"OWASP" matching MCP tools:

• list_security_guidanceA

  RoutebaseA

  List the static security guidance library — one entry per OWASP API-security issue with its remediation text, code examples and references. Pass guidanceId (the guidanceId of a finding) for a single entry.

  MIT

• check_safetyA

  HallucC — Hallucination Fact-Check & AI Safety GuardA

  Scan AI outputs and prompts for injection, jailbreaks, harmful content, data leaks, fraud, and hallucinations. Returns risk score, threat details, and recommendations per OWASP LLM Top 10.

  MIT

• cyberchef_analyse_hashA

  cyber-chef-mcpA

  Identify a hash's algorithm by analyzing its character set, bit length, and structure, including bcrypt, Argon2, scrypt, PBKDF2, and hex digests like MD5.

  Apache 2.0

• electron_lint_securityA

  @yawlabs/electron-mcpA

  Scan Electron source code to detect dangerous patterns: shell.openExternal with user input, disabled webSecurity, missing navigation restrictions, and unrestricted window creation. Fix OWASP-style vulnerabilities before deployment.

  MIT

• dast_scanA

  PwnBridgeA

  Run dynamic security scans against a live web app: OWASP ZAP spider/passive or active checks and Nuclei CVE detection run in parallel, with optional authentication, then save a consolidated report.

  MIT

• appknox_owaspA

  Appknox MCP ServerA

  Retrieve OWASP category details by ID for mobile app security testing. Provides specific OWASP Mobile Top 10 information to identify vulnerabilities.

  MIT

• sanitize_and_validate_payloadC

  SEOSiri API Guard MCP ServerA

  Sanitize and validate incoming API payloads against OWASP security rules while dynamically activating industry compliance profiles.

  MIT

• domain_changesA

  Dechonet MCPA

  Compare a domain's security posture over time to identify regressions in SSL, headers, DNS, and OWASP. Use stored snapshots to answer what changed since yesterday.

  MIT

• inkog_mcp_scanA

  inkogA

  Scan MCP servers from registry or repository URL to detect vulnerabilities including tool poisoning, command injection, and data exfiltration. Maps results to OWASP Agentic and MCP Top 10.

  Apache 2.0

• run_api_security_scanA

  mk-qa-masterA

  Scans an API against OWASP API Security Top 10 rules (BOLA, broken authentication, etc.) using an OpenAPI 3.x spec and returns a findings report with remediation hints.

  MIT

• zap_get_alertsA

  TenguA

  Fetch OWASP ZAP vulnerability alerts, filter by URL and risk level, and view risk details, solutions, and evidence.

  MIT

• owasp_checkA

  Dechonet MCPA

  Assess a domain's external OWASP posture via passive header, TLS, and version checks. Returns an A+ to F grade and a shareable report.

  MIT

• find_by_external_referenceA

  finos-mcpA

  Find which AIGF risks and controls cite a given external reference key, such as NIST SP 800-53 or OWASP LLM Top 10. Matching ignores case and punctuation; optionally filter by framework.

  Apache 2.0

• generate_security_reportA

  OrihimeA

  Generate a security findings report by aggregating taint analysis results and mapping them to a compliance framework such as OWASP, CWE, PCI DSS, or STIG.

  MIT

• grimoire_searchA

  grimoireA

  Search across indexed offline security knowledge bases from HackTricks, OWASP, and more. Retrieve ranked matches with source and snippet to ground answers in real documentation.

  MIT

• zap_active_scanA

  TenguA

  Send crafted requests to a target URL to actively discover vulnerabilities via OWASP ZAP. Returns scan status and alert count.

  MIT

• inkog_skill_scanA

  inkogA

  Scan SKILL.md packages and agent tool definitions for security vulnerabilities including tool poisoning, command injection, data exfiltration, and prompt injection. Maps findings to OWASP Agentic and MCP Top 10.

  Apache 2.0

• owasp_llm_classifyA

  mcp-security-toolkitA

  Map security findings or observations to OWASP LLM Top 10 (2025) categories with rule-based keyword and regex matching, returning top matches with evidence snippets and confidence scores.

  MIT

• audit_openapiA

  OpenAPI DoctorA

  Check OpenAPI or Swagger specs for API security flaws such as missing authentication, plaintext servers, and object ID enumeration. Outputs SECURE, REVIEW, or INSECURE verdict.

  MIT

• owasp_llm_classifyA

  mcp-security-toolkitA

  Map security observations to OWASP LLM Top 10 categories using keyword and regex pattern matching. Returns top matching categories with evidence and confidence scores.

  MIT

• generate_security_reportA

  Agent Security MCPA

  Generate a comprehensive security assessment report by aggregating configuration scans and permission audits into a prioritized remediation plan with OWASP LLM Top 10 compliance notes.

  MIT