- Reversecore MCP @sjkim1127/reversecore-mcpSecurity-first MCP server for reverse engineering, malware analysis, forensics, and SAST.7% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.208 GitHub stars.
- Shodan @w0h1v/shodanMCP server for Shodan API — device search, IP lookup, DNS, and CVE/CPE queries.7% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.174 GitHub stars.
- Observatory @kryptosai/mcp-observatoryMCP security scanner. CI-native testing, attack simulation, health scoring, and SARIF.6% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.141 GitHub stars.
- Dvalincode @arthurpanhku/dvalincodeDeterministic security scanning, no model or API key, plus offline-verifiable proof a fix worked.6% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.120 GitHub stars.
- cloud-audit @gebalamariusz/cloud-auditAWS security scanner with attack chain detection, IAM privilege escalation, and fixes12% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.72 GitHub stars.
- Cybersec Toolkit @26zl/cybersec-toolkitAuthorization-gated MCP server to discover and run 670+ security tools for CTF, pentest, and DFIR.9% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from Docker.69 GitHub stars.
- MCP ZAP Server @dtkmn/mcp-zap-serverSafe, self-hosted ZAP operator for guided AI security scans and reports.4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from Docker.67 GitHub stars.
- Snyk MCP @snyk/mcpEasily find and fix security issues in your applications leveraging Snyk platform capabilities.4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.55 GitHub stars.
- runZero MCP @servosity/runzero-mcpEvery runZero query, plus a local SQLite copy of your whole attack surface that diffs over time8% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from MCPB.47 GitHub stars.
- CodeInspectus @synvoya/codeinspectusLocal-first MCP security scanner and CLI for AI-generated applications.4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.47 GitHub stars.
- Mythos Agent @mythos-agent/mythos-agentOpen-source AI security agent: SAST, DAST, and policy-as-code over MCP.7% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.44 GitHub stars.
- Solana Security Standard @copenhagen0x/solana-security-mcpScan Solana/Anchor code against the Solana Security Standard and serve the ruleset to MCP clients.4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.38 GitHub stars.
- ContrastAPI @contrastcyber/api55 tools, 7 Resources, Sigma rules, email SPF/DMARC, MITRE, CVE/KEV, risk_score. No key.10% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.33 GitHub stars.
- agent-bom @msaad00/agent-bomSecurity scanner and graph for agentic infrastructure — agents, MCP, runtime, and blast radius.5% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.31 GitHub stars.
- AynOps @aynops/aynopsAynOps is a reconnaissance focused MCP Server which gives reconnaissance capabilities to AI Clients18% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.27 GitHub stars.
- Operant @operantlabs/operant-mcpSecurity testing MCP server for penetration testing, forensics, and vulnerability assessment12% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.25 GitHub stars.
- Domain Intelligence @oti-labs/domain-intelligenceWHOIS/RDAP, DNS, SSL, live subdomains with IPs, and SPF/DMARC/DKIM for any domain.8% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.14 GitHub stars.
- Ntobjmanager @lupingqaq/ntobjmanager-mcpStateful Windows RPC attack-surface research for AI agents: 22 tools on NtObjectManager.Not assessed yet.Runs on your machine, installed from a package registry.14 GitHub stars.
- Bawbel Scanner @bawbel/scannerSecurity scanner for MCP servers and skill files. Detects AVE vulnerabilities before production.6% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.12 GitHub stars.
- HackTricks MCP Server @xplo8e/hacktricks-mcp-serverSearch and query HackTricks pentesting documentation with quick lookup and section extraction14% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.10 GitHub stars.
- PerspectiveGraph @luiacuaniello/perspectivegraphRead-only attack-path tools: reachable routes to sensitive assets, and what a fix would cut.12% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from Docker.9 GitHub stars.
Penetration testing MCP servers
A server here scans apps, sites or networks for security holes, attack-surface recon, pentesting.
Not here: software QA testing.
179 remote266 localTagged by Odel's AI, which can make mistakes
Most popular in Penetration testing
By GitHub stars, at most two per publisher- Number 1: Jshookmcp@vmoranv/jshookmcpSearch-first MCP server for JavaScript reverse engineering: 735 tools across 36 domains.9% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.2,035 GitHub stars.
- Number 2: OpenOSINT@openosint/openosintAI-powered OSINT agent & MCP server. 21 tools: email, breach, IP, WHOIS, DNS, Shodan, GitHub & more.11% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.1,744 GitHub stars.
- Number 3: Crowdsentinel@thomasxm/crowdsentinel-mcp-serverAI threat hunting & incident response for Elasticsearch/OpenSearch with endpoint & network forensics6% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.209 GitHub stars.
