mcp-recon acts as a conversational interface and Model Context Protocol (MCP) server, enabling seamless web domain and ASN reconnaissance through natural language prompts. It integrates powerful tooling like httpx and asnmap to conduct lightweight or full HTTP analysis and ASN lookups, exposing these capabilities to any MCP-compatible AI assistant. With predefined prompts and Docker-based deployment, it streamlines infrastructure analysis via AI interfaces such as Claude Desktop.

• ⭐ 22
• MCP
• nickpending/mcp-recon

IDA Pro MCP provides a Model Context Protocol (MCP) server that connects the IDA Pro reverse engineering platform to clients supporting the MCP standard. It exposes a wide array of program analysis and manipulation functionalities such as querying metadata, accessing functions, globals, imports, and strings, decompiling code, disassembling, renaming variables, and more, in a standardized way. This enables seamless integration of AI-powered or remote tools with IDA Pro to enhance the reverse engineering workflow.

• ⭐ 4,214
• MCP
• mrexodia/ida-pro-mcp

Bugsy provides a command-line interface for automatic remediation of security vulnerabilities in codebases. It integrates with popular SAST tools such as Checkmarx, Snyk, CodeQL, and Fortify to identify issues and generate fixes. Bugsy supports both direct scanning and analysis of pre-generated SAST reports, and also operates as a Model Context Protocol (MCP) server for AI assistant integrations. The tool enables developers to streamline the vulnerability fixing process and improve code security efficiently.

• ⭐ 60
• MCP
• mobb-dev/bugsy

ghidraMCP acts as a Model Context Protocol (MCP) server, exposing core Ghidra reverse engineering functionality for use by large language models. It enables model clients to perform actions such as decompilation, binary analysis, and automated renaming of methods and data. The system integrates as both a Ghidra plugin and a Python MCP server, supporting interoperability with various MCP-compliant clients. By bridging Ghidra and MCP, it allows autonomous or semi-autonomous analysis of compiled application binaries.

• ⭐ 6,483
• MCP
• LaurieWired/GhidraMCP

mcp_vms implements an MCP server that bridges CCTV Video Management Systems (VMS) with model context protocols. It retrieves live and recorded video streams, exposes channel information and status, and supports remote video playback control and PTZ camera management. Comprehensive error handling and logging ensure reliable integration with AI tooling requiring contextual video feeds.

• ⭐ 11
• MCP
• jyjune/mcp_vms

GhidrAssistMCP is a Ghidra extension providing a Model Context Protocol (MCP) server that allows AI assistants and other tools to interact programmatically with Ghidra's reverse engineering platform. It offers a standardized API for querying program data, managing tool interactions, and enabling real-time analysis features. The extension features a configurable UI, built-in logging, and dynamic management of 31 specialized analysis tools.

• ⭐ 337
• MCP
• jtang613/GhidrAssistMCP

Intruder MCP allows AI model clients such as Claude and Cursor to interactively control the Intruder vulnerability scanner through the Model Context Protocol. It can be deployed using smithery, locally with Python, or in a Docker container, requiring only an Intruder API key for secure access. The tool provides integration instructions tailored for MCP-compatible clients, streamlining vulnerability management automation for AI-driven workflows.

• ⭐ 21
• MCP
• intruder-io/intruder-mcp

EntraID MCP Server provides a modular, resource-oriented implementation of a FastMCP server tailored for Microsoft Graph API interactions. It supports advanced operations across users, groups, applications, service principals, MFA, and sign-in logs, offering extensibility and strong security practices. Resource modules use a centralized authentication client, while comprehensive permission management, consistent context handling, error reporting, and logging are built in. The tool is designed for ease of development and extensibility, supporting standardized model context protocols.

• ⭐ 29
• MCP
• hieuttmmo/entraid-mcp-server

Wazuh MCP Server is a Rust-based service that interfaces with Wazuh SIEM systems and transforms their complex data into Model Context Protocol (MCP) compatible formats. It enables AI assistants, including Claude Desktop Integration, to access security alerts, vulnerability assessments, agent health, and other SIEM insights through natural language queries. This solution facilitates compliance teams and security operations by providing actionable data for monitoring, forensics, compliance validation, and incident response.

• ⭐ 137
• MCP
• gbrigandi/mcp-server-wazuh

MCP Server for TheHive enables AI models and automation clients to interact with TheHive incident response platform using the Model Context Protocol. It provides tools to retrieve and analyze security alerts, manage cases, and automate incident response operations. The server facilitates seamless integration by exposing these functionalities over the standardized MCP protocol through stdio communication. It offers both pre-compiled binaries and a source build option with flexible configuration for connecting to TheHive instances.

• ⭐ 11
• MCP
• gbrigandi/mcp-server-thehive

MCP Server for Cortex exposes the analysis capabilities of a Cortex instance as tools consumable by Model Context Protocol (MCP) clients, such as large language models. It enables these clients to request threat intelligence analyses via Cortex and receive structured results. The server supports easy configuration, secure authentication, and flexible analyzer selection for integrating threat intelligence tasks into automated AI workflows.

• ⭐ 12
• MCP
• gbrigandi/mcp-server-cortex

Volatility MCP integrates the Volatility 3 framework for memory image analysis with a FastAPI backend, exposing forensic plugins as RESTful APIs. Featuring Model Context Protocol (MCP) support, it enables seamless interaction with AI assistants like Claude Desktop for advanced memory forensics. The platform connects memory artifacts to AI or web applications, offering natural language driven analysis and automation. Designed for security analysts and forensic professionals, it supports key Volatility plugins such as pslist and netscan.

• ⭐ 36
• MCP
• Gaffx/volatility-mcp

ORKL MCP Server is an implementation of the Model Context Protocol (MCP) designed for seamless integration with MCP-compatible applications. It enables secure querying of the ORKL API, offering tools to fetch and analyze threat reports, threat actors, and intelligence sources. The server streamlines access to detailed cyber threat data for security operations and research.

• ⭐ 45
• MCP
• fr0gger/MCP_Security

Binary Ninja MCP enables real-time integration of Binary Ninja's reverse engineering environment with various Model Context Protocol (MCP) clients. It acts as a server exposing Binary Ninja's capabilities via HTTP endpoints and includes a bridge to connect to MCP clients. The extension supports auto-setup with popular clients such as Cline, Claude Desktop, Roo Code, and others, streamlining the use of AI-assisted workflows. This enhances tasks such as analyzing binaries, switching targets, and leveraging LLM-driven automation in reverse engineering.

• ⭐ 112
• MCP
• fosdickio/binary_ninja_mcp

Authenticator App MCP Server provides a secure Model Context Protocol (MCP) server enabling AI agents to interact with authentication credentials, such as 2FA codes and passwords. It facilitates automated login processes for AI assistants while maintaining robust security by requiring access tokens and integrating with the Authenticator App desktop client. This solution streamlines the management of user credentials across multiple platforms and websites, ensuring seamless and secure credential retrieval by AI agents.

• ⭐ 27
• MCP
• firstorderai/authenticator_mcp