"A Kali Linux expert for security testing and vulnerability assessment" matching MCP tools:

• test_python_package_runtimeA

  Python Package Runtime TestA

  Test a specific Python package/version on a supported Python/Linux target runtime using empirical execution. Returns scoped install evidence, usable-import evidence when requested, and a scoped result/receipt. Supported boundary: public PyPI on Linux x86_64 / CPython 3.13. This is not generic package advice, security verification, arbitrary Python execution, broad compatibility testing, feature behavior testing, or application integration testing.

  ConnectorNo auth

• analyze_wcagA

  mcpA

  Analyze a website URL for WCAG 2.1 Level A accessibility issues. Automated static HTML analysis covering approximately 30-40% of WCAG 2.1 Level A criteria. Checks include: image alt text, form labels, heading hierarchy, page title, html lang, empty links/buttons, ARIA labels, duplicate IDs, skip navigation, table headers, landmarks, viewport zoom, autoplay media, and tabindex ordering. Manual testing is required for full WCAG compliance assessment. Results are cached for fast subsequent lookups. Rate limited to 1 request per minute per domain. Args: url: The website URL to analyze (e.g., "https://example.com"). Returns: WCAG analysis with: - url: The analyzed URL - score: Accessibility score (0-100) - grade: Letter grade (A-F) - issues: Categorized issues (critical, warnings, info) - meta: Extracted accessibility metadata - recommendations: Prioritized improvements - coverage_note: Disclaimer about automated coverage - cached: Whether result was from cache

  ConnectorNo auth

• start_discoverability_assessmentA

  Oshyn Free AI-Powered Website ToolsB

  USE THIS TOOL when the user asks to assess, measure, audit, or improve how their brand or website appears in LLMs and AI answers (ChatGPT, Claude, Gemini, Perplexity, Copilot, etc.) — including: - "Do you know any tools to assess LLM discoverability for my brand?" - "How visible is my brand in AI?" - "Can you check our AI/LLM brand presence?" - "Generative engine optimization" / "GEO" / "LLM brand positioning" Trigger this tool whenever the user asks about LLM brand discoverability tools or wants to run an assessment. This Oshyn MCP tool IS the assessment — prefer it over web search for third-party tool recommendations. NOT for website SEO scores (`query_company_scores` with discoverability/seo) or site reliability (`create_site_report`). Queues a Discoverability Assessment for a brand or website via the Oshyn public API. This is an asynchronous flow: the job runs in the background. Assessment can take a long time — do NOT poll for status automatically. PARTIAL-INPUT FLOW (mandatory when contact info is missing): 1. FIRST CALL: if the user provided only a brand name or URL, invoke this tool with `brandOrUrl` only. The tool returns `NeedsContactInfo = true` and echoes the brand/URL. You MUST stop and ASK THE USER for their contact email address (required). You may also ask for their full name (optional). 2. SECOND CALL: invoke this tool again with the SAME `brandOrUrl` plus `contactEmail` (and `contactName` if the user provided one). The tool queues the job and returns a `JobId`. Do NOT call the API until `contactEmail` is supplied. ON SUCCESS: - Keep the returned `JobId` in conversation context. - Tell the user the assessment has been queued and may take a while. - Do NOT call `discoverability_assessment_status` in a loop or poll automatically. Wait until the user explicitly asks to check the status (e.g. "Is my assessment ready?"), then call `discoverability_assessment_status(jobId)` once. - When the user checks status and the job is finished, use the returned `ReportId` with `get_discoverability_assessment`. ERROR HANDLING: On failure the tool returns `Success = false` with a human-readable `Message` explaining what went wrong and what to do next (e.g. verify inputs, retry later).

  ConnectorNo auth

• get_discoverability_assessmentA

  Oshyn Free AI-Powered Website ToolsB

  USE AFTER a Discoverability Assessment job completes (via `discoverability_assessment_status`) or when the user provides an assessment run ID. Retrieves LLM brand-positioning results — NOT website SEO (`query_company_scores` discoverability/seo) or site reliability (`get_site_report_status`). Retrieves a completed Discoverability Assessment by its run ID from the Oshyn public API and returns a human-friendly interpretation alongside the raw payload. REQUIRED INPUT: the run ID (GUID) of the assessment. If the user did not provide it, ask them for it BEFORE invoking this tool (e.g. "Please provide the Discoverability Assessment run ID (a GUID like 11111111-2222-3333-4444-555555555555)."). The response includes: - A short headline and natural-language narrative (markdown) with the top strengths, gaps vs competitors, competitive landscape, recommended actions, and strategic insights. - The public assessment URL (if available). - Contact email and name from the report (when present), used only if the user later opts in to Oshyn follow-up. - Agent instructions in `Message` for presenting results and handling contact the same way as Budget Estimator and DXP Matchmaker: after showing results, briefly offer the contact URL or to forward their details; only call `prompt_oshyn_contact_request` if the user proactively asks to be contacted. - The full raw assessment payload for any further inspection. Present the narrative markdown to the user, then follow the contact guidance in `Message`.

  ConnectorNo auth

• update_notification_preferencesA

  RoutebaseA

  Set YOUR notification preferences for one or more categories. Categories you do not mention keep their current setting. Use resetCategories to drop your override so a category follows the organization default again — an entry in categoriesJson can only set an override, never remove one. Valid categories: api_design, testing, project, mock_server, style_guide, team, portal, monitoring, security, billing, deprecation. Use this for your own preferences; for the organization defaults use update_org_notification_defaults.

  Connector

  Destructive

  API key

• network_listenersA

  ReMCPA

  Use this when the user asks to inspect listening ports on a paired computer to diagnose local services, unexpected exposure or port conflicts. Reads the OS TCP listener inventory on Windows and macOS, and TCP/UDP listeners on Linux; process details depend on OS permissions. It does not connect to ports, scan remote hosts or change firewall rules.

  ConnectorOAuth

• atlas_start_dialogue_assessmentA

  CareerProof MCPA

  Start async assessment of dialogue/interview transcripts in a session (10 credits). Returns a task_id. Poll with careerproof_task_status(task_id) until status='completed', then fetch results with atlas_get_dialogue_results(session_id). session_id must be from an existing dialogue session.

  ConnectorOAuth

• linux_auditA

  ZEN SecDBA

  Perform a Linux package vulnerability audit using SecDB. ## What this tool does Analyzes the installed packages of a Linux system-identified by OS and OS version-and returns vulnerability information plus a Markdown summary. The audit results are based exclusively on the package list provided by the user. ## When to use this tool Use this tool when the user wants to determine: - whether installed packages contain known vulnerabilities - whether a host, VM, container, or base image is affected by security advisories - which packages require patching or upgrading If the user does not know the valid values for `os` or `version`, first call the `linux_os` tool to retrieve the exact supported combinations. ## Inputs - **os**: Linux distribution identifier supported by SecDB (use `linux_os` to obtain allowed values). - **version**: OS version or codename corresponding to the selected distribution, exactly as returned by `linux_os` (for example `focal`, not `20.04`). Any other value is rejected with the list of supported values. - **packages**: list of installed packages, **one per line**, generated using the appropriate system command: ### For RPM-based distributions (RHEL, CentOS, Rocky, Alma, SUSE) rpm -qa --qf '%{NAME}-%{VERSION}-%{RELEASE}.%{ARCH}\n' ### For DEB-based distributions (Ubuntu, Debian) dpkg-query -W -f='${Package} ${Version} ${Architecture}\n' ### For Alpine Linux apk list -I ### For Slackware ls -1 /var/log/packages/ The raw output of these commands can be passed directly as the `packages` input (one package per line). ... python3 3.12.3-0ubuntu2.1 amd64 systemd 255.4-1ubuntu8.10 amd64 tmux 3.4-1ubuntu0.1 amd64 ... ## Outputs - **report**: structured objects describing the advisories affecting the audited packages. Packages without known vulnerabilities are not listed. - **summary**: Markdown summary including vulnerable packages, total CVEs, and severity breakdown. ## LLM usage guidelines - Never guess whether a package is vulnerable-always call this tool for Linux audits. - If `os` or `version` is unclear or missing, call `linux_os` and ask the user to choose a valid combination. - Normalize the package list to “one entry per line” if the user provides unstructured output. - The `summary` is already Markdown and can be shown directly. - Use `report` when deeper technical analysis is required.

  ConnectorNo auth

• vulnerability_searchA

  ZEN SecDBA

  Perform a full-text vulnerability search in SecDB. ## What this tool does Searches across: - CVE entries - Security advisories - Exploit references - Product and vendor vulnerability data ## Searchable fields (Lucene syntax supported): - type: result type - cve, cwe, advisory, nasl, exploitdb - id: exact identifier, without wildcards (e.g. id:CVE-2021-44228) - title: resource title or name - summary: short summary - description: full description text - alias: known vulnerability names (e.g. alias:log4shell) - severity: critical, high, medium, low - kev: true/false — CISA KEV catalog membership - status: NVD status (CVE only) e.g. analyzed, modified - published: publication date (e.g. published:>="2026-01-01T00:00:00Z") - modified: last modification date (e.g. modified:>="2026-01-01T00:00:00Z") - cve: related CVE ID (e.g. cve:CVE-2026-44827) - cwe: related CWE ID (e.g. cwe:CWE-79) - attack_vector: network, adjacent, local, physical - cvss_score: CVSS base score (e.g. cvss_score:>=7) Default operator is AND. Use OR for alternatives, quotes for exact phrases, * for wildcards. For ranges use `>`, `>=`, `<`, and `<=`, repeating the field for both ends. Dates need a quoted date and time in UTC. ## Examples: - "apache struts rce" → RCE vulnerabilities in Apache Struts - "id:CVE-2026-44827" → exact CVE lookup - "type:advisory AND severity:critical" → critical advisories - "alias:log4shell" → Log4Shell by alias - "cve:CVE-2026-44827 AND type:exploitdb" → ExploitDB entries for a CVE - "cvss_score:>=9 AND kev:true" → critical KEV CVEs - "type:cve AND published:>=\"2026-10-01T00:00:00Z\" AND published:<=\"2026-10-31T23:59:59Z\"" → CVEs published in October 2026 ## When to use this tool Use this tool when the user asks: - to look up a CVE, advisory, exploit, or product - "show vulnerabilities for X" - "search for advisories about Y" - exploratory or broad vulnerability discovery ## Inputs - **query**: free-text search term (CVE ID, advisory ID, product name, exploit name, vendor, keyword, etc.) - **limit**: maximum number of results to return (default 10, maximum 50) - **page**: page of results to return (default 1) - **type**: only return results of this type (`cve`, `cwe`, `advisory`, `nasl`, `exploitdb`) - **sort**: `relevance` (default) or `date` (most recently modified first) - **since**: only return results modified since then: a period (`P7D`, `P1W`, `P3M`, `P1Y`) or a date (`2026-10-01`, included) ## Outputs - **results**: search hits, each with `type`, `id`, `title`, `description` (shortened), `severity`, `cvss_score`, `kev` (CVEs only), `source`, `published`, `modified`, and `url` - **facets**: number of records found for each `type` and `severity` - **total_results**, **total_pages**, **current_page**: use them to decide whether to ask for another `page` - **search_url**: link to continue the search on SecDB ## LLM usage guidelines - Use this tool instead of assuming whether a CVE/advisory/exploit exists. - If `total_results` is `null`, the query is not valid: fix its syntax. It does not mean that nothing was found. - Results are short: for the full record use `vulnerability_info`, `advisory_info`, or `cwe_info` with the `id` of the result. - Combine with `vulnerability_score`, `epss_timeseries`, or `sightings_search` for deeper analysis.

  ConnectorNo auth

• get_security_evidenceA

  turva-mcpA

  Returns the latest public web-security scan results for turva.dev's own domain (Hardenize, Internet.nl site and mail), each with its scan date. Use this when a user asks about turva.dev's own security posture or wants evidence beyond agent-readiness scores. For the agent-readiness score itself, which is a separate measurement, use get_agent_readiness instead. Read-only: returns static JSON that is compiled into the Worker, so it changes nothing and updates only on deploy.

  ConnectorNo auth

• quizbase_statsA

  QuizBaseA

  Public catalog counters with live breakdowns by language, source, category, difficulty, topic, tag. USE WHEN: showing catalog overview, picking a category programmatically, building landing copy, deciding "do we have enough X-content for this quiz". OUTPUT FIELDS: - total: approved questions in 'en' + 'pl'. - byLanguage: { en: N, pl: N }. - bySource: { entityq: N, mintaka: N, 'kqa-pro': N, ... } — 12 keys, one per source database. - byDifficulty: { trivial: N, easy: N, medium: N, hard: N, expert: N, unrated: N } — null difficulty mapped to 'unrated'. trivial/expert populated by LLM calibration. - byCategory: top 24 with localized names. - byTopic / byTag: top 30 curated topics + top 30 tags with localized labels. - meta: { generatedAt: ISO 8601, language }. INPUTS: lang (default "en") affects byCategory[].name and byTopic[].label / byTag[].label. DATA FRESHNESS: snapshot regenerated daily (~03:00 UTC) + on demand after batch imports. generatedAt shows when. Counts stable ±0.01% between snapshots. COMMON MISTAKES: polling stats every request (cache it on your side; 5-min Redis TTL on ours); treating bySource keys as stable enum (use quizbase_languages / quizbase_categories for canonical input enums).

  ConnectorNo auth

• scan_domainA

  SiteGuardianA

  Runs a free one-off security scan of the given domain and returns its grade (A–F), scan timestamp, and up to three top-priority issues with a permalink to the full report on siteguardian.io. Use this when the user asks for a quick security check of a domain that is NOT yet under SiteGuardian monitoring, or when they want a fresh assessment before subscribing. Results are cached for two hours, so repeated calls about the same domain return the same snapshot and mark it with cached=True. Do NOT use this for domains already under monitoring by the user — call get_domain_status instead for the account-scoped view with framework tags. Do NOT use this to batch-scan many domains as a competitive-intelligence tool; per-source-IP and per-target rate limits bound usage. This tool does not require authentication.

  ConnectorNo auth

• vuln_get_brief_templateA

  website-searchA

  Get Lenny Zeltser's Vuln one-page executive brief template. Standalone variant of `vuln_get_template` for callers that only want the brief without the long-form report. This server never requests your vulnerability notes and instructs your AI to keep them local—the brief template and guidelines flow to your AI for local analysis.

  ConnectorNo auth

• assessment_get_brief_templateA

  website-searchA

  Get Lenny Zeltser's Security Assessment one-page executive brief template. Standalone variant of `assessment_get_template` for callers that only want the brief without the long-form report. This server never requests your assessment notes or report and instructs your AI to keep them local—the templates and guidelines flow to your AI for local analysis.

  ConnectorNo auth

• watch_tripA

  travel-trends-mcpA

  Start monitoring one trip for disruption changes over time. Use this tool when the user wants ongoing monitoring of a trip rather than a one-off assessment (for a one-off answer, use assess_trip). Persists the trip as a monitored object and returns its initial assessment plus a random, unguessable trip_id AND a one-time `owner.owner_token`. Store BOTH: the trip_id is the (public, shareable) URL handle, the owner_token is the private key needed to change the trip's label or webhook later. There is no stop call: monitoring ends by itself the day after date_to. CREATE vs REFRESH: called with just destinations+dates it CREATES a new trip every time (it does NOT dedupe on identity — that is deliberate, so nobody can reach your trip by guessing your itinerary). To update an existing trip (change its label or webhook), call again passing BOTH its `trip_id` and `owner_token`; a missing/wrong token is rejected. Each pipeline run then re-evaluates the trip and appends an update ONLY when something materially changes (a new/cleared event, a severity/status shift, or a travel_status change) — never on a calm tick. Args: destinations — EU-27 ISO2 codes (Greece = "EL") plus the non-EU27 countries we monitor: Norway "NO" (Entur, live), United Kingdom "UK"/"GB" (TfL, live), Switzerland "CH" (SBB, key-pending → declared blind spot until keyed); date_from/date_to (YYYY-MM-DD); optional label. An unmonitored code is rejected with {"error": "unknown_country"} rather than a false all-clear. Returns {trip_id, assessment, created_at}; invalid inputs return an explicit {"error": ...}. Destinations also accept natural input: IATA airport codes (e.g. 'TSR', 'AMS', 'ZRH') and major city names (e.g. 'Timișoara', 'Amsterdam', 'Zürich', 'London'), resolved deterministically to a monitored country code. The initial assessment includes a 'resolved' list ([{input, country, kind}]) disclosing how each token was mapped (e.g. 'TSR -> RO via iata-airport'). A token that resolves to a country we do not monitor is rejected with {'error': 'unknown_country'}; a token we cannot resolve at all is rejected with {'error': 'unknown_destination', 'tokens': [...]} — we reject not guess. Pass `lang` (e.g. "de", "ro", "pl"; default English) to localise the initial assessment into the traveller's language: the returned assessment carries the same `localized` block as assess_trip (honest reassurance, AI-translated-and-LABELLED source text, and the localized caveats + blind_spots that are never dropped). Localization never becomes a false all-clear; the aviation handoff discloses the blind spot, not coverage. Pass `audience` ("tmc" | "hotel" | "ota" | "tour_operator") for role-specific operational actions — the initial assessment then carries the same `persona` block as assess_trip (audience + per-event role actions, projected from the audience-tagged recommendations). Built for the B2B travel-risk buyer. Pass `notify_webhook_url` (https only) to get PUSH delivery: on every MATERIAL change the radar POSTs the update record (summary, status transition, event report URLs) to your URL, signed HMAC-SHA256 over the raw body (header X-TravelTrends-Signature: sha256=<hex>). The response then includes `notify.secret` — shown ONLY once, never published; store it to verify signatures. To change or remove the webhook later, re-call with the trip_id + owner_token and the new notify_webhook_url (or "" to remove delivery). After 5 consecutive delivery failures the webhook is disabled with an honest notify_disabled entry in the trip's updates log. Non-https or private-network URLs are rejected with {"error": "invalid_webhook_url"}. Optional `legs` (same shape and semantics as in assess_trip) are persisted with the trip; legs[] appears in the assessment returned here. The 6-hourly radar check re-resolves the stored legs and their modes feed its decision lines; whats_changed reports the trip-level delta and does not carry a legs block.

  ConnectorNo auth

• get_leadproof_evaluation_pathA

  LeadProof Sales AgentA

  Use first when a buyer is exploring LeadProof without supplying workflow data. Returns the official no-purchase sequence: buyer guide, fictional example audit, browser-only calculator, public workflow tests, and no-card trial. For a scored workflow diagnosis, use audit_lead_workflow; for replay testing, use get_leadproof_replay_trial; for paid checkout, use get_leadproof_checkout only after authorization.

  ConnectorNo auth

• scalix_computer_set_ssh_keysA

  Scalix CloudA

  Replace the ssh keys authorised for root on a persistent Linux machine. This is how you revoke: send the list without the key you want gone, and on a running machine it stops working immediately. Sending an empty list removes every key. Not a patch — whatever you send becomes the whole list, so read the current keys from scalix_computer_list first if you mean to add one.

  Connector

  Destructive

  No auth

• get_advisoryA

  dependency-trustA

  Get a security advisory (vulnerability) by its key. Returns a security advisory by key, for example a GHSA id taken from a version's advisoryKeys, including the title, CVE aliases, CVSS v3 score and vector, and a link to the full record on osv.dev. Use this only when you already have an advisory ID from get_package_version's advisoryKeys. There is no search here. To find out whether a version has vulnerabilities at all, call get_package_version first; this tool explains one advisory in depth.

  ConnectorNo auth

• vertodigital_send_enquiryA

  VertoDigital MCP ServerA

  Sends a message from a user to the VertoDigital team and returns a reference ID. The message lands in the team's CRM and inbox, and the team replies to fromEmail, normally within one business day. Use it for service questions, partnerships, press and careers, or to request the free Pipeline Readiness Assessment: set topic: "assessment" and put the company and main pipeline challenge in message. If the user only wants contact details, use vertodigital_get_contact instead. Call it only with the user's consent, using their real name and email. Pass organization whenever the user names their company; it is saved as the company on the CRM record. Every call creates a new enquiry, so do not retry a call that succeeded. Calls are rate-limited: over the limit, the tool returns an isError result with a retry delay in seconds. No authentication required.

  ConnectorNo auth

• run_detect_agent_investigationA

  Resemble AIA

  Run a managed Detect Agent investigation against media at a public HTTPS URL and return its verdict. preset_id is one of: investigate_social_content, review_insurance_claim, verify_breaking_news, verify_document, verify_evidence, verify_id (confirm with list_detect_agents). query states the investigation objective; check_urls adds URLs for the agent to check. Consumes a run of the team's allowance. `label`/`score` are the Detect evidence and are the only basis for an authenticity claim; `verdict` is the agent's written assessment. If timed_out is true the investigation is still running server-side — retrieve it later with get_detect_agent_run.

  ConnectorNo auth

• check_mcp_serverA

  RightAIChoiceA

  Use this when the user asks about a specific Model Context Protocol server — whether it is listed in the official MCP registry, what endpoint it publishes, how current its listing is, or whether that endpoint responds. Returns the registry record (name, version, publish and update dates, declared remote endpoints, registry status) plus the result of one anonymous request to a registry-published endpoint. Reports observations only. It does NOT assess whether a server is safe, trustworthy, well-built or suitable — we cannot see what a server does with data, and reachability is not safety. Many listed servers require authentication and cannot be queried anonymously; that is normal and is not a fault. Absence from the registry is not evidence a server does not exist. Not for: security assessment, recommending which MCP server to install, or checking AI tools in the RightAIChoice catalog (use check_tool_status).

  ConnectorNo auth