A catalog of ChatGPT & Codex plugins, sorted by people.
Best MCP servers & Codex plugins for pentesting
17 plugins in our catalog say they help with pentesting. Here are the top 12, editor's picks first, then by GitHub stars. Most of them sit in Security & Governance and Agent Workflows.
How to choose
- Match the host first: Codex and Claude Code install commands differ, and the install line below shows which one each project targets.
- Check where it runs. Hosted MCP endpoints are quicker to set up but send your requests to someone else's server.
- Prefer a recent push and a real license (MIT or Apache-2.0) for anything you'll use at work.
- Stars tell you how many people looked, not whether it works. Read the code before you install.
The list
1. Supercov
Coverage, security and code quality for coding agents.
★ 166 · MIT · pushed 2026-11-13 (this week) · plugin · by supercorp-ai · alternatives
/plugin marketplace add supercorp-ai/supercov
2. synology-nas-cli
Zero-dependency Python CLI and MCP server for Synology DSM 7: security audits, one-command config fixes and alerts, usable from Claude Code, Codex and Cursor.
★ 104 · MIT · pushed 2026-11-12 (this week) · MCP server · by akari-sora
claude mcp add synology-nas --scope user -- /path/to/synology-nas-cli/bin/nas mcp
3. vibe-shield
60-rule static security scanner, MCP server and skill-poisoning auditor for AI-generated codebases in Claude Code, Codex and Cursor.
★ 44 · MIT · pushed 2026-11-15 (this week) · MCP server, skills · by VibeFoundry
claude mcp add vibe-shield -- npx -y @vibefoundry/vibe-shield mcp
4. Kanareika
Agentless, read-only Linux server security audit over SSH (CVE, Trivy and KEV scanning) with an MCP server for AI agents.
★ 8 · MIT · pushed 2026-11-14 (this week) · MCP server · by mikekosulin · alternatives
5. River Review
Versioned Skill Registry of code-review skills driven by a perspective-based review agent (code, security, performance, architecture, testing, adversarial) that verifies findings against the diff.
★ 8 · MIT · pushed 2026-11-15 (this week) · plugin, skills · by s977043
/plugin marketplace add s977043/river-review
6. Tartiner Labs
Agent skills for git workflows, GitHub automation, security audits, code refactoring, and project tooling.
★ 8 · MIT · pushed 2026-11-15 (this week) · plugin, skills · by tartinerlabs · alternatives
codex plugin add xcode-skills@tartinerlabs
7. ArmorCodex
Intent-based security for Codex with MCP plan registration, policy gating, CSRG cryptographic proofs, and audit logging on `bash` and `apply_patch`.
★ 7 · MIT · pushed 2026-11-15 (this week) · MCP server · by armoriq · alternatives
8. BurpSuite MCP Bridge
Bridge Burp Suite traffic, replay, rewrite rules, and evidence export into Codex through MCP for WSL, Windows, and macOS workflows.
★ 5 · No license file · pushed 2026-11-09 (this week) · MCP server · by 6jeffr3y · alternatives
9. EndoStack
Security-first workflows for coding agents that threat-model, security-review and verify code changes before they ship, across Codex, Claude Code, Cursor and Copilot.
★ 4 · MIT · pushed 2026-10-29 (last 30 days) · plugin · by requie
10. Claude Code Codex Plugin
Security-focused Codex plugin that connects to the local Claude Code CLI through MCP with login, status checks, safe-mode prompts, and no credential storage.
★ 2 · MIT · pushed 2026-11-12 (this week) · MCP server · by davidq888
11. Darkmoon
Start authorized autonomous AI pentest runs, poll status, list campaigns and read findings on your own self-hosted Darkmoon Pro through MCP.
★ 1 · GPL-3.0 · pushed 2026-11-02 (last 30 days) · plugin · by ASCIT31
12. Fixlane
Known security issues in developer software with reviewed fix procedures: checks your installed tools and versions read-only. Remote MCP server plus plugin for Claude and Codex.
★ 0 · MIT · pushed 2026-11-11 (this week) · MCP server, plugin · by Fixlane (LightSmite)
/plugin marketplace add lightsmite/fixlane-plugin
Head-to-head
Kanareika vs Fixlane · Supercov vs Kanareika · Kanareika vs ArmorCodex
Matched by keywords in each project's own name and description. The topic comes from what people actually type into Google and Bing search boxes.
All comparisons and use cases →
Data from GitHub and each project's README, checked 2026-11-15. We haven't installed or audited these, and stars measure attention, not quality. Paid placements never change this page. Spot a mistake? hello@pickaplugin.com
New MCP servers & plugins, once a week
One short email a week: the MCP servers and plugins that joined the catalog, and the ones gaining stars fastest. Free. Confirm by email, unsubscribe in one click. Past issues.
