"Cybersecurity penetration testing frameworks" matching MCP tools:

• recommend_frameworkA

  jeda-aiA

  Recommends business / strategy / risk frameworks for a stated problem. Powered by the Jeda.ai · Visual AI framework knowledge graph (~2,100 frameworks across 19 categories, edge-curated). Use when the user describes a business problem ("customer churn rising", "evaluating market entry", "need to assess vendor risk") rather than naming a specific framework. Returns top-N frameworks ranked by fit, each with a concrete reason citing the specific problem signals matched. Input: just the problem statement is enough. Optional faceted filters (`persona`, `regulation`, `decision_stage`) narrow the candidate set. Set `limit` between 3 and 10 for picker UIs. Pair with `generate_framework_analysis` to actually run a recommended framework against the user's inputs. Example: { "problem_statement": "We need to decide whether to enter the EU SMB market in Q3", "decision_stage": "decide", "limit": 5 }

  ConnectorNo auth

• list_coverageA

  Ansvar: EU Compliance & Legal IntelligenceA

  Show which countries, frameworks, and legal domains are available. Use this BEFORE calling `search` when the user's topic doesn't name a jurisdiction (e.g., 'what does the law say about consumer protection'); then present the returned jurisdictions to the user or ask which applies. Examples: • 'Which countries do you cover?' → list_coverage() • 'Do you have German law?' → list_coverage(jurisdiction='DE') • 'What jurisdictions for NIS2?' → list_coverage(domain='cybersecurity') • 'Which countries have drone law?' → list_coverage(domain='aviation') (also accepts 'drone' / 'uas') Returns a `jurisdictions` array (each with `code`, `name`, `region`, `laws`, `provisions`, `domains`, `counts_complete`, and `uncounted_sources`) plus framework and source listings. An incomplete-count row also carries `coverage_note` explaining why. NOTE: `laws`/`provisions` are WHOLE-JURISDICTION corpus totals — the response's `count_scope` is `whole_jurisdiction`. Under a `domain` filter the jurisdiction list is narrowed to that domain but the counts are NOT domain-scoped; do not report them as a per-domain count. The domain-specific signal is the (domain-filtered) `sources`/`frameworks`.

  ConnectorOAuth

• list_topicsA

  bill-commonsA

  List Bill Commons' curated cross-state topic trackers (e.g. artificial intelligence, youth online safety, platform accountability, cybersecurity, cryptocurrency, data privacy, local government & preemption) -- the entry point for "what subjects does Bill Commons track across all 50 states + DC" and "how do I get every bill in one". Each topic is a title/subject membership rule tuned for precision over recall, with a live bill_count and how_to_fetch_bills. This tool does not itself return bill rows -- pair it with search_legislation or the REST API's /topics/{slug} for the bills.

  ConnectorNo auth

• list_creative_agent_skill_presetsA

  HeistaA

  Portable craft skills (frameworks + method + worked examples) a Creative Agent loads ON TOP of its worldview — additive and stackable, never substitutive (unlike a creative_director_playbook, which replaces the agent for a session). Pinned per character on creative_agent_versions.skill_ids. Workspace = org-authored private skills; official = the Heista-curated starter library. Read-only, free. Filter scope with only_workspace / only_official (mutually exclusive — same toggle as the in-app library lens). Page with limit + offset.

  ConnectorNo auth

• tech_fingerprintA

  ContrastAPIA

  Detect website technology stack: CMS, frameworks, CDN, analytics tools, web servers, languages (via HTTP headers + HTML analysis). Use for passive reconnaissance; for full audit use audit_domain. Free: 30/hr, Pro: 500/hr. Returns {technologies: [{name, category, confidence%, version}]}.

  ConnectorNo auth

• rating_get_sheetA

  website-searchA

  Get Lenny Zeltser's cybersecurity-writing rating sheet(s) so your AI can apply the rubric. Returns the structured rubric (groups, items, scoring bands) WITHOUT computing a score. Use `rating_score_writing` if you also want a numeric score, gap analysis, or rubric-anchored feedback. This server never requests your draft and instructs your AI to keep it local—rating sheets and scoring instructions flow to your AI.

  ConnectorNo auth

• intel_stackA

  TunnelMind Data APIB

  Fetches up to 32KB of the domain's HTML and response headers from the edge, then fingerprints the content for known CMS platforms, JavaScript frameworks, CDN providers, and analytics tools. Detection is based on meta generator tags, script src patterns, response headers, and cookie names. Use this tool when: - You need to know what CMS (WordPress, Drupal, Shopify) a site runs. - You are assessing a domain's infrastructure before a security review. - You want to identify analytics or marketing tools a site embeds. Do NOT use this tool when: - You want HTTP headers and security posture — use `intel_http` instead. - You want tracker database classification — use `get_domain` instead. - You need robots.txt AI policy — use `intel_robots` instead. Inputs: - `domain` (query, required): Domain to fingerprint. Returns: - `cms`: detected content management system, or null. - `frameworks`: JavaScript/backend frameworks detected. - `cdn`: CDN provider detected, or null. - `analytics`: analytics and tracking tools detected. - `meta_generators`: raw meta generator tag values. Cost: - Free. No API key required. Latency: - Typical: 2-4s (HTML fetch), p99: 7s.

  ConnectorNo auth

• get_faqA

  CalmActivaA

  Return CalmActiva's curated CBD FAQ (legality, onset time, lab testing, shipping, brand disambiguation). Use for general CBD/brand questions before falling back to web search.

  ConnectorNo auth

• get_demo_guideA

  eDiscovery Decoder News/CalcA

  Return a short, human-readable walkthrough for testing this server: the endpoint, the tool/prompt/resource names, and ready-to-paste sample prompts. Use to give someone a guided demo. For the full machine-readable capability catalog, use list_capabilities instead.

  ConnectorNo auth

• list_runtimesA

  MCPExplorerA

  List the runtimes generate_runtime_config supports (Claude Desktop, Cursor, VS Code, agent frameworks, …), with each one's config path. Enumerate these instead of guessing runtime slugs.

  ConnectorNo auth

• list_collectionsA

  Skill of SkillsA

  The curated buyer-intent collections (e.g. mcp-servers, testing-qa, browser-automation). Use get_collection for the ranked tools inside one.

  ConnectorNo auth

• get_site_infoA

  BedrockNewsA

  BedrockNews metadata: what the site is, how the GRIN/CLAIMS/NOVEL frameworks work, terms of use + attribution, and every machine-readable surface. Also returns the full capability map (every tool, prompt, and resource) — call this first.

  ConnectorNo auth

• tengu_v3_framework_listA

  tengu-firmC

  Lightweight catalogue of all registered frameworks — one row per framework with framework_id + intent + 1-line applies_when + version. Useful for discovery / debugging without parsing the full library. For the actual decision template, call tengu_v3_framework_lookup.

  ConnectorNo auth

• get_agent_framework_docsA

  Velane CloudB

  Returns Mastra (Bun) and LangGraph (Python) patterns for AI agent workflows. Call this BEFORE create_workflow / update_draft when building chatbots, tool-using agents, or multi-step LLM flows. Do not hand-roll custom agent loops — use the preinstalled frameworks.

  ConnectorNo auth

• rating_score_writingA

  website-searchA

  Get Lenny Zeltser's scoring playbook so your AI can score a draft locally against a cybersecurity-writing rating sheet. THIS IS THE ONLY TOOL THAT PRODUCES NUMERIC SCORES — the writing-coach tools (`get_security_writing_guidelines`, `ir_*`, `product_*`) never score. Returns the rubric plus step-by-step instructions for applying it. This server never requests your draft and instructs your AI to keep it local—rating sheets and scoring instructions flow to your AI.

  ConnectorNo auth

• vuln_get_frameworksA

  website-searchA

  Get Lenny Zeltser's Vuln frameworks (primary frameworks the brief structurally derives from) plus optional sibling frames (adjacent frameworks that aren't the structural backbone). Pass `include_siblings: false` to skip sibling blocks. This server never requests your vulnerability notes and instructs your AI to keep them local—the brief template and guidelines flow to your AI for local analysis.

  ConnectorNo auth

• list_pillarsA

  Bidda Sovereign IntelligenceA

  List all compliance pillars in the Bidda Sovereign Intelligence registry with node counts. Use this first to discover available compliance domains before searching. Bidda has 10,099 cryptographically-verified nodes across 39 pillars, including a MITRE layer spanning 6 frameworks (ATT&CK Enterprise/Mobile/ICS, D3FEND, ATLAS, CAPEC) plus Banking, AI Governance, Cybersecurity, Healthcare, Legal, ESG and more.

  ConnectorNo auth

• get_billingA

  EchoRelayA

  Get the project's credit balances (paid + testing) and which ledger it settles on. `billingModel` is `prepaid` (metered against the credit balance) or `invoiceable` (an Enterprise account, settled on the contract — its credit fields read empty/zero by design, not because it is out of credits). A zero balance is not on its own a reason to stop: live traffic is never refused for an empty balance, and a free-tier project is exempt from live credit billing entirely. Only the testing pool refuses when exhausted (402 `testing_credits_exhausted`). Read this before concluding from any other field that a project cannot send.

  ConnectorNo auth

• get_usersA

  JsonplaceholderA

  Fetch all fake users for testing. Returns name, username, email, address, phone, website, and company details.

  ConnectorNo auth

• ir_get_guidelinesA

  website-searchA

  Get Lenny Zeltser's expert writing guidelines for incident response reports. Topics: tone, words, structure, executive_summary, voice, articles, summary, brief (one-page brief section guidance, IR 1.5.0+), frameworks (regulatory + maturity frameworks), handoffs (cross-server routing). When the topic maps to a lens (tone, words, structure), the response includes a rating-sheet checklist appendix as concrete reference points for grounded feedback. This server never requests your incident notes and instructs your AI to keep them local—guidelines flow to your AI for local analysis.

  ConnectorNo auth

• malware_get_frameworksA

  website-searchA

  Get Lenny Zeltser's Malware frameworks (primary frameworks the brief structurally derives from) plus optional sibling frames (adjacent frameworks that aren't the structural backbone). Pass `include_siblings: false` to skip sibling blocks. This server never requests your sample, analysis notes, or indicators and instructs your AI to keep them local—guidelines and the report template flow to your AI for local analysis.

  ConnectorNo auth