blitzstrike

Blitz Strike Reconnaissance at speed. Analysis in depth. Validation before report. Blitz Strike is a structured penetration-testing methodology — reconnaissance, source analysis, and validation — delivered as a universal MCP server. It enumerates the attack surface BLITZ, traces source-to-sink...

siyuan-mcp-admin-takeover-cve-2026-66012-missing-authorization

CVE-2026-66012 — SiYuan MCP Unauthenticated Administrator Takeover Proof of Concept for CVE-2026-66012 CVSS 10.0 Critical, a missing-authorization vulnerability in SiYuan's MCP Model Context Protocol endpoint that allows an unauthenticated attacker to achieve administrator takeover and remote cod...

CVE-2026-23744

CVE-2026-23744 — MCPJam Inspector Unauthenticated RCE Unauthenticated remote code execution PoC for CVE-2026-23744. MCPJam Inspector 1.4.2 and earlier expose functionality through /api/mcp/connect that can launch an attacker-controlled MCP server command without authentication. For authorized...

toolbox

-Significant%20AI%2C%20fully%20reviewed-1f77b4 MCP-based application security testing tools for your coding agent. Not a scanner — a collaborative workbench. Agents struggle with UI and stateful APIs; you're good at both. Sectool lets you explore an application through its proxy while an agent...

OWASP-MCP-Threat-Modeling

This repository does not have a README...

mcp-server-attestation

Part of theStudioMeyer MCP Stack — Built in Mallorca 🌴 · ⭐ if you use it mcp-server-attestation Layer-2 supply-chain hardening for Model Context Protocol servers. Ed25519-signed tool manifests, runtime spawn-attestation, default-deny argument sanitizer. Direct response to: OX Security...

CVE-2026-116045

A vulnerability was detected in 1999AZZAR designer-mcp up to 2.1.0. This affects the function getreference of the file skills/motion-designer/references/motion-dev-guidelines.md of the component MCP Interface. The manipulation of the argument Name results in path traversal. It is possible to laun...

mcpshield

mcpshield A drop-in fix for the unpatched MCP STDIO command-injection flaw the CVE-2026-30623 family, disclosed by OX Security in April 2026 as "by design" -- no SDK patch is coming. Import one line, and every stdio MCP server your Python app launches gets its command/args/env validated before th...

spectrIDA-Reverse_Engineering_Stack

👻 spectrIDA Ghost through binaries. A local, AI-powered reverse engineering assistant: parallel IDA Pro analysis, AI function naming, a terminal that doesn't suck, a Neo4j knowledge graph of everything it's ever figured out, and an MCP server so Claude can search and chain through that graph...

h3-cli

NodeZero MCP Server The NodeZero MCP Server is now available, enabling you to run and manage a locally hosted MCP Server that brings NodeZero’s Find, Fix, Verify FFV capabilities directly to your development and security workflows. MCP Readme h3-cli: CLI tool for the Horizon3.ai API h3-cli is a...

windbg-mcp

WinDbg MCP An MCP Model Context Protocol server that exposes every pybag Windows debugger function as a native MCP tool. It gives any MCP-compatible client Claude Desktop, Claude Code, Cowork, OpenAI Codex CLI, Cursor, and custom agents full control over user-mode processes, kernel sessions, and...

IDAssistMCP

IDAssistMCP !IMPORTANT Planned archival: IDAssistMCP is planned for archival as IDA Pro introduces a bundled native MCP server. Native support removes the need to maintain a separate MCP integration and keeps it aligned with IDA Pro itself. Please use IDA Pro's native MCP server once it is...

Agent-Security-Regression-Harness

OWASP Agent Security Regression Harness The OWASP Agent Security Regression Harness is an open source, vendor-neutral test harness for running executable security regression scenarios against agentic applications and MCP-integrated systems. The project helps builders and defenders verify that...

OWASP-MCP-Governance-and-Risk-Project

This repository does not have a README...

CVE-2026-116045 1999AZZAR designer-mcp MCP motion-dev-guidelines.md get_reference path traversal

A vulnerability was detected in 1999AZZAR designer-mcp up to 2.1.0. This affects the function getreference of the file skills/motion-designer/references/motion-dev-guidelines.md of the component MCP Interface. The manipulation of the argument Name results in path traversal. It is possible to laun...

CVE-2026-116045

The 1999AZZAR designer-mcp software (up to version 2.1.0) contains a path traversal vulnerability in the MCP Interface component. Specifically, the get_reference function of the file skills/motion-designer/references/motion-dev-guidelines.md fails to properly sanitize the Name argument, allowing ...

EUVD-2026-109354

A vulnerability was detected in 1999AZZAR designer-mcp up to 2.1.0. This affects the function getreference of the file skills/motion-designer/references/motion-dev-guidelines.md of the component MCP Interface. The manipulation of the argument Name results in path traversal. It is possible to laun...

prismsec

PrismSec 🔷 Secure, modular MCP server for pentesting tools. Wraps 7 industry-standard security tools nmap, nuclei, gobuster, subfinder, httpx, nikto, sqlmap into 13 registered MCP tools — ready to use with Claude, Cursor, Copilot, and any MCP-compatible AI agent. Features Feature| Description...

binary-ninja-headless-mcp

Binary Ninja Headless MCP A headless Binary Ninja server that speaks MCP Model Context Protocol, giving AI agents full access to deep reverse-engineering workflows — disassembly, IL, patching, types, xrefs, and more — without a GUI. Designed to run in the same Docker container as the agent runtim...

unidbg

unidbg Allows you to emulate an Android native library, and an experimental iOS emulation. This is an educational project to learn more about the ELF/MachO file format and ARM assembly. Use it at your own risk ! Features Support MCP Model Context Protocol for AI-assisted debugging with Cursor and...