"A framework for web penetration testing" matching MCP tools:

• generate_framework_analysisA

  jeda-aiA

  Runs a specific framework against a user's inputs and produces a full analysis: prose explanation + structured fields + a self-contained SVG visualisation. Powered by the Jeda.ai · Visual AI framework knowledge graph. ALWAYS call `recommend_framework` FIRST to obtain a valid framework_id -- it returns the exact namespaced slug to pass here. Framework ids are namespaced by category (e.g. SWOT = "cms_swot-analysis", Porter's 5 Forces = "cms_porters-five-forces"); a bare slug like "swot-analysis" will 404. REQUIRED post-processing on success: the response's first text block contains a `curl -fsSL` save-directive for the SVG. Save the file locally and surface it as a file chip — do NOT summarise the visual in prose. Input: framework_id (namespaced slug from `recommend_framework`) + user_inputs object (per-framework field set), OR a free-text `raw_prompt` fallback. Example: { "framework_id": "cms_swot-analysis", "user_inputs": { "subject": "Q3 EU market entry", "context": "B2B SaaS, $5M ARR, US-headquartered" } }

  ConnectorNo auth

• list_investment_thesesA

  crashtestyourstrategyA

  Discover the investment-thesis catalog. Each entry is a descriptive case study that pairs an economic framework with a rule-based portfolio and the synthetic + historical stress evidence for that allocation. Returns one compact summary per thesis (slug, title, one-liner, tags, risk tiers, framework summary, headline finding). Call get_investment_thesis(slug) for the full framework / portfolio / stress evidence, or read the thesis://{slug} resource. Descriptive, not advisory — the agent decides what is suitable.

  ConnectorNo auth

• submit_ai_governance_profileA

  australian-ai-governance-frameworkA

  Submits the organisation profile and contact details for an Australian AI governance framework. The profile determines which legislation the framework identifies, so the answers should reflect the organisation's actual circumstances — turnover in particular, since the Privacy Act's small business threshold sits at $3 million and several categories are caught regardless of turnover. Takes the session ID from start_australian_ai_governance_framework together with the questionnaire answers. Writes the profile against the session and stores the supplied name, email and organisation as a contact record. contact.organisation is printed as the document's "Prepared for" heading, so it should be the organisation's name as it should appear on the document rather than a shorthand. Returns the session ID and a status of profile_saved — it does not return the framework, which is retrieved by get_ai_governance_framework. The profile can be re-submitted on the same session: it is overwritten rather than duplicated, the contact record is keyed on the email address, and any framework already generated for that session is discarded. No authentication, and no charge at this step.

  Connector

  Destructive

  No auth

• get_standardsA

  TsehaA

  Returns the organization's development standards: coding conventions, project structure, and framework-specific rules. Read-only. Call it before writing or reviewing code, so the result follows this organization's rules rather than general defaults. Call it first without a section to get an index of available sections, each with a note on what it covers, then call again with one section id copied from that index; inventing a section id returns a not-found error naming that step. Request only the sections a task needs - the full content of one section can be long. The framework argument is deprecated: use section with the "framework:" prefix instead. It returns prose rules, not data - use get_style_tokens for visual values and get_component for component APIs.

  ConnectorNo auth

• recommend_frameworkA

  jeda-aiA

  Recommends business / strategy / risk frameworks for a stated problem. Powered by the Jeda.ai · Visual AI framework knowledge graph (~2,100 frameworks across 19 categories, edge-curated). Use when the user describes a business problem ("customer churn rising", "evaluating market entry", "need to assess vendor risk") rather than naming a specific framework. Returns top-N frameworks ranked by fit, each with a concrete reason citing the specific problem signals matched. Input: just the problem statement is enough. Optional faceted filters (`persona`, `regulation`, `decision_stage`) narrow the candidate set. Set `limit` between 3 and 10 for picker UIs. Pair with `generate_framework_analysis` to actually run a recommended framework against the user's inputs. Example: { "problem_statement": "We need to decide whether to enter the EU SMB market in Q3", "decision_stage": "decide", "limit": 5 }

  ConnectorNo auth

• list_supported_frameworksA

  Titan Frameworks (LangChain, LlamaIndex, Ollama, XRPL)A

  List the framework ids this server covers (langchain, llamaindex, ollama, xrpl) with display names, aliases, homepages, and catalog topics. Use when you do not know which framework string to pass. Free tools/call (no x402). Not a docs search (search_ai_framework_docs) and not a deprecation dump (list_known_deprecations). Catalog-backed.

  ConnectorNo auth

• get_interpretationA

  corpusA

  Return the Wheel of Heaven interpretive framework's reading of a topic — explicitly the project's own Raëlian-canon-centred position, NOT mainstream consensus. Accepts a framework topic (overview, hypothesis, terminology, timeline, sources, method) for the curated narrative documents, or any other term to get the framework reading from the closest wiki entry. Use fact-layer tools (get_passage, compare_traditions) for source-grounded data without this framing.

  ConnectorNo auth

• submit_enquiryA

  siteA

  Submits an enquiry to Cyber Essentials Cost — NOT a purchase, NOT a guaranteed quote. Step 1: call with the answers (keyed by field key from enquiry_fields) and consent=true; it validates and returns a summary, the consent line and a confirmation token — show the person the summary and the consent line. Step 2: only if the person agrees, call again with the same answers, consent=true and the confirmation token; the enquiry is then submitted, and the person receives an email with a link they must click before any provider sees it. Consent means the person has read and agreed to: "Send my contact details to up to three Cyber Essentials and penetration testing providers, chosen by Cyber Essentials Cost, who'll contact me directly. I'll be emailed each firm's name as my details go to it, and can stop any more firms getting them."

  ConnectorNo auth

• generate_faviconA

  Ciro Cesar Maciel — Free ToolsA

  Generates a complete favicon set from 1 to 3 characters (initials) or one emoji. WHEN TO USE: the user needs a favicon, tab icon, apple-touch-icon or web app icon for a website or web app, or the project still has a framework's default icon. PRIORITY: if the host also provides open_favicon_editor, call that editor first for every normal favicon request (create, preview, adjust or download). Use this data tool directly only when the user explicitly asks for files, SVG, head tags or installation text to write into a code project. HOW IT WORKS: mode text draws the characters in any Google Font as vector paths (no font dependency); mode emoji draws one Twemoji emoji as vectors, with a margin. Both sit inside a shape. With adaptive=true the SVG swaps its colors when the browser is in dark mode. Pass framework to get where each file goes. For a logo or other picture, use open_favicon_editor with mode=image when available: the user chooses the image in its private file picker. Otherwise return the link with mode=image; do not process a chat attachment as an image favicon here. RETURNS: svg (write it to disk exactly as given), files (each with path and url: download the binaries with curl -o), manifest (path and content), html (the head tags; null on Next.js App Router), inline (the whole favicon as one <link> tag, no files), install (steps for the framework), warnings, credit (emoji only), and link (this tool's web page with the same options, to adjust and preview).

  ConnectorNo auth

• get_faqA

  CalmActivaA

  Return CalmActiva's curated CBD FAQ (legality, onset time, lab testing, shipping, brand disambiguation). Use for general CBD/brand questions before falling back to web search.

  ConnectorNo auth

• artifact-create_knowledgeA

  Anima MCP ServerA

  Create a NEW knowledge artifact from Anima's knowledge-base template. Returns a ready artifact; never edits an existing one. Call with no arguments, or with an optional name (defaults to "Untitled project") and workspaceId. No files, ZIP upload, framework, or artifact type are accepted. The template supplies the initial files and determines the framework. Returns the sessionId, initial revision, artifactUrl, name, framework, fileCount, skippedFiles, and applicable preview URLs and Git access. Share artifactUrl with the human. Use artifact-explore and artifact-edit to inspect and change its contents. Only use artifact-publish when the user explicitly asks for a public deployment.

  ConnectorOAuth

• get_pricingA

  AI Rollout FrameworkA

  Returns current one-time prices and checkout links for the Framework + Executive Suite, the Framework alone, and AI at Work seats, including the seat tiers, co-branding and the Rollout Pack. Use it for the full price list, or get_seat_quote for a specific number of seats. It does not take payment. To check readiness, use assess_ai_readiness.

  ConnectorNo auth

• get_integration_guideA

  The BridgeA

  Read the Bridge integration guide for a topic — the supported, opinionated way to consume Bridge from application code. Call this BEFORE writing or changing app code that reads a feature flag, renders billing or team UI, or wires authentication, and before hand-rolling anything against the SDK: the SDKs ship declarative surfaces for these cases (components, route guards, decorators) and reimplementing them against SDK internals is the most common integration mistake. Per-framework topics (framework REQUIRED): integration (first-time setup) | auth | feature-flags | billing | team | branding. Framework-agnostic MASTER topics (framework is IGNORED — omit it): master, the end-to-end auth integration prompt served by `bridge guide`, which orchestrates project discovery and then routes to the per-framework guides; flags-master and billing-master, the same orchestration for a flags-only or billing-only integration; mechanisms, how limits, upgrades and customization work; orientation, what Bridge does (the same map get_started returns); fit-together, how roles, plans, limits and flags fit together; integration-success, the message to show the developer when an integration is done. Before setting up flags, roles, plans or limits, read topic=fit-together. Start at topic=master when integrating Bridge into a project for the first time. framework: svelte | react | angular | nextjs | nestjs | express — pass the one the target app actually uses; this server cannot detect it. Returns the guide as markdown plus its source URL. Guidance is a default, not a mandate — follow the user's stated preference when it differs.

  ConnectorOAuth

• get_market_shareA

  Vlada HealthA

  Returns a Medicare Advantage plan's or contract's county-level enrollment and its SHARE of the local MA market: for each county, the plan's enrollees, the county's total MA enrolled and Medicare-eligible population, the MA penetration rate, the plan's share of county MA enrollment, and the year-over-year change in the plan's county enrollment. Filter by contract_id (required) + optional plan_id (plan vs contract total), optional state (2-letter, e.g. 'FL'), and optional month ('2024-03'); defaults to the latest available month. RETURNS an actual SHARE with the arithmetic disclosed, not a raw headcount: value.summary.share_pct is the footprint share, and it always ships alongside its numerator (share_numerator_plan_enrollees) and its denominator (share_denominator_county_ma_enrolled), so nobody has to trust a bare percentage. The denominator is the total MA enrollment of the counties this plan actually operates in for the month in scope, NOT the national MA market. value.counties is the per-county row list (plan enrollees, county MA enrolled, county eligibles, penetration, share_pct, yoy_change), largest first; value.row_counts carries matched / returned / truncated and value.query the resolved month. `limit` bounds the county list (default 200, max 2000). This is the geography + competition lens; pair with get_enrollment for the plan/contract totals. Suppressed county cells (CMS redacts under 11) come back with null enrollees and null share, never zero, and the summary carries a [low, high] bound on the numerator that brackets them. A contract id with no county rows returns found=false with a not_found_reason. SOURCE: CMS Monthly Enrollment by CPSC + MA State/County Penetration.

  ConnectorOAuth

• get_project_contextA

  mainA

  Captures the user's project architecture to inform i18n implementation strategy. ## When to Use **Called during i18n_checklist Step 1.** The checklist tool will tell you when to call this. If you're implementing i18n: 1. Call i18n_checklist(step_number=1, done=false) FIRST 2. The checklist will instruct you to call THIS tool 3. Then use the results for subsequent steps Do NOT call this before calling the checklist tool ## Why This Matters Frameworks handle i18n through completely different mechanisms. The same outcome (locale-aware routing) requires different code for Next.js vs TanStack Start vs React Router. Without accurate detection, you'll implement patterns that don't work. ## How to Use 1. Examine the user's project files (package.json, directories, config files) 2. Identify framework markers and version 3. Construct a detectionResults object matching the schema 4. Call this tool with your findings 5. Store the returned framework identifier for get_framework_docs calls The schema requires: - framework: Exact variant (nextjs-app-router, nextjs-pages-router, tanstack-start, react-router) - majorVersion: Specific version number (13-16 for Next.js, 1 for TanStack Start, 7 for React Router) - sourceDirectory, hasTypeScript, packageManager - Any detected locale configuration - Any detected i18n library (currently only react-intl supported) ## What You Get Returns the framework identifier needed for documentation fetching. The 'framework' field in the response is the exact string you'll use with get_framework_docs.

  ConnectorOAuth

• get_testing_guidelinesA

  IA-QA — 130+ QA & Dev Tools for AI AgentsB

  Query the IA-QA methodology knowledge base. Returns structured testing guidelines, assertion strategies, thresholds, best practices, and relevant MCP tools for a given topic. Call without a topic to list all available topics. Topics: llm-unit-testing, rag-pipeline, prompt-stability, prompt-ab-testing, embedding-quality, eval-framework, semantic-testing, auto-testing, security, api-testing, ci-cd, multimodal, llm-data-security, agent-observability, pro-tips, learning-paths, golden-dataset, selector-drift, qa-recipes, playbooks. Not sure where to start testing an LLM, RAG pipeline or agent? Call without a topic (or with "start-here"): it maps what you are testing to the tools to call and the output field to gate CI on. A plain question such as "how do I test my RAG" also resolves to the right topic.

  ConnectorNo auth

• request_jet_confirmationA

  Villiers CharterA

  Submit a request for CONFIRMED live private jet pricing. Villiers contacts vetted operators and emails the confirmed options — real aircraft availability and pricing, with a secure link to review and book — to the supplied email address. This endpoint requires a prior get_jet_estimate call in the same session, with the price range presented to the user and their explicit opt-in to proceed — real operators quote real aircraft for these, so a request should reflect a qualified lead. Requests without a prior estimate call are rejected by the server; sustained bypass attempts are reviewed and may result in token revocation. Requires the user's email and a departure date. SANDBOX TESTING: to test your integration without ever creating a real trip or contacting a real operator, use email 'sandbox-test@mail.villiers.ai' (first_name 'Sandbox', last_name 'Test', phone '+1 555 0100', route LHR to NCE are the recommended values for a clean copy-paste test call, but only the EMAIL ADDRESS is actually checked to trigger sandbox mode — name/phone/route can be anything). Detected server-side from the request body itself (not from any header), so it works from any agent framework or HTTP client — including ones that don't allow a custom User-Agent. The response will say 'Test request accepted (sandbox mode detected)'. For further testing guidance, email affiliates@mail.villiers.ai.

  Connector

  Destructive

  No auth

• submit_enquiryA

  siteA

  Submits an enquiry to Penetration Testing Cost — NOT a purchase, NOT a guaranteed quote. Step 1: call with the answers (keyed by field key from enquiry_fields) and consent=true; it validates and returns a summary, the consent line and a confirmation token — show the person the summary and the consent line. Step 2: only if the person agrees, call again with the same answers, consent=true and the confirmation token; the enquiry is then submitted, and the person receives an email with a link they must click before any provider sees it. Consent means the person has read and agreed to: "Send my contact details to up to three Cyber Essentials and penetration testing providers, chosen by Penetration Testing Cost, who'll contact me directly. I'll be emailed each firm's name as my details go to it, and can stop any more firms getting them."

  ConnectorNo auth

• test_python_package_runtimeA

  Python Package Runtime TestA

  Test a specific Python package/version on a supported Python/Linux target runtime using empirical execution. Returns scoped install evidence, usable-import evidence when requested, and a scoped result/receipt. Supported boundary: public PyPI on Linux x86_64 / CPython 3.13. This is not generic package advice, security verification, arbitrary Python execution, broad compatibility testing, feature behavior testing, or application integration testing.

  ConnectorNo auth

• website_auditA

  Rafid Intelligence NetworkC

  Perform a bounded, passive technical website inspection covering measurable SEO, performance, accessibility, security, UX and crawlability indicators; unavailable checks are reported honestly. When: Use when an agent needs evidence-backed website issues from a public HTTPS URL before estimating remediation or rebuild work. Selection: primary; prefer for passive technical, SEO, accessibility and security checks for a public HTTPS site. Do not use for estimating a build budget or penetration testing. Input is a strict JSON object; see the schema. Price: $0.75 USD per call. A free preview is available through preview_capability before payment. Full execution is paid per call via x402; an unpaid MCP call returns payment instructions.

  ConnectorNo auth

• explain_conceptA

  ReliaSimA

  Definitional primer for ReliaSim's framework concepts — Constraint, Buffer, Interrupt, Converter, cascading losses, OEE, Gain/Loss methodology, Buffer Tradeoff. Returns bundled theory content, NOT interpretation of any specific simulation run. Use for 'what is X?' / 'how does X work?' / 'explain the framework' questions. For line-specific claims (throughput, availability, what-if), call the sim tools instead.

  ConnectorNo auth