MCP servers and skills: search, filter by where they run, and compare.
Blitz Strike — a universal MCP security-audit toolbelt. Reconnaissance at speed. Analysis in depth. Validation before report.
Node.jsMIT★ 509No key
Autonomous Offensive Security, Bug Bounty & Red Teaming Agent Framework powered by Hermes Agent, specialized reasoning skills, and multi-model LLM orchestration.
SkillApache-2.0★ 949No key
Hardening skill for Solana cross-program invocations (CPI), with first-class coverage of the return-data spoofing exploit class. Claude Code / Codex skill for the Solana AI Kit.
SkillMIT★ 4Few starsNo key
MCP server for CVE intelligence: 16 read-only tools for CVE records, CISA KEV, EPSS history, exploits, fix guidance as sources state it, version, SBOM and lockfile checks, vendor advisories, and per-C
Node.jsMIT★ 7No key
Solana's SOL-0XX security standard — bug-class rules distilled from $514M of real exploits, firing as you code in every AI tool, editor & CI.
Node.jsMIT★ 38No key
AI agent security scanner. Detect vulnerabilities in agent configurations, MCP servers, and tool permissions. Available as CLI, GitHub Action, ECC plugin, and GitHub App integration. 🛡️
Node.jsMIT★ 1.3kNo key
Bring HackTricks pentesting knowledge into Claude Desktop. Search 1000+ security techniques, exploits, and payloads without leaving your AI assistant. MCP-powered, npx-ready.
Node.jsMIT★ 10No key
CISA Known Exploited Vulnerabilities with BOD 26-04 deadlines, SSVC prioritization, and the full ICS advisory corpus (CSAF) via MCP. Keyless. STDIO or Streamable HTTP.
Node.jsApache-2.0★ 1Few starsNo key
MCP server for the ThreatCluster threat intelligence API: incident clusters, IOCs, CVEs, ransomware leak-site victims and entity profiles as tools for Claude, Cursor, VS Code and any MCP client. Pytho
Node.jsGPL-3.0★ 1Few starsNeeds a key
Autoremediator is an agentic Node.js CVE remediation tool.
Node.jsMIT★ 1Few starsNo key
Production-ready AI AppSec skills for SAST, threat modeling, remediation, PR security review, and serialization abuse analysis.
SkillApache-2.0★ 7No key
Deterministic decision-intelligence MCP server for AI agents — 17 tools (bandits/LinUCB, HiGHS LP/MIP, PageRank, Monte Carlo, CMA-ES, conformal). Sub-25ms. Zero LLM cost. 11 free, no key. Listed on th
Node.jsMIT★ 13No key
SkillMITFew starsNo key
Passive external attack-surface mapping: CT subdomains, DNS, TLS, HTTP posture, RDAP/WHOIS, Shodan via MCP. STDIO or Streamable HTTP.
Node.jsApache-2.0★ 1Few starsNo key
CLI threat intel scanner + local STDIO MCP server: check IPs, domains, hashes, CVEs against the DugganUSA Feed from your terminal. npx dugganusa-cli
Node.jsMIT★ 2Few starsNo key
Agentic MCP for Roblox. Run tests and find exploits in your game from Claude Code, Codex, or Gemini.
Node.jsMIT★ 3Few starsNo key
FIRST EPSS scores, score history, and CVE prioritization with caller-supplied severity.
Node.jsApache-2.0Few starsNo key
Read-only Postgres MCP server: a drop-in replacement for the archived server-postgres, with schema context for correct answers.
Node.jsMIT★ 4Few starsNo key
MCP server for Monero. Give any AI agent a private wallet.
Node.jsMIT★ 20No key
MCP server for WalletTriage — real-time exploit-exposure check for EVM wallets, built for AI agents
MCPLink onlyFew stars
Official MCP server for Attestd. Use Attestd supply chain and CVE signals directly in Claude Code, Cursor, and Windsurf.
Node.jsMITFew starsNo key
Understands a repository’s architecture and attack surface, then compiles validated, harness-ready security audit skills for application-security testing.
SkillMITFew starsNo key
Read-only MCP server for investigating activity on Sui — fund tracing, funding-source attribution, address fan-out, multi-address timelines. No API keys or wallet.
Node.jsMIT★ 1Few starsNo key
Node.jsMIT★ 1Few starsNo key
Who stands behind it
