"How to fill out a webpage form" matching MCP servers:

Enables Claude and other MCP clients to search, read, write and organise mail on Stalwart servers over JMAP — including folders, Sieve filters, out-of-office replies and one-click unsubscribe — with draft-first and confirmation safeguards against prompt injection. A separate admin endpoint additionally exposes account, domain, mailing-list, queue, IP, log and task management through Stalwart's JMAP management API.

Routes web requests from AI tools through Tor for anonymized fetching, with selective per-URL routing to bypass Tor-blocking sites.

An MCP server that reads a file's embedded C2PA Content Credential to report whether it declares AI generation or a real-world capture, and checks whether that declaration's signature still verifies against the file's current bytes.

Official reference MCP server for A202, the Verifiable Agreement Protocol for Agent-Led Commerce. Gives an agent the seven capabilities two organisations need to buy and sell directly: issue a mandate, check what an agent may do under it, approve an act needing a person, form an agreement, exchange obligations, verify a record by replay, and read the transaction record back.

Lets AI agents check whether an EVM wallet address carries an EIP-7702 delegation across eight chains (Ethereum, Base, BNB Chain, Arbitrum, OP, Polygon, Gnosis, Unichain) and learn how to obtain a deeper paid report with delegate bytecode heuristics and risk levels. Read-only, never touching private keys or seed phrases.

Share encrypted, self-destructing secrets from your AI agent. Zero-knowledge E2E encryption. Agent-blind input sources (env:, file:, dotenv:) keep secrets out of LLM context.

Local stdio MCP server (in packages/opsecforge-mcp, built on @modelcontextprotocol/sdk) that keeps secrets out of coding-agent context: redact_file returns only redacted file content, scan_secrets checks staged changes before commit, plus offline webhook signature verification and JWT inspection. No network calls.

Privacy layer for healthcare AI agents. Pseudonymises patient identifiers (NHS numbers, names, dates of birth, addresses; UK and US) into labelled tokens locally before text reaches an agent, then restores the originals afterwards, keeping the token map out of agent context.

Gives AI agents verifiable, tamper-evident receipts for their actions — attest_action signs a cryptographic receipt for what the agent did (email sent, payment made, form filed), verify_receipt checks it offline, get_identity returns the agent's did:key. Sign locally, verify anywhere, zero backend.

A local-first MCP server that scores your codebase's Build Readiness by reading code and running tests on your machine, outputting a diligence-grade score and risk register without uploading your source.

Enables passive security scanning of HAR files from QA test automation to detect missing security headers, insecure cookies, CORS misconfigurations, and leaked secrets, without making any live requests.

Read selected local folders from ChatGPT on macOS, with per-folder read-only or read-write access and hash-checked, recoverable edits. Requires local installation and a private ChatGPT app. The Glama container is a synthetic evaluation demo; it does not connect to files on your Mac.

URL intelligence for AI agents. One URL in, structured security and data quality signals out across 7 dimensions. 13 tools, risk score 0-100 with 23 configurable weights.

Runs a regular expression on real engines — JavaScript (V8), Python (CPython re), PCRE2 and RE2 — reporting each engine's own compile errors with positions, every match with its groups and named groups, replacement results, and where the engines disagree. It also detects catastrophic backtracking (ReDoS), naming the at-risk part of the pattern, generating an attack string, and timing how long each engine actually takes on it.

Mandatory human approval gate for autonomous AI agents. Before any critical, irreversible, or financially significant action executes — file deletion, production deployment, financial transaction — the agent calls oracle_validate. A human receives a real-time Telegram notification with full context and taps Approve or Reject. The agent waits for the decision before proceeding.

Enables an AI assistant to redact text and, more importantly, files without reading them, since file redaction and restoration happen locally and only counts are reported, keeping personal data out of the conversation. It exposes tools for redacting text, writing a redacted copy of a UTF-8 file with an owner-only restore mapping, and putting original values back offline.

Zero-knowledge proof generation MCP server. AI agents can prove identity claims (Coinbase KYC, Country, Google OIDC, Google Workspace, Microsoft 365) without revealing personal data. Runs in AWS Nitro Enclave TEE with x402 USDC payments.

Enables AI agents to register proposed outbound or destructive actions, such as sending, deleting, publishing, paying or deploying, and block until a human approves or denies them out-of-band via a CLI. Requests default to fail-closed with a one-hour TTL and every request, decision and expiry is written to an append-only audit log.

OS keychain secrets for AI coding agents, over MCP. Anchors credentials to the native vault (macOS Keychain, Linux Secret Service, Windows Credential Vault) and exposes them through 44 policy-governed tools: per-environment values, TTL, linked rotation, encrypted transfer bundles, redacted exec, and a tamper-evident audit log. Local-first, no cloud account.

Local security layer for coding agents: keeps secret values out of what Claude Code, Codex CLI, Cursor and OpenCode send to their model, and checks untrusted text for prompt injection. MIT, runs on your machine, no account.

Scans prompts for PII and masks or redacts sensitive data locally before sending to an LLM, supporting multiple anonymization modes.

Local-first MCP proxy with BM25 tool discovery, quarantine security, Docker isolation, OAuth support, activity logging, and web UI. Routes multiple upstream MCP servers through a single endpoint.

Enables MCP-capable assistants to run read-only AI governance inventory checks, assemble Decision Packs, and validate signed Agent Trust Passports against pinned upstream tooling, returning every result as non-authorizing with authority_effect NONE.

Blocks prompt injection, jailbreaks, and out-of-scope input before an AI agent acts. classify_input tool, stdio transport.

MCP server that lets an AI assistant perform scoped Okta identity operations with an out-of-band human-approval gate on destructive actions.

A reference MCP server that enforces identity-aware tool access using role-based permissions (Reader, Analyst, Auditor) and supports multiple identity routes like Entra RBAC, Copilot Studio, and Okta XAA. It provides read-only access to test evidence with explicit denial paths for unauthorized tools.

PII detection agent

Two-way Burp Suite MCP bridge enabling AI agents to capture traffic, analyze endpoints, queue scans, and send findings back to Burp.

Provides AI assistants with specialized tools to interact with NIST's Open Security Controls Assessment Language (OSCAL) framework. It enables agents to retrieve schemas, explore models, and generate valid OSCAL documentation for security compliance automation.

Enables AI assistants to raise, submit, approve, amend, and cancel purchase orders and onboard suppliers in ERPNext or SAP S/4HANA while enforcing procurement controls such as duplicate detection, budget limits, split-purchase checks, price tolerances, and segregation of duties.