#cybersecurity

Domain security reconnaissance for AI agents — 13 tools (DNS, SSL, HTTP headers, email auth, port scan, ASN, RDAP) with a 0–100 Health Score. Free, no API key

Threat intelligence MCP server for SOC analysts, DFIR and security researchers. Scan and enrich IOCs directly from Claude, Cursor or any MCP client: IP addresses (IPv4/IPv6), domains, file hashes and blockchain addresses. Search CVEs by keyword, vendor or product, retrieve full CVE records, and explore a threat actor database (APTs, groups, TTPs) with reverse CVE-to-actor lookup. Includes scan history, bookmarks and quota management. Free tier available — no credit card required. Built by mlab.sh, the IOC & file intelligence platform.

A Model Context Protocol server that gives AI Clients real-time cybersecurity reconnaissance capabilities — WHOIS, DNS enumeration, port scanning, SSL inspection, CVE lookup, IP reputation, ASN lookup and more.

LiveDataLink is a hosted MCP server giving AI agents 182 real-time data tools across 36 domains through a single Streamable HTTP endpoint. Coverage includes sanctions screening (OFAC + UN + EU + BIS DPL first-party indexed), SEC EDGAR, federal courts plus Caselaw Access Project, IRS nonprofits, NPPES healthcare providers, USAspending federal awards, Federal Register + eCFR regulations, CVE + threat intel (RDAP, IP reputation, FBI Wanted, CISA KEV), FRED + BLS + US Treasury + World Bank macro, EIA + NREL energy, Zillow real estate, Texas parcels, ClinicalTrials.gov, FDA, EPA, FEC, FMCSA trucking, USPTO patents, Census, federal recreation (RIDB), Project Gutenberg books, OpenAlex scholarly, NPM + PyPI + cargo + GitHub supply-chain intel, and more. One bearer token, one endpoint, one bill. Built for compliance + due diligence + agentic research workflows. Free tier (100 queries/month, no credit card) available at https://livedatalink.ai/signup/free. Paid plans from $10/month. Open MCP protocol, portable keys, no lock-in. Operated by Blackbox Foundry LLC out of Texas.

RelayShield gives AI agents and developers real-time identity and infrastructure threat detection via a single REST API. Monitor breach exposure, SIM/eSIM swap attacks, and domain lookalikes. Install as a native MCP server for Claude Desktop and Claude Code in one line: pip install relayshield-mcp

pentestMCP: AI-Powered Penetration Testing via MCP pentestMCP provides a powerful bridge between Large Language Models (LLMs) and practical penetration testing tools through the Model Context Protocol (MCP). This project functions as an MCP Server, exposing a curated suite of over 20 standard security assessment utilities (Nmap, Nuclei, ZAP, SQLMap, etc.) as callable 'tools'. This allows AI agents within MCP-compatible clients (like Claude Desktop or specific VS Code setups) to leverage these utilities for automated and interactive security analysis tasks.

Search and retrieve cryptographically-verified compliance nodes. 3,000+ nodes across 31 pillars AI Governance, Banking & Global Finance, Cybersecurity, Medical & Healthcare, Legal & IP Sovereignty, ESG and more. Zero hallucination: every node traces to primary legal sources with avg 7 citations.

AI-powered URL safety checker for agents. Returns SAFE/SUSPICIOUS/DANGEROUS verdict using Google Web Risk and Google Safe Browsing before any agent fetches an untrusted URL.

A standalone Python/FastAPI server that implements the Model Context Protocol (MCP) for the OPTIX threat intelligence platform. It exposes 26 analyst-friendly tools that AI assistants and programmatic consumers can use to query threat feeds, search documents and indicators, manage watchlists, triage IOCs, generate detection rules, trigger AI research, and produce intelligence reports — without needing to understand OPTIX's internal REST API.

MCP server for interacting with the APVISO AI-powered penetration testing platform from Claude Code, Cursor, Windsurf, Codex, and other MCP-compatible tools.

Runtime policy enforcement for AI agents. Evaluate every agent action against your organization's policies before execution. Define policies once in the Hejdar dashboard, enforce everywhere via MCP. Supports observe mode (shadow/audit) and enforce mode (real-time blocking).

Real-time phishing detection, IP reputation, and CVE risk analysis API for AI agents. Powered by live threat feeds (OpenPhish, Feodo Tracker, URLhaus). Pay per request via x402 micropayments (USDC on Base). First 1,000 requests free, no signup required.

Security intelligence API for AI models. CVE lookup with EPSS/KEV enrichment, domain reconnaissance (DNS, WHOIS, SSL, subdomains, WAF detection), and code security checks (secrets, injection, headers). No API key required.

Security intelligence API for AI models. CVE lookup with EPSS/KEV enrichment, domain reconnaissance (DNS, WHOIS, SSL, subdomains, WAF detection), and code security checks (secrets, injection, headers). No API key required.

Security testing MCP server with 51 tools across 19 modules. Covers SQL injection, XSS, command injection, SSRF, path traversal, PCAP forensics, memory forensics (Volatility), reconnaissance, malware analysis, CloudTrail analysis, and more. Includes 8 methodology prompts for guided security workflows. Run via npx operant-mcp.

An MCP server that gives Claude and other AI agents the ability to audit any public URL's HTTP security headers. What it checks: - HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy - HTTPS enforcement and redirect chain depth - Presence of security.txt, robots.txt, sitemap.xml Payment model: - 0.05 USDC per scan, paid automatically on Base via the x402 protocol - No API key, no account, no subscription required - The agent's wallet pays directly — fully autonomous Tools provided: - scan_security_headers(url): Live scan (costs 0.05 USDC) - demo_security_snapshot(): Free pre-baked example

A Python MCP Server that connects Large Language Models natively to a comprehensive suite of offensive security tools.

Live threat intelligence for Claude — check IPs, CVEs, KEV predictions, malware hashes, and pre-attack staging detection. Free, no API key required. Data updates every 15 minutes.

eip-mcp connects AI assistants to the Exploit Intelligence Platform via the Model Context Protocol. 17 tools to search vulnerabilities, analyze exploits, audit tech stacks, and generate pentest findings — with real-time data from NVD, CISA KEV, VulnCheck KEV, InTheWild.io, ENISA EUVD, EPSS, ransomware attribution, ExploitDB, Metasploit, GitHub, and more.

DMARC MCP Server is a Model Context Protocol server that exposes DNS and email authentication data as structured, read only tools for developers and AI agents. It enables direct inspection and validation of DMARC, SPF, and DKIM records, including RFC compliant SPF analysis, lookup limit checks, and configuration diagnostics. The server integrates with MCP compatible tools like Cursor, VS Code, and Claude Code, making email authentication part of modern development and automation workflows.

NetForensicMCP V2.1 is a Model Context Protocol (MCP) server designed to empower Large Language Models (LLMs) with advanced offline network traffic analysis and threat intelligence capabilities. Built on top of Wireshark's tshark, NetForensicMCP provides comprehensive PCAP analysis tools for cybersecurity professionals, threat hunters, and network forensics investigators.

NetForensicMCP V2.1 is a Model Context Protocol (MCP) server designed to empower Large Language Models (LLMs) with advanced offline network traffic analysis and threat intelligence capabilities. Built on top of Wireshark's tshark, NetForensicMCP provides comprehensive PCAP analysis tools for cybersecurity professionals, threat hunters, and network forensics investigators.

Connect real-time cybersecurity threat intelligence to your AI workflows through standardized tools and resources. Access comprehensive IOCs, CVEs, TTPs, and threat actor data from FalconFeeds.io with seamless integration across Claude Desktop, VS Code, and other MCP-enabled applications.

Kaspersky OpenTIP Model Context Protocol Server This server gives access to Kaspersky OpenTIP API to agentic applications.

Kaspersky OpenTIP Model Context Protocol Server This server gives access to Kaspersky OpenTIP API to agentic applications.

Scan and analyze potentially malicious URLs using the urlDNA

Zerotrusted Ai Privacy Agent

Detects PII entities in the given prompt.

A reference implementation of the SchemaPin protocol for cryptographically signing and verifying AI agent tool schemas to prevent supply-chain attacks.

MCP server for CIRCL CVE Search API with intelligent risk assessment and comprehensive vulnerability analysis.

A PII detection Agent which helps you detect PII entities in a given prompt.

A comprehensive Model Context Protocol (MCP) server for web security reconnaissance and analysis.

Node.js MCP server for UpGuard CyberRisk API integration. Provides comprehensive cybersecurity risk assessment tools with stateless HTTP transport, caching, and resilience patterns.

MCP Server for Panther

All-in-one offensive security toolbox with AI agent and MCP architecture. Integrates tools like Nmap, Metasploit, FFUF, SQLMap. Enables pentesting, bug bounty hunting, threat hunting, and reporting. RAG-based responses with local knowledge base support.

A PII detection Agent which helps you detect PII entities in a given prompt.

A Model Context Protocol (MCP) tool for retrieving and analyzing Windows event logs (e.g. Sysmon). WinLog-mcp provides programmatic access to ingest and query Windows event logs, making it ideal for security monitoring, incident response, and log analysis automation.

MCP Client which serves as bridge between mcp servers and local LLMs running on Ollama, Created for MCP Servers Developed by Me, However other MCP Servers may run as well

This is curated list of Security tools' MCP server

A Model Context Protocol (MCP) server for scanning IP addresses for vulnerabilities. This server provides tools to perform security scanning on individual IPs or multiple IPs at once.

The NOVA MCP Security Gateway is a prompt-validation service that runs first in your Model Context Protocol (MCP) chain. It loads Nova rules (in .nov format), checks each incoming prompt against these rules, and blocks any that match high-severity security or jailbreak patterns.

VIBE CODING 😈 lol

NOT for educational purposes: An MCP server for professional penetration testers including nmap, go/dirbuster, nikto, JtR, wordlist building, and more.

Fast MCP integration for NetworksDB API - Query IP addresses, organizations, ASNs, and DNS records using natural language through Model Context Protocol

NOT for educational purposes: An MCP server for professional penetration testers including nmap, go/dirbuster, nikto, JtR, wordlist building, and more.

This repository demonstrates a variety of **MCP Poisoning Attacks** affecting real-world AI agent workflows.

CyberMCP is a Model Context Protocol (MCP) server designed for testing backend APIs for security vulnerabilities. It provides a set of specialized tools and resources that can be used by LLMs to identify common security issues in APIs.

一款帮助云租户发现和测试云上风险、增强云上防护能力的综合性开源工具

Secure Messages Control Plane (MCP) Server - A robust platform for managing communication between AI agents

A Model Context Protocol server that provides network asset information based on query conditions. This server allows LLMs to obtain network asset information and supports querying network asset information by zoomeye dork etc.

MCP Server for mallory.ai intelligence

Model Context Protocol Server For Cyber Security