Awesome Cybersecurity Agentic AI

Table of Contents

• MCP Servers
• Research
• Tools
• Frameworks
• Datasets
• Communities

MCP Servers

• addcontent/nuclei-mcp - MCP server implementation for Nuclei, a fast and customizable vulnerability scanner.
• alexgoller/illumio-mcp-server - MCP server for Illumio PCE, enabling AI-driven workload management, label operations, and traffic flow analysis for security.
• atomicchonk/roadrecon_mcp_server - MCP server for Azure AD data analysis with ROADRecon, mapping Azure Active Directory environments.
• Bamimore-Tomi/ghidra_mcp - MCP server for Ghidra, providing reverse engineering and binary analysis capabilities to LLMs and agentic workflows.
• bromoket/x64dbg_mcp - MCP server for x64dbg debugger, providing 152 tools for AI-driven Windows debugging, reverse engineering, memory analysis, tracing, and anti-debug bypass.
• BurtTheCoder/mcp-dnstwist - MCP server for DNS fuzzing with dnstwist, detecting phishing and domain takeover threats.
• BurtTheCoder/mcp-maigret - MCP server for OSINT data collection with Maigret, gathering user info from various sources.
• BurtTheCoder/mcp-shodan - MCP server for querying Shodan, providing data on Internet-connected devices for security analysis.
• BurtTheCoder/mcp-virustotal - MCP server for querying the VirusTotal API for file and URL malware analysis.
• ExposureGuard/exposureguard-mcp - Domain security scanning for AI agents. 8-check audit (SPF, DMARC, SSL, headers, DNSSEC, ports), A-F grades, fix snippets. getexposureguard.com
• ExposureGuard/haldir - Guardian layer for AI agents: scoped sessions (Gate), encrypted secrets (Vault), audit trail (Watch), proxy mode for policy enforcement. Identity, spend limits, human-in-the-loop approvals. haldir.xyz
• MCPPhalanx/binaryninja-mcp - MCP server for Binary Ninja, enabling binary analysis and reverse engineering in agentic workflows.
• mobilehackinglab/jadx-mcp-plugin - Jadx plugin for MCP server access, used for decompiling Android apps.
• MorDavid/BloodHound-MCP-AI - MCP server for BloodHound, providing Active Directory analysis and attack path discovery for agentic AI.
• operantlabs/operant-mcp - Open-source MCP server with 51 security testing tools for pentesting, vulnerability scanning, and security auditing. Covers SQLi, XSS, SSRF, IDOR, auth bypass, CORS, path traversal, command injection, NoSQL injection, PCAP analysis, and cloud security.
• PortSwigger/mcp-server - MCP integration for Burp Suite, enabling web security testing and automation via agentic AI workflows.
• san-techie21/astracipher - Cryptographic identity MCP server for AI agents using W3C DIDs, Verifiable Credentials, and NIST post-quantum cryptography (ML-DSA-65 FIPS 204). Provides capability-bounded tool authorization, trust chain verification, and hybrid PQC signatures.
• urldna/mcp - urlDNA MCP server for phishing detection and URL analysis through advanced contextual scanning.
• voidly-ai/mcp-server - Global internet censorship intelligence MCP server with 116 tools across 119+ countries. OONI / IODA / CensoredPlanet evidence, 5,356 citable incidents, ISP-level risk scoring, ML-driven shutdown forecasting (Sentinel), and domain accessibility checks for nation-state network interference. Free read endpoints, no API key.

Research

• agentic-anti-patterns - Curated catalog of 20 documented LLM-agent failure modes (prompt injection via tool output, MCP server trust boundary collapse, RAG retrieval poisoning, exfiltration via agent-initiated fetch, autonomy creep, multi-agent vertical-domain failure, and more) with symptoms, root causes, mitigations, and detection methods per entry.
• AI CTF: Autonomous Agents in Cybersecurity Competitions - Research on the use of agentic AI in CTF competitions and cybersecurity challenges.
• AutoCTF: Automated Capture The Flag Framework - Research on an automated CTF framework using agentic AI for autonomous penetration testing and vulnerability discovery.
• BreachSeek - A Multi-Agent Automated Penetration Tester
• CAI: An Open, Bug Bounty-Ready Cybersecurity AI - Comprehensive research on an open-source agentic AI system for cybersecurity and in particular for bug bounty, featuring hierarchical agent patterns, multi-agent collaboration, and autonomous penetration testing capabilities.
• CyberBattleSim (Microsoft) - Research platform for simulating cybersecurity environments and evaluating autonomous agents in attack/defense scenarios.
• D-CIPHER - A multi-agent framework for collaborative CTF solving.
• Dynamic-Risk-Assessment - Dynamic risk assessment specifically for offensive cybersecurity agents, offering insights into evaluating the risks and potential impact of autonomous attack tools.
• LLM Agents for Automated Penetration Testing - Paper on leveraging LLM-based agents for autonomous penetration testing and red teaming.
• Multi-Agent Systems for Cybersecurity - Survey and research on the application of multi-agent systems in cybersecurity, including threat detection and response.

Tools

• AgentFence - Open-source platform for automatically testing AI agent security, detecting vulnerabilities like prompt injection, secret leakage, and system instruction exposure.
• Agentic Radar - Open-source CLI security scanner for agentic workflows.
• agenticsorg/agentic-security - An AI-powered security analysis tool intended to automatically detect vulnerabilities within code repositories.
• Aguara - Static security scanner for AI agent skills and MCP servers. 173 detection rules, 4 analysis layers (pattern matching, NLP, taint tracking, rug-pull detection), offline, deterministic.
• AI Agent Launch Tools - CLI and no-login checklists for scanning public AI-agent/MCP launch pages, approval gates, prompt-injection fixtures, and safe intake paths.
• AICA Agent - Autonomous intelligent cyberdefense agent for research and production, supporting advanced detection, response, and management capabilities.
• Armorer Guard - Local Rust security scanner and MCP proxy for AI agents that detects prompt injection, credential leakage, exfiltration, and risky tool-call arguments before execution.
• ATR (Agent Threat Rules) - Open-source detection rules for AI agent threats. 419 regex rules, 10 OWASP-mapped categories, sub-millisecond latency. Adopted in production by Cisco AI Defense and Microsoft agent-governance-toolkit. MIT licensed.
• brood-box - CLI tool for running AI coding agents (Claude Code, Codex, OpenCode) inside hardware-isolated microVMs with snapshot isolation, egress control, and MCP authorization profiles.
• CAI (Cybersecurity AI) - Open-source Bug Bounty-ready AI system with hierarchical agentic patterns, supporting autonomous penetration testing, vulnerability discovery, and multi-agent cybersecurity workflows.
• ClawSearch - Search engine for AI agent skills with security-first indexing, surfacing audit results, risk scores, and safe alternatives for MCP servers and agent tools.