools for flaky test detection, test quality linting, and LLM evaluation harness, enabling them to triage failures, review test quality, and check prompt changes for regressions.

Reads a small-business website like a customer would and shows where they get stuck. Every AI answer has to quote the page, and the server checks the quote before it counts.

A lightweight, local-first MCP server for executing HTTP requests and managing API collections and environments without cloud dependencies. It enables testing APIs, handling authentication, and importing OpenAPI specifications directly within MCP-compatible workflows.

CP server for RAD Security, providing AI-powered security insights for Kubernetes and cloud environments. This server provides tools for querying the Rad Security API and retrieving security findings, reports, runtime data and many more.

Analyzes a public webpage for SEO, metadata, and technical signals through 27 stdio tools, including a complete multi-analyzer call.

Provides tools for frontend testing including code analysis, test generation, test execution, and React component testing for Jest and Cypress frameworks.

Enables triggering GuardBee security scans via natural language, checking scan status, filtering findings by severity or ID, and obtaining AI-assisted remediation guidance.

This server performs a comprehensive analysis of a website by fetching its HTML and scoring it across five categories: performance, SEO, design, functionality, and technology. It enables users to identify technical strengths and weaknesses in a webpage's structure and health.

MCP server that fetches and converts website pages into clean markdown for agents, with sitemap-based discovery, disk caching, and polite crawling (robots.txt, rate limiting).

Enables deterministic bilingual website intelligence audits by URL, returning fixed English or Spanish findings without ever contacting the submitted site.

Provides deterministic, standards-based calculations for data center critical power infrastructure. Enables site selection, generator sizing, UPS sizing, NFPA 110 compliance, and more via 50+ AI agents and 8 compound chains.

Detect live website vulnerabilities and security flaws in GitHub repositories using automated DAST and SAST scanning. Safeguard applications by identifying exposed secrets, insecure dependencies, and common code patterns prone to exploitation. Receive structured fix plans with precise code remediation steps to resolve identified risks and improve security posture.

Enables AI agents to submit npm, PyPI, Go, or Maven packages and manifests to the free OSV.dev database and receive per-package and per-advisory results with CVE mappings, CVSS scores, severities, and the versions that fix each issue. It also supports filtering by minimum severity, de-duplicating alias advisories, and machine-readable error/warning rows for CI gates and upgrade recommendations.

Classifies company sites as B2B or B2C and as SaaS, online store, agency, manufacturer, wholesaler, distributor, or marketplace, while matching your own buyer phrases and returning the quoted text and page as evidence. Runs deterministically on Apify, giving one row per domain with grace-free status rows for unreachable, blocked, or empty sites.

Protects AI agents from threats like prompt injection, jailbreaks, and SQL injection through a multi-layer scanning pipeline. It also enables PII redaction and rehydration to ensure data privacy during LLM interactions.

Captures high-quality screenshots of web pages with automatic resolution limiting and tiling optimized for Claude Vision API and other AI models.

Webhook management and testing tools for AI agents. Provides tools for sending, validating, generating, and debugging webhooks.

Enables AI agents to inspect any public domain’s web technology stack, email deliverability and DNS health (MX, SPF, DKIM, DMARC, MTA-STS, TLS-RPT, BIMI), and HTTPS security posture with typed JSON scores and remediation-ready findings, plus history, bulk checks, monitoring alerts, and reverse technology lookups.

Fast, token-efficient web content extraction tool that converts websites to clean Markdown for AI agents, featuring smart caching, content extraction with Mozilla Readability, and polite crawling capabilities.

Enables AI agents to audit email and domain security (SPF, DKIM, DMARC, etc.) for any domain without requiring API keys.