Odel

Penetration testing MCP servers

A server here scans apps, sites or networks for security holes, attack-surface recon, pentesting.

Not here: software QA testing.

Penetration testingFraud & scam detectionVulnerability managementData privacyIdentity & access managementThreat intelligenceEmail & DNS securityAll of Security & privacy
445servers
179 remote266 localTagged by Odel's AI, which can make mistakes

Best fit

253 made for this, ranked by starsRemoteLocal
  1. Audit AI @audit0/auditai-mcpFinds authorization holes in Next.js + Supabase apps and live Supabase databases. No API key.20% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
  2. TokenOS Smart Contract Audit @tokenos/contract-auditScan Solidity & Anchor code6% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
  3. VAAST @xtrinel/vaastRead-only access to VAAST vulnerability scan findings, workspaces, and targets for AI agents8% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
  4. PromptBrake Free Tools @aj888/promptbrake-free-toolsFree AI test helpers: injection inputs, OWASP mapping, release plans, response and tool-call packs.11% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
  5. TLPT @tooloracle/tlptTLPTOracle — 17-tool TIBER-EU TLPT framework: scope, threat intel, scenarios, reports.10% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
  6. Aegis @verrysimatupang99/aegisCharter-bound defensive security copilot: secrets, obfuscation, deps, Dockerfile, IaC scans.8% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.
  7. Sentrysurface @sentrysurface/sentrysurfaceCybersecurity MCP server for URL scanning, threat intelligence, and domain reputation.14% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; it needs your API key.
  8. Dnstwister @mrfentmen/dnstwister-mcpDNS twister domain threat intelligence: fuzz domains for typosquatting, check whois.7% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
  9. Sectora @megabrainee/sectoraThreat intel + your scans/findings/Shield posture. CVE, EPSS, KEV, package vuln lookup, DAST.6% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
  10. Security Audit @joepangallo/mcp-server-security-auditScan websites for security vulnerabilities, headers, TLS, and email security.8% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
  11. Kryptheon @jhashantanu987-beep/kryptheonRecord a flow through your app, check it after every change, and attack a copy of your database.19% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
  12. Codeaudit @infoinlet-marketplace/mcp-codeauditSecurity audit for AI agents — scan code/diffs for leaked secrets, check deps via OSV.5% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
  13. Fray — WAF Security Testing MCP Server @dalisecurity/frayWAF security testing: 5,500+ payloads, 25 WAF fingerprints, 21 recon checks, bypass AI30% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.
  14. Hacker Bob public records @bobnetsec/hacker-bob-public-recordsRead-only public CVE records, capability metadata, and agent instructions from Hacker Bob.7% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
  15. selvo @cope-labs/selvoLinux CVE prioritisation: 16 MCP tools for scan, fleet, runtime, and PR-able fix discovery.5% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.
  16. Ecoa @ecoa/ecoaVerificação de segurança e conformidade de sites: cabeçalhos, TLS, DNS, e-mail, LGPD e pentest.9% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; you sign in with your account.
  17. Scannd @scannd/scanndTrigger security scans and read reports/vulnerabilities via the hosted Scannd API. Free: 2 scans/mo.9% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
  18. FEDLIN Scanners @fedlin/fedlin-mcp-serverExposes FEDLIN's public security scanners as agent-callable tools over Streamable HTTP.6% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
  19. Arc Security @arcself/arc-securityScan AI agent skills for 25 attack classes + runtime monitoring. 1,316+ findings.9% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
  20. MacroCyber @macrocyber/attack-surfaceScan a site or AI-built app for exposed databases, keys and MCP endpoints, then verify the fixes.15% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
  21. SecScan @secscan/secscanScan, monitor and fix a live web app from your editor: graded security reports with fix prompts.4% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
  22. XploitScan @bgage72590/xploitscan-mcpSecurity scanner for AI-generated code. 30 free rules; all 223 with a paid-plan API key.12% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
  23. Argus @thetempleofdoom/argusAgent rental platform: web-vuln scanning, OSINT and red-team tools via subscription.29% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
  24. Jsmon @jsmon/mcpDiscover exposed assets, leaked secrets, APIs & client-side vulns across your attack surface30% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; you sign in with your account.