- MITRE Attack @imouiche/mitre-attack-mcp-serverMCP server providing 50+ tools for MITRE ATT&CK techniques, groups, and mitigations11% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.5 GitHub stars.
- Gitleaks Cloud - GitHub API Key Hunter & Secret Scanner @anshumanatrey/gitleaks-github-secret-scannerGitleaks Cloud - GitHub API Key Hunter & Secret Scanner26% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; it needs your API key.3 GitHub stars.
- attAck @smithery/alex-llm-attack-mcp-serverQuery and retrieve information about various adversarial tactics and techniques used in cyber atta…15% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; it needs your API key.3 GitHub stars.
- mlab.sh @mlab/mcpThreat intelligence: enrich IOCs (IP, domain, URL, hash), search CVEs and actors, scan SBOMs.8% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; you sign in with your account.2 GitHub stars.
- HoneyLabs @honeylabs/mcpHoneypot probe data: IP reputation, scanners, CVE probing, TLS and SSH fingerprints.5% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.2 GitHub stars.
- Whisper @whisper-sec/whisperOne routable IPv6 per AI agent, verifiable from the DNS root. Keyless tools need no signup.12% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.2 GitHub stars.
- DugganUSA CLI — Local STDIO MCP @pduggusa/dugganusa-cliLocal STDIO MCP for DugganUSA threat intel. 1.13M IOCs. Read-only. npm: dugganusa-cli.7% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.2 GitHub stars.
- ThreatCluster @jam0k/threatclusterLive threat intel for agents: incidents, actors, CVEs with KEV/EPSS, ransomware leak-site victims.5% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; you sign in with your account.1 GitHub stars.
- BeVigil OSINT @santhosh-005/bevigilDiscover mobile app attack surfaces via BeVigil OSINT — hosts, subdomains, URLs, and more.9% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.1 GitHub stars.
- Phishunt @0xdaniellopez/phishuntPublic phishing feed: suspicious/confirmed phishing URLs detected hourly. No auth, CC0.7% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.1 GitHub stars.
- Cybersec @xu-c0/cybersec-mcpCybersecurity MCP server: 323 prompts + 7 workflows for red team, blue team, SOC, cloud, OSINT.12% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.1 GitHub stars.
- WhisperGraph @whisper-sec/whisper-graphThe internet's infrastructure graph for AI agents - 46B nodes and edges, free trial via 2 HTTP calls13% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; you sign in with your account.1 GitHub stars.
- Eidolon @sudohnim/eidolonPrivacy-first OSINT scanner: breaches, credentials, Shodan, username sweep. Scored PDF report.23% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from a package registry.1 GitHub stars.
- OSINT MCP @rjn32s/osint-mcp26 free OSINT tools as MCP tools for AI agents. Auto-installs everything on first run.22% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.1 GitHub stars.
- Pwntools @daedalus/mcp-pwntoolsMCP server exposing pwntools 4.15.0 functionality for binary exploitation19% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.1 GitHub stars.
- Pymetasploit3 @daedalus/mcp-pymetasploit3MCP server for Metasploit Framework via pymetasploit340% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.1 GitHub stars.
- NetAPI @netapi/mcpDomain data: Top 1M domain ranks, compromised checks, new domain search, registered domain lists.6% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; you sign in with your account.
- Brand Lookalike Watch @yzf75011-ui/brand-lookalike-watchPhishing/typosquat domains imitating a brand, from CT logs. Weekly email: $2.99/mo on Gumroad.52% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; it needs your API key.
- GreyNoise @mrfentmen/greynoise-mcpMCP server for GreyNoise: IP noise classification, tags. Free key.6% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
- BlackDome Threat Intel @blackdome-ai/blackdome-mcpLive honeypot threat intel: attacker IPs, IOCs, credentials, payloads, actors.8% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.
- OSINT Toolbox @renkagod/osint-toolbox-mcpRun Sherlock, Maigret, Holehe, GHunt, theHarvester, SpiderFoot and more OSINT tools locally11% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.
- AbuseIPDB @mrfentmen/abuseipdb-mcpMCP server for AbuseIPDB: IP abuse reports, reputation. Free key.7% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from npm.
- PG1 Sovereign Threat Intelligence @project-gifted1/pg1-threat-intelThreat intel for AI agents: IOCs, CVEs (EPSS/KEV), wallet sanctions and age, domain and URL checks.7% chance this is malicious. Assessed by AI, which can make mistakes.A remote server; no sign-in.
- ZeroDOM @devhusnainai/zerodomDeterministic DOM perception for AppSec red teams and AI agents: live Chrome, attack-surface scans.16% chance this is malicious. Assessed by AI, which can make mistakes.Runs on your machine, installed from PyPI.
