"An overview of penetration testing (pentest)" matching MCP servers:

Provides access to over 40 industry-standard penetration testing tools, including Nmap, SQLMap, and Metasploit, within an isolated Kali Linux Docker container. It enables security professionals to perform comprehensive network reconnaissance, web application testing, and vulnerability research through natural language commands.

Enables developers and product owners to scan a codebase and extract a readable business overview—features, roles, access control, data model, and endpoints—along with findings on missing or inconsistent rules, and generate shareable HTML or Markdown reports and diagrams.

Enables MCP-compatible agents to query structured penetration testing engagement state captured from tmux sessions, including credentials, hosts, and command provenance with exact source bytes.

An automated penetration testing framework that enables intelligent security assessments through reconnaissance, vulnerability scanning, and controlled exploitation. Features AI-driven workflow management with comprehensive reporting for authorized security testing.

Enables AI agents to orchestrate 25+ security tools for penetration testing through natural language, automating scans, vulnerability detection, and report generation.

AI-powered security scanning MCP server that exposes 25+ professional tools, enabling penetration testing and security assessments through natural language interaction with AI agents like Claude Desktop.

A Model Context Protocol server that integrates essential penetration testing tools (Nmap, Gobuster, Nikto, John the Ripper) into a unified natural language interface, allowing security professionals to execute and chain multiple tools through conversational commands.

Enables authorized penetration-testing workflows through MCP by exposing tools for network scanning, web fuzzing, subdomain enumeration, vulnerability scanning, brute-force checks, packet capture, and report generation with HTTP/STDIO/SSE transports and bearer/OIDC authentication.

Enables professional penetration testers to orchestrate reconnaissance, web scanning, brute-force testing, exploitation, traffic capture, hash cracking, wordlist building, privilege escalation audits, and client report generation via STDIO/HTTP/SSE transports with optional bearer/OIDC authentication.

Enables AI clients to drive professional penetration-testing workflows—subdomain enumeration, host probing, content fuzzing, vulnerability scanning, brute-force, traffic capture, and exploitation sweeps—through a single MCP interface with stdio, Streamable HTTP, and legacy SSE transports plus bearer/OIDC auth. It also records engagement artifacts and generates client-ready reports with scope handling, cutting manual pentest administration.

Enables professional penetration-testing workflows through MCP, including reconnaissance, web/content scanning, brute-force checks, traffic capture, exploitation sweeps, wordlist generation, and engagement reporting over stdio, Streamable HTTP, and legacy SSE.

Unified penetration testing MCP server for Claude Desktop providing 34 security tools for reconnaissance, web scanning, code analysis, and authenticated testing.

Enables AI assistants to write and debug integration tests by providing live access to DOM structure and executing code directly in test environments.

Provides testing and quality assurance tools for AI agents via MCP, enabling generation of test cases, mock data, API mocks, coverage analysis, and assertions.

MCP server for testing GitHub Actions workflows locally using nektos/act.

Enables accessibility testing of websites and HTML content using axe-core and IBM Equal Access engines. Supports WCAG compliance checking, multi-viewport testing, and provides detailed violation reports with remediation guidance.

Enables agents to store, search, and manage a personal penetration testing knowledge base via MCP, using BM25-ranked retrieval with Chinese tokenization, plus draft approval, deduplication, and sensitive-data redaction workflows.

Code-aware browser testing agent — reads your codebase, understands functionality, tests every element, reports with screenshots. Works as MCP server for Cursor/Claude Code or standalone CLI.

A security testing tool that enables automated vulnerability detection including XSS and SQL injection, along with comprehensive browser interaction capabilities for web application penetration testing.

Enables submitting FMF-based test requests to Testing Farm and listing available OS composes for testing.