Code-only MCP servers — agent-tools.cloud

MCP servers that ship as code — a repository or a package you install and run locally (usually over stdio). They have no hosted endpoint, so we cannot probe or grade them: instead each one shows its repository, install command, license, stars and when it was last updated.

Collected from GitHub repositories and npm, PyPI, Cargo, Go, Maven, NuGet and RubyGems packages tagged as MCP servers, the official MCP Registry, Docker's MCP catalog, ModelScope, Baidu MCP World, Cline and other public directories; one entry per repository. A server that also offers a hosted endpoint is listed under Remote instead. These entries are not counted in our reachability, verification or readiness statistics.

@recon-fuzz-mcp/chimera

github.com/recon-fuzz/recon-mcp-chimera
updated this year

MCP server that scaffolds Chimera fuzzing test suites

npm MIT
kahea

github.com/copyleftdev/kahea
active

OpenAPI testing and deterministic API fuzzing for AI agents—catch contract bugs before unsafe calls with local-first sealed plans, MCP, and replayable evidence.

Apache-2.0 ★ 2
universal-agentic-qa

github.com/syed-dilawar-engineer/universal-agentic-qa
active

Deterministic, zero-hallucination agentic QA engine. Equips AI agents with cognitive heuristics and boundary fuzzing to autonomously test Web, Mobile, Desktop, and APIs.

npm MIT ★ 1
api-burp-mcp

github.com/marilynceo/api-burp-mcp
updated this year

Rate-Limit and API Stress Tester u2014 test, benchmark, fuzz, and monitor any HTTP API endpoint. 12 tools: burst testing, load profiling, auth testing, HAR replay, and more.
mcp-security-scanner

github.com/badchars/mcp-security-scanner
active

55-tool MCP server for security scanning of MCP servers. Runtime inspection, AST-based SAST, config audit, dependency analysis, OWASP MCP Top 10 compliance. OAuth, TLS, fuzz testing, prompt injection, tool mutation detection. 100% local, zero external API calls.

MIT ★ 5
@recon-fuzz-mcp/knowledge

github.com/recon-fuzz/recon-mcp-knowledge
updated this year

MCP server for all Recon knowledge — getrecon.xyz, book.getrecon.xyz, and getrecon.substack.com

npm MIT
universal-agentic-qa

github.com/syed-dilawar-engineer/universal-agentic-qa
active

Deterministic, zero-hallucination agentic QA verification engine across Web, Mobile, Desktop, and APIs

npm MIT
buggy-debugger

github.com/himanshusaini-afk/buggy
active

Proof-carrying debugger. Executes your code to find a real failing input, verifies the failure three ways before reporting it, generates candidate repairs, and rejects patches that only fit the example that caught them. CLI, MCP server, or programmatic AP

npm MIT