- Conduid
- Marketplace
- #blue-team
MCP servers tagged blue-team
80 live MCP servers tagged "blue-team", ranked by trust score. Tags come from package metadata and repository topics, so this list covers servers across every category that work with blue-team.
Opensquat
openSquat is an open-source tool that detects look-alike domains impersonating your brand, by scanning newly registered domains daily.
Wazuh MCP Server
Wazuh MCP Server: AI-Driven SOC Automation
DarkArk
DarkArk, Powerful Windows Anti-Rootkit(ARK)
Aptl
SOC-in-a-Box for AI purple teaming
Fengarde
Open-source, self-hosted security pipeline for IT, AI and OT. Logs in. Evidence out.: OCSF normalization, 36 detection rules (MITRE/ATLAS/ICS-tagged), correlation, evidence packag…
Ramibot
RamiBot v3.8.0 is a local-first AI security operations platform integrating multi-LLM support, a dynamic red/blue team skill pipeline, MCP tool orchestration, Docker terminal acce…
C2detect
C2 server fingerprinter — Cobalt Strike, Sliver, Mythic, Havoc, Brute Ratel
Huntable CTI Studio
Huntable CTI Studio is an AI-assisted cyber threat intelligence workbench that turns open-source CTI into Sigma rules.
FactGraph
Agent-native incident investigation graph: analysts and AI agents (MCP/REST) link evidence from EDR, Entra ID, cloud and GitHub logs into one shared, real-time attack graph and ti…
Blitzstrike
⚡ Blitz Strike — a universal MCP penetration-testing toolbelt. Structured methodology: reconnaissance & attack-surface mapping, source-to-sink analysis, and live validation. 57 es…
Huntdeck
Hunt IOCs with a tactical terminal - Next.js + FastAPI orchestrating MCP providers, Supabase auth, daily quota and BYOK.
Dfir Threat Intel Platform
A 135+ tool DFIR toolkit, a live self-updating threat-intel platform, and a 332-tool MCP server — on one Cloudflare Workers deploy. MIT licensed. Portfolio: pranithjain.qzz.io
Fedramplens
FedRAMP boundary visualizer & OSCAL-format SSP/POAM generator
Blescope
Sniff and decode BLE GATT traffic, fingerprint device profiles, and assert on insecure pairing/characteristics in CI against a capture.
Fwxray
Diff two firmware images and surface exactly what changed: new binaries, flipped config flags, added certs, and shifted entropy regions.
Yararun
Run simple YARA-style string/regex rules over a directory
Qwen Security Copilot
Chinese-first unified Qwen security copilot plugin for authorized red-team, blue-team, purple-team and lab workflows
Crackq
Self-hosted password cracking queue — multi-user hashcat with audit log
Pcapsummary
Summarize flows/talkers/protocols from a pcap text export
Approvewarden
Scans any wallet for dangerous ERC-20/721/1155 token approvals and infinite allowances, scoring drainer exposure and emitting revoke transactions.
Hayabusa
MCP server wrapping the Hayabusa Windows event log forensic analysis CLI for AI-assisted threat hunting.
Cybersec Toolkit
580+ cybersecurity tools, one command. Modular bash installer for Linux & Termux with 14 profiles, 18 modules, and an MCP server for AI-assisted ethical hacking.
Canzap
Replay, fuzz, and assert on CAN bus traffic from a .pcap or SocketCAN interface with a tiny YAML DSL.
Piiscan
PII discovery across warehouses and lakes (data-side scanner)
Egresswatch
Server-side outbound connection auditor — eBPF/Falco wrapper
ProcWitness
Passive process forensics for Windows, Linux and macOS. Records process behavior locally and produces an AI-ready evidence bundle.
Living Off The Land Lolbins MCP Server
Living off the Land LOLBins MCP Server — 59 composite tools for LOL binary intelligence across 10 catalogs (GTFOBins, LOLBAS, LOOBins, LOLDrivers, LOLRMM, LOLESXi, LOTP, LOLC2, LO…
Phishforge
Open-source phishing simulation — campaigns, templates, training
Attackmap
Map findings to MITRE ATT&CK techniques + coverage heatmap
Reposecure
One-shot repo security posture grade (secrets/CI/branch rules/deps)
Logsift
Detect brute-force, spray, and anomalous auth events in logs
Mftparse
Analyze an NTFS $MFT CSV for timestomping and suspicious file activity
Wavewatch
Offline RF signal reconnaissance & triage from capture files — detect, fingerprint & classify emitters (drone/Wi-Fi/BLE/GNSS) without demod. Defensive, zero-dependency, CLI + MCP.
Servus
[ BETA ] – Local-first AI operator for coding, browser workflows, desktop files, data/docs, media, security analysis, and custom skills/plugins.
Portfan
Summarize and diff nmap XML into prioritized, attackable findings
Ssltriage
Grade TLS config (protocols/ciphers/expiry) from openssl/sslyze output
Hotwash
Interactive incident-response runbooks: build IR playbooks as visual flowcharts, run them step-by-step, and drive runs from an LLM via MCP.
Soc Stack
One-command self-hosted SOC lab for Proxmox: Wazuh, TheHive, Cortex, MISP, Zeek, Suricata, and MCP servers for homelab blue-team training.
Daemonaudit
Red/blue security audit for self-hosted AI agent daemons — finds the secrets, the open doors, and the blast radius.
AI Security Roadmap
Bilingual, evidence-led roadmap for LLM, RAG, agent, MCP, red-team, and blue-team security.
Guardx MCP
Defensive MCP server: secret scanning, dependency CVE auditing, and breached-password checks.
Phishcheck
Score URLs/emails for phishing signals (lookalike, auth, intent)
Cookieaudit
Audit Set-Cookie flags (Secure/HttpOnly/SameSite) from a response dump
Headerscan
Grade HTTP security headers (CSP/HSTS/XFO) A-F from a response dump
Baadiff
Scan a repo or infra manifest for HIPAA Security Rule gaps and produce a Business Associate readiness scorecard.
Payloadlab
Static malicious payload analyzer — PE/ELF/LNK/macro/OneNote
K8saudit
Audit Kubernetes manifests against CIS-style security rules
Yaragen
Generate candidate YARA rules from sample files/strings
Binhunt
Game/desktop binary integrity scanner that fingerprints executables, detects common packers/obfuscators, and diffs against a known-good baseline to catch tampering.
Obscan
Conformance and security linter for Open Banking / FAPI APIs: validates OAuth flows, consent scopes, and PSD2 endpoints against the spec.