5 tagged blue team, measured the same way as everything else here.
MCP server Claude CodeCodexCursor +2
MCP server "cybersec-toolkit" as configured in 26zl/cybersec-toolkit. Runs in Docker (ghcr.io/26zl/cybersec-toolkit:1.1.1). Needs 2 environment variables to run.
MCP server Claude CodeCodexCursor +2
MCP server "rami-kali-docker-local" as configured in RamiBotAI/ramibot. Runs in Docker (/opt/rami-kali/mcp_server.py).
MCP server Claude CodeCodexCursor +2
MCP server "huntable-cti-studio" as configured in dfirtnt/Huntable-CTI-Studio. Launched with bash scripts/run_mcp_server.sh.
badchars/living-off-the-land-lolbins-mcp-server
MCP server Claude CodeCodexCursor
Living off the Land binaries MCP server — GTFOBins, LOLBAS, LOOBins, LOLDrivers, LOLRMM, LOLESXi, LOTP, LOLC2, WADComs intelligence with attack graph reasoning, privilege escalation paths, defense evasion, detection engineering. Runs locally from the living-off-the-land-lolbins-mcp-server npm package.
MCP server Claude CodeCodexCursor
MCP server "hayabusa" as configured in omeryemba/mcp-hayabusa. Launched with mcp-hayabusa.