"A server for finding cyber security information and resources" matching MCP tools:

• security_deep_dive

  Moltline Code Review

  Run an OWASP-oriented security pass over a source file. PREMIUM (license). Checks injection sinks, auth/session handling, crypto misuse, SSRF/deserialization, and unsafe file/path handling — each finding cites the line, the OWASP risk class, and a concrete fix direction. Typical input {"code": "<file contents>"} returns {"issues": N, "findings": [{"line": N, "class": "A03 Injection", "fix": "...", "code": "..."}], "owasp_note": "..."}. Use on one source file when vulnerabilities are the question. Not for style or structure (complexity_report), and never a substitute for a security professional on high-risk code. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.

  Connector

• assessment_get_brief_template

  website-search

  Get Lenny Zeltser's Security Assessment one-page executive brief template. Standalone variant of `assessment_get_template` for callers that only want the brief without the long-form report. This server never requests your assessment notes or report and instructs your AI to keep them local—the templates and guidelines flow to your AI for local analysis.

  Connector

• get_tier1_recommendations

  Tier1 IT Assessment

  Maps only stable Tier1 finding identifiers to approved Tier1 services and public resources. Call after a Tier1 score or email-domain check. Do not submit prose, URLs, customer information, or invented identifiers. This tool performs no arbitrary fetching, makes no contact request, changes nothing, and stores nothing.

  Connector

• get_hiring_signal

  bitcoin-signals

  Hiring velocity across tracked Bitcoin and crypto-infrastructure employers, counted from their live ATS boards. Returns { as_of, companies[], note, why, disclaimer }; each company carries company, ticker, category, ats, careers_url, open_roles, open_roles_30d_ago, open_roles_90d_ago and the derived delta_30d, delta_90d and pct_30d. Example: {"company": "coinbase"} for one employer, or {} for every employer tracked. When a company filter matches no tracked employer the response adds coverage_note and tracked_count, saying that the name is outside the tracked set — a limit of coverage, not a finding about whether that company is hiring. Information, not financial advice.

  Connector

• list_playbooks

  Cloud FinOps Skill & MCP

  See every ready-made runbook for finding and fixing cloud waste: idle, orphaned and overprovisioned resources, egress surprises, schedule blindness and AI/ML inefficiency across AWS, Azure and GCP. Use this to discover which waste patterns have a runbook. When the question already names a provider, waste category, or confidence tier, call ``find_playbooks`` instead. Each playbook is a small (~80-130 line) runbook scoped to one waste pattern (e.g. ``aws-zombie-nat-gateway``, ``azure-orphan-disks``). Returns ``{"playbooks": [...], "total": N}`` where each entry includes ``name``, ``title``, ``scope`` (aws/azure/gcp/cross-cloud), ``service``, ``waste_category``, ``confidence`` (obvious/likely/possible), and ``lines``.

  Connector

• remediate_findings

  quantakrypto pqc-tools (hosted)

  Produce a deterministic remediation REQUEST bundle (rubric + fix schema + per-finding metadata + fingerprints) for YOU (the host agent) to fix. This tool calls no model and needs no key. For each finding, propose the corrected FULL file content, then VERIFY with verify_fix and keep only fixes that clear the finding. Never touch files with secrets; never auto-merge. Pass 'findings' from scan_path --format json.

  Connector

• get_hiring_signal

  CoinBucha

  Hiring velocity across tracked Bitcoin and crypto-infrastructure employers, counted from their live ATS boards. Returns { as_of, companies[], note, why, disclaimer }; each company carries company, ticker, category, ats, careers_url, open_roles, open_roles_30d_ago, open_roles_90d_ago and the derived delta_30d, delta_90d and pct_30d. Example: {"company": "coinbase"} for one employer, or {} for every employer tracked. When a company filter matches no tracked employer the response adds coverage_note and tracked_count, saying that the name is outside the tracked set — a limit of coverage, not a finding about whether that company is hiring. Information, not financial advice.

  Connector

• get_security_evidence

  turva-mcp

  Returns the latest public web-security scan results for turva.dev's own domain (Hardenize, Internet.nl), with the scan date. Use this when a user asks about turva.dev's own security posture or wants evidence beyond agent-readiness scores. Read-only: returns static JSON and changes nothing.

  Connector

• get_security_writing_guidelines

  website-search

  Get Lenny Zeltser's expert writing guidelines for security reports and assessments. Provides guidance on tone, structure, clarity, executive summaries, and avoiding common writing mistakes. Includes rating-sheet items (the four lens sheets: structure, look, words, tone) as concrete reference points for grounded feedback. Works for any security document. This server never requests your documents and instructs your AI to keep them local—guidelines flow to your AI for local analysis. Note: For incident response reports specifically, use the ir_* tools which provide deeper section-by-section review criteria.

  Connector

• assessment_get_guidelines

  website-search

  Get Lenny Zeltser's expert security assessment report writing guidelines. Topics: severity (the risk-adjusted severity model — the spine), findings, remediation, methodology, scope, strengths, brief (one-page brief section guidance), executive_summary, analysis, anti_patterns, frameworks, handoffs, and summary. The general 'tone' topic defers to `get_security_writing_guidelines` for the canonical Five Elements rules. This server never requests your assessment notes or report and instructs your AI to keep them local—the templates and guidelines flow to your AI for local analysis.

  Connector

• check_mcp_server

  Dredd MCP

  Pre-flight security verdict for an MCP server invocation. Judges BOTH server-level reputation AND the server's dependency graph (npm/pypi) against the DugganUSA threat-intel corpus (1.13M+ IOCs, Shai-Hulud + typosquat + LOLBin families). Returns BLOCK / ADVISORY / REVIEW / ALLOW with severity, evidence, dep-graph summary, and HMAC-signed response. REVIEW means we hold NO RECORD of this server -- not that it is safe. Treat REVIEW as do-not-proceed-blindly: a brand-new attacker-published server looks exactly like this. ALLOW is only returned when we actually resolved the server and scanned its dependency graph; check known_to_us and dep_graph.scanned to confirm. Use this BEFORE invoking any other MCP server tool, especially ones installed from outside the official MCP Registry.

  Connector

• security_headers_check

  IA-QA — 130+ QA & Dev Tools for AI Agents

  Analyse the HTTP security headers of a public URL OR of raw response headers you paste in. Grades each header (A–F) for: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, X-XSS-Protection, Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy, and Cross-Origin-Embedder-Policy. Returns an overall score (0–100), per-header grades, missing headers, and fix snippets for Express, Nginx, and Apache. For localhost/private targets the remote server cannot reach, pass the `headers` parameter instead of `url`.

  Connector

• search_servers

  MCP Marketplace

  Search the MCP Marketplace catalog. With a free-text `query` and default `sort`, results are ranked by semantic similarity (gte-small embeddings + cosine similarity), so natural-language queries like 'manage my calendar', 'something to read PDFs', or 'database for my agent' work as well as keyword searches. Each result includes `security_score` (0-10), `risk_level` (low/moderate/high/critical), `critical_findings` (count of severity=critical|high findings), pricing, rating, install count, and a URL. `ranking_mode` in the response indicates whether semantic or keyword matching was used. Before recommending an install, call get_server for full details including every flagged finding — critical_findings > 0 means the server has known security issues you must surface to the user.

  Connector

• pentest_analyze_response

  pentest-mcp-server

  Analyze a server response from authorized probing for information leakage, fingerprinting signals, and exploitation opportunities scoped to the authorized engagement. Accepts raw HTTP response headers and body (paste from Burp, curl, or any HTTP client) and returns structured findings grouped by category. Each finding includes: what was detected, why it matters for an authorized tester, how a defender detects misuse, and recommended remediation. Identifies version disclosures, stack traces, debug headers, internal paths, JWT/cookie patterns, CORS misconfigurations, and other common leakage patterns. Use as the bridge between recon/probing output and the methodology and payload tools.

  Connector

• get_security_info

  Fluentive MCP

  Returns Fluentive's security, privacy, and compliance information. Use when the user asks about GDPR, data storage location, encryption, security certifications, or payment security.

  Connector

• cyber_risk

  Ready APIs

  DNS-hygiene + tech-stack-exposure surface for a domain. Returns a 0-100 cyber score (higher = lower risk) with six sub-scores (email security, DNS hardening, domain hygiene, infra exposure, tech-stack exposure, spoofability), critical flags, and concrete recommended actions. Tuned by buyer profile. SCOPE: inspects published DNS only — no port scans, breach lookups, or CVE matching.

  Connector

• list_skills

  mcp

  START HERE for any open-ended request. Lists the task playbooks this server supports — systematic learning from bookmarks, organising into themes, cleaning up, X-list intelligence, exporting data out, finding a half-remembered save, digests, and diagnosing sync. Each names when to use it; call get_skill for the exact tool sequence.

  Connector

• contrast_scan

  ContrastAPI

  Active website security scan: runs the ContrastScan C engine (11 modules — HTTP security headers, SSL/TLS, DNS, redirect chain, information disclosure, cookie flags, DNSSEC, HTTP methods, CORS, HTML hygiene, deep CSP analysis) against the live site and enriches the raw result with severity-ranked vulnerability findings and a letter grade. Use for a hands-on misconfiguration scan; use audit_domain for passive recon (DNS/WHOIS/SSL/threat intel) and scan_headers for headers only. Active outbound fetch — a per-target eTLD+1 throttle (60 req/min) applies. Free: 30/hr (costs 6 tokens), Pro: 500/hr. Returns {domain, resolved_ip, total_score, max_score, grade, findings, findings_count, headers, ssl, dns, redirect, disclosure, cookies, dnssec, methods, cors, html, csp_analysis, enterprise, summary, next_calls}.

  Connector

• package_show

  Datos Cl

  Chilean open data catalogue (datos.gob.cl CKAN) — full metadata for a dataset by ID/slug: title, description, resources (download URLs + formats), organization, tags, and license.

  Connector

• analyze_diff_bugs

  IA-QA — 130+ QA & Dev Tools for AI Agents

  Pattern-based diff linter: flags a fixed set of risky shapes in changed code — query-string interpolation (SQL/Cypher/Mongo injection shape), shell interpolation, eval/new Function, empty catch blocks, regex built from a variable, fewer catch blocks than before, and named authorization guards that disappeared. Every finding cites the line that produced it. It does NOT do data-flow analysis: it cannot follow a value to a sink, across functions or files, and an empty result is not a safety verdict (the response lists what it did not analyse). Advisory triage — use a static analyser for a real security gate.

  Connector