- Bug Bounty Intelligence @holistis/bug-bounty-intelligence-mcpAI security scanner for Solidity + free CC0 dataset of Sherlock audit-competition acceptance rates.12% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.9 GitHub stars.
- BlackVeil DNS & Email Security Scanner @blackveilsecurity/dnsDNS and email security scanner with 81 MCP tools for SPF, DMARC, DNSSEC, SSL, and brand audits.9% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.9 GitHub stars.
- PreClick — An MCP-native URL preflight scanning service for autonomous agents. @preclick/preclick-mcpPreClick scans links for threats and confirms intent match with high accuracy before agents click.6% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.6 GitHub stars.
- Skill Audit @eltociear/skill-audit-mcpMCP server: static security scanner for MCP servers, agent skills & plugins. 17 attack patterns.6% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.5 GitHub stars.
- Gitleaks Cloud - GitHub API Key Hunter & Secret Scanner @anshumanatrey/gitleaks-github-secret-scannerGitleaks Cloud - GitHub API Key Hunter & Secret Scanner26% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; it needs your API key.3 GitHub stars.
- Pentest Tools MCP @pentest-tools/mcp-serverMCP server for Pentest-Tools.com: run scans, manage findings and reports via your preffered LLM.8% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; it needs your API key.3 GitHub stars.
- Bounty Operator @bountyoperator/bounty-operatorArgues against a security finding or a draft bug bounty report before you submit it.7% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.2 GitHub stars.
- Android Security Analyzer @ako2345/android-security-analyzerMCP server for static security analysis of Android source code4% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.2 GitHub stars.
- WhisperGraph @whisper-sec/whisper-graphThe internet's infrastructure graph for AI agents - 46B nodes and edges, free trial via 2 HTTP calls13% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; you sign in with your account.1 GitHub stars.
- DechoNet MCP @dechonet/mcp25 security tools for AI agents: phishing links, exposure maps, DNS, SSL, PQC, history, pivots.9% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.1 GitHub stars.
- AgentAegis @astafford8488/agentaegisPay-per-call cybersecurity for AI agents: vuln scans, threat intel, compliance, code security.9% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.1 GitHub stars.
- pentest-mcp-server @cyanheads/pentest-mcp-serverOffline methodology engine for authorized penetration testing, CTF, and security research.9% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.1 GitHub stars.
- Betterleaks Cloud - GitHub, Git, S3, Dir Secret Scanner @anshumanatrey/betterleaks-cloudBetterleaks Cloud - GitHub, Git, S3, Dir Secret Scanner16% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; it needs your API key.
- Swamp @swampai/swampAn open habitat where security agents register themselves, work in public, and rerun each other.14% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
- PYRESEC - AI Code Security Auditing @renaat-s/pyresec-agentAI code security audits via x402 USDC: $0.01 scans, $0.50 audits, $5 auto-fixes. SAST/SCA.12% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
- MCP Security & Vulnerability Auditor @ansarii/mcp-security-auditorStatic AST security scanner detecting command injection, leaked secrets, and SSRF in MCP tools.10% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
- Censys @pipeworx-io/censysCensys MCP — internet-scan search over the Censys Platform API (censys.com)8% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
- MEOK Hardening @csoai-org/meok-mcp-hardening-mcpMEOK MCP Hardening MCP — automated security red-team for any MCP server. Maps OWASP LLM Top 1021% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
- WP HealthKit @wphealthkit/mcp-serverSecurity audits for WordPress plugins and themes — 62 verification layers, fix plans and SBOMs.8% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; it needs your API key.
- Sitelemetry @sitelemetry/sitelemetryOAuth website audits: security, SEO, AI visibility, integrations, accessibility and performance.6% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; you sign in with your account.
- Aribot @aristiun/aribotThreat modeling, code/cloud/pipeline scanning, shadow-AI discovery, compliance checks and fixes.7% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
Penetration testing MCP servers
A server here scans apps, sites or networks for security holes, attack-surface recon, pentesting.
Not here: software QA testing.
179 remote266 localTagged by Odel's AI, which can make mistakes
Most popular in Penetration testing
By GitHub stars, at most two per publisher- Number 1: ContrastAPI@contrastcyber/api55 tools, 7 Resources, Sigma rules, email SPF/DMARC, MITRE, CVE/KEV, risk_score. No key.10% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.33 GitHub stars.
- Number 2: Domain Intelligence@oti-labs/domain-intelligenceWHOIS/RDAP, DNS, SSL, live subdomains with IPs, and SPF/DMARC/DKIM for any domain.8% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.14 GitHub stars.
- Number 3: Trent@trent/trentSecurity reviews, threat models over a repo or website, and remediation tracking, in your editor.8% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; you sign in with your account.9 GitHub stars.
