- Conduid
- Marketplace
- #dast
MCP servers tagged dast
29 live MCP servers tagged "dast", ranked by trust score. Tags come from package metadata and repository topics, so this list covers servers across every category that work with dast.
Burpsuite MCP Server
BurpSuite MCP Server: A powerful Model Context Protocol (MCP) server implementation for BurpSuite, providing programmatic access to Burp's core functionalities.
Fuzzforge AI
AI-powered workflow automation and AI Agents platform for AppSec, Fuzzing & Offensive Security. Automate vulnerability discovery with intelligent fuzzing, AI-driven analysis, and…
Secpipe
MCP server for AI-driven security pipelines
Dark Moon
Autonomous AI pentesting engine, continuous offensive security across web, cloud, AD & Kubernetes. Agentic reasoning + real exploit execution deliver proof-based vulnerabilities.…
Vibescan
Security scanner for AI-generated ("vibe-coded") code. Runs SAST, DAST, and sandboxed exploit simulation across 15+ languages using 30+ tools. Catches what LLMs introduce bef…
Irulescan
:shield: irulescan - security analyzer for iRules
Mcpaudit
Zero-config security auditor and dynamic fuzzer for Model Context Protocol (MCP) servers
Audit
Zero-config security auditor and dynamic fuzzer for Model Context Protocol (MCP) servers
Burpsuite MCP Server
MCP server for Burp Suite Professional's REST API.
Sf Security Review Toolkit
Take an AppExchange / AgentExchange security review from audit to an honest readiness verdict, end to end.
Zap MCP Server
Production-grade OWASP ZAP MCP server for authorized penetration testing and bug-bounty workflows (67 curated tools, authenticated scanning, target authorization policy).
Blackduck Polaris MCP Server
Feature-rich MCP server for Black Duck Polaris — 66 tools for scan management, findings, reports, policies, and more
Zap MCP Server
Production-grade OWASP ZAP MCP server for authorized penetration testing and bug-bounty workflows (67 curated tools, authenticated scanning, target authorization policy).
DevSecShield Public
DevSecShield is a unified, AI-powered Devsecops assistant designed to provide comprehensive security analysis across multiple dimensions of modern software development. From tradi…
EAtheria Security
Self-hosted application security platform: SAST, DAST and SCA with AI false-positive validation. OWASP Top 10/CWE mapping, SBOM export, CI/CD integrations and MCP server.
Overstep
Authorization testing for REST APIs and MCP servers. Declare who may do what as a matrix, and overstep turns it into positive and negative tests that catch BOLA, BFLA, BOPLA and p…
Surface Audit
Deterministic security smoke tests for preview, staging, and pre-deploy web URLs.
Hacking The LLM AI Goat Red Team
Red teaming AI Goat™ to explore OWASP Top 10 for LLM Applications (2025), prompt injection, RAG poisoning, MCP-assisted auditing, and AI security vulnerabilities.
Batesian
Active security scanner for A2A and MCP servers
Binhunt
Game/desktop binary integrity scanner that fingerprints executables, detects common packers/obfuscators, and diffs against a known-good baseline to catch tampering.
Deeplinkfuzz
Fuzzes Android/iOS deep links, intents, and custom URL schemes against an emulator/device to surface unvalidated-redirect, injection, and component-hijack bugs.
Apkpeek
One-command static triage of Android APK/AAB binaries: surfaces hardcoded secrets, exported components, dangerous permissions, and insecure manifest flags as a single SARIF report.
Mcpsnare
Active security scanner that pentests MCP (Model Context Protocol) servers. Triggers and out-of-band-confirms real vulns (RCE, SSRF, path traversal, auth bypass) with graded confi…
AI Protect
AI-application security assurance pipeline: tier-aware SAST · DAST · AI red-team scanning with a findings dashboard, CVE intel feeds & auto-remediation. For AppSec & platform team…
Hookcraft
Generates ready-to-run Frida instrumentation scripts from a YAML intent (e.g. 'bypass SSL pinning', 'dump crypto keys') and verifies they attach to a target process.
Semsift
Lightweight semantic-aware SAST that runs curated taint rules over diffs only, so PRs get fast incremental SAST instead of whole-repo scan fatigue.
Sbomx
Generates a CycloneDX SBOM for mobile apps by unpacking native libs and bundled SDKs, then matches components against known-vuln and tracker/privacy databases.
Dastlite
A headless, config-as-code DAST runner that crawls an authenticated web/mobile-API surface and fires a curated active-scan ruleset, emitting deduplicated SARIF.
Mobile Security Research Framework
Self-contained Mobile & IoT SAST/DAST/pentest toolkit: MobSF + Frida + objection + mitmproxy + rooted emulator, as a desktop app, CLI and MCP server.