Professional MCP servers for penetration testing automation - SQLi, Exploit, Auth, Recon

Pentest with any AI agent — one MCP server & CLI orchestrating Semgrep, Trivy, SQLMap and Nuclei, with a human-only authorization scope enforced in code.

NOT for educational use: An MCP server for Nmap and John the Ripper, for professional penetration testers.

OSCP+ and OSWE pentest knowledge base for CLI agents and humans: 70 structured modules, section-level retrieval CLI, attack-path graph, and a stdlib-only MCP server.

Authorization-gated penetration testing MCP server for AI agents - 80 tools (recon, vuln scanning, web app, exploit, CTF, reporting) with engagement-file scope enforcement. pipx install pentester-mcp

A dockerized Pentest-Suite capable of running AI-Powered full security checks .

Elevate your AI assistants (like Claude & Cursor) into autonomous cybersecurity experts. Pentester-MCP integrates 200+ pentesting tools via the Model Context Protocol (MCP) using a secure Docker sandbox.

Lightweight attack-surface discovery and vulnerability intelligence toolkit in pure Python stdlib (zero dependencies), with CISA KEV/cve.now feeds, OODA loop orchestration, and MCP server.

Pentest MCP Toolkit: 50 Kali Linux security tools exposed as one MCP server over Docker stdio, built to be driven 100% by AI agents (Claude Code, Codex). For authorized pentests of systems you own. You are responsible for authorization.

NOT for educational purposes: An MCP server for professional penetration testers including STDIO/HTTP/SSE support, nmap, go/dirbuster, nikto, JtR, hashcat, wordlist building, and more.

KhaosMCP is a local-first, agent-operated pentest platform using AI via MCP. It connects the external operator to the complete assessment cycle: scoping, supervised execution, integrations, evidence gathering, review of findings, and reporting.

Android Pentest AI Assistant (APAIA) is an MCP server for Claude AI that was specifically created for Android pentesting/bug bounty purposes and aims to provide assistance for recon, static code analysis and exploits using ADB and JADX.

MCP-based autonomous pentesting framework — Claude, ChatGPT, or Ollama orchestrate 70+ Kali Linux tools (nmap, sqlmap, Metasploit & more) for recon, exploitation, and post-exploitation, Wireshark packet analysis, and headless Chromium evidence capture. Fully containerized, authorization-enforced, structured pentest reports out of the box.

MCP server to assist pentesting with Faction

Aircrack-MCP WiFi Pentesting Suite Automated 2026

Pentest report generator — YAML findings to CREST-grade PDF

A fast, keyboard-driven HTTP intercepting proxy and pentesting toolkit for the terminal built for humans and AI agents alike.

Bring HackTricks pentesting knowledge into Claude Desktop. Search 1000+ security techniques, exploits, and payloads without leaving your AI assistant. MCP-powered, npx-ready.

Connect Claude Code or Cursor to PreHack, the autonomous AI pentester. Device-code login, no API key.

Security pentesting MCP Server with 89 tools across 10 categories. Windows/WSL bridge for Kali tools integration with Claude.

Native stdio MCP server for Kali Linux pentesting - 72 typed tools, structured JSON output, engagement session state, Sliver C2, desktop interaction, tunneling. Authorized testing only.

AI Pentesting Framework, Bug Bounty MCP Server, SAST/DAST Taint Engine & 12 Offensive Security Skills for Claude Code, Google Antigravity, Codex & Cursor.

Wissensgetriebener, lokaler Pentest-Workspace (CLI) für CTF, Bug Bounty & autorisierte Tests – geführte Recon, Findings/Loot/Reports, Web-Dashboard, lokale KI-Unterstützung & MCP-Server. KI analysiert, führt nie selbst aus.

Vibe code fast. Ship like an engineer. AI engineering framework packaged as an MCP server that enforces TDD, security scanning, pentesting, secret management, QA audits, and deployment to a securely configured VPS — automated with up to 100× fewer exploration tokens.

Self-hosted security scanner, autonomous pentest & QA agent, and production-readiness gate

Unified MCP Server for Web Security — 39 tools for autonomous pentesting

⚡ Autonomous AI Interception Proxy, Multi-Protocol OAST Canary Engine & Attack Hypothesis Ledger for LLM Pentesting Agents (Claude Code, Cursor, OpenCode, Hermes)

AI-powered pentesting automation with MCP integration for Claude Code - parallel scanning, OWASP ASVS 5.0, workflow recording/replay

CYBERDUDEBIVASH® MCP Server – Zero-Trust AI Cybersecurity Command Center (Private Development) Production-grade autonomous AI agents for SOC, pentesting, malware analysis, threat intel & DevSecOps. © 2026 CYBERDUDEBIVASH – All Rights Reserved

Full-stack security, performance & schema diagnostic sniffer for Supabase & PostgreSQL — RLS initPlan, Supavisor :6543, missing indexes, Splinter parity, CONCURRENTLY fixes, pentest & MCP.

🛡️ Production-grade Model Context Protocol (MCP) Server for Autonomous AI Security Bug Hunting, Persistent Pentest Memory, Dynamic Checklists, Secret Redaction, and Exploit PoC Generation.

🐻 BearStrike AI: High-Signal Pentesting Console (MCP-First, Model-Agnostic). Build fast, low-noise security workflows with queue-first execution, skills-aware planning, and 150+ integrated tools.

HexStrike AI MCP Agents is an advanced MCP server that lets AI agents (Claude, GPT, Copilot, etc.) autonomously run 150+ cybersecurity tools for automated pentesting, vulnerability discovery, bug bounty automation, and security research. Seamlessly bridge LLMs with real-world offensive security capabilities.

Local-first credential manager & validator for red teams / pentest：致力于 ALL IN ONE 的本地凭据管理与验证平台 keyrealm（凭域）。 允许将红队渗透测试中获取的散落在各处的 API Key、云厂商 AK/SK、机器人 Token、邮箱授权码、登录态等集中加密保管、便捷验证与快速利用。多插件多类别，单条·批量·定时验证，内置 MCP Server；AES-256-GCM 字段级加密，每凭据可选代理出口，加密/明文备份可跨库还原；数据只存本机、不联网同步，Windows / macOS / Linux。

Open-source, self-hostable backend-as-a-service — a Supabase × Firebase hybrid on your own free Oracle Autonomous AI DB. Auth with cookie sessions, auto REST tables, RLS, realtime, storage, webhooks, SQL console, MCP server, transactional email (Resend/SMTP/OCI) — 82-check self-hack pentest ships in-repo.

One command installs 670+ security tools on Debian/Ubuntu/Kali, Fedora, Arch, openSUSE and Termux. Its authorization-gated MCP server runs them in a disposable Kata Containers VM sandbox for Claude Code, Codex, Gemini CLI, OpenCode and other MCP clients. 872 agent skills for CTF, pentesting, bug bounty, DFIR and red/blue teams.

Self-hosted Kali Linux MCP control plane with modular tools, network management, sandboxed execution, optional host execution and a live WebUI

RedVector AI - AI-powered penetration testing and cybersecurity automation framework for security researchers and ethical hackers.

Autonomous Offensive Security Agent for Red Team Operations

Self-Learning AI for Manual Web Penetration Testing

Execute commands interactively on remote Windows machines using the WinRM protocol (just faster)

MCP runtime for AI-assisted security testing with Kali tools, explicit target controls, bounded scanning, structured evidence, and persistent Docker deployment.

RedQuanta MCP transforms penetration testing into an intelligent, automated, and secure process. Built specifically for LLM integration and professional security teams, it provides enterprise-grade security orchestration.

Full-lifecycle HashiCorp Vault penetration testing toolkit — recon, hijack, escalate, exfiltrate, pivot, and persist across CLI, AI chat, and MCP server modes.

JsOwl —— Go 编写的 Web 安全信息收集利器。集 JavaScript 信息收集、API 端点提取、敏感信息扫描、攻击面梳理 于一体，同时提供 CLI 工具与 Go 库。内置 direct / browser / auto 三种采集模式，兼容 HaE 规则，支持登录态扫描、运行时交互、AI 辅助分析与 MCP Server，输出 JSON 与交互式 HTML 报告，是渗透测试、红队信息收集与 Web 安全测试的高效自动化方案。

Thick client penetration testing and MSIX security audit toolkit for Windows. Audits .NET, Electron and native binaries: static and runtime checks, IL-verified findings, computed CVSS v4.0, CWE/ATT&CK mapping, SBOM, HTML/Excel reports. PowerShell engine, GUI, MCP server and agentic AI triage.

—

MCP server for searching HackTricks documentation

—

MCP Server for AI-powered security reconnaissance

MCP configuration to connect AI agent to a Linux machine.

Capability-aware MCP client for a Docker-hosted Kali Linux tools API

MCP Server for Aircrack-ng WiFi pentesing tools

MCP Server for Aircrack-ng WiFi pentesing tools

MCP server for Burp Suite Professional's REST API.

AI -Powered Bettercap - Mcp based tool

Agent 自主渗透测试工具: SPA/MPA 接口枚举、运行时流量捕获、权限树还原、参数矩阵合并。

MCP server that connects AI assistants to HackerOne for bug bounty hunting

Static malicious payload analyzer — PE/ELF/LNK/macro/OneNote

Active Directory attack path mapper — minimum-cost paths + remediation priority