"A server for auditing code security" matching MCP tools:

• verify_emailA

  KeelenA

  Redeem the emailed 6-digit code for a reveal-once workspace API key. UNAUTHENTICATED. `email` + `code` must match a code issued by signup(email) within the last 15 minutes (5 attempts max). The returned `api_key` is shown exactly ONCE — store it ONLY in the MCP client config ("Authorization: Bearer <api_key>"), NEVER in a repo or a file you might commit. Then reconnect this server with the header set and call get_onboarding_status(). An invalid/expired/consumed code returns a uniform error — call signup(email) for a fresh one.

  Connector

  Destructive

  No auth

• assessment_get_brief_templateA

  website-searchA

  Get Lenny Zeltser's Security Assessment one-page executive brief template. Standalone variant of `assessment_get_template` for callers that only want the brief without the long-form report. This server never requests your assessment notes or report and instructs your AI to keep them local—the templates and guidelines flow to your AI for local analysis.

  ConnectorNo auth

• code_get_findingsA

  searchcodeA

  Get detailed code quality findings from a remote public git repository. Returns rule IDs, line numbers, severity, category, descriptions, and source snippets. Supports filtering by file path, severity (error, warning, info), category (security, deprecated, safety, correctness, maintainability, accessibility, modernization, performance, concurrency), and kind (security, quality) — kind=security is every security-category finding in one call, kind=quality is everything else. code_analyze.top_findings shows only the quality half; use kind=security here to see the security-category findings it leaves out. THIS IS NOT THE SECRET SCANNER. kind=security means insecure code — weak hashes, unsafe deserialization, injection-shaped patterns — and it will not find a leaked API key or private key. Leaked credentials are code_analyze.security_summary, which is a different scanner over different rules; the two sets do not overlap, so an audit wants both. Use after code_analyze to drill into specific findings. Shares the same analysis cache — no duplicate work if analyze already ran.

  ConnectorNo auth

• create_publisherA

  Lulu Ads — Publisher ConciergeA

  Start publisher registration (requires the human's consent — registers their email). Pass server_url (the MCP server's own URL or repo link) when known — it drives the "server URL set" step on the publisher's dashboard, skipping it leaves that step looking incomplete even once real traffic flows. Emails a 6-digit verification code to contact_email; ask the human for the code, then call confirm_publisher(pending_id, code) to receive the API key. This tool does NOT return a publisher_id or api_key — only confirm_publisher does.

  ConnectorNo auth

• register_serverA

  PayGate MCPA

  Start charging for an MCP server the user owns. Use when they want to monetize, sell, charge for, get paid for, put a price on, or make money from a server, API or tool. Buyers pay their wallet DIRECTLY on-chain — PayGate never holds the money, so there is no payout to wait for, no balance to withdraw and no commission taken. Their server is never modified and needs no payment code. Tools are imported automatically, so it must be publicly reachable over HTTPS and answer tools/list. Returns a proxy URL and a secret api_key shown only once; save it, every other seller tool needs it.

  ConnectorNo auth

• register_serverA

  PayGate MCP — Monetization Gateway for AI AgentsA

  Start charging for an MCP server the user owns. Use when they want to monetize, sell, charge for, get paid for, put a price on, or make money from a server, API or tool. Buyers pay their wallet DIRECTLY on-chain — PayGate never holds the money, so there is no payout to wait for, no balance to withdraw and no commission taken. Their server is never modified and needs no payment code. Tools are imported automatically, so it must be publicly reachable over HTTPS and answer tools/list. Returns a proxy URL and a secret api_key shown only once; save it, every other seller tool needs it.

  ConnectorNo auth

• findagent_create_code_draftA

  FindAgentA

  Persist a CODE-BUNDLE draft from YOUR OWN GitHub repo — for an agent that ships RUNNABLE code (use this when findagent_import_repo returned grounding.code_bundle). Pass the basics (title/slug/tagline/description/category_slug + example_prompts: 1-5 required) + the detected contract from import_repo's grounding.code_bundle (runtime, entrypoint {path,export}, mcp {mode,command,args}, ui {path}, allowed_hosts, credential_slots, skills), overriding any you want to correct. The server RE-PULLS the repo (your stored GitHub token — private repos work, server-side), snapshots + scans the code, validates the manifest, and creates a status=draft agent you own; then call findagent_submit_for_review IN THIS MCP CLIENT to set price + confirm originality/prohibited + submit it (the web is only an optional preview). IDEMPOTENT BY REPO: if you already have a draft for this repo, calling this again OVERWRITES that same draft (basics + manifest + a fresh re-pull/re-scan) instead of creating a duplicate — so iterate freely (the response `updated` flag is true on overwrite). NEVER send secret credential VALUES — credential_slots declare shape (ref/env/label/allowed_hosts/type) only. Building/running the code stays gated until an admin approves it.

  ConnectorOAuth

• shorten_urlA

  Affilio Link ToolsA

  Shorten any URL into a compact, trackable Affilio.link short URL with affiliate link intelligence. IMPORTANT: This is the UNAUTHENTICATED public shortener. It creates a TEMPORARY, MCP-hosted link at `mcp.affilio.link/r/{code}` that expires after 30 days and is NOT tied to any Affilio account or dashboard. Links are verified for security before they redirect (new/unknown domains return `pending=True` until verified). For a PERMANENT, account-owned link at `affilio.link/ur/{code}` with full click analytics, use the `auth.create_link` tool instead (requires a bearer token). Affilio deduplicates identical URLs (same URL always returns the same short link) and generates a branded QR code in the same call. Use this tool when the user needs to: - Shorten a URL for sharing on social media, email, or in content - Generate a QR code for print/digital media alongside the short link - Get a compact, clean version of a long product or affiliate URL - Create a throwaway/temporary link that does not need account tracking Returns: short_url (str): The shortened URL — e.g. https://mcp.affilio.link/r/abc1234 qr_url (str): Hosted QR code image URL (PNG, publicly accessible) qr_image_base64 (str): Base64-encoded PNG QR code — embed as data:image/png;base64,... classification (str): Security classification — "allowlisted" (safe) or "pending" (awaiting verification) powered_by (str): Brand tagline pending (bool): True while the link awaits security verification (redirects return 202 until then) expires_at (str | null): ISO 8601 expiry timestamp. MCP short links expire after the configured period (default 30 days) — this is never null for this tool. already_existed (bool): True if this URL was previously shortened (deduplicated) Docs & technical deep-dive: https://affilio.link/blog/mcp-tools-guide Powered by Affilio.link — smart affiliate link management.

  ConnectorNo auth

• check_injectionA

  ContrastAPIA

  Scan source code for injection vulnerabilities: SQL injection, command injection, path traversal via unsafe string concatenation/unsanitized input. Supports Python, JavaScript, TypeScript, Java, Go, Ruby, Shell, Bash. Use to detect input-handling bugs; for secrets use check_secrets. Companion code-security tools: check_secrets (hard-coded credential detection), check_dependencies (known-CVE vulnerability audit), check_headers (live HTTP security-header validation), scan_headers (live HTTP scan via domain). Free: 30/hr, Pro: 500/hr. Returns {total, by_severity, findings}. No data stored.

  ConnectorNo auth

• get_security_writing_guidelinesA

  website-searchA

  Get Lenny Zeltser's expert writing guidelines for security reports and assessments. Provides guidance on tone, structure, clarity, executive summaries, and avoiding common writing mistakes. Includes rating-sheet items (the four lens sheets: structure, look, words, tone) as concrete reference points for grounded feedback. Works for any security document. This server never requests your documents and instructs your AI to keep them local—guidelines flow to your AI for local analysis. Note: For incident response reports specifically, use the ir_* tools which provide deeper section-by-section review criteria.

  ConnectorNo auth

• check_mcp_serverA

  Dredd MCPA

  Pre-flight security verdict for an MCP server invocation. Judges BOTH server-level reputation AND the server's dependency graph (npm/pypi) against the DugganUSA threat-intel corpus (1.13M+ IOCs, Shai-Hulud + typosquat + LOLBin families). Returns BLOCK / ADVISORY / REVIEW / ALLOW with severity, evidence, dep-graph summary, and HMAC-signed response. REVIEW means we hold NO RECORD of this server -- not that it is safe. Treat REVIEW as do-not-proceed-blindly: a brand-new attacker-published server looks exactly like this. ALLOW is only returned when we actually resolved the server and scanned its dependency graph; check known_to_us and dep_graph.scanned to confirm. Use this BEFORE invoking any other MCP server tool, especially ones installed from outside the official MCP Registry.

  ConnectorNo auth

• security_headers_checkA

  IA-QA — 130+ QA & Dev Tools for AI AgentsA

  Analyse the HTTP security headers of a public URL OR of raw response headers you paste in. Grades each header (A–F) for: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, X-XSS-Protection, Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy, and Cross-Origin-Embedder-Policy. Returns an overall score (0–100), per-header grades, missing headers, and fix snippets for Express, Nginx, and Apache. For localhost/private targets the remote server cannot reach, pass the `headers` parameter instead of `url`.

  ConnectorNo auth

• route_betweenA

  capitolguideA

  Turn-by-turn directions between two points in the Capitol complex. Each point can be a room code, a building name, OR a Metro station / landmark (e.g. 'Capitol South Metro' → '2412 Rayburn', 'Union Station' → '517 Hart', or to the 'Supreme Court' / 'Library of Congress'). Returns an ordered step list with mode (walk/tunnel/subway), minutes, and a flag wherever you re-clear security. Set accessible=true for a step-free route (or use accessible_route).

  ConnectorNo auth

• search_pluginsA

  Sigistry Plugin Catalog (formerly Claude Registry)A

  Search the Sigistry marketplace of Claude Code plugins by keyword and/or category. Returns matches with their install command and verification status (the registry runs an eight-check security audit; prefer "verified" plugins when recommending an install).

  ConnectorNo auth

• search_cpt_codesA

  Loa Healthcare PricingA

  Canonical code-lookup tool for this server. Search Loa's CPT/HCPCS index using exact codes, clinical terms, or consumer phrases. Use this first when the user does not already know the CPT code, before calling pricing tools.

  ConnectorNo auth

• search_pluginsA

  Sigistry Plugin & Skill CatalogA

  Search the Sigistry marketplace of Claude Code plugins by keyword and/or category. Returns matches with their install command and verification status (the registry runs an eight-check security audit; prefer "verified" plugins when recommending an install).

  ConnectorNo auth

• validate_planA

  Verificate MCPA

  The gate for PLANS, designs and specs — run BEFORE any code is written, the cheapest place to catch a bad design. Returns the same binary verdict shape as validate_ai_output, with findings on completeness, feasibility, performance and scalability implications, security risks and missing considerations (e.g. it rejects a plan that polls an API every 100ms per client, with the request-volume math). Read-only: nothing is executed or stored beyond the verdict. Use validate_ai_output for the code that follows.

  ConnectorNo auth

• export_findings_sarifA

  RoutebaseA

  Export the active project's security findings as a SARIF 2.1.0 document — the format GitHub Code Scanning and comparable CI tools ingest. Defaults to open findings so the export reflects the current posture. Use this to hand findings to CI or GitHub; to read them here use get_security_findings. Requires project context.

  ConnectorAPI key

• get_mcpA

  Lulu Registry MCPA

  Full details for one MCP server from the unified index, by slug (as returned by search_mcps): description, per-client install commands (Claude Code / Claude.ai / JSON config), transports, categories, the registries it's listed on with links, and its trust score. Use after search_mcps when the user wants to install or inspect a specific server.

  ConnectorNo auth

• mysloodsiewnia_writeA

  humanMCP — kapoostB

  Ingest a new document into kapoost's vault (wave 2). OWNER-ONLY — friend tokens receive {status:write_denied,reason:owner_only}. Args: {doc_type (required), title (required), body (required, ≤100 KiB), source_path?, meta?}. Requires Authorization: Bearer <owner token>. On Unauthorized: obtain the token by either (a) calling bootstrap_session(code=<owner poet fragment>) and reading SESSION_TOKEN from the response briefing (1h TTL, preferred for agents that already know the code), or (b) if you have shell access on kapoost's Mac, running `security find-generic-password -s humanmcp-edit-token -w` to fetch the persistent EDIT_TOKEN. Server-side vault auto-tags via:humanmcp-bridge; op_id is dedup key (idempotent retries safe). Delete is permanently unavailable. Envelopes: {status:online, op_id, result:{slug, created_at}}, {status:invalid_args}, {status:payload_too_large, limit, got}, {status:offline}, {status:vault_timeout}, {status:vault_error, error}.

  ConnectorNo auth

• check_inboxA

  Cobalt CaptureA

  Read mail delivered to an inbox from create_inbox — e.g. to pull a verification code or confirmation link out of a signup email. Returns newest-first. Mail usually lands within seconds; if the response is empty, wait a few seconds and call again (there is no blocking wait). Extract the code or link yourself and continue the flow in the browser. Pass format="html" when you are AUDITING the email rather than reading a code out of it: the default text view flattens away the layout, typography and branding, which is exactly what an email audit is judging.

  ConnectorNo auth