A collection of servers which are deliberately vulnerable to learn Pentesting MCP Servers.

MistTrack Agent Skills

380 Claude Code skills & agent skills & plugins (30+ Agents, 70+ custom commands, 380+ skills, customizable references, scripts)for Claude Code, Codex, Gemini CLI, Cursor, and 8 more coding agents — engineering, marketing, product, compliance, C-level advisory, research, business operations, commercial & finance, and your daily productivity skills.

Security Scanner for Agent Skills

MCP server for remediating hardcoded secrets using GitGuardian’s API. It detects over 600 secret types and prevents credential leaks before code is made public.

Open-source adversary emulation for AI agents and MCP servers.

Ghost Security's collection of AppSec skills for AI coding agents

Open-source GRC toolkit from the GRC Engineering Club. Claude Code plugins for evidence collection, SCF crosswalks, multi-framework gap reports, OSCAL workflows.

Comprehensive sets of standards and practices designed to elevate the capabilities of AI coding agents.

The community-driven Claude Code plugin marketplace for MSPs — 70+ plugins across PSA, RMM, security, documentation, and accounting, plus cross-vendor industry workflow packs (ops, security, finance, compliance, sales, DevOps, cloud infra) that compose whatever tools you have connected.

MCP server for AI agents that need a phone number: order a private number in 200+ countries, read the SMS verification code, hand it back. The widest country coverage in the category, and you can check it with one API call.

Security scanner MCP server for AI coding agents. Prompt injection firewall, package hallucination detection (4.3M+ packages), 1000+ vulnerability rules with AST & taint analysis, auto-fix.

Curated + scored map of official MCP servers and agents for DevOps, Cloud, SRE, and Platform Engineering — every entry rated on production access, approval gates, and audit evidence.

Drive x64dbg with your AI. MCP server: 23 mega-tools / 153 endpoints for breakpoints, memory, disasm, tracing, anti-debug & PE dumping. Claude/Cursor/Windsurf/Cline. All local.

Skill-Inject: Measuring Agent Vulnerability to Skill File Attacks

C++ MCP SDK - build Model Context Protocol (MCP) servers and clients in C++ / CPP. Enterprise-grade security, observability, connectivity. Stdio, HTTP+SSE, Streamable HTTP, WebSocket, TCP transports. Bindings for Python, TypeScript, Go, Rust, Java, C#.

A Claude Code skill that plays bouncer at the door of production: audits AI-built apps (Lovable, Bolt, v0, Cursor) across 5 domains and hands you a scored punch list with copy-paste fixes. MIT.

Delegate tasks to Codex and Gemini directly from within Claude Code.

NOT for educational purposes: An MCP server for professional penetration testers including STDIO/HTTP/SSE support, nmap, go/dirbuster, nikto, JtR, hashcat, wordlist building, and more.

Security testing that runs inside the coding agent you already use. Source-available, not open source.

The Privacy Firewall for LLMs

Claude Code plugin: scope-aware protection — allows destructive ops (rm, mv, chmod) within project, blocks them outside. Built for dangerouslySkipPermissions mode.

🔥🔒 Awesome MCP (Model Context Protocol) Security 🖥️

A skill for AI agents: search the web with SearXNG, browse with Camofox, bypass protections with CloakBrowser. Anti-hallucination by design. Self-hosted, free, unlimited.