MCP servers for security testing 750
These MCP servers and clients focus on security testing, matched from their name, description and GitHub topics. MCP Harbor lists 750 of them; the most starred are RuView (★99,349), SkillSpector (★21,135) and hexstrike-ai (★13,054).
84% open source · mostly Python, JavaScript, TypeScript · 478 updated in the last 30 days · fastest this week: AiSOC (+911 stars)
No servers on this page match that filter. Try one word, such as a product name, or .
RuView★ 99,349
ruvnet · Rust
π RuView turns commodity WiFi signals into real-time spatial intelligence, vital sign monitoring, and presence detection — all without a single pixel of video.
NVIDIA · Python+720 stars this week (+3.5%)
Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.
hexstrike-ai★ 13,054
0x4m4 · Python+174 stars this week (+1.4%)
HexStrike AI MCP Agents is an advanced MCP server that lets AI agents (Claude, GPT, Copilot, etc.) autonomously run 150+ cybersecurity tools for automated pentesting, vulnerability discovery, bug bounty automation, and security research. Seamlessly bridge LLMs with real-world offensive security capa
kubeshark★ 12,107
kubeshark · Go+7 stars this week (+0.1%)
eBPF-powered network observability for Kubernetes. Indexes L4/L7 traffic with full K8s context, decrypts TLS without keys. Queryable by AI agents via MCP and humans via dashboard.
astrid★ 10,284
astrid-runtime · Rust+1 stars this week (+0%)
Astrid is a portable, capability-secure operating system for composable software.
lamda★ 8,651
firerpa · Python+33 stars this week (+0.4%)
Android Full-Stack Device Control Platform: WebRTC/H.264 remote desktop, UI/OCR/image-matching automation, one-click MITM, built-in Frida, proxy/VPN/frp/P2P networking, MCP/Agent, 160+ APIs, designed for multi-device clusters and engineered deployments.
CyberStrikeAI★ 8,003
AIPentest · Go+138 stars this week (+1.8%)
The system of action for AI-native cybersecurity—where intent becomes governed execution, evidence becomes operational memory, and every operation improves the next.
agent-governance-toolkit★ 6,459
microsoft · Python+25 stars this week (+0.4%)
AI Agent Governance Toolkit — Policy enforcement, zero-trust identity, execution sandboxing, and reliability engineering for autonomous AI agents. Covers 10/10 OWASP Agentic Top 10.
claude-code-ultimate-guide★ 6,235
FlorianBruniaux · Python
The most comprehensive Claude Code guide: agentic workflows, hooks, skills, MCP servers, quizzes, and production-ready templates. 430K+ lines.
lean-ctx★ 3,898
yvgude · Rust+17 stars this week (+0.4%)
LeanCTX is the Context Gateway for AI Systems. Select task-relevant context, apply supported controls, connect local knowledge and inspect recorded evidence. Open-source Engine: CLI, MCP, hooks and supported proxy paths.
goclaw★ 3,667
nextlevelbuilder · Go
GoClaw - GoClaw is OpenClaw rebuilt in Go — with multi-tenant isolation, 5-layer security, and native concurrency. Deploy AI agent teams at scale without compromising on safety.
beenuar · Python+911 stars this week (+37.7%)
Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.
CyberStrike★ 3,238
CyberStrikeus · TypeScript
Open-source AI-powered offensive security harness for automated penetration testing.
pentestagent★ 3,209
GH05TCREW · Python
PentestAgent is an AI agent framework for black-box security testing, supporting bug bounty, red-team, and penetration testing workflows.
redamon★ 3,202
samugit83 · Python
Open-source, self-hosted AI penetration testing framework: maps your attack surface into a graph, autonomously exploits it from a Kali sandbox with human approval gates, and opens PRs that fix what it finds. MCP both ways: plug in any MCP server as a tool, or drive RedAmon from Claude Code or your o
jadx-ai-mcp★ 2,934
zinja-coder · Java+25 stars this week (+0.9%)
Plugin for JADX to integrate MCP server
toolhive★ 2,305
stacklok · Go+14 stars this week (+0.6%)
ToolHive is an enterprise-grade platform for running and managing Model Context Protocol (MCP) servers.
beelzebub★ 2,207
beelzebub-labs · Go
A secure low code deception runtime framework, leveraging AI for System Virtualization.
DevDocs★ 2,107
cyberagiinc · TypeScript
Completely free, private, UI based Tech Documentation MCP server. Designed for coders and software developers in mind. Easily integrate into Cursor, Windsurf, Cline, Roo Code, Claude Desktop App
ADR★ 2,073
uber · Python+12 stars this week (+0.6%)
ADR secures enterprise AI agents through observability, security benchmarking, and threat detection. Deployed at Uber.
jshookmcp★ 2,060
vmoranv · TypeScript+6 stars this week (+0.3%)
A search-first, profile-aware reverse-engineering workspace for AI agents — 735 tools across 36 domains in one MCP server.
OpenOSINT★ 1,801
OpenOSINT · Python+33 stars this week (+1.9%)
Open-source engine for passive OSINT checks: 21 tools as CLI, MCP server and web UI. Hosted Monitor & Diligence at app.openosint.tech.
pentest-ai★ 1,772
0xSteph · Python+28 stars this week (+1.6%)
Open-source AI pentester that proves every finding. Machine oracles re-run each exploit; verified bugs ship a proof capsule you can replay yourself.
cheatengine-mcp-bridge★ 1,690
miscusi-peek · Lua+29 stars this week (+1.7%)
Connect your favorite AI agents directly to Cheat Engine via MCP. Automate reverse engineering, pointer scanning, and memory analysis using natural language.
cve-mcp-server★ 1,637
mukul975 · Python+12 stars this week (+0.7%)
Production-grade MCP server giving Claude 27 security intelligence tools across 21 APIs — CVE lookup, EPSS scoring, CISA KEV, MITRE ATT&CK, Shodan, VirusTotal, and more.
LitterBox★ 1,554
BlackSnufkin · YARA+3 stars this week (+0.2%)
A self-hosted sandbox for red teams to test payloads against modern detection before deployment. MCP integration lets an LLM agent drive analysis end to end.
burp-ai-agent★ 1,554
six2dez · Kotlin
Burp Suite extension that adds built-in MCP tooling, AI-assisted analysis, privacy controls, passive and active scanning and more
agentshield★ 1,319
affaan-m · TypeScript
AI agent security scanner. Detect vulnerabilities in agent configurations, MCP servers, and tool permissions. Available as CLI, GitHub Action, ECC plugin, and GitHub App integration. 🛡️
reverify★ 1,312
2akouwu · Python+7 stars this week (+0.5%)
Stop your AI from making things up — it proposes, deterministic tools decide, every claim checked against ground truth with evidence. Grounded facts and context survive resets. Reverse engineering is the proving ground. MCP server + CLI.
ZeroDayEvil · HTML+296 stars this week (+36.2%)
🛡️ Free open-source AI-powered security terminal & vulnerability scanner (CVE, SBOM). Supports SSH, SFTP, RDP, VNC, Serial, and 12+ autonomous AI agents (DeepSeek, OpenAI) for automated security workflows, CTF & DevSecOps. Cross-platform & Web UI.
mcp-scanner★ 1,096
cisco-ai-defense · Python
Scan MCP servers for potential threats & security findings.
stackql★ 1,067
stackql · Go
Query, provision and operate Cloud, SaaS, API and Model Context Protocol (MCP) resources through a unified SQL-based framework for humans and AI agents.
pentest-agents★ 1,031
H-mmer · Python
Bug bounty agent framework for Claude Code, Codex, Gemini, Cursor, Windsurf, Copilot, and OpenClaw — 48 agents, 26 commands, 19 CLI tools, 2 MCP servers, autonomous hunt loops, exploit chain builder.
marc-shade · Python+63 stars this week (+6.5%)
160-tool MCP server for real-time global intelligence from free public APIs: markets, liquidity, prediction markets, SEC filings, conflict, military, aircraft-cohort early warning, migration and border flows, cyber, climate, news and more. Dated observation history, 29 research prompts, cited briefs
medusa★ 1,006
Pantheon-Security · Python
AI-first security scanner. NEW in v2026.7: Claude Code compromise detection — vet .claude/ hooks, permissions & skills before you clone — plus an always-on AI attack-signature scanner and native Rust & PHP rules. Also: medusa scan --git to vet any repo, medusa secrets scan for leaked API keys. 40,00
hol-guard★ 975
hashgraph-online · Python
Open-source antivirus for AI agents: block risky tools, secret access, prompt injection, malicious packages, MCP servers, plugins, and skills at runtime.
wassette★ 970
microsoft · Rust+4 stars this week (+0.4%)
Wassette: A security-oriented runtime that runs WebAssembly Components via MCP
pipelock★ 959
pipelab-org · Go
Open-source AI agent firewall for MCP security and agent egress. Scans mediated HTTP, MCP, A2A, and WebSocket traffic for exfiltration, SSRF, and prompt injection, and emits mediator-signed action receipts: verifiable audit evidence from outside the agent.
ship-safe★ 862
asamassekou10 · JavaScript
The independent security agent for AI-written software. Finds issues, investigates whether they are real, and shows you the evidence. Deterministic core, no API key needed, JSON and SARIF output.
MCP-Kali-Server★ 860
Wh0am123 · Python+11 stars this week (+1.3%)
MCP configuration to connect AI agent to a Linux machine.
ThinkWatch★ 818
ThinkWatchProject · Rust
Self-hosted AI API and MCP gateway for organizations: SSO and RBAC, per-user identity for MCP tool calls, PII redaction and tool-call guards, rate limits, budgets, cost accounting and audit logs.
FofaMap★ 751
asaotomo · Python+5 stars this week (+0.7%)
一款证据驱动的 FOFA 资产测绘智能体：支持自然语言侦察、AI 反思、CLI / MCP / Skill / REST API，以及经人工审批的 Nuclei 扫描。
mcpcan★ 728
Kymo-MCP · Go
MCPCAN is a centralized management platform for MCP services. It deploys each MCP service using a container deployment method. The platform supports container monitoring and MCP service token verification, solving security risks and enabling rapid deployment of MCP services. It uses SSE, STDIO, and
calmrocks · Jupyter Notebook
Hands-on, framework-free Colab notebooks for the AI Engineer / Forward Deployed Engineer (FDE) skill set — model APIs, structured output, tool calling, RAG, evals-as-the-spine, agents (loop from scratch, tool design, guardrails, MCP, Skills), fine-tuning vs LoRA, prompt-injection/security, LLMOps, a
arcjet-js★ 693
arcjet · TypeScript
Runtime security for AI apps and agents: prompt injection detection, tool-call authorization, sensitive-data redaction, bot protection, and rate limiting. Drop it into your JS/TS code.
agent-safe-pipeline★ 687
decionis · TypeScript
An execution-authority gateway for AI agents and APIs. It intercepts consequential HTTP actions, asks Decionis whether they are authorized, and forwards exactly the authorized request once on a single-use grant, holds it for a person, or refuses it, leaving chained evidence of each. Installs by Home
sonarqube-mcp-server★ 671
SonarSource · Java
Official SonarQube MCP Server for code quality and security in AI agents
graygnatconsole · Python+298 stars this week (+80.8%)
🛡️ Security audit CLI for Model Context Protocol (MCP) servers — scan AI agent configs for tool poisoning, rug pulls, hardcoded secrets, command injection & supply-chain risks. Pure Python, SARIF + CI ready.
vestige★ 656
samvallad33 · Rust
Think before doing, prove before saving. Vestige is a local, deterministic safety kernel for AI agents. Every memory write and agent action is recorded in Strata, an append-only log, so you can see exactly what your agent did and why.
cti-expert★ 616
7onez · Python
CTI Expert — Cyber Threat Intelligence & OSINT analysis skill for Claude Code / Codex. 120+ commands, 57 techniques, 79 typed MCP tools, deterministic case pipeline + ICD-203 reports. No API keys required for core.
ironcurtain★ 614
provos · TypeScript+1 stars this week (+0.2%)
A secure* runtime for autonomous AI agents. Policy from plain-English constitutions. (*https://ironcurtain.dev)
asqav-sdk★ 610
jagmarques · Python
Python and TypeScript SDKs for verifiable evidence of AI agent actions. Signed receipts, policy enforcement, audit trails. Works with LangChain, CrewAI, MCP.
emilia-protocol★ 599
emiliaprotocol · TypeScript
Authority control plane for autonomous work. EMILIA Gate enforces finite customer-owned mandates at protected executor boundaries; the open protocol keeps evidence verifiable.
agent-opfor★ 583
KeyValueSoftwareSystems · TypeScript
Open-source adversary emulation for AI agents and MCP servers.
0★ 516
0sec-labs · TypeScript
Open-source AI security harness with a local web UI for code review, vulnerability research, verification, and fixes. CLI and MCP for coding agents.
blitzstrike★ 513
shinthink · TypeScript
Blitz Strike — a universal MCP security-audit toolbelt. Reconnaissance at speed. Analysis in depth. Validation before report.
lunar★ 506
TheLunarCompany · TypeScript
lunar.dev: Agent native MCP Gateway for governance and security
MHaggis · TypeScript
MCP to help Defenders Detection Engineer Harder and Smarter
iam-policy-autopilot★ 499
awslabs · Rust
IAM Policy Autopilot is an open source static code analysis tool that helps you quickly create baseline AWS IAM policies that you can refine as your application evolves. This tool is available as a command-line utility and MCP server for use within AI coding assistants for quickly building IAM polic
ARL-Next★ 474
owl234 · Python+10 stars this week (+2.2%)
Modern attack-surface reconnaissance & asset monitoring platform — rebuilt from classic ARL with async decoupled scheduling, enterprise asset correlation and native MCP support. Docker-ready.
agentguard★ 471
GoPlusSecurity · TypeScript
Security guard for AI agents — blocks malicious skills, prevents data leaks, protects secrets. 24 detection rules, runtime action evaluation, trust registry.
agent-skills-hub★ 464
zhuyansen · Python
Discover and compare open-source Agent Skills, tools & MCP servers — with quality scoring, trending analysis, and automated GitHub sync
AgentHound★ 452
adithyan-ak · Go
Offensive security framework for AI agent infrastructure - recon, credential looting, model exfiltration, poisoning, and attack-path analysis across MCP, A2A, gateways, and AI services. BloodHound for the agentic stack.
bug-bounties★ 451
lissy93 · TypeScript
⚔️ Community maintained directory, MCP and API of 3,000+ active bug bounty programs and VDPs
prismor★ 426
PrismorSec · Python
Self-hosted runtime control plane for AI agents. Observe or HITL approve or Block rogue tool calls before it executes: secret leaks, prompt injection, supply chain etc in a local dashboard. Agent agnostic (Claude, codex, langchain etc.)
evil-winrm-py★ 414
adityatelange · Python
Execute commands interactively on remote Windows machines using the WinRM protocol (just faster)
Vigil-SOC · Python+26 stars this week (+7%)
Vigil SOC: The leading open source AI SOC. Apache 2.0. Runs against your own LLM, local or remote.
mssql_mcp_server★ 399
RichardHan · Python
A Model Context Protocol (MCP) server for Microsoft SQL Server that enables secure database interactions through a controlled interface. Allows AI assistants to safely list tables, read data, and execute SQL queries while maintaining security and structure.
mcp-gateway★ 395
lasso-security · Python
A plugin-based gateway that orchestrates other MCPs and allows developers to build upon it enterprise-grade agents.
AdStrike★ 387
capture0x · Python
AI-powered modular Active Directory red-team framework for authorized penetration testing, AD enumeration, attack-path analysis, Kerberos/ADCS workflows, reporting, operator automation, and MCP server integration.
BloodHound-MCP-AI★ 383
MorDavid · Python
BloodHound-MCP-AI is integration that connects BloodHound with AI through Model Context Protocol, allowing security professionals to analyze Active Directory attack paths using natural language instead of complex Cypher queries.
cross-code-organizer★ 383
mcpware · JavaScript
Cross-Code Organizer (formerly Claude Code Organizer): cross-harness config dashboard for Claude Code, Codex CLI, MCP servers, skills, memories, agents, sessions, security scanning, context budget, and backups.
agentseal★ 380
getagentseal · Python
Security toolkit for AI agents. Scan your machine for dangerous skills and MCP configs, monitor for supply chain attacks, test prompt injection resistance, and audit live MCP servers for tool poisoning.
api★ 377
vulnersCom · Python
Official Python SDK for the Vulners vulnerability-intelligence API — search CVEs, exploits and advisories (CVSS/EPSS/KEV), audit software, Linux/Windows hosts and SBOMs, and stream the whole graph. Typed sync + async clients, 100% v3-compatible, with a built-in MCP server for AI agents.
gemini-kit★ 372
nth5693 · Shell
🚀 19 AI Agents + 44 Commands for Gemini CLI - Code 10x faster with auto planning, testing, review & security
BugTraceAI★ 369
BugTraceAI · Shell+9 stars this week (+2.5%)
Open-source, self-hosted web pentesting suite with agentic scanning, analyst tools, API testing, model checkpoints and MCP integrations.
saf-mcp★ 365
secure-agentic-framework · Python
SAF-MCP is a comprehensive security framework for documenting and mitigating threats in the AI Agent ecosystem.
h1-brain★ 356
PatrikFehrenbach · Python
MCP server that connects AI assistants to HackerOne for bug bounty hunting
Wireshark-MCP★ 352
bx33661 · Python
Wireshark-MCP，Give your AI assistant a packet analyzer. Drop a .pcap file, ask questions in plain English — get answers backed by real tshark data.
emisar★ 331
AndrewDryga · Elixir
Let AI agents investigate and operate infrastructure through declared actions, bounded by policy and host-side checks. Approvals when required, with an audit trail. By Protectorate.
brain0★ 316
Brain0-ai · Rust
The black box for AI-written code. Passive decision graph linking every commit to the agent prompts behind it: drift detection, DLP audit of what agents read, evidence-driven risk, MCP memory for coding agents, signed provenance attestations. One command, offline by default.
LazyOwn★ 300
grisuno · HTML
LazyOwn RedTeam/APT Framework is the first RedTeam Framework with an AI-powered C&C, featuring rootkits to conceal campaigns, undetectable malleable implants compatible with Windows/Linux/Mac OSX, and self-configuring backdoors. With its Web interface and powerful Console Client, it is the best comb
claudit-sec★ 299
HarmonicSecurity · PowerShell
Security audit tool for Claude Desktop and Claude Code on macOS — single-command visibility into MCP servers, extensions, plugins, connectors, scheduled tasks, and permissions.
orchestkit★ 298
yonatangross · TypeScript
The Complete AI Development Toolkit for Claude Code. 106 skills, 36 agents, 171 hooks. Install `ork` for stable (v9.x), or `ork-alpha` for the v10 line, which ships daily.
squirrelscan★ 296
squirrelscan · TypeScript
The website QA tool for your coding agent. 300+ audit rules across SEO, performance, security, accessibility and agent experience.
BurpMCP-Ultra★ 287
Cy-S3c · Kotlin
AI-powered MCP server for Burp Suite Professional — 149 tools across proxy, scanner, inline fuzzer, race conditions, guided injection, JWT/IDOR attacks, recon & OOB, with a real-time dashboard and hardened localhost security. Drive Burp from Claude Code or any MCP client.
gram★ 275
speakeasy-api · Go
The AI control plane for every agent in your enterprise, built around an enterprise-grade MCP gateway. Give each team one governed path to its MCP servers, provisioned by role from the IdP you already run, with security policy enforced on every action.
Doberman-Core★ 275
DobermanCore · Python
Your AI's guard dog. Doberman sits at runtime, gating every input, output and tool call to stop unsafe or unintended actions before they execute.
falcon-mcp★ 273
CrowdStrike · Python
Connect AI agents to CrowdStrike Falcon for automated security analysis and threat hunting
mcp-for-stata★ 270
SepineTam · Python
Stata-MCP: A MCP server for integrating Stata into your agent loop with a safety-first design.
Coff0xc · Python
MCP-native security automation workbench (SDK + CLI + MCP) — authorized testing + static AI/MCP attack-surface self-audit to SARIF / GitHub Code Scanning
Wazuh-MCP-Server★ 257
gensecaihq · Python
Production-grade MCP server for Wazuh SIEM — 55 security tools for alert triage, threat hunting, vulnerability management, compliance (PCI DSS, GDPR, HIPAA, NIST CSF, ISO 27001) and active response. Connect Claude or any LLM to your SOC. OAuth 2.1, RBAC, multi-cluster, air-gap ready.
santosomar · Python
Hands-on code, labs, and reference material by Omar Santos for building, securing, and operating AI agents in cybersecurity.
guardana★ 256
guardana · Python
Open-source AI security verification for model artifacts, live endpoints, MCP servers, and recorded agent traces. Reproducible evidence for release decisions.
MCP-Defender★ 255
MCP-Defender · TypeScript
Desktop app that automatically scans and blocks malicious MCP traffic in AI apps like Cursor, Claude, VS Code and Windsurf.
Arkana★ 253
JameZUK · Python
Arkana - Your entire malware analysis lab, behind one AI prompt. 250+ MCP tools for binary analysis with Claude Code or other MCP
SCStelz · Python
Automated security investigation tool using Microsoft MCP Servers, GitHub Copilot, Python Modules and custom copilot-instructions.
frishtik · Python
MCP server exposing multiple OSINT tools for AI assistants like Claude
autopentest-ai★ 243
bhavsec · Python
Agentic Pentesting MCP server that discovers, exploits, and reports web application vulnerabilities.
agent-audit★ 241
HeadyZhang · Python
Static security scanner for LLM agents — prompt injection, MCP config auditing, taint analysis. 51 rules mapped to OWASP Agentic Top 10 (2026). Works with LangChain, CrewAI, AutoGen.
secops-mcp★ 220
securityfortech · Python
All-in-one security testing toolbox that brings together popular open source tools through a single MCP interface. Connected to an AI agent, it enables tasks like pentesting, bug bounty hunting, threat hunting, and more.
parse-dmarc★ 219
dmarcguardhq · Go
DMARC aggregate report parser with a built-in dashboard. One Go binary, IMAP in, SQLite, Prometheus metrics, MCP server. Apache-2.0.
node9-proxy★ 219
node9-ai · TypeScript
Access control for AI agents. Set what Claude Code, Codex, Gemini, Cursor and any MCP server are allowed to do, review risky actions before they run, and keep every action on the record.
Reversecore_MCP★ 212
sjkim1127 · Python
A security-first MCP server that empowers AI agents to perform automated reverse engineering, malware analysis, forensics, vulnerability research, and SAST — powered by Radare2, YARA, LIEF, Capstone, and more.
MobileRE-Skill★ 211
index-login · JavaScript
AI Agent 驱动的移动端逆向技能集：Frida hook、一键脱壳、反检测绕过、内存 DEX dump、Ghidra MCP 符号/结构恢复。AI-agent skill system for mobile reverse engineering.
mcp-shell-server★ 201
tumf · Python
Secure MCP server for whitelisted shell command execution with stdin, argv pipelines, timeouts, and structured audit logging.
repo-forensics★ 196
alexgreensh · Python
Offline security scanner for AI-agent repos, skills, plugins, and MCP servers.
dev-machine-guard★ 193
step-security · Go
Scan your dev machine for AI agents, MCP servers, IDE extensions, and suspicious packages - in seconds.
wirken★ 192
gebruder · Rust
The enterprise gateway for autonomous agents. Identity management, per-channel isolation, credential vault, per-session tamper-evident audit log.
permit0★ 191
permit0-ai · Rust
Stop AI agents from doing things they shouldn't. The action authorization layer — pre-execution, deterministic, policies included. Drop in. Day one.
OWASP · Python
Runtime defense against memory poisoning in AI agents (OWASP ASI06). Drop-in for LangChain, OpenAI Agents, AutoGen, CrewAI and mem0.
sallyport★ 189
OlegSotnikov · Swift
A Mac vault that runs authenticated actions for AI agents over MCP. The agent gets the operation, never the key: no command reveals a stored credential, and there is no export route.
openclaw-mcp★ 188
freema · TypeScript
🦞 MCP server for OpenClaw - secure bridge between Claude.ai and your self-hosted OpenClaw assistant with OAuth2 authentication
jentic-one★ 187
jentic · Python
Self-hosted execution layer for AI agents: connect any agent to real APIs, scope exactly what it can touch, and keep credentials out of the agent's hands.
narsil-mcp★ 185
postrv · Rust
Rust MCP server for comprehensive code intelligence - 90 tools, 32 languages, security scanning, call graphs, and more
BugTraceAI-CLI★ 183
BugTraceAI · Python
Agentic web-scanning engine with a terminal workspace, specialist tools, browser validation, reports, REST and MCP.
mcp-shodan★ 179
w0h1v · TypeScript
MCP server for Shodan — search internet-connected devices, IP reconnaissance, DNS lookups, and CVE/CPE vulnerability intelligence. Works with Claude Code, Codex, Gemini CLI, and Claude Desktop.
mcp-shark★ 179
mcp-shark · JavaScript
Wireshark-like forensic analysis for Model Context Protocol communications Capture, inspect, and investigate all HTTP requests and responses between your IDE and MCP servers
deliberation★ 178
antonbabenko · JavaScript
Ask Codex, Gemini, Grok, and 400+ OpenRouter models (Qwen, Kimi, DeepSeek) for second opinions or arbiter-mediated consensus. One MCP server for Claude Code, Codex, Cursor, Kiro, OpenCode. Measures the models' usefulness, too.
cli-mcp-server★ 177
MladenSU · Python
Command line interface for MCP clients with secure execution and customizable security policies
ggsrun★ 172
tanaikech · Go
High-performance Google Drive CLI and Model Context Protocol (MCP) Server for LLM/AI agents. Natively execute Google Apps Script (GAS) under a secure whitelisted runtime sandbox, automate transfers, and manage Drive infrastructure.
toolhive-studio★ 172
stacklok · TypeScript
ToolHive is an application that allows you to install, manage and run MCP servers and connect them to AI agents
Consensus-OSINT★ 170
OSINT-Experts-Society · Python
🔎 Username, email & phone OSINT — 9,700+ lookup checks from 19 projects, with profile enrichment, bulk searches, evidence graphs and expert-reviewed updates.
Hexstrike-redteam★ 170
Yenn503 · C++
AI-powered MCP penetration testing framework combining HexStrike's 150+ security tools with BOAZ's advanced payload evasion (77+ loaders, 12 encoders). Features 12+ autonomous AI agents for bug bounty, CTF, CVE intelligence, exploit generation, and red team operations.
geiger★ 167
Atomburstofficial · JavaScript
A Geiger counter for AI agents — one read-only command that inventories every agent, MCP server, plugin, and AI extension on a machine
docker★ 165
decionis · Go
Govern consequential AI agent actions in Docker with deterministic policy, human approval, and signed Decision Dossiers.
mcp-audit★ 165
apisec-inc · Python
See what your AI agents can access. Scan MCP configs for exposed secrets, shadow APIs, and AI models. Generate AI-BOMs for compliance.
disrobe★ 159
1-3-7 · Rust
Static decompiler, deobfuscator, and unpacker for reverse engineering and malware analysis: Python decompiler (3.8-3.15), PyInstaller extractor, PyArmor unpacker, JavaScript deobfuscator (obfuscator.io, JS-Confuser, webpack), Android APK and Java decompiler, .NET deobfuscator, UPX unpacker, Lua, PHP
Aegis★ 158
antropos17 · JavaScript
Windows-first desktop oversight for AI agents: live monitoring, local security reviews, token usage, audit reports and opt-in action policies/MCP gateways. Experimental Hyper-V guest execution; macOS/Linux experimental.
mcp-jenkins★ 155
lanbaoshen · Python
The Model Context Protocol (MCP) is an open-source implementation that bridges Jenkins with AI language models following Anthropic's MCP specification. This project enables secure, contextual AI interactions with Jenkins tools while maintaining data privacy and security.
aws-solutions-library-samples · TypeScript
This Guidance demonstrates how to securely run Model Context Protocol (MCP) servers on the AWS Cloud using containerized architecture. It helps organizations implement industry-standard OAuth 2.0 authentication while protecting server deployments with multiple security layers, including content deli
mcp-virustotal★ 152
w0h1v · TypeScript
MCP server for VirusTotal API — analyze URLs, files, IPs, and domains with comprehensive security reports, relationship analysis, and pagination support.
gopher-mcp★ 152
GopherSecurity · C++
C++ MCP SDK - build Model Context Protocol (MCP) servers and clients in C++ / CPP. Enterprise-grade security, observability, connectivity. Stdio, HTTP+SSE, Streamable HTTP, WebSocket, TCP transports. Bindings for Python, TypeScript, Go, Rust, Java, C#.
pentest-mcp★ 150
DMontgomery40 · JavaScript
NOT for educational purposes: An MCP server for professional penetration testers including STDIO/HTTP/SSE support, nmap, go/dirbuster, nikto, JtR, hashcat, wordlist building, and more.
Tracekit★ 150
Cygnux-Labs · Python
Tamper-evident tracing, policy gates and cross-checks for AI agents: see what the agent did, and why.
code-pathfinder★ 143
shivasurya · Go
Static Code Analysis for security teams with Inter file taint analysis. Built for finding vulnerabilities, advanced structural search, derive insights and supports MCP
SecureMCP★ 140
makalin · Go
SecureMCP is a security auditing tool designed to detect vulnerabilities and misconfigurations in applications using the [Model Context Protocol (MCP)](https://modelcontextprotocol.io/introduction). It proactively identifies threats like OAuth token leakage, prompt injection vulnerabilities, rogue M
shellward★ 139
jnMetaCode · TypeScript
AI 应用合规网关 · 一行命令体检 AI 项目的「数据出境 / 硬编码密钥 / 个人信息暴露」（网安法·PIPL·等保2.0·数据出境·AI标识），并给出境内模型替代建议；可作运行时防护拦截注入与数据外泄 · 中文优先 · 零依赖 · 开源
AI-Surface★ 138
apisec-inc · Python
Find and govern AI attack surfaces in application code, at PR time and inside your AI coding tool (MCP server, Claude Code hook). Free, OSS, runs offline.
mcp-watch★ 138
kapilduraphe · TypeScript
A comprehensive security scanner for Model Context Protocol (MCP) servers that detects vulnerabilities and security issues in your MCP server implementations.
mcp-observatory★ 136
KryptosAI · TypeScript
Free, MIT-licensed MCP security testing from ClearFrame. Scan, audit, compare, and review locally; continue in the ClearFrame CLI or Mac app.
caido-mcp-server★ 135
c0tton-fluff · Go
MCP server for Caido proxy integration. Enables AI assistants like Claude Code to browse, analyse, and interact with HTTP traffic.
zhin★ 135
zhinjs · TypeScript
AI-native TypeScript bot framework — one codebase for 20+ chat platforms (QQ, Discord, Telegram, Slack, WeChat…). Opt-in AI agent with MCP, tools & security policies. <10MB core.
template-repo★ 133
AndrewAltimit · Rust
Agent orchestration & security template featuring MCP tool building, agent2agent workflows, mechanistic interpretability on sleeper agents, and agent integration via CLI wrappers
OpenKeylet★ 129
omaekumiko2-create · Rust
OpenKeylet — Local password and credential manager for AI agents via MCP. Use passwords, API keys, SSH, and TOTP while keeping hidden plaintext out of model context by default.
ai-dfir-toolkit★ 129
depalmar · Python
A vendor-neutral collection of Sigma, YARA, and Suricata rules for detecting compromise of LLM applications, MCP servers, ML supply chains, AI infrastructure, AI-powered insider threats, and RAG/vector database attacks.
dreamgraph★ 127
mmethodz · TypeScript
DreamGraph is a graph-governed conceptual development environment (CDE) that turns plans, architecture decisions, and project knowledge into auditable execution through a persistent cognitive graph.
gori★ 126
hahwul · Crystal
A fast, keyboard-driven HTTP intercepting proxy and hacking & pentesting toolkit for the terminal.
openlegion★ 125
openlegion-ai · Python
Secure autonomous AI agent framework and platform. Build AI teams by describing what you want. Orchestrate agents that can do everything a human can do.
sinewaveai · JavaScript
Security scanner MCP server for AI coding agents. Prompt injection firewall, package hallucination detection (4.3M+ packages), 1000+ vulnerability rules with AST & taint analysis, auto-fix.
mcp-armor★ 124
aira-security · Python
MCP Armor continuously secures and monitors Model Context Protocol operations through static and dynamic scans, revealing hidden risks in agent-to-tool communications.
mcp-reticle★ 123
soth-ai · Rust
Reticle intercepts, visualizes, and profiles JSON-RPC traffic between your LLM and MCP servers in real-time, with zero latency overhead. Stop debugging blind. Start seeing everything.
GoSQLX★ 120
ajitpratap0 · Go
Pure-Go SQL parser, formatter, linter and security scanner for 8 dialects. Zero-copy, race-free, with an LSP and MCP server.
dvalincode★ 118
arthurpanhku · TypeScript
Independent security verification for code written by humans and AI agents. Scan, repair, then prove it — Dvalin runs your project's own checks and issues a Verified Fix Record anyone can re-derive offline. Local-first, policy-bound, MIT.
reolink-cli★ 116
reolink · Shell
Official command-line tool for Reolink IP cameras, doorbells and NVRs — LAN only, no cloud. Snapshots, PTZ, RTSP/RTMP stream URLs, two-way audio (talkback/TTS), motion and AI detection, event monitoring, VOD download. JSON output and a built-in MCP server. Works with Home Assistant, Frigate and go2r
alfred-dev★ 115
686f6c61 · Python
Tu equipo de desarrolladores en un plugin. 10 agentes, 11 skills planas, 18 comandos /alfred-dev:*. Memoria persistente, quality gates con evidencia y MCP local.
earl★ 113
mathematic-inc · Rust
Secure CLI proxy for AI agents — HCL-defined operation templates with OS keychain secrets, MCP integration, and prompt injection protection
pfsense-mcp-server★ 112
gensecaihq · Python
Model Context Protocol (MCP) server for pfSense firewall management. Control firewall rules, VPNs, DNS, DHCP and diagnostics in natural language from Claude Desktop, Claude Code or any MCP client — 333 wire-format-verified tools for the pfSense REST API, with safety guardrails, config backup and rol
opencode-chat-bridge★ 112
ominiverdi · TypeScript
Bridge OpenCode, Ferrum, and other ACP-compatible agents to Matrix, Slack, Mattermost, WhatsApp, Discord, Telegram, and Web—with permission-based security.
pentestMCP★ 111
RamKansal · Python
pentestMCP: AI-Powered Penetration Testing via MCP, an MCP designed for penetration testers.
AgentScan★ 109
7anX · Go
AI protocol scanner — discover exposed MCP servers, A2A Agent Cards, and open LLM APIs in one command. 一条命令盘点 MCP、A2A Agent Card 和 LLM 开放接口暴露面。
docker-mcp-guardian★ 109
SivaSaiKrishnaSuryadevara · Python
Security-hardened MCP server for Docker with read-only defaults, restart deny-lists, and secret redaction
ipaship-audit★ 108
atharvnaik1 · TypeScript
Let your AI Agent review your iOS/Android apps for appstore policy & security bugs with ipaShip's web app, cli, mcp or claude-skill with safety hooks layer any any llm agent you use - loopin fixes in dev stage only no more waits till submissions.
ccq1 · Python
awsome kali MCPServers is a set of MCP servers tailored for Kali Linux
schemagate★ 105
ashishsinha1602 · Python
Text-to-SQL access control: schema selection that gives the LLM only the tables the caller is allowed to read. Row-level-security-aware table pruning for LangChain, MCP and any SQL agent. Postgres, Oracle, MySQL, SQL Server. 75% fewer prompt tokens.
OffensiveSET★ 105
PentesterFlow · TypeScript
Offensive Security Dataset Generator — MCP server for generating high-quality pentesting conversation datasets for LLM fine-tuning
nothumanallowed★ 102
adoslabsproject-gif · JavaScript
Security-first platform for AI agents. 38 specialized agents, 15 AI-powered extensions, zero-knowledge multi-agent orchestration. SENTINEL WAF, Ed25519 auth, 2.6M grounding facts.
purple-mcp★ 102
Sentinel-One · Python
Access SentinelOne's Purple AI and security services through the Model Context Protocol (MCP) - query alerts, vulnerabilities, misconfigurations, and inventory
tenuo★ 101
tenuo-ai · Rust
Task-scoped authorization for AI agents. Cryptographic warrants constrain tools and arguments, prevent privilege escalation at every delegation hop, and produce signed evidence of what was allowed or denied.
sqlmap-skynet★ 100
drcrypterdotru · Python
SQLMap with Autonomous AI, phased workflows, RAG memory, and MCP Agent Tools
hacker-bob★ 100
vmihalis · JavaScript
A local MCP runtime that attacks what you own and only reports what it proved. 17 CVEs across 9 projects came out of this repo. Install: npx -y hacker-bob@latest install /path/to/project, then run /bob-evaluate target.com
mcp-trust-plane★ 100
abluva · JavaScript
Composable data security plane for Model Context Protocol. Pluggable layers — collect, analyze, guard — across 50+ enterprise providers. Open architecture.
XposedOrNot-API★ 99
XposedOrNot · Python
Open-source API to check if an email has been exposed in a data breach and monitor breaches across your verified domains. Real-time alerts and breach analytics protect your online identity.
Hx0-HawkEye★ 98
asaotomo
面向 Chrome/Firefox 的轻量级浏览器安全工作台：集成抓包、拦截改包、重放/Fuzz、编解码工作台、敏感信息检测、HawkEye MCP 与浏览器级 Agent。（A lightweight Chrome/Firefox browser security workbench for capture, interception, replay/Fuzz, codec toolkit, sensitive-data detection, HawkEye MCP, and browser-level Agent workflows.）
ramparts★ 98
highflame-ai · Rust
MCP & SKILL scanner that scans any mcp server or skills for indirect attack vectors and security or configuration vulnerabilities. Aligned with OWASP SKILL Top 10 and OWASP MCP Top 10 threats & vulnerabilities.
slither-mcp★ 98
trailofbits · Python
MCP server for Slither static analysis of Solidity smart contracts
MasterMCP★ 98
slowmist · Python
A demonstration toolkit revealing potential security vulnerabilities in MCP (Model Context Protocol) frameworks through data poisoning, JSON injection, function overriding, and cross-MCP call attacks, exposing AI security issues while providing defense recommendations. For educational and research p
rolecraft★ 96
rolecraft-sh · JavaScript
The security-first skill manager for AI agents — every install runs a security scan. Manage skills & MCP servers across 90 agents. Zero-dependency CLI.
viper★ 96
ozanunal0 · Python
🛡️ VIPER: Stay ahead of threats with AI-driven vulnerability intelligence. Prioritize CVEs effectively using NVD, EPSS, CISA KEV, and Google Gemini insights, all on an interactive dashboard
backenly★ 94
backenly · TypeScript
Autonomous backend platform. Your coding agent builds it over MCP, Backenly keeps it running: Postgres, REST APIs, auth, storage, realtime, and functions, with every change governed, verified, and reversible.
mcp-snitch★ 93
Adversis · Swift
MCP Snitch is a macOS application that intercepts and monitors MCP server communications, providing security analysis, access control, and audit logging for AI tool usage.
OWASP
A practical governance framework for organizations adopting the Model Context Protocol (MCP), the open standard that lets AI agents connect to external tools, data sources, and systems.
rampart★ 92
peg · Go
Open-source firewall for AI agents. Policy engine that audits and controls what OpenClaw, Claude Code, Cursor, Codex, and any AI tool can do on your machine.
agentgate★ 91
ciceroyang · JavaScript
Control plane for the tools agents run: inventory, evidence, policy, enforcement. Clean is only emitted when every check ran. · agent 工具层的控制面：清单、证据、策略、执行；只有每个检查都跑完，才会给出 clean。
edgecrab★ 91
raphaelmansuy · Rust
EdgeCrab 🦀 A Super Powerful Personal Assistant inspired by NousHermes and OpenClaw — Rust-native, blazing-fast terminal UI, ReAct tool loop, multi-provider LLM support, ACP protocol, gateway adapters, and built-in security hardening.
agents-shipgate★ 90
ThreeMoonsLab · Python
The deterministic merge gate for AI-generated agent capability changes — a local-first, static Tool-Use Readiness review for MCP, OpenAPI, and SDK tool surfaces. Open-source CLI + GitHub Action.
PawelKozy · Python
Hands-on MCP security lab: 10 real incidents reproduced with vulnerable/secure MCP servers, pytest regressions, and Claude/Cursor battle-tested exploit walkthroughs
Pixelworlds · JavaScript
Modular MCP server for OPNsense firewall management - 88 tools providing access to 2000+ methods through AI assistants
cve-intel★ 89
Fazmin · Rust
Local security intelligence for CVE triage - 38 data sources and 36 tools, risk scores and an MCP server for AI agents, all in native Rust. Private by default.
DocSentinel★ 88
arthurpanhku · Python
MCP server for AI agent for cybersecurity: automate assessment of documents, questionnaires & reports. Multi-format parsing, RAG knowledge base,Risks, compliance gaps, remediations.
Pantheon-Security · TypeScript
Secure NotebookLM MCP Server - Query Google NotebookLM from Claude/AI agents with 17 security hardening layers
hackmyagent★ 87
opena2a-org · TypeScript
Metasploit for AI agents: scan, attack, and fix AI agents and MCP servers. Open source security toolkit.
ProcMon-MCP★ 87
0xhackerfren · Python
An MCP to expose process monitoring and ETW tracing functionally to AI agents to assist in security work
christiangrey922 · TypeScript
Testing and observability for multi-agent delegation, MCP tools, permissions, sandboxed actions, prompts, and workflow replay.
aws-security-mcp★ 84
groovyBugify · Python
A Model Context Protocol server that connects AI assistants like Claude to AWS security services, allowing them to autonomously query, inspect, and analyze AWS infrastructure for security issues and misconfigurations.
mcp-gateway★ 84
MikkoParkkola · Rust
Unlimited MCP servers, tools and APIs. One fixed context cost. Plug every tool you own into Claude, Cursor, Codex or any MCP client: your agent sees a handful, finds the rest on demand, and never drowns in tool definitions. Self-hosted MCP gateway and proxy in one Rust binary, 100+ API integrations
pi★ 84
TGYD-helige · TypeScript
Pluggable extension packages for the Pi AI-agent runtime. Each package exposes LLM-callable tools via MCP — covering IM workspace integrations (Lark, DingTalk, WeCom), browser & computer automation, persistent memory, telemetry, task scheduling, image generation, web access, security policies, and m
ShibaClaw★ 84
RikyZ90 · Python
🐕 Self-hosted security-first AI agent · 28 providers · 11 chat channels · WebUI · 3-level memory · task-schedule · automation · skills · MCP
antares★ 84
enowdev · Go
Antares: a self-hosted AI pentest agent and assistant in one binary. Authorized penetration testing with security specialists, 7,000+ procedures and reports, plus files, shell, a real browser, memory and RAG.
elliot35 · TypeScript
Governance gateway for AI agents — bounded, auditable, session-aware control with MCP proxy, shell proxy & HTTP API. Works with Cursor, Claude Code, Codex, and any MCP-compatible agent.
mcp_zoomeye★ 82
zoomeye-ai · Python
A Model Context Protocol server that provides network asset information based on query conditions. This server allows LLMs to obtain network asset information and supports querying network asset information by zoomeye dork etc.
dotfiles★ 81
sebastienrousseau · Shell
Cross-platform developer workstation control plane powered by chezmoi — adaptive terminal themes, AI CLI workflows, read-only MCP, WASM attestations, encrypted secrets, and SLSA-verified releases.
RedTeam-Agent★ 78
ktol1 · C
RedTeam-Agent: AI-Powered Autonomous Red Team Framework via Model Context Protocol. AI红队与内网渗透自动化框架，支持 gogo, fscan, httpx, nuclei, impacket, playwright 等 15+ 渗透工具，让 LLM 直接化身安全审计黑客。
OnionClaw★ 77
JacobJandon · Python
OnionClaw™ — OpenClaw skill for full Tor dark web access: search .onion sites, fetch hidden services, rotate identity, run OSINT pipeline, craw.
cybersec-toolkit★ 77
26zl · Python
One command installs 670+ security tools on Debian/Ubuntu/Kali, Fedora, Arch, openSUSE and Termux. Its authorization-gated MCP server runs them in a disposable Kata Containers VM sandbox for Claude Code, Codex, Gemini CLI, OpenCode and other MCP clients. 872 agent skills for CTF, pentesting, bug bou
secbot★ 76
iammm0 · TypeScript
AI-powered authorized security testing workspace. Maintained on the release branch (NestJS + Ink TUI + Web/Desktop).
openpawz★ 75
OpenPawz · Rust
OpenPawz is a native, offline-first desktop AI platform (Tauri v2 + Rust) that lets you run local models or connect to any compatible provider. It gives you private-by-default agents with hybrid memory, strong security guardrails, and extensibility through built-ins plus n8n community integrations
mcp-security-standard
MCP Server Security Standard (MSSS): an open, testable security control standard for certifying MCP servers, with levels, evidence requirements, and reporting schemas.
sonatype
Sonatype component intelligence: versions, security analysis, and Trust Score recommendations
danielsogl · TypeScript
MCP server that enables AI agents to perform comprehensive web audits using Google Lighthouse with 13+ tools for performance, accessibility, SEO, and security analysis.
ArchieIndian · Python
44 plug-and-play skills for OpenClaw — self-modifying AI agent with cron scheduling, security guardrails, persistent memory, knowledge graphs, and MCP health monitoring. Your agent teaches itself new behaviors during conversation.
ai-security-crew★ 73
Srajangpt1 · Python
Security for AI coding agents, covering the code they write and the actions they take. MCP server, skills and a runtime guard.
cache-commander★ 73
juliensimon · Rust
Cache Commander — a TUI and MCP server to explore, audit, and clean developer cache directories. Scan for CVEs, find outdated packages, reclaim disk space. Supports pip, npm, Cargo, HuggingFace, Homebrew, and more.
HollyZoe · Lua
TCP-enhanced fork of Cheat Engine MCP Bridge. Connect Cursor, Copilot and Claude AI directly to local or remote Cheat Engine via TCP. Automate reverse engineering, pointer scanning, and memory analysis using natural language.
cerno★ 70
ridgebackinfosec · Python
TUI for triaging Nessus findings: import .nessus into SQLite, launch nmap/NetExec against affected hosts, track review progress across scans, and drive it all from an MCP client.
AegisGate★ 70
ax128 · Python
Open-source security gateway for LLM APIs — prompt injection detection, PII redaction, dangerous response sanitization, and audit logging. OpenAI/Claude compatible, MCP & Agent SKILL support. Drop-in proxy for AI coding agents (Cursor, Claude Code, Codex).
gobuildwp · PHP
GoBuildWP (formerly WPPilot): WordPress MCP server & AI agent for ChatGPT, Claude, Cursor, Codex. Build and edit full websites in Elementor and Gutenberg, run SEO, PageSpeed checks, safe updates, backups and security, many sites via GoBuildWP Cloud. Safety profiles, human approval, undo. Free core;
KeibiDrop★ 69
KeibiSoft · Go
Share files between devices on demand. They show up as a folder on your computer, available instantly while downloading.
bethington · Python
MCP Cheat Engine Server — provides safe, structured read-only access to memory analysis and debugging functionality through the Model Context Protocol (MCP). For developers, security researchers, and game modders.
pic-standard★ 68
pic-standard · Python
Open standard for Provenance & Intent Contracts (PIC) in AI agents. Verify intent, provenance, and evidence before high-impact tool calls.
mcp-zap-server★ 67
dtkmn · Java
Give AI agents a safe, self-hosted ZAP operator for guided web security scans, findings, reports, and production guardrails.
opena2a-org · Go
The IAM layer for AI agents: cryptographic identity, capability authorization, and audit trails for non-human identities.
rocklambros · HTML
MCP server implementation for NIST Cybersecurity Framework 2.0
zettelforge★ 66
ThreatRecall · Python
Agentic memory for CTI in Python — STIX knowledge graphs, threat-actor alias resolution, offline-first RAG, MCP server for Claude Code and LangChain agents
nuguard★ 66
NuGuardAI · Python
AI red-teaming tool and LLM security framework to evaluate agentic AI applications. Tests prompt injections, handles vulnerability assessment, SBOM generation, and static analysis.
skillhawk★ 66
Berserk-hub150 · JavaScript
Catch dangerous AI agent skills before they catch you. Zero-dependency security scanner for Agent Skills, SKILL.md and MCP configs.
panguard-ai★ 65
panguard-ai · TypeScript
Open-source security platform for AI agents -- audits skills before install, monitors 24/7, shares threat intelligence across all users. | AI Agent 開源安全平台 -- 安裝前審計 skill、24/7 即時監控、社群共享威脅情報。
federated-mcp★ 65
ruvnet · TypeScript
This implementation follows the official MCP specification, including proper message framing, transport layer implementation, and complete protocol lifecycle management. It provides a foundation for building federated MCP systems that can scale across multiple servers while maintaining security and
alter-zero★ 63
linuztx · Rust
RAM efficient terminal agent harness for coding, cybersecurity, and automation.
deptrust★ 61
clidey · Go
deptrust is a CLI that checks package versions for known vulnerabilities across npm, PyPI, crates.io, Go modules, RubyGems, NuGet, Maven, Packagist, pub.dev, CocoaPods, Hex.pm, Hackage, GitHub Actions, and more. It runs locally as a CLI and as an MCP server, comes with a skill, and a hook.
VibeRaven★ 61
ohad6k · JavaScript
Keep changing the app you built with AI, and see that each change works. Your own coding agent makes the edit; VibeRaven shows the steps, your checks, the running app and the diff, with Undo. For Vercel + Supabase apps from Lovable, Bolt, Cursor or Claude Code.
pentester-mcp★ 60
halilkirazkaya · Python
Elevate your AI assistants (like Claude & Cursor) into autonomous cybersecurity experts. Pentester-MCP integrates 200+ pentesting tools via the Model Context Protocol (MCP) using a secure Docker sandbox.
Wazuh-Autopilot★ 60
gensecaihq · Python
Agentic SOC for Wazuh built on Strands Agents: a 13-agent swarm with 37 Wazuh-verified skills triages, investigates and plans response through the Wazuh MCP Server. Policy-gated autonomy, approvals, RBAC, audit, tracing and evals in one Docker stack. Bedrock, Anthropic, NVIDIA NIM, vLLM, LiteLLM or
helm-ai-kernel★ 60
Mindburn-Labs · Go
Fail-closed execution firewall for AI agents: quarantine MCP tools, proxy OpenAI-compatible requests, emit signed receipts, and verify EvidencePacks offline.
kastell★ 60
kastelldev · TypeScript
Provision, secure, backup, and manage self-hosted servers — full lifecycle, one CLI.
cyvisguard★ 58
flankerhqd · TypeScript
Security control plane for AI agents — identity and delegation, capability policy, data-flow taint and a live audit trail, enforced over MCP. Guards a real Claude Code end to end.
enkryptai · Python
Secure MCP Gateway - Setup Admin level gateway functionality for MCP servers - with guardrails at each MCP server to overcome multiple security issues with using MCPs
MCP-Scanner★ 58
knostic · Python
Advanced Shodan-based scanner for discovering, verifying, and enumerating Model Context Protocol (MCP) servers and AI infrastructure tools over HTTP & SSE.
studio-mcp★ 58
snyk · Go
Easily find and fix security issues in your applications leveraging Snyk platform capabilities.
BurpMCP★ 57
swgee · Java
Burp Suite Extension with MCP Server to enhance manual application security testing
SquidC5★ 57
SquidSec · Python
Security-first AI-native C5 teamserver (Command · Control · Cognitive · Collaborative · Coordination) for authorized red team & pentest. Built by SquidSec.
qianniuspace · TypeScript
A powerful MCP (Model Context Protocol) Server that audits npm package dependencies for security vulnerabilities. Built with remote npm registry integration for real-time security checks.
orca-skills★ 55
orcasecurity · Python
Skills and plugins to accelerate security workflows with the Orca Cloud Platform
OWASP · Python
Executable security regression testing for agentic applications and MCP-integrated systems.
inkscape-mcps★ 55
grumpydevorg · Python
Inkscape MCP Server - FastMCP-based server for Inkscape CLI and DOM operations with security boundaries and automatic parameter flattening
agent-passport-system · TypeScript
Open protocol and TypeScript SDK for AI agent authority: identity, scoped delegation, enforcement before the action, and signed receipts.
roblox-dev-skill★ 54
MSayib · Python
An agent skill that turns AI coding assistants into Roblox development experts: Luau, engine APIs, architecture, anti-exploit security, and how to drive Studio's built-in MCP server safely. Version-stamped against a specific Studio/Luau release. Works with Claude Code, Antigravity, Codex, and any Sk
sofagent★ 54
KongFangXun · TypeScript
sofagent is an open-source FDE Harness for AI coding agents — on entry, write your business judgment into files (workflows, ontology, AI nodes); after departure, audit every change against them. 28 codified audit rules, tamper-evident chain, snapshots, and an MCP toolset (104 tools, 11 plugins). Eve
penthera★ 54
danoszz · JavaScript
Offline cyber security agent for your apps and AI coding tools. Open R&D: measured in public, improved every release.
AI-SOC-Agent★ 53
M507 · Python
Blackhat 2025 presentation and codebase: AI SOC agent & MCP server for automated security investigation, alert triage, and incident response. Integrates with ELK, IRIS, and other platforms.
huntkit★ 53
assafkip · Shell
Investigation toolkit for Claude Code: case management, OSINT, structured analytic techniques, chain-of-custody evidence capture, and bundled threat-intel MCP servers.
alpadalar · Python
MCP server for Active Directory over LDAP: users, groups, computers, OUs and security auditing.
Cyreslab-AI · TypeScript
MCP server for Shodan — host/network recon, CVE and exploit lookup, InternetDB, and persistent alerts (34 tools).
flare-redact★ 52
flare-collection · TypeScript
Zero-dependency TypeScript secret and PII redaction for any SDK, logs, HTTP, LLM prompts, and scoped MCP tool boundaries.
zebbern-kali-mcp★ 51
zebbern · Python
MCP server for Kali toolkit (docker) - 121 tools for AI-assisted security testing give agents access to all it needs!
mcp-dnstwist★ 51
w0h1v · JavaScript
MCP server for dnstwist, a powerful DNS fuzzing tool that helps detect typosquatting, phishing, and corporate espionage.
sfr-development · Rust
AI-Powered Offensive Security Research Engine - desktop-native security testing platform with native MCP integration. 90 tools, MITM proxy, stealth browser, autonomous AI agent. Built on Tauri + Rust + React.
Farenhytee · Python
Open-source security audits for Supabase: a read-only MCP server, a CLI agent and a Claude Skill. Finds RLS misconfigurations, exposed keys and risky functions, and returns a scored report with fix SQL. Hosted version: Locksoup.
WYRE-AI · Astro
The community-driven Claude Code plugin marketplace for MSPs — 70+ plugins across PSA, RMM, security, documentation, and accounting, plus cross-vendor industry workflow packs (ops, security, finance, compliance, sales, DevOps, cloud infra) that compose whatever tools you have connected.
codeinspectus★ 49
Synvoya · TypeScript
Local-first MCP security scanner for AI-generated apps. Scan → fix → rescan from Claude Code, Cursor, Codex, and other agents.
ephemora-cell★ 48
MichaelS1011 · Python
Ephemeral, stateless, capability-bound execution for untrusted AI and agent-generated code.
sandraschi · Python
Windows Computer Use for AI Agents. Both a tool (22 MCP tools for click, type, screenshot, OCR, UI inspection) and an agent (autonomous mission engine, macro recorder, intent-based discovery, event watchers). Built with opencode (DeepSeek V4). Ships as MCP server, web UI, and Tauri desktop app.
mcp-panther★ 47
panther-labs · Python
Write detections, investigate alerts, and query logs from your favorite AI agents
VulneraMCP★ 47
telmon95 · TypeScript
An AI-Powered Bug Bounty Hunting Platform - Comprehensive MCP server for security testing, vulnerability research, and bug bounty hunting
Frequently asked questions
What is the best MCP server for security testing?
By GitHub stars, the most adopted security testing entries on MCP Harbor are RuView (★99,349), SkillSpector (★21,135) and hexstrike-ai (★13,054). Popularity is a starting point only. Check whether the project is maintained by the vendor, when it was last updated and which permissions it needs, then try it on a test account before giving it real credentials.
How do I add an MCP server for security testing?
Open a listing below, copy the package name or server URL from its README, and add it to your client: claude mcp add in Claude Code, mcpServers in Cursor or Claude Desktop, servers in VS Code. The install guide has copy-paste config for each one.
How many security testing MCP servers are there?
MCP Harbor currently lists 750 projects that match security testing. 478 of them were updated in the last 30 days and 84% of the GitHub projects carry an open-source license. The list is rebuilt every day from the official MCP Registry, GitHub, npm and PyPI, so a new server shows up here on the first daily update after it meets the listing criteria.
MCP servers for other tools
Data last updated . Stars and downloads are refreshed every day from GitHub and npm.