"A server for finding information about Checkmarx application security testing software" matching MCP tools:

• migrate_to_propelauth_fullstack

  PropelAuth Integration MCP Server

  Returns instructions for migrating from an existing auth provider to PropelAuth in a fullstack Nextjs App Router or Nextjs Pages Router application. If the user is using Next.js as just a frontend (e.g. client-side rendered with or without server routes), use the migrate_to_propelauth_frontend tool. Guidance includes installation and configuration, retrieving user or org information, logging users out, redirecting users to login, and more. Make sure to use the 'Installation' guidance first. It is important to call every guidance to ensure a successful integration. Do not update a component/hook/etc from the auth provider until you receive guidance about that component/hook/etc

  Connector

• tide_blast_radius

  Raziel

  Run a Blast Radius Assessment of an EXISTING app: an adversarial, vendor-neutral map of where authority is concentrated to a single point (whoever obtains that one thing obtains everything it governs), scored by blast radius (Total/Systemic/Contained/Limited) across three cores — Identity, Governance, Access — and delivered as a director-facing PDF. Phase 1 names no vendor; an opt-in Phase 2 companion explains how TideCloak shrinks each blast radius. Use this when the user wants to 'assess', 'red team', 'threat model', 'find the security gaps in', or make a before/after security case for an existing application.

  Connector

• get_corpus_coverage

  SRI — MCP Server Inspector

  No arguments. Returns how many MCP servers have been read at source level, and the share of them with each category of finding (credential access, network egress, install-time execution, prompt-injection surface). Use this to judge whether checking a specific server is worth it before you look one up. It reports aggregate counts only - no per-server findings, and no verdict about any individual server.

  Connector

• vulnerability_info

  ZEN SecDB

  Get detailed information about a specific CVE. ## What this tool does Retrieves the full vulnerability record for a CVE from SecDB, including: - official description and summary - CVSS metrics (all versions available) - EPSS metadata (if present) - affected products and versions - vendor/security advisories - references and upstream sources - weakness classification (CWE) - exploit and patch information (if included in the record) All information is returned in a structured Markdown format suitable for direct display. ## When to use this tool Use this tool when the user asks: - "Give me details about CVE-XYZ." - "Which products are affected by this vulnerability?" - "Show me advisories or references for this CVE." - "Explain what this vulnerability is and how serious it is." This tool is ideal for **deep inspection of a single vulnerability**. For multiple CVEs, call the tool once per CVE. ## Inputs - **cve_id**: valid CVE identifier (`CVE-YYYY-NNNNN`). ## Outputs Markdown-formatted vulnerability information including: - detailed description - severity metrics (CVSS, vectors) - affected products list - advisory list - references - weakness (CWE) details - additional structured metadata from SecDB ## LLM usage guidelines - Always prefer this tool when the user needs factual information about a specific CVE. - If multiple CVEs are mentioned, call the tool once per CVE. - Combine with: - **`vulnerability_score`** - to enrich output with numerical CVSS/EPSS metrics - **`sightings_search`** - to check real-world exploitation, PoCs, plugins, advisories - **`ssvc_calculator`** - to compute prioritization based on the vulnerability data - Do not hallucinate product lists, advisories, or details—use what the tool returns.

  Connector

• get_security_evidence

  turva-mcp

  Returns the latest public web-security scan results for turva.dev's own domain (Hardenize, Internet.nl), with the scan date. Use this when a user asks about turva.dev's own security posture or wants evidence beyond agent-readiness scores. Read-only: returns static JSON and changes nothing.

  Connector

• get_loan_application_fields

  IncredibleFi — Personal Loan Marketplace

  Get the loan application form fields, their types, allowed values, and validation rules. Call this first to understand what information is needed to submit a loan application.

  Connector

• security_headers_check

  IA-QA — 130+ QA & Dev Tools for AI Agents

  Analyse the HTTP security headers of a public URL OR of raw response headers you paste in. Grades each header (A–F) for: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, X-XSS-Protection, Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy, and Cross-Origin-Embedder-Policy. Returns an overall score (0–100), per-header grades, missing headers, and fix snippets for Express, Nginx, and Apache. For localhost/private targets the remote server cannot reach, pass the `headers` parameter instead of `url`.

  Connector

• get_demo_guide

  eDiscovery Decoder News/Calc

  Return a short, human-readable walkthrough for testing this server: the endpoint, the tool/prompt/resource names, and ready-to-paste sample prompts. Use to give someone a guided demo. For the full machine-readable capability catalog, use list_capabilities instead.

  Connector

• get_security_info

  Fluentive MCP

  Returns Fluentive's security, privacy, and compliance information. Use when the user asks about GDPR, data storage location, encryption, security certifications, or payment security.

  Connector

• get_solution_detail

  Tuki — Travel Marketplace (Chile y Latinoamérica)

  Get full detail for a Tuki solution: description, who it is for, capabilities, status and contact / CTA. Use after `list_solutions` or when the user asks about a specific Tuki product (WhatsApp Booking OS, boutique ticketing, rental inventory software, event post-sale, tailor-made tourism software).

  Connector

• mesh-audit-external-posture

  MeshMarket

  Mesh Audit — External Posture — Consent-gated, READ-ONLY external posture report — informational only, not a formal audit or warranty. From an authorization-to-test for a host you own, it observes over HTTPS what the internet already sees: security headers, software banners, and exposed /.env //.git/admin surfaces. Always names what it did NOT check; internal targets refused. Input: {consent_id, asset} via /api/audit/consent. (6 MESH/call, a tool · audit)

  Connector

• g2_reviews

  review-intelligence-mcp-server

  Get G2 software reviews. Returns ratings, pros, cons, use cases. Args: product: Software product name (e.g. 'Salesforce') max_results: Max reviews (default 20)

  Connector

• search_occupations

  O*NET Occupational Data

  Search O*NET occupations by keyword. Returns a list of occupations matching the keyword with their SOC codes, titles, and relevance scores. Use the SOC code from results with other O*NET tools to get detailed information. Args: keyword: Search term (e.g. 'software developer', 'nurse', 'electrician'). limit: Maximum number of results to return (default 25).

  Connector

• ios_set_location

  Robot Actions — Remote Device Control

  Set the iOS device's GPS location for testing location-aware apps. Works on physical devices (iOS 16.4+) via the bundled iOS automation agent's simulated-location route. Coordinates persist until the device reboots or ios_clear_location is called. PREREQ: On the device, grant the iOS automation agent app Location Services permission (Settings → Privacy & Security → Location Services → automation runner → While Using App). Without this, the simulated value is cached server-side but apps on the device still see zero coordinates. SCOPE: only affects apps that read CoreLocation (CLLocationManager, Safari navigator.geolocation). Does NOT affect apps using IP-based geolocation, Wi-Fi/cell-tower triangulation, or anti-fraud detection paths.

  Connector

• guides.list

  AI Design Blueprint

  List application guides that show how Blueprint principles apply to engineering challenges (security, evaluation, observability, etc.). Use this to discover which guides exist before drilling in. Prefer guides.search when the user describes a topic or failure mode in natural language. Prefer guides.get when you already know the guide slug and need full detail.

  Connector

• guides.get

  AI Design Blueprint

  Get a full application guide by its stable slug (e.g. 'security-application', 'observable-evaluation'). Returns sections, action items, and linked principles. Use this when you already have the guide slug from guides.list or guides.search. Prefer guides.search when the user describes a topic in natural language; prefer guides.list when you need the full inventory.

  Connector

• adw.adw_339

  AlpineDataWorks Intelligence Server

  Returns a 0-100 software supply-chain vulnerability pressure index (per-package CVSS3 sums over recent npm and PyPI GA releases via deps.dev, max-normalized, basket mean) with weekly history, top_drivers identifying pressure-driving packages, and audit-ready source lineage. Call when the user asks about open-source dependency risk, CVE/CVSS severity trends, npm or PyPI package security, or supply-chain attacks, or when timing dependency upgrades, patch prioritization, or deployment gating. Updates: weekly.

  Connector

• scan_url

  Opzyai Vibe Check

  Scan a live URL for leaked API keys, exposed config files and missing security headers. Returns a Launch Readiness score (0-100) and a paste-ready fix for each finding. Use before deploying, or when checking the security of an app built with AI coding tools like Cursor, Lovable, v0 or Bolt.

  Connector

• health_check

  qorenext-mcp

  Check MCP server health status. Verify this server is operational and get basic server information (name, version, auth method). Use for connectivity testing and diagnostics. No authentication required.

  Connector

• assessment_get_cross_server_routes

  website-search

  Get Lenny Zeltser's Security Assessment cross-server handoff routes — when this MCP server can't fulfill a request, which other MCP servers (or fallback workflows) to consult. Surfaces a compact subset of `assessment_load_context`. This server never requests your assessment notes or report and instructs your AI to keep them local—the templates and guidelines flow to your AI for local analysis.

  Connector