Penetration testing MCP servers

A server here scans apps, sites or networks for security holes, attack-surface recon, pentesting.

Not here: software QA testing.

445servers
179 remote266 localTagged by Odel's AI, which can make mistakes

Best fit

253 made for this, ranked by starsRemoteLocal
  1. SimplyScan @simplyscan/simplyscanSecurity, SEO and AI-visibility scanner for web apps · free scans and focused checks via MCP.5% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
  2. SecurityScan @apisecurityscan/securityscanScan GitHub-hosted AI skills for vulnerabilities: prompt injection, malware, OWASP LLM Top 10.13% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
  3. MCP Fortress @mcp-fortress/mcp-fortressSecurity scanner for MCP servers. Detect vulnerabilities, prompt injection, and tool poisoning.9% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
  4. QuantumScan PQC Scanner @gaiabio12-design/quantumscan-pqc-scannerPQC scanner for GitHub repos and smart contracts. Detects quantum-vulnerable ECDSA/RSA.11% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
  5. Kloudle Cloud Security Scanner @kloudle/cloud-security-scannerAWS cloud security scanners for AI agents — S3, IAM, EC2, EKS, RDS, CloudTrail, CloudWatch Logs7% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
  6. CodeVulnerability @evozim/codevulnerabilityOWASP threat scanner auditing codebases for safety leaks.27% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; it needs your API key.
  7. Opzyai Pro @opzyai/proDeep security scans of repos you own from your editor: dependency CVEs, SAST, git-history secrets.12% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; it needs your API key.
  8. Subdomain API @subdomain/subdomainsFind known subdomains of a domain. Passive data; may include historic entries. List or count.6% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
  9. ByteRay AI @byteray/byteray-mcpHunt zero-days by talking to binaries. 40+ tools. Hosted, OAuth + SSO, invite: hi@byteray.ai20% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; you sign in with your account.