- Conduid
- Marketplace
- #pentesting
MCP servers tagged pentesting
117 live MCP servers tagged "pentesting", ranked by trust score. Tags come from package metadata and repository topics, so this list covers servers across every category that work with pentesting.
Burp MCP Agents
Practical setup guides and helpers to connect Burp Suite MCP Server to multiple AI backends (Codex, Gemini, Ollama, ...).
qianniuspace/mcp-security-audit
A powerful MCP (Model Context Protocol) Server that audits npm package dependencies for security vulnerabilities. Built with remote npm registry integration for real-time security…
BurpSuite Collections
有关burpsuite的插件(非商店),文章以及使用技巧的收集(此项目不再提供burpsuite破解文件,如需要请在博客mrxn.net下载)---Collection of burpsuite plugins (non-stores), articles and tips for using Burpsuite, no crack version file
User Scanner
🕵️♂️ (2-in-1) Email & Username OSINT suite featuring native MCP support for deep data extraction just from a single Email/Username. Analyzes 465+ actively maintained scan vectors…
Burpsuite MCP Server
BurpSuite MCP Server: A powerful Model Context Protocol (MCP) server implementation for BurpSuite, providing programmatic access to Burp's core functionalities.
Reconmap
Reconmap is a collaboration-first security operations platform for infosec teams and MSSPs, enabling end‑to‑end engagement management, from reconnaissance through execution and re…
Dark Moon
Autonomous AI pentesting engine, continuous offensive security across web, cloud, AD & Kubernetes. Agentic reasoning + real exploit execution deliver proof-based vulnerabilities.…
Agentseal
Security toolkit for AI agents. Scan your machine for dangerous skills and MCP configs, monitor for supply chain attacks, test prompt injection resistance, and audit live MCP serv…
Agentseal
Security toolkit for AI agents. Scan your machine for dangerous skills and MCP configs, monitor for supply chain attacks, test prompt injection resistance, and audit live MCP serv…
AI Security Tool
🛡️ Free open-source AI-powered security terminal & vulnerability scanner (CVE, SBOM). Supports SSH, SFTP, RDP, VNC, Serial, and 12+ autonomous AI agents (DeepSeek, OpenAI) for aut…
H1 Brain
Connect your AI assistant to HackerOne by syncing bounty data and enabling detailed search and analysis with MCP-compatible tools.
Pentest Agents
Autonomous bug-bounty framework for Claude Code — 40 specialist agents, exploit-chain builder, writeup search, and live HackerOne/Bugcrowd integration.
AdStrike
AI-powered modular Active Directory red-team framework for authorized penetration testing, AD enumeration, attack-path analysis, Kerberos/ADCS workflows, reporting, operator aut…
AgentHound
Offensive security framework for AI agent infrastructure - recon, credential looting, model exfiltration, poisoning, and attack-path analysis across MCP, A2A, gateways, and AI ser…
Evil Winrm Py
Execute commands interactively on remote Windows machines using the WinRM protocol (just faster)
AI Osint
🤖 Curated AI OSINT resources — Google dorks, Shodan queries, GitHub dorks, and techniques to discover exposed LLM endpoints, leaked AI API keys, misconfigured vector databases, an…
For Security
MCP for Security: A collection of Model Context Protocol servers for popular security tools like SQLMap, FFUF, NMAP, Masscan and more. Integrate security testing and penetration t…
Cerno
TUI for triaging Nessus findings: import .nessus into SQLite, launch nmap/NetExec against affected hosts, track review progress across scans, and drive it all from an MCP client.
Awesome AI Pentesting
A curated list of AI-powered pentesting tools, frameworks, MCP servers, and resources for autonomous cybersecurity operations
Bug Bounty Agents
AI-Powered Agents for Bub-Bounty Pentesting and Red-Teaming purposes
Hacker Bob
A local MCP runtime that attacks what you own and only reports what it proved. 17 CVEs across 9 projects came out of this repo. Install: npx -y hacker-bob@latest install /path/to/…
Gori
A fast, keyboard-driven HTTP intercepting proxy and hacking & pentesting toolkit for the terminal.
Bughunter AI
Autonomous Bug Bounty Hunting Framework powered by Claude Code. 20 AI agents, state-machine orchestration, Burp Suite MCP, credential vault, LLM security track. Type 'hunt target.…
AutoWIFI
Wireless penetration testing framework. Automates WPA/WPA2/WEP/WPS attacks - recon to exploitation in one command. aircrack-ng + hashcat + PMKID.
Toolbox
Collaborative application security testing between humans and agents via CLI and MCP
Reap
reconnaissance for agent attack surfaces
Red Clippy
open-source pentest management built to be operated by an AI agent
Awesome Security Agent Harnesses
AI agents for pentesting, code audit, fuzzing, vulnerability discovery, and reverse engineering — harnesses, sandboxes, security MCP servers, benchmarks, and evals.
Mcpwn
Offensive security testing framework for MCP (Model Context Protocol) servers. Active red teaming with command injection, SSRF, RCE blind, tool poisoning detection + vulnerable la…
Outrider Recon
Claude-native, governed offensive-OSINT & external attack-surface platform for authorized red-team and bug-bounty. Multi-agent recon across web, identity, cloud, secrets & breach…
Jsowl
JsOwl —— Go 编写的 Web 安全信息收集利器。集 JavaScript 信息收集、API 端点提取、敏感信息扫描、攻击面梳理 于一体，同时提供 CLI 工具与 Go 库。内置 direct / browser / auto 三种采集模式，兼容 HaE 规则，支持登录态扫描、运行时交互、AI 辅助分析与 MCP Server，输出 JSON 与交…
Echo Adapt V5
"Local LLM agent runtime in Rust — native tool-role support, tmux session persistence, two-tier summarization, SQLite tool logging and ShareGPT logging. Optional remote tool serve…
Ramibot
RamiBot v3.8.0 is a local-first AI security operations platform integrating multi-LLM support, a dynamic red/blue team skill pipeline, MCP tool orchestration, Docker terminal acce…
Tengu
AI-powered penetration testing MCP server
Pentest AI
The most autonomous pentesting AI on the market. MCP server + Python agents with 150+ security tools, exploit chaining, and PoC validation.
Client And Proxy
A universal MCP client with proxying feature to interact with MCP Servers which support STDIO transport.
RedTeam Agent
RedTeam-MCP: AI-Powered Autonomous Red Team Framework via Model Context Protocol. AI红队与内网渗透自动化框架，支持 gogo, fscan, httpx, nuclei, impacket, playwright 等 15+ 渗透工具，让 LLM 直接化身安全审计黑客。
WonderSuite AI Bug Bounty
AI-Powered Offensive Security Research Engine - desktop-native security testing platform with native MCP integration. 90 tools, MITM proxy, stealth browser, autonomous AI agent. B…
Cheatengine MCP Tcp Bridge
TCP-enhanced fork of Cheat Engine MCP Bridge. Connect Cursor, Copilot and Claude AI directly to local or remote Cheat Engine via TCP. Automate reverse engineering, pointer scannin…
Hackbrowser MCP
The first browser MCP built for security testing. Give your AI agent a real Firefox browser and let it find vulnerabilities.
Tcpk
Thick client penetration testing and MSIX security audit toolkit for Windows. Audits .NET, Electron and native binaries: static and runtime checks, IL-verified findings, computed…
SpectreWeb AI
Self-Learning AI for Manual Web Penetration Testing
Architect To Product
Vibe code fast. Ship like an engineer. AI engineering framework packaged as an MCP server that enforces TDD, security scanning, pentesting, secret management, QA audits, and depl…
Bugbountyrules
Behavioral-discipline skill turning an AI agent into a methodical, non-robotic bug-bounty & pentest hunter - 42 always-on rules: scope, coverage, no false positives, never quits e…
AI Pentest Playbook
🛡 The reference playbook for pentesting AI chatbots & LLM-powered apps in one place. Ready-to-use payloads covering the full OWASP LLM Top 10 plus frontier vectors (MCP · RAG · A2…
Awesome Offensive MCP
A curated list of Offensive Security MCP Servers for Red Teaming & Pentesting.
Nextr4y
Golang tool for Next.js reconnaissance - uncover build IDs, routes, and assets with bot management evasion.
Burpsuite MCP Server
MCP server for Burp Suite Professional's REST API.
Kali MCP Server
A Python MCP Server that connects Large Language Models natively to a comprehensive suite of offensive security tools.
Pyntra
AI-native security testing platform - multi-agent orchestration, for authorized pentesting.