"An open-source penetration testing framework" matching MCP connectors:

Prompt evals over MCP: run a prompt on your dataset, score each output 1-5 with an LLM judge.

Verify scraped data against the live source page. Signed verdicts, $0.01 via x402.

Can an AI shopping agent find, understand and BUY on a store? Deterministic e-commerce audit /100.

Grade MCP servers A to F with the open behavioral litmus. npm: full toolset; hosted: lookups only.

Hire a real human for real-world verification, product testing, AI output review, and errands.

Generate deterministic placeholder image URLs and packs for docs, staging, testing, and AI agents.

Scan URLs for WCAG 2.1 violations, generate AI fixes, and produce VPAT 2.5 compliance reports.

Pay-per-call MCP server. Vetted human experts review AI-generated content (text, images, video, audio, social posts), audit reasoning chains, run prepublish safety checks, and gate high-stakes actions for human approval. 7 paid tools at $1.00 each plus 4 free tools (list_offerings, list_expert_profiles, get_result, verify_certificate). Payment via x402, USDC on Base mainnet. Approved outputs receive an on-chain Taste content certificate downstream agents verify before consuming.

MCP-native AI browser testing for coding agents. Submit a URL + goal, get back action trail, bugs, screenshots, and WebM video your agent patches from directly. 43 tools, 12 AI evaluation personalities, combo tiers with auto-pause-on-bugs, throwaway email + SMS inboxes.

130+ QA & dev tools for AI agents: prompt injection, RAG testing, VLM eval, guardrails. Free.

End-to-end API testing — generate and run tests from OpenAPI, curl, Postman, or real user traffic.

MCP server for static security analysis of Android source code

ResilienceOracle - 10 operational resilience tools: BIA, RTO/RPO, scenario testing.

Drive OctoPerf load testing from any AI agent — import, edit, validate, run scenarios, read metrics. Hosted remote server, OAuth 2.1 (DCR + PKCE), no API key.

Test-inbox API for email and SMS: create inboxes, long-poll messages, extract OTPs and links. 34 tools; bearer auth with an mfx_ API key (free tier).

Programmatic email deliverability testing for AI agents. Create inbox placement tests across Gmail, Outlook, Yahoo, Mail.ru, Yandex — get per-provider placement (Inbox/Spam/Promotions), SPF/DKIM/DMARC auth, Rspamd & SpamAssassin verdicts, DNS health, and live SSE results.

Agentic testing: HyperExecute jobs, test failure triage, SmartUI visual diffs, a11y audits

AI agent testing: replay real sessions against a rebuilt staging environment to catch regressions.

3rd Generation Testing (3TG) — generate deterministic test suites from Markdown spec tables via MCP.

WCAG-Compliance/wcagc-mcp lets an assistant run real axe-core accessibility scans through the user's own wcagc account, rather than guessing accessibility from markup it can see. Tools cover a single URL or PDF, a full-site crawl, saved multi-step journeys, and violation trends.