A collection of servers which are deliberately vulnerable to learn Pentesting MCP Servers.

Security testing that runs inside the coding agent you already use. Source-available, not open source.

Security testing toolkit for AI Agent: curated SecLists wordlists, injection payloads, and expert agents for authorized pentesting, CTFs, and bug bounties

A local MCP runtime that attacks what you own and only reports what it proved. 17 CVEs across 9 projects came out of this repo. Install: npx -y hacker-bob@latest install /path/to/project, then run /bob-evaluate target.com