22 agent tools in this category, ranked by GitHub stars for now. Hands-on test results will replace this ranking as they finish.
The three most-starred tools here. Not tested together yet.
Authorization-gated MCP server to discover and run 670+ security tools for CTF, pentest, and DFIR.
oci:ghcr.io/26zl/cybersec-toolkit:1.4.0Governed OT tap (57 tools): OPC-UA/Modbus/S7/MC/MTConnect/MQTT/EtherNet-IP/EtherCAT.
pypi:ot-aiopsQuery and retrieve information about various adversarial tactics and techniques used in cyber atta…
https://server.smithery.ai/@alex-llm/attack-mcp-server/mcp| Tool | Stars | Last update | License | |
|---|---|---|---|---|
| io.github.26zl/cybersec-toolkit Authorization-gated MCP server to discover and run 670+ security tools for CTF, pentest, and DFIR. MCP serverGitHub-verified authorLocal · Docker | 95 | MIT | ||
| OT AIops Governed OT tap (57 tools): OPC-UA/Modbus/S7/MC/MTConnect/MQTT/EtherNet-IP/EtherCAT. MCP serverGitHub-verified authorLocal · PyPI | 10 | MIT | ||
| ai.smithery/alex-llm-attack-mcp-server Query and retrieve information about various adversarial tactics and techniques used in cyber atta… MCP serverVerified domain · smithery.aiRemote | 3 | — | ||
| Ansvar: Threat Intelligence CVE intelligence, STRIDE, OWASP test cases via Ansvar Gateway. Cited, OAuth + paid. MCP serverVerified domain · ansvar.euRemote | 3 | — | ||
| Sn1per MCP Server: pentest, recon and attack surface scanning Run scoped, authorized Sn1per pentest, recon and attack surface scans from AI agents; read findings. MCP serverGitHub-verified authorLocal · PyPI | 3 | Apache-2.0 | ||
| Bewary: scam, phishing and fraud detection Threat intelligence for AI agents: checks URLs, domains, phones, emails, wallets and IBANs for scams MCP serverVerified domain · bewary.appRemote | — | — | ||
| BlueTeamJobs Search open defensive cybersecurity (blue team) jobs and salary data. Read-only, no sign-in. MCP serverVerified domain · blueteamjobs.comRemote | — | — | ||
| com.pentest-tools/mcp-server MCP server for Pentest-Tools.com: run scans, manage findings and reports via your preffered LLM. MCP serverVerified domain · pentest-tools.comRemote | — | — | ||
| ControlDrill List, schedule, and retrieve evidence for ControlDrill incident-response tabletop exercises. MCP serverVerified domain · controldrill.comRemote | — | — | ||
| Deltabridge Threat Intelligence Cyber threat intelligence: threat actors, malware, CVEs, IOCs, ATT&CK and analyst briefs. MCP serverVerified domain · deltabridge.aiRemote | — | — | ||
| FET112 Security intelligence for AI agents monitoring Ethereum before actions. MCP serverVerified domain · fet112.comRemote | — | — | ||
| isMalicious threat intelligence for AI agents Reputation for IPs, domains, URLs, hashes, emails, phones; CVEs; injection and email scans MCP serverVerified domain · ismalicious.comLocal · npm | — | — | ||
| Jeevesus — DugganUSA threat-intel MCP Membrane for AI agents: threat intel you can check, IOC enrichment, pre-install package checks. MCP serverVerified domain · dugganusa.comRemote | — | — | ||
| KEVWire Exploited vulnerabilities, critical CVEs, breaches and AI security incidents, with primary sources. MCP serverVerified domain · kevwire.comRemote | — | — | ||
| Lightbringer Register innovations, request patent preparation, and collaborate with Lightbringer’s patent team. MCP serverVerified domain · lightbringer.comRemote | — | — | ||
| Midkernel Threat Intel Free, read-only public-source threat intel over MCP. No account or API key. MCP serverVerified domain · midkernel.comRemote | — | — | ||
| Pentest requests, security headers checker, guides Request a penetration test, grade a website's HTTP security headers, and search pentest guides. MCP serverVerified domain · penetrationtestservices.comRemote | — | — | ||
| PentestCompare: pentest provider data Sourced data on 66 penetration testing providers: scope, delivery, published prices, retests. MCP serverVerified domain · pentestcompare.comRemote | — | — | ||
| Strix AI pentesting: run scans, triage vulnerabilities, review PRs, manage schedules and assets. MCP serverVerified domain · strix.aiRemote | — | — | ||
| TheLeaf Threat Observatory Read-only honeypot observations and evidence. Invite-only API key; request access on our website. MCP serverVerified domain · observatory.theleaf.aiRemote | — | — | ||
| Unit 42 Threat Research & Malware Analysis — buy per-query in-session (unit42watch) Unit 42 malware analysis & threat research. $0.01/query. Be born in one call — free testnet funds. MCP serverVerified domain · a2awire.comRemote | — | — | ||
| Vysion Darknet threat intelligence for AI assistants: leaks, documents, chat, ransomware. MCP serverVerified domain · vysion.aiRemote | — | — |
Filters apply to the top 22 of 22 tools by stars. Full list for agents: sec-offense.json