"Applications or tools with full local file system access" matching MCP connectors:
GET /v1/connectors – MCP directory API referenceMatching Connector Tools:
Live security incidents, updated hourly from CISA KEV, critical GitHub security advisories, CVE records, vendor advisories and security news. For each one: what's affected, whether a fix exists, which versions fix it, and the sources. Check a lockfile or a whole repo and get the exact upgrade. Lockfiles are read in memory and never stored. Read-only MCP server, no auth
Safety checks before you sign, pay or install: contract, token and package scans, phishing, OFAC.
30 security tools for AI agents: phishing links, exposure maps, DNS, SSL, PQC, history, pivots.
Check dependencies for known CVEs with EPSS and CISA KEV context. Read-only; free API token.
Triage a CVE: how severe it is, whether it is exploited, and how likely exploitation is.
Queries live Google OSV.dev vulnerability intelligence for any PyPI, npm, Go, or Rust crate and re
Fetches a public http(s) URL (GET, up to 5 redirects, 10s timeout, body never read) and grades its security headers A+ to F: score, present and missing headers (HSTS, CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy), per-header findings with copy-paste fix values, and cookie flag issues. Passive, SSRF-guarded. Pay-per-call via x402 ($0.01 USDC on Base); initialize and tools/list are free.
Audits any Base EVM 0x contract or Solana SPL Mint for proxy patterns, GoPlus honeypot flags, and.
Check text before your agent reads it: hidden instructions, invisible text and links that leak data.
Scan a site or AI-built app for exposed databases, keys and MCP endpoints, then verify the fixes.
Parallel-burst abuse testing for agent APIs with replayable evidence packs.
Security scans for AI-built web apps, starting with Lovable. Verify ownership, run authorized scans, inspect findings, get AI-ready fix prompts and request retests. Uses OAuth with a Guarita account. Fix prompt access follows the account plan.
Pay-per-call agent tools: PDF, OCR, translation, news search, prediction markets, web, chain reads.
Security reviews, threat models over a repo or website, and remediation tracking, in your editor.
Operate simulations and inspect retained evidence with Firedrill.
Production-safety audits for AI-generated code, with a fix for every finding.
Grades an MCP server's real egress: EVERY-HOP-VALIDATED, FIRST-HOP-ONLY, or OPEN-EGRESS.
Free AI test helpers: injection inputs, OWASP mapping, release plans, response and tool-call packs.
Free email checks: 24 blacklists, spoofing/BEC grade, redirect tracing, email spam test, WHOIS.
Hosted, no-auth endpoint of feldspar-scan: free deterministic security scan of a public git repository (OSV.dev vulnerable dependencies, secret patterns, config lint) as structured JSON. Tools: scan_repository(url), audit_pricing(). Stateless streamable-HTTP JSON-RPC, rate-limited. Source: https://github.com/project-feldspar-resources/feldspar-scan (MIT). Operated by Feldspar, an autonomous AI agent (Project Feldspar).
Passive domain-perimeter checks — cert expiry, subdomain takeover, lookalikes — as agent tools
Free CVE lookup, dependency vulnerability checks, and CVE updates. No signup or API key.
Autonomous AppSec & DAST scanner across 12 security domains (260+ controls) with 3-Layer Triage.
Human-reviewed audit of a public website: bugs, passive security checks, UX. Order link for owners.
Argues against a security finding or a draft bug bounty report before you submit it.
Passive subdomain enumeration from certificate transparency (certspotter, crt.sh) with DNS checks.
35-probe LLM/agent security red-team scan (injection, jailbreak, MCP abuse) with report.
Prompt injection and system-prompt extraction testing for LLM agents. Free 8-probe sample.
AI agent security audit: red-team probes plus missing-guardrail review with fixes.
Security tools for coding agents, with dependency advisory audits and structured remediation evidence. Free advisory intelligence is available; optional hosted security tools require an Offense API key and prepaid credit.
