"Services or tools available for free without requiring an API key" matching MCP servers:

A comprehensive suite of HTTP and API testing tools that enables AI agents to perform requests, check endpoint health, and decode JWTs. It also provides utilities for URL parsing and detailed security analysis of HTTP response headers.

Scans code for exposed secrets, API keys, tokens, and credentials across 69 patterns covering cloud services, AI platforms, payment providers, authentication services, and databases.

MCP server enabling AI agents to use secrets (API keys, tokens) via encrypted vault, executing HTTP/shell/SSH actions server-side while never exposing secret values to the AI.

A thin MCP server that wraps provenance-receipts and quality-gate services as tools, enabling AI agents to certify content origin and score quality via Ed25519-signed receipts.

Enables Claude to manage NVIDIA API keys through an OAuth-secured MCP connector, including listing, dispensing, rotating, and revoking keys with RBAC and audit trail.

Pay-per-use AI security and research tools for autonomous agents on Base, enabling honeypot detection, risk assessment, wallet analysis, and yield optimization via the x402 protocol.

Enables AI agents to access DDG's payable services including checkout/payment conformance, MCP/tool security audits, agent-discovery repair, and buyer-agent smoke probes, with structured payment challenges.

An MCP server that exposes 43 domain tools behind 4 meta-tools, applying guardrails such as budgets, rate limits, schema validation, human-in-the-loop confirmation for mutations, PII redaction, and an append-only audit log while reducing context window usage.

Post-quantum readiness for AI coding agents: scans code for quantum-vulnerable cryptography (RSA/ECDH/ECDSA/DH) and returns NIST ML-KEM/ML-DSA/SLH-DSA (and hybrid) migration guidance, with fix verification and dependency checks. Content-based, advisory tools only; runs local (npx @quantakrypto/mcp) or as a hosted OAuth endpoint.

Community MCP server for the Cymulate security validation platform. It exposes the full Cymulate REST API (337 endpoints) as 106 semantic tools for BAS, exposure validation, attack surface management, and platform administration.

Wraps the Remnawave API to provide per-operation MCP tools with mutation safety and data redaction, enabling secure interaction with Remnawave panel.

Enables MCP clients to use paid tools for secret scanning, agent-config auditing, and OG image rendering, with payments handled over the x402 protocol on Base.

An MCP server providing risk-aware API governance tools for AI agents. Agents call preflight checks before tool calls or merges to verify API contracts are safe. Returns risk score, blast radius, agent impact, economic cost, and a deterministic ALLOW/WARN/REQUIRE_APPROVAL/BLOCK decision. MCP endpoint: https://app.coderifts.com/mcp

Provides 9 utility APIs for AI agents covering DNS, email, IP, QR, WHOIS, URL health, headers, text extraction, and tech detection, with x402 micropayments on Base.

Dependency health checker for AI agent skills. Analyzes external endpoints for uptime, SSL validity, domain reputation, ownership changes, and abuse scores. Returns a 0-100 trust score per endpoint.

MCP server for inspecting email domains and addresses, providing objective domain-level email infrastructure answers such as MX, SPF, DMARC, MTA-STS, and disposable-domain evidence.

Two-way Burp Suite MCP bridge enabling AI agents to capture traffic, analyze endpoints, queue scans, and send findings back to Burp.

Provides AI assistants with specialized tools to interact with NIST's Open Security Controls Assessment Language (OSCAL) framework. It enables agents to retrieve schemas, explore models, and generate valid OSCAL documentation for security compliance automation.

Enables AI assistants to manage Namecheap domains, DNS, contacts, registrar locks, and view SSL certificates and pricing through safe read and configuration tools.

Enables cryptographic operations including hashing, encoding/decoding, ID generation, password tools, and JWT inspection via MCP.