[{"name": "io.github.26zl/cybersec-toolkit", "kind": "mcp", "desc": "Authorization-gated MCP server to discover and run 670+ security tools for CTF, pentest, and DFIR.", "repo": "https://github.com/26zl/cybersec-toolkit", "install": ["oci:ghcr.io/26zl/cybersec-toolkit:1.4.0"], "stars": 95, "pushed": "2026-11-11T17:24:49Z", "license": "MIT", "plat": "github"}, {"name": "OT AIops", "kind": "mcp", "desc": "Governed OT tap (57 tools): OPC-UA/Modbus/S7/MC/MTConnect/MQTT/EtherNet-IP/EtherCAT.", "repo": "https://github.com/AIops-tools/OT-AIops", "install": ["pypi:ot-aiops"], "stars": 10, "pushed": "2026-11-09T16:30:56Z", "license": "MIT", "plat": "ot"}, {"name": "ai.smithery/alex-llm-attack-mcp-server", "kind": "mcp", "desc": "Query and retrieve information about various adversarial tactics and techniques used in cyber atta…", "repo": "https://github.com/alex-llm/attAck-mcp-server", "install": ["https://server.smithery.ai/@alex-llm/attack-mcp-server/mcp"], "stars": 3, "pushed": "2025-10-01T00:50:51Z", "license": null, "plat": ""}, {"name": "Ansvar: Threat Intelligence", "kind": "mcp", "desc": "CVE intelligence, STRIDE, OWASP test cases via Ansvar Gateway. Cited, OAuth + paid.", "repo": "https://github.com/Ansvar-Systems/ansvar-gateway", "install": ["https://gateway.ansvar.eu/threat-intel/mcp"], "stars": 3, "pushed": "2026-07-20T11:56:18Z", "license": null, "plat": "ansvar"}, {"name": "Sn1per MCP Server: pentest, recon and attack surface scanning", "kind": "mcp", "desc": "Run scoped, authorized Sn1per pentest, recon and attack surface scans from AI agents; read findings.", "repo": "https://github.com/1N3/sn1per-mcp", "install": ["pypi:sn1per-mcp"], "stars": 3, "pushed": "2026-11-07T13:58:17Z", "license": "Apache-2.0", "plat": "sn1per"}, {"name": "Bewary: scam, phishing and fraud detection", "kind": "mcp", "desc": "Threat intelligence for AI agents: checks URLs, domains, phones, emails, wallets and IBANs for scams", "repo": "https://github.com/bewary-app/bewary", "install": ["https://api.bewary.app/mcp"], "stars": null, "pushed": null, "license": null, "plat": "threat intelligence"}, {"name": "BlueTeamJobs", "kind": "mcp", "desc": "Search open defensive cybersecurity (blue team) jobs and salary data. Read-only, no sign-in.", "repo": null, "install": ["https://mcp.blueteamjobs.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "cybersecurity"}, {"name": "com.pentest-tools/mcp-server", "kind": "mcp", "desc": "MCP server for Pentest-Tools.com: run scans, manage findings and reports via your preffered LLM.", "repo": "https://github.com/pentesttoolscom/pentesttools-pypi", "install": ["https://mcp.pentest-tools.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "pentest-tools.com"}, {"name": "ControlDrill", "kind": "mcp", "desc": "List, schedule, and retrieve evidence for ControlDrill incident-response tabletop exercises.", "repo": null, "install": ["https://mcp.controldrill.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": ""}, {"name": "Deltabridge Threat Intelligence", "kind": "mcp", "desc": "Cyber threat intelligence: threat actors, malware, CVEs, IOCs, ATT&CK and analyst briefs.", "repo": null, "install": ["https://mcp.deltabridge.ai"], "stars": null, "pushed": null, "license": null, "plat": ""}, {"name": "FET112", "kind": "mcp", "desc": "Security intelligence for AI agents monitoring Ethereum before actions.", "repo": null, "install": ["https://www.fet112.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "ethereum"}, {"name": "isMalicious threat intelligence for AI agents", "kind": "mcp", "desc": "Reputation for IPs, domains, URLs, hashes, emails, phones; CVEs; injection and email scans", "repo": "https://github.com/hexablob/ismalicious-mcp-server", "install": ["npm:@ismalicious/mcp-server", "https://api.ismalicious.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": ""}, {"name": "Jeevesus — DugganUSA threat-intel MCP", "kind": "mcp", "desc": "Membrane for AI agents: threat intel you can check, IOC enrichment, pre-install package checks.", "repo": "https://github.com/pduggusa/enterprise-extraction-platform", "install": ["https://analytics.dugganusa.com/api/v1/mcp"], "stars": null, "pushed": null, "license": null, "plat": "dugganusa"}, {"name": "KEVWire", "kind": "mcp", "desc": "Exploited vulnerabilities, critical CVEs, breaches and AI security incidents, with primary sources.", "repo": null, "install": ["https://kevwire.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "kevwire"}, {"name": "Lightbringer", "kind": "mcp", "desc": "Register innovations, request patent preparation, and collaborate with Lightbringer’s patent team.", "repo": "https://github.com/lightbringer-patents/mcp-connector", "install": ["https://mcp.lightbringer.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "patent team"}, {"name": "Midkernel Threat Intel", "kind": "mcp", "desc": "Free, read-only public-source threat intel over MCP. No account or API key.", "repo": null, "install": ["https://www.midkernel.com/security/app/mcp/threat-intel"], "stars": null, "pushed": null, "license": null, "plat": ""}, {"name": "Pentest requests, security headers checker, guides", "kind": "mcp", "desc": "Request a penetration test, grade a website's HTTP security headers, and search pentest guides.", "repo": "https://github.com/Excession-Labs/mcp-servers", "install": ["https://penetrationtestservices.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": ""}, {"name": "PentestCompare: pentest provider data", "kind": "mcp", "desc": "Sourced data on 66 penetration testing providers: scope, delivery, published prices, retests.", "repo": "https://github.com/Excession-Labs/mcp-servers", "install": ["https://pentestcompare.com/mcp"], "stars": null, "pushed": null, "license": null, "plat": "pentest providers"}, {"name": "Strix", "kind": "mcp", "desc": "AI pentesting: run scans, triage vulnerabilities, review PRs, manage schedules and assets.", "repo": null, "install": ["https://app.strix.ai/mcp"], "stars": null, "pushed": null, "license": null, "plat": "ai pentesting"}, {"name": "TheLeaf Threat Observatory", "kind": "mcp", "desc": "Read-only honeypot observations and evidence. Invite-only API key; request access on our website.", "repo": null, "install": ["https://observatory.theleaf.ai/mcp"], "stars": null, "pushed": null, "license": null, "plat": ""}, {"name": "Unit 42 Threat Research & Malware Analysis — buy per-query in-session (unit42watch)", "kind": "mcp", "desc": "Unit 42 malware analysis & threat research. $0.01/query. Be born in one call — free testnet funds.", "repo": "https://github.com/ee324/a2awire", "install": ["https://a2awire.com/mcp/data/unit42watch-unit-42-threat-research-malware-analysis-ed410c/http"], "stars": null, "pushed": null, "license": null, "plat": "unit 42"}, {"name": "Vysion", "kind": "mcp", "desc": "Darknet threat intelligence for AI assistants: leaks, documents, chat, ransomware.", "repo": null, "install": ["https://mcp.vysion.ai/mcp"], "stars": null, "pushed": null, "license": null, "plat": "vysion"}]