M
MCP Directory CURATED DIRECTORY
911 MCP servers indexed
中文
← Back to directory
COMPARE UP TO 4 SERVERS

Compare MCP servers

Compare scores, permissions, risks, and fit in one decision-focused table.

DimensionBlitz StrikeRecon at speed. Analysis in depth. Validation before report.Context7Upstash's official server providing up-to-date third-party library docs for AI coding assistants
FMRS42 / 100 · D80 / 100 · B
Reliability6 / 2014 / 20
Security and permissions4 / 2016 / 20
Maintenance9 / 2017 / 20
Documentation13 / 2015 / 20
Setup experience10 / 2018 / 20
Best for
  • Authorized security researchers and red/blue team engineers who want verify-before-report workflows
  • Agent users who want a full penetration-testing flow driven by one call inside an MCP client
  • Developers and security reviewers needing code audit (taint analysis, source-to-sink, variant analysis)
  • Teams that want a structured methodology plus knowledge base (manuals, playbooks, escalation chains) instead of scattered scripts
  • Developers using fast-moving frameworks/libraries worried about the AI suggesting stale code
  • Scenarios wanting zero-config documentation lookup
Not for
  • Anyone wanting to test external systems without explicit owner authorization
  • Anyone treating a scan hit as a confirmed vulnerability and skipping STRIKE validation
  • Users expecting everything to work offline out of the box — payloads and templates need `blitzstrike sync-data`, and fofa_search needs FOFA_EMAIL/FOFA_KEY
  • Users looking for an official or vendor-endorsed product; this is a community project
  • Looking up internal/private codebase documentation (Context7 targets publicly published open-source libraries)
  • Cases needing very high coverage of obscure, niche libraries (coverage depends on what Context7's platform has indexed)
Required permissions
  • Read the source directory or files being audited
  • Run a local process over stdio (command `blitzstrike`, args `serve --mcp`)
  • Make outbound HTTP requests to the audited target for live validation and recon
  • Write to client MCP config files (install merges into existing config, never overwrites)
  • Read/write memory and data cache under ~/.blitzstrike (overridable via BLITZSTRIKE_HOME / BLITZSTRIKE_DATA)
  • Optional: FOFA_EMAIL / FOFA_KEY for FOFA access, and H1_USERNAME to add the X-HackerOne-Research header
  • ensure_tool may auto-install missing security tools on the local machine
  • Usable without an API key (subject to a free-tier rate limit); CONTEXT7_API_KEY is an optional credential for higher quota
  • Read-only documentation lookup — no code execution or local filesystem access involved
Risks and side effects
  • Live validation and live_recon send real requests to targets; misconfigured scope or missing authorization can cause harm or legal exposure
  • ensure_tool auto-installation modifies the local environment and introduces supply/version risk
  • Payloads, nuclei templates, and exploitation manuals are offensive material that can be misused
  • Memory is stored append-only as JSONL at ~/.blitzstrike/memory.jsonl and may accumulate sensitive target data
  • FOFA and HackerOne credentials are supplied via environment variables and can leak
  • Automated scan results can still be false positives — the README insists every finding stays a hypothesis until strike_verify confirms it
  • The free tier has limited quota — high-frequency use may hit rate limits
  • Documentation content comes from Context7's platform index, so its accuracy and freshness depend on that platform's crawl cadence
Supported clientsClaude Desktop, Claude Code, Cursor, OpenCode, Hermes, Gemini, Windsurf, GitHub Copilot, ClineClaude Code, VS Code, Cursor, Cline, Amp
Tools522