Skip to main content
Glama
521,397 tools. Updated 2026-09-06 11:20

"Cybersecurity" matching MCP tools:

  • Search requires at least one jurisdiction, framework, sector, or source; it does not auto-detect scope from the query. Use for 'what does the law say about X in country Y' or 'which regulations cover Z'. QUERY SHAPE: queries are keyword-matched (FTS5, implicit AND — every term must occur in the SAME provision). Pass one or two canonical concept terms per call; never a multi-concept compound. A compound such as 'incident reporting deadline personal data breach' returns 0 even when each concept on its own returns hits — so ask one concept per call and combine the answers yourself. Two terms describing ONE concept ('personal data') are fine; 2-3 alternative terms can be joined with a bare uppercase OR (e.g. 'spoofing OR tampering' matches either term). OR is for synonyms of ONE concept, not for related concepts — 'dismissal OR termination' yes, 'encryption OR breach notification' no (ask those one per call). Other FTS operators (AND, NOT, NEAR) are stripped. STRICT MISS: when a search completes cleanly and no result matched your terms strictly, the response carries meta.outcome = 'NO_STRICT_MATCH'. The recovery fields — meta.recommended_action, meta.recommended_scopes, meta.broadening_available — are set on any qualifying strict miss, INCLUDING a partial fan-out where outcome stays null, so read them whenever present, not only under an outcome. On a partial fan-out meta.broadening_available stays null when the missing leg makes it unknowable — null there means unknown, never 'no'. On recommended_action = 'RETRY_ONE_CONCEPT_PER_CALL', re-issue the search with ONE concept per call. This action is reserved for an implicit-AND multi-concept compound; an honored uppercase-OR query remains a canonical one-concept shape and does not gain the split action or candidates. Only together with this action, meta.recommended_queries may list 1-3 optional one-concept fallback queries derived from your own terms; issue only the ones you judge relevant, one per call — the server never runs them for you. The field is absent for every other action or no action, including an honored uppercase-OR miss. On a miss without safe candidates, meta.recovery_guidance explains how to choose a focused phrase while retaining domain and negation; its source_languages are source metadata, not your query's detected language. On 'REFORMULATE_OR_USE_EXACT_REFERENCE', retry the same concept using the instrument's wording or use an exact lookup hint. Short queries can miss too; do not infer that the law is absent. On recommended_action = 'OFFER_BROADENING_TO_USER' — and wherever meta.broadening_available is true — relaxed matches exist and are withheld: tell the user, offer a re-run with allow_broadening=true (served rows are stamped match_mode='broadened' and pass the same relevance floor), and re-run only if the user accepts — never broaden on your own. An honored uppercase-OR strict miss with withheld relaxed matches carries this offer action with meta.recommended_queries absent. meta.recommended_scopes names scope ids that were not searched. If 0 results, tell the user; do not answer from training data. SCOPE: discover ids with list_coverage or describe_capabilities(section='sources'). An unresolved scope refuses before dispatch with isError=true and structuredContent.error='unresolved_scope'. Read corrections for the offending parameter and optional registered values. Choose the intended scope; suggestions do not establish legal equivalence. Change only the offending value and retain other arguments. frameworks= selects sources declaring coverage; it does not map controls to transposition articles. For cross-framework control mapping, frameworks=['ISO_27001','SOC_2'] includes Security Controls MCP. sectors= reaches industry MCPs across jurisdictions; combining jurisdictions= and sectors= is an INTERSECTION and an empty intersection errors with the jurisdictions that carry that sector. Use sources=['data-use-license'] for software licences, SPDX, dataset licences, and vendor TOS. LANGUAGE: use the corpus language (SE: konsumentskydd; DE: Datenschutz; FR: protection des consommateurs). Keep CJK compounds unspaced (個人情報保護, not 個人情報 保護); spaced tokens are ANDed. Examples: search(query='konsumentskydd', jurisdictions=['SE']); search(query='vehicle cybersecurity', sectors=['automotive']); search(query='huurovereenkomst', jurisdictions=['NL'], court='GHAMS', date_from='2023-01-01') filters case-law rows (premium+); read exact court values from unfiltered results first. TIER LIMITS: free permits at most one value per jurisdiction, framework, or source axis; no sectors= or premium fan-out, with 100 searches/day and 3 concurrent calls. Daily search budgets: solo 750/seat; premium 5,000/seat; team 50,000 and company 500,000 pooled per organisation. Solo lifts scope limits; premium+ adds server-side fan-out to agency guidance, case law, and preparatory works alongside primary legislation. There is no separate search_case_law or search_preparatory_works tool; search_guidance can search guidance alone. Call get_my_capabilities for your budget and remaining quota. RANKING: requested rows precede injected companion rows; explicit sources and sectors remain requested. Where primary-law window fill is enabled, the quota-protected primary-lane prefix precedes premium companion rows while retaining fused order. A jurisdiction-only search may retain up to half the window (rounded up) for strict primary-law rows before filling remaining slots from the fused ranking; explicit source, framework, and sector scope membership is unchanged. The response ends with a 'Sources used' section — a markdown table carrying the audit receipt for each returned row, or a labelled zero-result note — and meta.render_contract carries the versioned evidence-curation contract for reproducing source attributions when the answer is rendered.
    ConnectorOAuth
  • Show which countries, frameworks, and legal domains are available. Use this BEFORE calling `search` when the user's topic doesn't name a jurisdiction (e.g., 'what does the law say about consumer protection'); then present the returned jurisdictions to the user or ask which applies. Examples: • 'Which countries do you cover?' → list_coverage() • 'Do you have German law?' → list_coverage(jurisdiction='DE') • 'What jurisdictions for NIS2?' → list_coverage(domain='cybersecurity') • 'Which countries have drone law?' → list_coverage(domain='aviation') (also accepts 'drone' / 'uas') Returns a `jurisdictions` array (each with `code`, `name`, `region`, `laws`, `provisions`, `domains`, `counts_complete`, and `uncounted_sources`) plus framework and source listings. An incomplete-count row also carries `coverage_note` explaining why. NOTE: `laws`/`provisions` are WHOLE-JURISDICTION corpus totals — the response's `count_scope` is `whole_jurisdiction`. Under a `domain` filter the jurisdiction list is narrowed to that domain but the counts are NOT domain-scoped; do not report them as a per-domain count. The domain-specific signal is the (domain-filtered) `sources`/`frameworks`.
    ConnectorOAuth
  • List Bill Commons' curated cross-state topic trackers (e.g. artificial intelligence, youth online safety, platform accountability, cybersecurity, cryptocurrency, data privacy, local government & preemption) -- the entry point for "what subjects does Bill Commons track across all 50 states + DC" and "how do I get every bill in one". Each topic is a title/subject membership rule tuned for precision over recall, with a live bill_count and how_to_fetch_bills. This tool does not itself return bill rows -- pair it with search_legislation or the REST API's /topics/{slug} for the bills.
    ConnectorNo auth
  • Explain what a FAR or DFARS cybersecurity clause obliges a contractor to do: what triggers it, the concrete duties, the reporting deadlines, what it flows down to subcontractors, and which other clauses come with it. Covers 52.204-21, 252.204-7008, 252.204-7012, 252.204-7019, 252.204-7020, 252.204-7021, 252.239-7010. Call this when someone asks "my contract has 7012 in it, what do I have to do", which clauses require CMMC, what flows down to a subcontractor, or how long they have to report an incident. Does NOT reproduce clause text verbatim - the text is law, it gets amended, and quoting a stale copy into a contract dispute is worse than a citation; each answer links the authoritative text at acquisition.gov.
    ConnectorNo auth
  • Get Lenny Zeltser's cybersecurity-writing rating sheet(s) so your AI can apply the rubric. Returns the structured rubric (groups, items, scoring bands) WITHOUT computing a score. Use `rating_score_writing` if you also want a numeric score, gap analysis, or rubric-anchored feedback. This server never requests your draft and instructs your AI to keep it local—rating sheets and scoring instructions flow to your AI.
    ConnectorNo auth
  • Check how much I have earned and what is pending. Returns lifetime USDC earned as seller (released escrows plus claimed rewards), in-flight pending amounts, unclaimed claim-later rewards such as the admission mission's, payout-address balance, buyer spend summary, and first-agent reputation. Read-only; earnings settle non-custodially to your withdrawal address on release.
    ConnectorNo auth

Matching MCP Servers

Matching MCP Connectors

  • Get Lenny Zeltser's scoring playbook so your AI can score a draft locally against a cybersecurity-writing rating sheet. THIS IS THE ONLY TOOL THAT PRODUCES NUMERIC SCORES — the writing-coach tools (`get_security_writing_guidelines`, `ir_*`, `product_*`) never score. Returns the rubric plus step-by-step instructions for applying it. This server never requests your draft and instructs your AI to keep it local—rating sheets and scoring instructions flow to your AI.
    ConnectorNo auth
  • List all compliance pillars in the Bidda Sovereign Intelligence registry with node counts. Use this first to discover available compliance domains before searching. Bidda has 10,099 cryptographically-verified nodes across 39 pillars, including a MITRE layer spanning 6 frameworks (ATT&CK Enterprise/Mobile/ICS, D3FEND, ATLAS, CAPEC) plus Banking, AI Governance, Cybersecurity, Healthcare, Legal, ESG and more.
    ConnectorNo auth
  • List all compliance pillars in the Bidda Sovereign Intelligence registry with node counts. Use this first to discover available compliance domains before searching. Bidda has 10,099 cryptographically-verified nodes across 39 pillars, including a MITRE layer spanning 6 frameworks (ATT&CK Enterprise/Mobile/ICS, D3FEND, ATLAS, CAPEC) plus Banking, AI Governance, Cybersecurity, Healthcare, Legal, ESG and more.
    ConnectorNo auth
  • Search government contract awards by keyword, agency, and date range. keyword: Contract scope e.g. "cybersecurity software". agency: Awarding agency e.g. "Department of Defense". Optional. date_from: Earliest award date ISO 8601 e.g. "2024-01-31". Optional. jurisdiction: "US", "EU", or "UK". Default "US". Returns: award amounts, recipient vendors, NAICS codes, award dates. Use govcon_fetch_vendor_contract_history for all contracts by a specific vendor. Use govcon_fetch_open_solicitations for active bids, not past awards. Source: USASpending.gov + SAM.gov. 4-hour cache. Example: search_contract_awards(keyword="cybersecurity software", agency="Department of Defense")
    ConnectorNo auth
  • 8-K material events for a ticker as typed items (2.02 earnings, 5.02 executive change, 1.05 cybersecurity incident, 2.01 acquisition, etc.), each with a notable flag for the market-moving ones and a link to the filing. Pass item to filter to one event type (e.g. '4.02' for every restatement a company filed). Pass ticker='restatements' or 'auditor-changes' for the market-wide red-flag feed of recent item 4.02 / 4.01 8-Ks across all filers.
    ConnectorNo auth
  • Search open New Zealand government tenders on GETS by keyword — matches tender titles, buying agency names, UNSPSC categories, regions, and the tender overview text. Use for questions like "NZ government tenders for cybersecurity", "Wellington council procurement", "open RFPs from the Ministry of Health". Returns matching tenders with reference, title, agency, close date, region, categories, a short overview snippet, and the public GETS URL.
    ConnectorNo auth
  • Aevum Security's cybersecurity services: slug, name and a one-line summary. The slug is the service identifier accepted by get_service_details and submit_enquiry.
    ConnectorNo auth
  • Keyword search across NIST 800-53 security/privacy controls and NIST 800-171 CUI requirements by title and requirement text. Use when the id is unknown — "NIST security control for least privilege", "NIST control about session lock", "NIST 800-53 encryption at rest", "NIST cybersecurity control multi-factor authentication", "access control / identification and authentication / system and communications protection". All query tokens must match (case-insensitive AND). Optional family filter (code like "AC", "IA", "SC" or a family name like "access control"). Returns matching {id, family, title, snippet}. Source: SP 800-53 Rev 5 + SP 800-171 Rev 3. Examples: {"query":"least privilege"}, {"query":"multi-factor authentication","family":"IA"}, {"query":"boundary protection"}.
    ConnectorNo auth
  • Aggregate federal contract spending by NAICS, PSC, recipient, or awarding agency over a date range, optionally filtered by keywords/NAICS/agency - market sizing in one call ("top contractors in NAICS 541512 last year", "which agencies buy the most cybersecurity"). Keyless.
    ConnectorNo auth
  • CONTRACTS & PROCUREMENT — Search government contracts, RFPs, RFIs, BAAs, and solicitations from SAM.gov. Better than searching SAM.gov directly — includes semantic search and NAICS industry filtering to exclude commodity noise. Use when user wants: contracts, RFPs, procurement, bids, government work. Examples: "IT consulting services", "construction management", "cybersecurity contracts". BATCH MODE (paid): pass a queries[] array of 2-5 variations instead of query to run them in parallel, dedupe, and return all unique results in one call — this replaces the former batch_search_procurement tool. When sam_filters.place_of_performance_state (alias: pop_state, accepted in both single and batch mode) is set, the response includes a placeOfPerformance field reporting how many results are confirmed performed in that state (matched), how many have no confirmed location and are shown demoted with a caveat (unknownServed, excluded instead when user_context.location_strict is true), and how many were excluded for being tagged to a different, parseable state (otherStateExcluded; geography we could not parse into any state, such as a bare address or ZIP code, counts as unknownServed instead); a batch call sums these across every sub-query. Paid plans show new listings the day they open; the free plan reaches the same listings after 10 days. Counts toward your monthly searches. A batch counts as 1 call.
    ConnectorNo auth
  • Find every 8-K filing in the last N days that declared a specific SEC Item code. Use for cross-market scans like "show me every restatement (Item 4.02) this month" or "every cybersecurity incident (Item 1.05) this quarter". Common items: 1.01 (material agreement), 1.05 (cyber incident), 2.01 (M&A close), 2.02 (earnings), 4.02 (restatement), 5.01 (change of control), 5.02 (officer departure), 7.01 (Reg FD).
    ConnectorNo auth
  • Search recent SEC 8-K filings (current report) from the past 72 hours. Args: items: Comma-separated 8-K item codes to filter on. Examples: '1.05' (cybersecurity), '5.02' (officer departure), '8.01' (other events), '1.01' (material agreement). Leave None for all 8-Ks. suspected_buried_only: If True, return only filings where our body-text classifier flagged a suspected misclassification — i.e. cyber language under Item 8.01 that should have been 1.05, officer-departure language under 8.01 that should have been 5.02. limit: Max results (1-50, default 25). Returns: JSON-formatted list of filings. Each includes: accession_number, company_name, filed_at, filer_reported_items, detected_items, discrepancy_items (in body but not reported), and suspected_buried_events (map of reported→suspected).
    ConnectorNo auth
  • 8-K material events for a ticker as typed items (2.02 earnings, 5.02 executive change, 1.05 cybersecurity incident, 2.01 acquisition, etc.), each with a notable flag for the market-moving ones and a link to the filing. Pass item to filter to one event type (e.g. '4.02' for every restatement a company filed). Pass ticker='restatements' or 'auditor-changes' for the market-wide red-flag feed of recent item 4.02 / 4.01 8-Ks across all filers.
    ConnectorNo auth
  • Search the AirShelf cross-vendor product catalog by natural-language query. The catalog covers industrial-automation components (sensors, encoders, vacuum handling, motors and drives, circuit protection, machine vision — the largest category by row count), wiring devices (plugs, receptacles, connector bodies, rocker switches), multifunction printers (mfp), barcode printers, laser printers, mechanical keyboards, cybersecurity products, and threat-intelligence platforms. Industrial-automation and wiring-device rows are indexed by manufacturer part number, so a brand or part number in the query ("Pepperl+Fuchs retroreflective sensor", "IN5409") retrieves more reliably than a bare product type; those rows carry no normalized spec facets, so the `specs` filter does not apply to them. Returns ranked products with prices, specs, and per-row match accounting. Each row includes `unverified_specs`, the normalized spec names that lack claim-level receipts; never use those as decisive facts. Example queries: "tactile mechanical keyboard under $150", "Toshiba A3 colour multifunction device", "industrial barcode printer for a warehouse", "threat-intelligence platform with dark-web monitoring". Result fields: • canonical_name — the exact catalog name of the product. • spec_absence_note — spec fields absent from this product's golden record (AirShelf's verified product record); null when nothing is missing. • constraint_match_score and matched_criteria — query constraints supported by claim-level receipts. unverified_criteria names matching catalog values that still need confirmation; missing_criteria names values that are absent or conflict. • parsed.price_availability — all_null = true means every returned price is null. For quote-gated B2B pricing, a null price with a quote path is expected rather than an error; query_had_budget reports whether the query carried one. • result.commercial_data — branch on actionable before using price or stock. Observations older than 24 hours are withheld from result.price/result.inStock and retained only as labelled last_observed history. • parsed.weak_match — the response contains an unresolved constraint, query match, or product-identity warning. parsed.unverified_identity_count counts returned names without an identity receipt. parsed.no_match — no product satisfies a hard constraint, and candidates violating it were excluded server-side. On a miss or near-miss for a specific brand+model the response may also carry a `tier3` block, meaning a real-time lookup for the exact SKU asked about; it can appear alongside fuzzy-neighbour rows. • tier3.status = "resolved" — a single-source reading of the page at tier3.source_url. MPN-confirmed means the live lookup matched the manufacturer part number. Its verification is "live-unverified": confirmed on a live page during this run, but not yet matched to an AirShelf catalog record. A verified row is matched to the catalog record. tier3.cached = true means it came from a recent prior lookup, with fetched_at recording when the page was read. • tier3.status = "abstain" — the lookup could not confirm the product exists as asked, so no specs, price, or availability were established. tier3.guidance describes the quote-request path. • tier3.status = "declined" — an applicable lookup did not run; tier3.reason says why (disabled, rate_limited, daily_cap, negative_cache, error). No specs or availability were established, and none should be inferred. No tier3 block at all means a live lookup was not applicable to this query (no parseable brand+model identity). Optional `market` (ISO 3166-1 alpha-2, e.g. "TH") excludes catalog rows whose country-specific URL conflicts with the buyer market and scopes tier3 lookup/cache. A remaining global URL is not local-availability proof: parsed.weak_match stays true and unsatisfied_constraints includes market_availability until every returned row has a matching country receipt. "Available in <market>" still does not guarantee stock.
    ConnectorNo auth