MCP servers that ship as code — a repository or a package you install and run locally (usually over stdio). They have no hosted endpoint, so we cannot probe or grade them: instead each one shows its repository, install command, license, stars and when it was last updated.
Collected from GitHub repositories and npm, PyPI, Cargo, Go, Maven, NuGet and RubyGems packages tagged as MCP servers, the official MCP Registry, Docker's MCP catalog, ModelScope, Baidu MCP World, Cline and other public directories; one entry per repository. A server that also offers a hosted endpoint is listed under Remote instead. These entries are not counted in our reachability, verification or readiness statistics.
-
@recon-fuzz-mcp/chimeragithub.com/recon-fuzz/recon-mcp-chimeraupdated this year
MCP server that scaffolds Chimera fuzzing test suites
npm MIT -
@recon-fuzz-mcp/knowledgegithub.com/recon-fuzz/recon-mcp-knowledgeupdated this year
MCP server for all Recon knowledge — getrecon.xyz, book.getrecon.xyz, and getrecon.substack.com
npm MIT -
Stream-first CAN & J1939 toolkit for security research and AI agents — typed JSONL events, CLI, TUI, fuzzing, MCP server.
GPL-3.0 ★ 5 -
OpenAPI testing and deterministic API fuzzing for AI agents—catch contract bugs before unsafe calls with local-first sealed plans, MCP, and replayable evidence.
Apache-2.0 ★ 2 -
面向 Chrome/Firefox 的轻量级浏览器安全工作台：集成抓包、拦截改包、重放/Fuzz、编解码工作台、敏感信息检测、HawkEye MCP 与浏览器级 Agent。（A lightweight Chrome/Firefox browser security workbench for capture, interception, replay/Fuzz, codec toolkit, sensitive-data detection, HawkEye MCP, and browser-level Agent workflows.）
★ 100 -
Deterministic, zero-hallucination agentic QA engine. Equips AI agents with cognitive heuristics and boundary fuzzing to autonomously test Web, Mobile, Desktop, and APIs.
npm MIT ★ 1 -
MCP server for dnstwist - DNS fuzzing to detect typosquatting, phishing and corporate espionage
npm MIT -
api-burp-mcpgithub.com/marilynceo/api-burp-mcpupdated this year
Rate-Limit and API Stress Tester u2014 test, benchmark, fuzz, and monitor any HTTP API endpoint. 12 tools: burst testing, load profiling, auth testing, HAR replay, and more.
-
deeplinkfuzzgithub.com/cognis-digital/deeplinkfuzzupdated this year
Fuzzes Android/iOS deep links, intents, and custom URL schemes against an emulator/device to surface unvalidated-redirect, injection, and component-hijack bugs.
NOASSERTION -
55-tool MCP server for security scanning of MCP servers. Runtime inspection, AST-based SAST, config audit, dependency analysis, OWASP MCP Top 10 compliance. OAuth, TLS, fuzz testing, prompt injection, tool mutation detection. 100% local, zero external API calls.
MIT ★ 5 -
alfgithub.com/blacktop/alfupdated this year
Agentic LLDB Fuzzer
Apache-2.0 ★ 2 -
nodriver-proxy-mcpgithub.com/BobongKu/nodriver-proxy-mcpupdated this year
—
★ 3 -
CLI-first CAN security research toolkit
pypi GPL-3.0-or-later -
sabbagithub.com/8nobletruths/sabbaupdated this year
SABBA: a security templates CLI and MCP server for coding agents that prove findings by running them.
pypi Apache-2.0 -
nodriver-proxy-mcpgithub.com/bobongku/nodriver-proxy-mcpupdated this year
Unified MCP Server for Web Security — 39 tools for autonomous pentesting
pypi MIT -
Deterministic, zero-hallucination agentic QA verification engine across Web, Mobile, Desktop, and APIs
npm MIT -
MCP server that fetches and explains syzbot Linux kernel bug reports - KASAN, KCSAN, lockdep, WARNING, hung tasks - with alloc/free stacks, cause commits and reproducers. Polite, cached, rate-limited.
MIT -
Proof-carrying debugger. Executes your code to find a real failing input, verifies the failure three ways before reporting it, generates candidate repairs, and rejects patches that only fit the example that caught them. CLI, MCP server, or programmatic AP
npm MIT