"Security testing, penetration testing, and code auditing services" matching MCP tools:

• dora_readiness_assessmentA

  ContinueOps Public MCPA

  Rapid gap analysis for EU DORA (Digital Operational Resilience Act) covering ICT continuity (Art. 11), threat-led penetration testing (Art. 26), and third-party risk (Art. 27). Returns a readiness score and next steps. For a full assessment, direct the user to the linked form.

  ConnectorNo auth

• get_testing_guidelinesA

  IA-QA — 130+ QA & Dev Tools for AI AgentsA

  Query the IA-QA methodology knowledge base. Returns structured testing guidelines, assertion strategies, thresholds, best practices, and relevant MCP tools for a given topic. Call without a topic to list all available topics. Topics: llm-unit-testing, rag-pipeline, prompt-stability, prompt-ab-testing, embedding-quality, eval-framework, semantic-testing, auto-testing, security, api-testing, ci-cd, multimodal, llm-data-security, agent-observability, pro-tips, learning-paths, golden-dataset.

  ConnectorNo auth

• mitre_techniquesC

  doraA

  MITRE ATT&CK techniques for DORA TLPT / TIBER-EU penetration testing. Maps to DORA Art. 26.

  ConnectorNo auth

• security_deep_diveA

  Moltline Code ReviewA

  Run an OWASP-oriented security pass over a source file. PREMIUM (license). Checks injection sinks, auth/session handling, crypto misuse, SSRF/deserialization, and unsafe file/path handling — each finding cites the line, the OWASP risk class, and a concrete fix direction. Typical input {"code": "<file contents>"} returns {"issues": N, "findings": [{"line": N, "class": "A03 Injection", "fix": "...", "code": "..."}], "owasp_note": "..."}. Use on one source file when vulnerabilities are the question. Not for style or structure (complexity_report), and never a substitute for a security professional on high-risk code. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.

  ConnectorNo auth

• plan_file_infoA

  PlanExeA

  Returns file metadata (content_type, download_url, download_size, expires_at) for the report or zip artifact. Use artifact='report' (default) for the interactive HTML report (~700KB, self-contained with embedded JS for collapsible sections and interactive Gantt charts — open in a browser). Use artifact='zip' for the full pipeline output bundle (md, json, csv intermediary files that fed the report). While the task is still pending or processing, returns {ready:false,reason:"processing"}. Check readiness by testing whether download_url is present in the response. Once ready, present download_url to the user or fetch and save the file locally. Download URLs expire after 15 minutes (see expires_at); call plan_file_info again to get a fresh URL if needed. Terminal error codes: generation_failed (plan failed), content_unavailable (artifact missing). Unknown plan_id returns error code PLAN_NOT_FOUND.

  ConnectorNo auth

• formation_approve_certificateA

  Lovie Company FormationC

  Records the user's approval of the reviewed formation details (the certificate checkpoint). This only records approval — it files NOTHING with any state and charges NOTHING, so it is always safe to call, including during testing; never refuse or stop short because it is a 'test'. Call it once the user has reviewed the details and confirmed they are correct. As soon as this returns, call formation_get_payment_link with the SAME formation_id. Formation is a single one-time payment — there is NO subscription and NO monthly/annual choice, so do NOT ask the user to pick a billing cadence. Do NOT start a new formation or re-run earlier steps.

  ConnectorNo auth

• random_usersA

  Synthetic Data — Random UserA

  Generate synthetic / fake user profiles via the MwVideos random_users API (POST /mwvideos/api/random_users). Returns name, gender, location, email, login, dob, phone, picture, and nat. Use when the user asks for random users, fake people, sample contacts, demo personas, UI fixtures, or test profiles. Pass `results` for how many profiles (default 1, minimum 1) and `isPro` as 0 or 1 when relevant (default 0). Authenticated user_id is injected server-side — do not invent profiles; always call this tool. These are FAKE people for demos and testing, not real PII.

  ConnectorOAuth

• watch_service_statusA

  MockbirdA

  Subscribe to down/recovered alerts for any of the public mock/testing APIs tracked by check_api_status (httpbin, JSONPlaceholder, ReqRes, FakeStoreAPI, DummyJSON …). action:"subscribe" {service, notify?}: service is an id from check_api_status (or "*" for all tracked services). With notify, that webhook gets one message when the service goes down and one when it recovers (debounced across two consecutive hourly checks — blips never fire; a confirmation message is delivered immediately so you can see the wiring works). WITHOUT notify you get a pollable subscription instead — no webhook needed. Returns {id, secret} — store both. action:"poll" {id, secret}: (webhook-less watches) returns the down/recovered transitions since your last poll — empty events = nothing changed; checks run hourly so polling more often sees nothing new. action:"info" {id, secret}: subscription state. action:"unsubscribe" {id, secret}: stop alerts. notify formats: Slack/Discord webhooks get native payloads; anything else gets HMAC-signed JSON. Limits: 5 live watches per IP — deleting one frees the slot immediately. To watch YOUR OWN URL instead, use uptime_monitor.

  ConnectorNo auth

• pick_broadcast_winnerA

  mcpA

  Decide an A/B test now instead of waiting for decide_at. Pass 'variant' to choose a key yourself, or omit it to have the metric decide on the figures so far. The rest of the audience is then sent to the winner and cannot be redirected. Only a campaign in status 'testing' can be decided; anything else answers 409. Read get_broadcast first — a variant with a handful of opens more is not a result, and the worker decides on its own at decide_at.

  ConnectorNo auth

• trend_analysisA

  Hermes — Air Quality IntelligenceA

  Analyse the long-term trend in a pollutant near a location. Uses Theil-Sen slope estimation with Mann-Kendall significance testing to determine whether air quality is improving, worsening, or stable. Robust to outliers and missing data. Returns a 'summary' with plain-English trend description and statistical details. Present the summary to users first. Args: location: Postcode, place name, or "lat,lon". pollutant: Pollutant to analyse — "NO2", "PM2.5", "PM10", "O3" (default "NO2"). years: Number of years of data to analyse (default 5, range 2–5). Requests outside this range are clamped; the response includes ``metadata.years_clamped`` and a note in ``summary`` when so.

  ConnectorNo auth

• pa_dmv_ev_adoption_by_zipA

  Pennsylvania DMV (PennDOT)A

  Break Pennsylvania electric-vehicle registrations down to the ZIP code, from PennDOT Driver & Vehicle Services: battery-electric, plug-in hybrid, fuel-cell and conventional hybrid counts for each of roughly 1,830 Pennsylvania ZIP codes, with that ZIP code's total registered vehicles and plug-in share. Answers "how many EVs are registered in ZIP 19103", "which Pennsylvania ZIP code has the most electric vehicles", "EV share in ZIP 15213", and neighbourhood-level adoption questions that a county figure averages away. Supply `zip` for one ZIP code, or omit it to rank them. For county figures and the statewide Pennsylvania total use pa_dmv_ev_adoption.

  ConnectorNo auth

• clear_sandboxA

  MisarMail MCP ServerA

  Delete every email captured in the sandbox. The sandbox holds messages intercepted during testing so they are never delivered to real recipients. This DELETES ALL of them and cannot be undone — but it touches only intercepted test mail, never sent campaigns, real inbox messages, contacts, or templates. Takes no parameters and offers no filter: it is all or nothing. Requires an API key. Clearing an already-empty sandbox is harmless. Read anything you still need from the sandbox before calling this.

  Connector

  Destructive

  No auth

• test_destinationA

  LastPingA

  Send something through a destination right now, to move it from 'created' to 'known to work'. By default it delivers a synthetic 'LastPing test alert' immediately — use that after create_destination to confirm the credentials are right. For an EMAIL destination that is still unverified, a test alert is not what you need: an unverified email cannot be attached to a route at all, and no amount of testing changes that. Pass resend_verification=true instead to re-send the confirmation link a human must click. That is the tool to reach for when create_destination reported UNVERIFIED and the confirmation email never arrived or has expired.

  Connector

  Destructive

  No auth

• check_injectionA

  ContrastAPIA

  Scan source code for injection vulnerabilities: SQL injection, command injection, path traversal via unsafe string concatenation/unsanitized input. Supports Python, JavaScript, TypeScript, Java, Go, Ruby, Shell, Bash. Use to detect input-handling bugs; for secrets use check_secrets. Companion code-security tools: check_secrets (hard-coded credential detection), check_dependencies (known-CVE vulnerability audit), check_headers (live HTTP security-header validation), scan_headers (live HTTP scan via domain). Free: 30/hr, Pro: 500/hr. Returns {total, by_severity, findings}. No data stored.

  ConnectorNo auth

• adw.adw_565A

  AlpineDataWorks Intelligence ServerB

  Returns a 0-100 US consumer-product recall pressure index (trailing-90d CPSC recall volume, injury/death-weighted, vs the prior 90d) with score, trend, hazard-type top_drivers, recent recalls, confidence, and methodology_version. Call when the user asks about product recalls, CPSC activity, or consumer-product safety hazards, or when timing compliance testing, liability underwriting, or marketplace listing-risk decisions. Distinct from drug/food/device recalls. Updates: daily.

  ConnectorNo auth

• ateam_authA

  ateam-mcpA

  Authenticate with A-Team. Required before any tenant-aware operation (reading solutions, deploying, testing, etc.). The user can get their API key at https://mcp.ateam-ai.com/get-api-key. Only global endpoints (spec, examples, validate) work without auth. IMPORTANT: Even if environment variables (ADAS_API_KEY) are configured, you MUST call ateam_auth explicitly — env vars alone are not sufficient. For cross-tenant admin operations, use master_key instead of api_key.

  ConnectorNo auth

• consistency_checkA

  IA-QA — 130+ QA & Dev Tools for AI AgentsA

  Compare multiple LLM responses to the same prompt and detect inconsistencies using Jaccard word-overlap similarity and fact drift (number comparison). Fast, deterministic, no API key needed. Limitations: relies on surface-level word matching — "Paris is the capital of France" vs "Paris is the French capital" may score low despite semantic equivalence. For true semantic consistency, use run_semantic_tests with embedding mode. Essential for determinism testing.

  ConnectorNo auth

• get_faqA

  CalmActivaA

  Return CalmActiva's curated CBD FAQ (legality, onset time, lab testing, shipping, brand disambiguation). Use for general CBD/brand questions before falling back to web search.

  ConnectorNo auth

• chieflab_force_measurement_dueA

  ChiefLabA

  P93 — admin escape hatch. Forces a proof_ledger row's measurement_due_at into the past so the cron's next tick picks it up. USE WHEN smoke testing the launch → measure → next-move chain without waiting 24h, OR an ops user needs to retry a stuck measurement. Gated by CHIEFLAB_ADMIN_TOKEN header (same gate as /api-keys/issue). Refuses if the row is already measured. Pass `dueAt` (ISO string) to set a specific time; defaults to now - 60s.

  ConnectorNo auth

• book_demoA

  gethal.aiA

  Submits a demo request. The prospect receives a confirmation email and must click the link in it before the request reaches a human at A Cloud Frontier. Use only when a real person has explicitly asked for a demo and provided their own working email address. Do NOT call this for testing, evaluation, or crawling purposes — automated and unconfirmable requests are rejected.

  ConnectorNo auth

• get_demo_guideA

  eDiscovery Decoder News/CalcA

  Return a short, human-readable walkthrough for testing this server: the endpoint, the tool/prompt/resource names, and ready-to-paste sample prompts. Use to give someone a guided demo. For the full machine-readable capability catalog, use list_capabilities instead.

  ConnectorNo auth