"Actual Budget" matching MCP servers:

Enables agents to query internet asset data through full FOFA DSL or structured conditions, with cursor-based pagination, field aggregation statistics, host/IP detail lookup, and account quota inspection. Adds multi-account rate-limit failover, local budget and size caps, and credential-safe diagnostics so large collection tasks can run reliably without exposing keys.

Governed reverse-proxy operations for Traefik, Caddy, and HAProxy — backend-health, cert-expiry, 5xx, and route-conflict RCA, with unbypassable audit logging (MCP + CLI), budget/runaway guards, dry-run, and undo/rollback.

Governed OPNsense + pfSense firewall operations — gateway-health, rule-shadow, and blocked-traffic RCA, with guarded rule/alias writes, unbypassable audit logging (MCP + CLI), budget/runaway guards, dry-run, and undo/rollback.

Governed network controller-layer operations (Cisco Meraki, plus Catalyst Center / Arista CVP / UniFi) — uplink loss/latency RCA, fleet health scoring, and config-template drift, with unbypassable audit logging (MCP + CLI), budget/runaway guards, and rollback.

NexaLayer MCP Server — a Model Context Protocol server that lets AI agents create and manage dynamic and static proxy sessions with budget guardrails.

Enables agents to probe a live host's TLS handshake, read the actual SubjectPublicKeyInfo from the served certificate, and corroborate that exact key against Certificate Transparency logs to learn how long it has been harvestable. Exposes typed tools for ranking watches by urgency, recording triage decisions, replaying audit chains, and exporting OpenSSL migration configs, runbooks and sealed JSON dossiers.