- Conduid
- Marketplace
- #pentesting
MCP servers tagged pentesting
117 live MCP servers tagged "pentesting", ranked by trust score. Tags come from package metadata and repository topics, so this list covers servers across every category that work with pentesting.
Kali MCP
MCP server that gives AI assistants access to a Kali Linux Docker environment for security testing
Plonix
Open-source web security research workbench for macOS: intercept, discover, investigate, experiment, validate. CLI, local API and built-in MCP for AI agents.
Burp MCP Agents
🚀 Connect Burp Suite MCP Server to multiple AI backends with practical guides and templates for safe, real traffic analysis.
Credence
Exposure intelligence for the AI-infrastructure layer — finds and weighs leaked credentials, MCP/agent configs, git-metadata secrets, and supply-chain risk, and tells you which ex…
Hacker Agent
hacker-agent
Zothos
🜂 ZOTHOS Linux: The Cybernetic Alchemy, Frontier AI & Autonomous Agent Security Operating System 🜄
Jcyber
Agent-driven bug bounty / pentest framework: one gated chain over five systems (Caido, HexStrike, Jev, Memgraph, TencentDB, Prometheus)
Security Audit
Security auditor for MCP servers. Purpose-aware scoring, injection testing, compliance checks.
Arsenal
Plugin-First Offensive Security & Reverse Engineering Harness for Oh My Pi (OMP)
Confirmesc
Linux privesc enumerator that confirms exploitability and gives you the exact root shell command - no GTFOBins searching. MCP server + AI-agent skills included.
Zap MCP Server
Production-grade OWASP ZAP MCP server for authorized penetration testing and bug-bounty workflows (67 curated tools, authenticated scanning, target authorization policy).
CVE 2026 23744
PoC for CVE-2026-23744, demonstrating an unauthenticated RCE in MCPJam Inspector (<= 1.4.2).
H1 Brain
Connect your AI assistant to HackerOne by syncing bounty data and enabling detailed search and analysis with MCP-compatible tools.
Kali MCP
Kali Linux container exposed to AI agents via MCP, behind a gateway with a network kill-switch
Zap MCP Server
Production-grade OWASP ZAP MCP server for authorized penetration testing and bug-bounty workflows (67 curated tools, authenticated scanning, target authorization policy).
Hackers Terminal Setup
One-script macOS/Linux security terminal setup — zsh, Powerlevel10k, tmux, and pentest/bug-bounty/cloud/AI-LLM/MCP tooling, installed from an interactive menu
Prismsec
Secure, modular MCP server wrapping nmap, nuclei, gobuster, subfinder, httpx, nikto, sqlmap for AI-powered pentesting
Mcpwn
Offensive security testing framework for MCP (Model Context Protocol) servers. Active red teaming with command injection, SSRF, RCE blind, tool poisoning detection + vulnerable la…
Thru Burp
A cross-platform desktop UI MCP client specifically for proxying MCP traffic through Burp Suite Proxy. Useful for recon and fuzzing when pentesting a remote MCP HTTP server.
Sec Nmap MCP
MCP server for nmap - Network scanner and security auditing
Ovogo
Ovogo: Autonomous Red Team Coordination Engine. 基于 AI Agent 的自动化渗透测试与红队协同引擎（专为靶场环境设计），支持 MITRE ATT&CK 攻击链生成、多节点并行利用与 Flag 自动化收集。
AppInspect
Desktop app for analysing iOS and macOS binaries. View headers, strings, classes, symbols, security findings, and more.
Cybersec Toolkit
580+ cybersecurity tools, one command. Modular bash installer for Linux & Termux with 14 profiles, 18 modules, and an MCP server for AI-assisted ethical hacking.
Wifi Security MCP Server
Full-spectrum wireless security MCP server — WiFi, Bluetooth, RF/SDR, NFC/RFID, Cellular/5G, IoT, MouseJack, air-gap, UWB, WIDS/WIPS, compliance. 34 tools, 9 knowledge bases.
Bearstrike AI
🐻 BearStrike AI: High-Signal Pentesting Console (MCP-First, Model-Agnostic). Build fast, low-noise security workflows with queue-first execution, skills-aware planning, and 150+ i…
RedQuanta MCP
RedQuanta MCP transforms penetration testing into an intelligent, automated, and secure process. Built specifically for LLM integration and professional security teams, it provide…
BreachPilot
Autonomous Offensive Security Agent for Red Team Operations
Unburden
Autonomous pentesting assistant that integrates a locally deployed LLM with MCP servers to automate reconnaissance, analysis and offensive security workflows.
Pentos
Wissensgetriebener, lokaler Pentest-Workspace (CLI) für CTF, Bug Bounty & autorisierte Tests – geführte Recon, Findings/Loot/Reports, Web-Dashboard, lokale KI-Unterstützung & MCP-…
Pentest MCP Toolkit
Pentest MCP Toolkit: 50 Kali Linux security tools exposed as one MCP server over Docker stdio, built to be driven 100% by AI agents (Claude Code, Codex). For authorized pentests o…
APAIA
Android Pentest AI Assistant (APAIA) is an MCP server for Claude AI that was specifically created for Android pentesting/bug bounty purposes and aims to provide assistance for rec…
Chrome Needle
Run a private, offline AI browser agent in Chrome with 18 built-in tools and zero cloud dependencies.
Hermes Pentest Lab
AI-orchestrated, Kali-native pentesting lab: an MCP tool-server with scope/VPN/rate/audit enforced in code, independent finding verification, MITRE ATT&CK + OWASP mapping, a reusa…
Mcploit
Framework to enumerate and exploit MCP servers
Hacktricks MCP
Fast, self-hostable MCP server giving AI agents token-authenticated full-text search over the HackTricks security wiki (Cloudflare Worker + D1).
The Box MCP
MCP daemon that gives an agentic coding client a native offensive-security toolchain: MITM proxy, app graph, OOB server, CVE/report RAG and 103 tools.
BurpSuiteMcp
Local-first Burp Suite MCP extension for HTTP, WebSocket, Scanner and Collaborator workflows, with operator controls and complete AI activity auditing.
Hachiman Agent
Hachiman Agent — autonomous security layer for AI agents and MCP. Scan before deployment, authorize before access, monitor during execution, contain when compromised, report every…
Pentquiver
Fast cross-platform TUI/CLI/API/MCP command library and cheat-sheet launcher for pentesters - 2,800+ security commands, argument templates, hexagonal architecture.
Offsec MCP
MCP server that gives AI agents authorized-only offensive-security tools: recon, CVE intel, JS analysis, port scanning
Websec Validator
Local-first security recon that briefs your AI coding agent: facts + tailored probes, code-in / artifacts-out. No LLM, no server, no running app.
HTB CLI
Hack The Box CLI - interact with the HTB platform from your terminal
Roelint
Turn Rules of Engagement into a policy firewall for red-team commands and AI agents
Burpsuite MCP Vscode
Model Context Protocol (MCP) integration for Burp Suite and VS Code. A proxy for context sharing, AI-assisted analysis, and streamlined security workflows
Rami Kali MCP
Rami-Kali MCP server running on Kali Linux. Exposes recon, exploitation, MITM, wireless, and credential tools via JSON-RPC 2.0 for use with LLM agents. Part of the RamiBot plat…
Switchyard
Detect when Claude silently falls back from Fable 5 to Opus 4.8, log it to a local tamper-evident ledger, and keep your work on the frontier model.
LilyStrike
Advanced pentest & BadUSB toolkit for the LILYGO T-Dongle-S3 (ESP32-S3 Device) HID, Deauth, EvilAP, MCP AI and more - Web Flasher Online
YeepForge
Automated web application penetration testing framework: OWASP Top 10 + advanced attacks, an autonomous AI agent (Ollama/Claude/OpenAI), SAST source-code analysis, and an MCP serv…
Arche
Build apps with Claude using Archē, a context framework that helps it work autonomously from idea to live app
CHAI
Cyber Host Artificial Intelligence (C.H.A.I) - mcp server