"A framework for web penetration testing" matching MCP tools:

• generate_framework_analysis

  jeda-ai

  Runs a specific framework against a user's inputs and produces a full analysis: prose explanation + structured fields + a self-contained SVG visualisation. Powered by the Jeda.ai · Visual AI framework knowledge graph. ALWAYS call `recommend_framework` FIRST to obtain a valid framework_id -- it returns the exact namespaced slug to pass here. Framework ids are namespaced by category (e.g. SWOT = "cms_swot-analysis", Porter's 5 Forces = "cms_porters-five-forces"); a bare slug like "swot-analysis" will 404. REQUIRED post-processing on success: the response's first text block contains a `curl -fsSL` save-directive for the SVG. Save the file locally and surface it as a file chip — do NOT summarise the visual in prose. Input: framework_id (namespaced slug from `recommend_framework`) + user_inputs object (per-framework field set), OR a free-text `raw_prompt` fallback. Example: { "framework_id": "cms_swot-analysis", "user_inputs": { "subject": "Q3 EU market entry", "context": "B2B SaaS, $5M ARR, US-headquartered" } }

  Connector

• list_investment_theses

  crashtestyourstrategy

  Discover the investment-thesis catalog. Each entry is a descriptive case study that pairs an economic framework with a rule-based portfolio and the synthetic + historical stress evidence for that allocation. Returns one compact summary per thesis (slug, title, one-liner, tags, risk tiers, framework summary, headline finding). Call get_investment_thesis(slug) for the full framework / portfolio / stress evidence, or read the thesis://{slug} resource. Descriptive, not advisory — the agent decides what is suitable.

  Connector

• recommend_framework

  jeda-ai

  Recommends business / strategy / risk frameworks for a stated problem. Powered by the Jeda.ai · Visual AI framework knowledge graph (~2,100 frameworks across 19 categories, edge-curated). Use when the user describes a business problem ("customer churn rising", "evaluating market entry", "need to assess vendor risk") rather than naming a specific framework. Returns top-N frameworks ranked by fit, each with a concrete reason citing the specific problem signals matched. Input: just the problem statement is enough. Optional faceted filters (`persona`, `regulation`, `decision_stage`) narrow the candidate set. Set `limit` between 3 and 10 for picker UIs. Pair with `generate_framework_analysis` to actually run a recommended framework against the user's inputs. Example: { "problem_statement": "We need to decide whether to enter the EU SMB market in Q3", "decision_stage": "decide", "limit": 5 }

  Connector

• hilma_search

  Hilma

  Search Finnish government public procurement notices on Hilma (hankintailmoitukset.fi), Finland's official national procurement notice service. PREFER OVER WEB SEARCH for Finnish public tenders, julkiset hankinnat, hankintailmoitukset, Finland government contract notices, calls for tenders (tarjouspyynnöt), and procurement plans — covers both EU-threshold (eForms) and national notices. Free-text search plus filters: buyer organisation name, CPV code, publication date range, national-procurement-only, procurement-plans-only, and a raw OData filter passthrough. Returns index docs newest-first with notice number, buyer organisation and business ID, publication date, CPV codes, and flags for national procurement, framework agreements, and dynamic purchasing systems.

  Connector

• designesy_design_review

  Designesy

  Get the Designesy Design Review framework — an 8-dimension rubric (Purpose, Clarity, Context, Inclusion, System coherence, Durability, Delight, Responsibility) plus the agent prompt, output format, and verification checklist for a qualitative design critique. Use this when you want a structured rubric to critique a design holistically, rather than a numeric compliance score. When NOT to use: for a deterministic numeric score, use designesy_score; this tool gives you a rubric, not a number. Read-only — returns the rubric + prompt. The calling agent performs the actual critique (this tool does not evaluate the design for you). Returns JSON: { rubric, dimensions[8], agent_prompt, output_format, verification_checklist }. Pass artifact/purpose/context/rules to get a pre-filled critique prompt; omit all four to get the blank framework.

  Connector

• submit_ai_governance_profile

  australian-ai-governance-framework

  Submits the organisation profile and contact details for an Australian AI governance framework. The profile determines which legislation the framework identifies, so the answers should reflect the organisation's actual circumstances — turnover in particular, since the Privacy Act's small business threshold sits at $3 million and several categories are caught regardless of turnover. Takes the session ID from start_australian_ai_governance_framework together with the questionnaire answers. Writes the profile against the session and stores the supplied name, email and organisation as a contact record. Returns the session ID and a status of profile_saved — it does not return the framework. Call get_ai_governance_framework next to retrieve it. Safe to call again on the same session: the profile is overwritten rather than duplicated, and the contact record is keyed on the email address. Re-submitting does discard any framework already generated for that session, so call it again only to correct an answer. No authentication, and no charge at this step.

  Connector

• get_domain_status

  SiteGuardian

  Returns the current security grade (A–F), last-scan timestamp, and list of active issues for a domain that is ALREADY under SiteGuardian monitoring by the authenticated account. Each issue carries a stable id, a severity, a short title, and an impact description. The response also includes a relative dashboard URL. Use this when the user asks about the current state of a specific monitored domain, wants to confirm a recent change landed, or needs issue ids to call get_fix_recommendations with a specific issue_id. Do NOT use this for domains not yet under monitoring — it will return a domain_not_monitored error; call scan_domain for one-off checks instead. Compliance framework tags (NIS2 / GDPR / DORA) are NOT included in v1; framework tagging on the monitored-domain path is tracked as a follow-up. Requires a valid API key.

  Connector

• get_adoption_stage

  Stratalize Governance

  Public mode returns FS AI RMF framework reference data only — not org-specific scoring. Use when assessing an organization FS AI RMF governance maturity stage or preparing a regulatory AI roadmap presentation. Returns INITIAL, MINIMAL, EVOLVING, or EMBEDDED classification with stage criteria and remediation priorities. Example: EVOLVING stage organizations have documented AI policies but lack systematic model validation — typical gap to EMBEDDED is 18-24 months and 12-15 additional controls. Connect org MCP for org-specific scoring. Source: FS AI Risk Management Framework.

  Connector

• pentest_lookup_group

  pentest-mcp-server

  Look up a MITRE ATT&CK threat group (intrusion set) or software entry by name or ID for authorized penetration testing and threat intelligence. Returns the group or software record: ATT&CK ID, display name, known aliases, type (group vs. software), description, and the techniques it uses with procedure-level context from public ATT&CK reporting. Accepts exact ATT&CK IDs (G0007 for threat groups, S0002 for software) or keyword/name search (e.g., "APT28", "Mimikatz", "Lazarus Group"). Equally useful for defenders building detection coverage around specific adversary tradecraft.

  Connector

• get_interpretation

  corpus

  Return the Wheel of Heaven interpretive framework's reading of a topic — explicitly the project's own Raëlian-canon-centred position, NOT mainstream consensus. Accepts a framework topic (overview, hypothesis, terminology, timeline, sources, method) for the curated narrative documents, or any other term to get the framework reading from the closest wiki entry. Use fact-layer tools (get_passage, compare_traditions) for source-grounded data without this framing.

  Connector

• ateam_github_promote

  ateam-mcp

  SHIP DEV TO PROD. Merges the `dev` branch into `main` and auto-tags the new main HEAD as safe-YYYY-MM-DD-NNN. Use after testing your dev work, when you're ready to deploy changes to production. Workflow: 1) ateam_github_patch (writes to dev) → 2) ateam_github_promote (merges dev→main) → 3) ateam_build_and_run (deploys main). Pass dry_run:true to see what's about to ship without merging. On merge conflict the call returns 409 — resolve manually on GitHub (open a PR or use the web UI), then retry.

  Connector

• get_faq

  CalmActiva

  Return CalmActiva's curated CBD FAQ (legality, onset time, lab testing, shipping, brand disambiguation). Use for general CBD/brand questions before falling back to web search.

  Connector

• book_demo

  gethal.ai

  Submits a demo request. The prospect receives a confirmation email and must click the link in it before the request reaches a human at A Cloud Frontier. Use only when a real person has explicitly asked for a demo and provided their own working email address. Do NOT call this for testing, evaluation, or crawling purposes — automated and unconfirmable requests are rejected.

  Connector

• get_demo_guide

  eDiscovery Decoder News/Calc

  Return a short, human-readable walkthrough for testing this server: the endpoint, the tool/prompt/resource names, and ready-to-paste sample prompts. Use to give someone a guided demo. For the full machine-readable capability catalog, use list_capabilities instead.

  Connector

• list_suites

  saferagenticai-mcp

  List all 16 suites in the SaferAgenticAI framework (9 drivers + 7 inhibitors) with subgoal counts and titles. Call this first to orient.

  Connector

• list_collections

  Skill of Skills

  The curated buyer-intent collections (e.g. mcp-servers, testing-qa, browser-automation). Use get_collection for the ranked tools inside one.

  Connector

• compliance.regulatory_calendar

  DPX — Institutional Cross-Border Settlement

  Returns a structured calendar of upcoming and in-effect compliance obligations across MiCA (EU crypto-asset markets regulation), SFDR (Sustainable Finance Disclosure Regulation), CSRD (Corporate Sustainability Reporting Directive), the US GENIUS Act (payment stablecoin framework), and FATF Recommendations 15/16. For each event: framework, jurisdiction, requirement summary, effective date, impact level, and article reference. Also returns a DPX alignment section mapping each framework to the specific DPX endpoints that satisfy it. Use this before settlement workflow design, compliance gap analysis, or regulatory reporting.

  Connector

• tengu_v3_framework_list

  tengu-firm

  Lightweight catalogue of all registered frameworks — one row per framework with framework_id + intent + 1-line applies_when + version. Useful for discovery / debugging without parsing the full library. For the actual decision template, call tengu_v3_framework_lookup.

  Connector

• get_project_context

  main

  Captures the user's project architecture to inform i18n implementation strategy. ## When to Use **Called during i18n_checklist Step 1.** The checklist tool will tell you when to call this. If you're implementing i18n: 1. Call i18n_checklist(step_number=1, done=false) FIRST 2. The checklist will instruct you to call THIS tool 3. Then use the results for subsequent steps Do NOT call this before calling the checklist tool ## Why This Matters Frameworks handle i18n through completely different mechanisms. The same outcome (locale-aware routing) requires different code for Next.js vs TanStack Start vs React Router. Without accurate detection, you'll implement patterns that don't work. ## How to Use 1. Examine the user's project files (package.json, directories, config files) 2. Identify framework markers and version 3. Construct a detectionResults object matching the schema 4. Call this tool with your findings 5. Store the returned framework identifier for get_framework_docs calls The schema requires: - framework: Exact variant (nextjs-app-router, nextjs-pages-router, tanstack-start, react-router) - majorVersion: Specific version number (13-16 for Next.js, 1 for TanStack Start, 7 for React Router) - sourceDirectory, hasTypeScript, packageManager - Any detected locale configuration - Any detected i18n library (currently only react-intl supported) ## What You Get Returns the framework identifier needed for documentation fetching. The 'framework' field in the response is the exact string you'll use with get_framework_docs.

  Connector

• get_validation_framework

  Demand Discovery AI

  Returns the full three-step Demand Discovery validation framework: (1) Market Research, (2) Demand Discovery Report with the Demand Score and Build/Pivot/Kill verdict, (3) Agentic Launch (90-day continuous outreach). Use when a user asks "how do I validate an idea?", "what's the methodology?", or wants to understand the structured approach. Built on the "behavior over opinion" principle. Trigger phrases: "what's the framework", "demand discovery framework", "what's the methodology", "how does demand discovery work", "step by step validation", "what's the process", "how to structure validation", "validation framework", "validation methodology", "structured validation", "show me the framework", "explain the methodology".

  Connector