Penetration testing MCP servers

A server here scans apps, sites or networks for security holes, attack-surface recon, pentesting.

Not here: software QA testing.

445servers
179 remote266 localTagged by Odel's AI, which can make mistakes

Best fit

253 made for this, ranked by starsRemoteLocal
  1. Hares — MCP security scanner @alialrikabi313/haresMulti-layer security scanner for MCP servers and agent skills (injection, exfiltration)15% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
  2. Security Scanner @vpatser1/mcp-server-security-scannerScan MCP configs for 30+ CVEs, prompt injection, tool poisoning; validate OAuth configs6% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
  3. index365 MCP @index365usa/index365Start index365 scans and read prioritized findings your coding agent can use.8% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
  4. ASMHunter @asmhunter/asmhunter-mcpDrive ASMHunter attack-surface monitoring from an AI agent: recon, scans, findings, reports.15% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.
  5. N0s1 @spark1security/n0s1-mcpSecret scanner for Slack, Jira, Confluence, Asana, Wrike, Linear, Zendesk, GitHub and GitLab21% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.
  6. RunSec Io MCP @runsec-io/mcpRunSec MCP server for workspace security scanning and remediation workflows.7% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
  7. Base Security Scanner @lordbasilaiassistant-sudo/base-security-scanner-mcpMCP server to scan smart contracts on Base for honeypots, rug pulls, and vulnerabilities.8% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
  8. Contract Scanner @lordbasilaiassistant-sudo/contract-scannerSmart contract security scanner — vulnerabilities, risk scores, and calldata decoding7% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
  9. Agent Security Scanner @mikehzp/agentvulnScan AI agents for tool-calling vulnerabilities: prompt leaks, hijacking, injections, and more.7% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.
  10. Safeguard @cognivators/mcp-safeguardMCP server security scanner: detects prompt injection, credential leaks, SSRF, tool poisoning.8% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.
  11. Bright Security @brightsec/mcpEnables AI agents to access Bright Security tools for app discovery and security testing.10% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from a package registry.