20 HackerOne alternatives
HackerOne: Official read-only MCP server for HackerOne bug bounty reports, programs, and remediation data. 20 MCP servers do similar work, most sharing Security and Vulnerability Management, ranked by how much they have in common with HackerOne.
-
by mukul975
Vulnerability triage for AI agents: 28 security tools across 24 free intelligence sources — NVD, EPSS, CISA KEV, MITRE ATT&CK, Shodan and VirusTotal — behind a single triage_cve call.
Also: Security, Vulnerability Management
-
by E2B
Run AI-generated code safely in an isolated cloud sandbox, with results returned as data rather than text.
Also: Security
-
by duty1g
A native x64dbg plugin exposing 84 debugging tools and 22 event callbacks over HTTP, so an AI assistant can drive breakpoints, memory and disassembly directly.
Also: Security
-
by JFrog
JFrog's official remote MCP server: 100+ tools across Artifactory, Xray and Curation, hosted on JFrog Cloud with OAuth and no client install.
Also: Security
-
by Aikido Security
Runs Aikido's code and secrets scan as a tool inside your coding agent, returning machine-readable findings the agent can triage, fix or ignore in place.
Also: Security
-
by Cloudsmith
Cloudsmith's official MCP server, built into its CLI: manage artifact repositories, packages and policies through an agent, with write operations off by default.
Also: Security
-
by PortSwigger
PortSwigger's official Burp Suite extension exposing proxy history, Repeater and scanning to AI agents over MCP.
Also: Security
-
by Doppler
Doppler's official MCP server — let an agent list projects, read and write secrets, manage configs and review activity logs, scoped by the token you give it.
Also: Security
-
by OpenAI
OpenAI's customer-run tunnel client: reach a localhost or private-network MCP server from ChatGPT, Codex, the Responses API and AgentKit without opening an inbound firewall rule.
Also: Security
-
by 1Password
1Password's official local MCP server for dev secrets: the agent manages Environments and .env mounts by name, and never sees a secret value.
Also: Security
-
by HashiCorp
HashiCorp's official MCP server for Vault: manage secret engine mounts, read and write KV secrets, and drive the PKI engine — issuers, roles and certificates — from an agent.
Also: Security
-
by Okta
Okta's official open-source MCP server: manage users, groups, apps, policies and branding in your Okta org from an AI agent, with scope-gated tools and confirmation on destructive actions.
Also: Security
-
by Bitwarden
Bitwarden's official MCP server — unlock the vault, read and edit items, generate passwords and TOTP codes, and run organisation administration. Local use only.
Also: Security
-
by Semgrep
Semgrep's official MCP server — scan code for security vulnerabilities, write and test custom rules, and pull findings from Semgrep Cloud, from inside an agent session.
Also: Security
-
by Snyk
Snyk's official MCP server, shipped inside the Snyk CLI: scan code, dependencies, containers and IaC for vulnerabilities, generate SBOMs and monitor projects from your agent.
Also: Security
-
by SonarSource
Official SonarSource MCP server — pull code-quality issues, security hotspots, quality gates and rule explanations from SonarQube Cloud or Server into your agent.
Also: Security
-
by Docker
Docker's official CLI plugin that runs MCP servers in isolated containers behind one gateway — secrets management, OAuth flows and a single config every client shares.
Also: Security
-
by Vanta
Vanta's official remote MCP server — query controls, tests, vendors, vulnerabilities and policies across SOC 2 and ISO 27001, and remediate failing tests from your agent.
Also: Security
-
by Splunk
Splunk's own MCP server, hosted inside your Splunk deployment, letting agents write SPL from natural language and run searches under existing RBAC.
Also: Security
-
by Automox
Automox's official MCP server for endpoint management — 130+ tools over devices, patches, policies, groups and audit data, self-hosted or on Automox's hosted endpoint.
Also: Security
