The request asks what to use for security testing, a general category rather than a named product. The strongest matches are Pentest-tools, which offers vulnerability scanning and autonomous AI pentesting for web, network and cloud 1, and Strix, an AI penetration testing platform that tests code, APIs and infrastructure with validated findings 7. Semgrep, a SAST and secrets-detection platform 8, and OWASP's application security projects and tools 6 are also relevant for code-level testin
- 1
Pentest-Tools.compentest-tools.comwebsite read, tools not yet checked
Vulnerability scanning, autonomous AI pentesting and human-led offensive security testing for web, network and cloud targets, with an MCP server available 1.
- 2
Strixstrix.aiverified and signed
AI penetration testing platform that tests code, APIs, web apps and cloud and delivers validated findings with proof-of-exploit 717.
official:MCP server · Strix
for agents: application-security-testing · api-security-testing · web-app-penetration-testing
- 3
- 4
- 5
Sources
- 1Autonomous pentesting, continuous monitoring - Pentest-Tools.compentest-tools.com · read 2026-10-29
- 5CyberStrike — Agentic AI Penetration Testingcyberstrike.io · read 2026-10-30
- 6OWASP Foundation - The Open Source Foundation for Application Securityowasp.org · read 2026-10-29
- 7Strix - AI Penetration Testing & Autonomous Securitystrix.ai · read 2026-10-29
- 8Semgrep App Security Platform | AI-assisted SAST, SCA and Secrets Detectionsemgrep.dev · read 2026-10-29
- 15bolt: declares "hydra" (the record we read)github.com · read 2026-10-24
- 16appsec-agent: declares "Bash" (the record we read)github.com · read 2026-10-24
- 17application-security-testing: declares "application-security-testing" (the record we read and signed)unfragile.ai · read 2026-10-24
- 18semgrep: declares "semgrep" (the record we read and signed)unfragile.ai · read 2026-10-24
For agents: the 10 actions behind this answer
· Pentest-tools website read, tools not yet checked
Vulnerability scanning and validation, autonomous AI pentesting, and human-led offensive security testing in one place. For web, network, and cloud.
webapp-testing · webapp-testing verified and signed
Toolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend functionality, debugging UI behavior, capturing browser screenshots, and viewing browser logs.
access-policy-tests · Cloudflare API verified and signed
Start Access policy test
docker-sandboxes-kits · docker-sandboxes-kits verified and signed
Use this skill when authoring, validating, packaging, signing, or composing a Docker Sandboxes kit `spec.yaml` (`sbx kit add/inspect/pack/pull/push/sign/validate/verify`), even if the user just says they want to "add a tool to a sandbox agent", "build a reusable sandbox extension", "publish a kit to
hydra · bolt found in code, not yet checked
hydra MCP server — fast and parallel network login brute forcer supporting 50+ protocols. Use this tool when you need to: - Brute force login credentials for network services: SSH, FTP, RDP, SMB, Telnet, VNC, MySQL, MSSQL, PostgreSQL, IMAP, SMTP, POP3 - Test HTTP/HTTPS form-based authentication (log
Bash · appsec-agent found in code, not yet checked
Execute a shell command in the project working directory. Use this to run tests, install dependencies, or inspect the project.
application-security-testing · application-security-testing verified and signed
Application security testing (AppSec) across a whole product with Strix — decide which asset needs which test (source code, running web app, API, CI pipeline), run it, and turn the results into a ranked remediation plan. Autonomous agents exploit and prove each issue instead of emitting static-analy
semgrep · semgrep verified and signed
Semgrep catches security vulnerabilities in real-time and guides Claude to write secure code from the start.
PostTestHelpersConfirmationTokens · Stripe API verified and signed
Create a test Confirmation Token
· Playwright website read, tools not yet checked
Web automation and testing for apps, scripts, and AI agents
Labels are the instruments' verdict and are never changed by ranking. Agents and robots get this same answer as JSON at /api/v1/find?q=…&answer=1 and through the MCP server.