mcpsnoop
kerlenton/mcpsnoopWireshark for MCP. A transparent proxy between your AI client and MCP server. Watch every call live in your terminal, fail CI on what it finds,…
api-security-testingdebuggersdynamic-analysis-sandboxing+5
362
kerlenton/mcpsnoopWireshark for MCP. A transparent proxy between your AI client and MCP server. Watch every call live in your terminal, fail CI on what it finds,…
thoropass-public/area51The exploit server for out-of-band findings. Point a target at a domain you own. Every HTTP request and every email it sends back lands in a…
letsencrypt/test-certs-siteA simple server to host the valid, revoked, and expired certificates required by Section 2.2 of the CA/Browser Forum Baseline Requirements.
mozilla/firefox-devtools-mcpModel Context Protocol server for Firefox DevTools - enables AI assistants to inspect and control Firefox browser through WebDriver BiDi
bishopfox/cve-2026-35616-checkNon-destructive scanner for CVE-2026-35616, a pre-authentication API bypass in FortiClient EMS. Detects vulnerability by comparing HTTP responses…
xaaha/hulakA lightweight, file-based CLI API client with age-encrypted secrets, first-class GraphQL support, and a built-in MCP server for AI agent workflows.
wi3memake/react2shell-scannerCommand-line security assessment framework for React and Next.js applications, analyzing React Server Components for misconfigurations, with…
dolevf/graphw00fGraphQL server engine fingerprinting tool that sends benign and malformed queries to identify backend technology and assess security defenses via the…
george0papasotiriou/cve-2026-11103-graphql-batching-alias-rate-limit-bypassProof-of-concept exploit for CVE-2026-11103 demonstrating GraphQL rate-limit bypass through batching and field aliases; includes vulnerable Node.js…
qustavo/httplabInteractive web server for inspecting HTTP requests and forging responses, with a terminal UI for real-time debugging and API testing.
mda2av/http11probeAn open testing platform that probes HTTP/1.1 servers against RFC 9110/9112 requirements, smuggling vectors, and malformed input handling. Add your…
elmasy-com/columbus-serverAPI-first subdomain discovery service using Certificate Transparency logs for fast, passive enumeration of subdomains via a REST API with JSON or…
boreas37/cve-2026-34910-pocCVE-2026-34910/34909 — UniFi OS unauth RCE + file read via ..%2f auth bypass (CVSS 10.0, KEV, Mirai ITW)
purpleteam-labs/purpleteam-server-scannerServer scanning component of purpleteam
george0papasotiriou/cve-2026-5432-graphql-batching-alias-confusion-sql-injectionDemonstrates a critical GraphQL batching alias-confusion SQL injection (CVE-2026-5432) with a vulnerable Node.js server and Python exploit for…
george0papasotiriou/cve-2026-22014-graphql-persisted-queries-injection-via-id-manipulationProof-of-concept exploit for CVE-2026-22014 demonstrating persisted-query ID manipulation in GraphQL APIs to bypass allowlists and execute arbitrary…
learner202649/cve-2025-45809-pocTime-based blind SQL injection proof-of-concept for LiteLLM v1.65.4. Exploits the `/key/block` endpoint to extract database contents and read server…
agentsid-dev/agentsid-scannerSecurity scanner for MCP servers. Grades auth, permissions, injection risks, and tool safety. The Lighthouse of agent security.