MCP servers and skills: search, filter by where they run, and compare.
MCP server for Exploit-DB — search public exploits and shellcode by CVE, platform, type, and tags.
SkillMIT★ 31No key
Offensive security toolkit for Claude Code covering red team, exploit dev, AD attacks, EDR bypass, mobile pentest
SkillMIT★ 392No key
MCP server for Shodan — host/network recon, CVE and exploit lookup, InternetDB, and persistent alerts (34 tools).
SkillMIT★ 51No key
Official Python SDK for the Vulners vulnerability-intelligence API — search CVEs, exploits and advisories (CVSS/EPSS/KEV), audit software, Linux/Windows hosts and SBOMs, and stream the whole graph. Ty
PythonMIT★ 377No key
13 production MCP servers for US government data — safety recalls, cybersecurity vulnerabilities, disasters, finance, and more
Hosted by authorMIT★ 6No key
FIRST.org EPSS (Exploit Prediction Scoring System) MCP.
Hosted by authorMITFew starsNo key
CVE ingestion + enrichment pipeline with an MCP server for AI agents.
PythonMIT★ 38No key
Vulnerability-intelligence MCP server for AI agents: CVE lookups (NVD) and dependency-manifest audits (OSV). Keyless.
Hosted by authorMITFew starsNo key
Built for security professionals, developers, and DevSecOps teams who need reliable vulnerability intelligence integrated directly into their development workflow.
PythonMIT★ 9No key
Open-source, self-hosted AI penetration testing framework: maps your attack surface into a graph, autonomously exploits it from a Kali sandbox with human approval gates, and opens PRs that fix what it
SkillMIT★ 3.1kNo key
Blitz Strike — a universal MCP security-audit toolbelt. Reconnaissance at speed. Analysis in depth. Validation before report.
Node.jsMIT★ 509No key
Agent skills for solving CTF challenges - web exploitation, binary pwn, crypto, reverse engineering, forensics, OSINT, and more
SkillMIT★ 3.5kNo key
Zero-key cybersecurity MCP server: grade any site security A+ to F, check if a CVE is actively exploited, get plain-English MITRE ATT&CK defenses. No API keys, no signups.
PythonMITFew starsNo key
AuditSentry — AI-powered smart contract security auditor for Claude Code. Automated vulnerability detection, exploit PoCs, mainnet-fork simulation, and professional audit reports for Solidity & Vyper
SkillMIT★ 37No key
Open-source AI pentester that proves every finding. Machine oracles re-run each exploit; verified bugs ship a proof capsule you can replay yourself.
PythonMIT★ 1.7kNo key
Mergen is an MCP server that gives your AI a real red team brain. It doesn't just run tools, it picks the right ones, chains them together, and actually makes sense of the output. Built by pentesters,
SkillMIT★ 16No key
Claude Code plugin: autonomous CTF solver + 9 category skills
SkillMIT★ 4Few starsNo key
Hardening skill for Solana cross-program invocations (CPI), with first-class coverage of the return-data spoofing exploit class. Claude Code / Codex skill for the Solana AI Kit.
SkillMIT★ 4Few starsNo key
MCP server exposing all Shodan API functionality.
PythonMIT★ 1Few starsNo key
Read-only Claude Code security skill: audit your OWN project like an attacker, every finding ships a working PoC. Turkish original + English, MIT.
SkillMIT★ 1Few starsNo key
MCP server for CVE intelligence: 16 read-only tools for CVE records, CISA KEV, EPSS history, exploits, fix guidance as sources state it, version, SBOM and lockfile checks, vendor advisories, and per-C
Node.jsMIT★ 7No key
Solana's SOL-0XX security standard — bug-class rules distilled from $514M of real exploits, firing as you code in every AI tool, editor & CI.
Node.jsMIT★ 38No key
Who stands behind it
