Penetration testing MCP servers

A server here scans apps, sites or networks for security holes, attack-surface recon, pentesting.

Not here: software QA testing.

447servers
181 remote266 localTagged by Odel's AI, which can make mistakes

Best fit

254 made for this, ranked by starsRemoteLocal
  1. EverThread @pb-digital-llc/everthreadPlain-English website security check for agents: certificate, headers, scripts, forms, spam.4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
  2. Telivy @wyre-ai/telivy-mcpMCP server for Telivy's security assessment API for MSPs.4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from Docker.
  3. ZeroDOM @devhusnainai/zerodomDeterministic DOM perception for AppSec red teams and AI agents: live Chrome, attack-surface scans.16% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.
  4. Nel Veil @nelproinc/nel-veilFree passive security scanning - check any domain's DMARC, TLS, headers, and exposures.7% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
  5. Checkmarx @checkmarx/checkmarxOfficial Checkmarx MCP Server3% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from a package registry.
  6. TenantGuard @rudrendupaul/tenantguardScans self-hosted multi-tenant AI-agent platforms for tenant-isolation gaps via an MCP tool.4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.
  7. Umbra @elberacasa/umbraTrust score for AI-generated code: scan repos, guard agent file writes, get a 0-100 score.6% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
  8. O360 @offensive360/o360-mcpRun Offensive360 SAST scans (60+ languages) on local code; findings with file/line and fixes7% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
  9. Voyager Agent @dir-ai/voyager-agentOne universal Voyager: name a goal; it activates senses (repo, net) and runs a live mission.7% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
  10. Voyager Browser @dir-ai/voyager-browserVoyager's web-page sense: safe read-only observation of one live URL (structure, security, a11y).4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
  11. Scout Security @varpost/scoutDeterministic, zero-token security scanner your AI agent calls to find and re-verify issues.4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.
  12. Datahogo @datahogo/datahogoScan a project for security issues locally with the open-source Data Hogo engine.4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
  13. mcp-scan @codingselim/mcp-scanPassive security scanner: audits MCP servers against the OWASP MCP Top 10, graded A-F.5% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
  14. MCP Shield @sophiacave/mcp-shieldSecurity scanner for MCP servers. SSRF, path traversal, injection, auth, secrets. Grade A-F.7% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
  15. CyberLens @shadoprizm/cyberlens-mcp-serverSecurity scanning for websites, public repositories, and Open CLAW skills.10% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
  16. MiddleBrick MCP @middlebrick/mcp-serverScan APIs for OWASP Top 10, LLM, and GraphQL security vulnerabilities.8% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
  17. Contract Security Scanner @mastrophot/contract-security-scannerMCP smart contract scanner with NEAR-focused security context.4% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
  18. Mcpwatch @lazymac2x/mcpwatchAudit MCP servers from inside Claude Code. 10 OWASP checks, A-F grade, live leaderboard.6% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
  19. Cybersim Pro @kayembahamid/cybersim-proCybersecurity training, simulation, and incident response MCP server6% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from Docker.
  20. Audit @joepangallo/mcp-audit-serverThin MCP and CLI proxy for AI agent and MCP security auditing via a hosted backend6% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
  21. Turbopentest @integsec/turbopentestAI-powered penetration testing. Launch scans, review findings, download reports.15% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
  22. Eleion Scanner @hernaninverso/eleion-scanner-mcpRegister/verify your domains, queue security scans, and read findings (CVE, severity).6% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
  23. Heimdall @caglarbozkurt/heimdallScan an MCP server or agent config for injection, exfiltration, and risky capabilities.3% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
  24. Mund — MCP Security Scanner @tyox-all/mundScan for prompt injection, secrets, PII, and vet MCP servers before installation15% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.