"How to evaluate an app in an Android emulator" matching MCP connectors:

Triage a CVE: how severe it is, whether it is exploited, and how likely exploitation is.

Fetches a public http(s) URL (GET, up to 5 redirects, 10s timeout, body never read) and grades its security headers A+ to F: score, present and missing headers (HSTS, CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy), per-header findings with copy-paste fix values, and cookie flag issues. Passive, SSRF-guarded. Pay-per-call via x402 ($0.01 USDC on Base); initialize and tools/list are free.

Queries live Google OSV.dev vulnerability intelligence for any PyPI, npm, Go, or Rust crate and re

Find hidden Unicode (zero-width, bidi, tag payloads), homoglyphs and lookalike names in text.

Check text before your agent reads it: hidden instructions, invisible text and links that leak data.

Scan a site or AI-built app for exposed databases, keys and MCP endpoints, then verify the fixes.

Inspects live IPv4/IPv6 DNS resolution, TLS certificate issuer/expiry, and HTTP security grade.

Grades an MCP server's real egress: EVERY-HOP-VALIDATED, FIRST-HOP-ONLY, or OPEN-EGRESS.

TrentAOAuth

ai.trent

Security reviews, threat models over a repo or website, and remediation tracking, in your editor.

Security scanner for MCP servers and skills: Unicode injection, patterns, secrets.

Hosted, no-auth endpoint of feldspar-scan: free deterministic security scan of a public git repository (OSV.dev vulnerable dependencies, secret patterns, config lint) as structured JSON. Tools: scan_repository(url), audit_pricing(). Stateless streamable-HTTP JSON-RPC, rate-limited. Source: https://github.com/project-feldspar-resources/feldspar-scan (MIT). Operated by Feldspar, an autonomous AI agent (Project Feldspar).

Passive domain-perimeter checks — cert expiry, subdomain takeover, lookalikes — as agent tools

PII/secret redaction, email checks, sanctions screening, OSV lookups and an MCP server pre-check.

Free passive outside security scan of a live web app: leaked keys, exposed files, open Supabase

Run real, auto-recovered cloud attacks on AWS, Azure and GCP to test your defenses.

Audit any live URL: 85 SEO, AI-search, security, leaked-key and speed checks, with fixes to verify.

Scans an MCP server for security gaps before your agent connects. Free tier, no signup.

PHP2Shell (CVE-2026-109618) scanner and automated WordPress to Zero-PHP Next.js migration.

Read-only agent-commerce audit, upgrade verification, diagnosis and x402 probing.

Scan a deployed app URL for exposed keys, open Supabase tables and missing security headers.