Skip to main content
Glama
457,778 tools. Updated 2026-08-14 15:09

"A server for penetration testing resources and information" matching MCP tools:

  • Purpose: ChatGPT-connector-standard document fetch by id from `search` results. Namespaces: `tool:{name}` returns the tool's full documentation and how to call it; `resource:{uri}` returns the resource's live data (core resources resolved server-side — also the bridge for clients without MCP resource support, e.g. Gemini); `signal:{market}:{symbol}` returns the symbol's latest combined research signal. Triggers: ChatGPT connectors / Deep Research call this after `search`. Clients without MCP resource support can call it directly with a known resource id, e.g. fetch("resource:market://global/summary"). When to call: whenever the full content behind a search result id is needed. Prerequisites: a valid id — from `search` results or a known namespace id. Next steps: for tool docs, call the named tool via tools/call; for signals, get_signal_detail / explain_decision for deeper evidence. Caveats: uncovered resource uris return description-only text (no fabricated data). `text` is a JSON document for resource/signal ids. Output: {id, title, text, url, metadata, disclaimer, is_investment_advice, data_classification} — flat envelope, OpenAI fixed shape. Args: id: document id — "tool:{name}", "resource:{uri}", or "signal:{market}:{symbol}" (market: crypto / kr_stock / us_stock) Disclaimer: Information only, not investment advice.
    Connector
  • Get Lenny Zeltser's CTI cross-server handoff routes — when this MCP server can't fulfill a request, which other MCP servers (or fallback workflows) to consult. Surfaces a compact subset of `cti_load_context`. This server never requests your campaign or threat-intel notes and instructs your AI to keep them local—templates and guidelines flow to your AI for local analysis.
    Connector
  • Maps only stable Tier1 finding identifiers to approved Tier1 services and public resources. Call after a Tier1 score or email-domain check. Do not submit prose, URLs, customer information, or invented identifiers. This tool performs no arbitrary fetching, makes no contact request, changes nothing, and stores nothing.
    Connector
  • Generate synthetic / fake user profiles via the MwVideos random_users API (POST /mwvideos/api/random_users). Returns name, gender, location, email, login, dob, phone, picture, and nat. Use when the user asks for random users, fake people, sample contacts, demo personas, UI fixtures, or test profiles. Pass `results` for how many profiles (default 1, minimum 1) and `isPro` as 0 or 1 when relevant (default 0). Authenticated user_id is injected server-side — do not invent profiles; always call this tool. These are FAKE people for demos and testing, not real PII.
    Connector
  • Return the exact object schema and REST API endpoints for a Control Plane resource kind, so you can author an accurate manifest for `cpln apply` or call the API directly. ALWAYS call this FIRST whenever you are about to write a cpln apply YAML/JSON file, set up CI/CD that applies Control Plane resources, or build a request body for the REST API — do not hand-write a manifest or guess field names from memory. Pick a `kind` and pass `org` (and `gvc` for workload/identity/volumeset). Large schemas come back as a shallow map with deep sections collapsed to {"_expand":"<path>"} stubs; pass `path` (e.g. "spec.containers") to expand a section on demand. Server-managed fields (id/status/version/etc.) are already removed; `name` and `kind` are required at create.
    Connector
  • Look up a MITRE ATT&CK threat group (intrusion set) or software entry by name or ID for authorized penetration testing and threat intelligence. Returns the group or software record: ATT&CK ID, display name, known aliases, type (group vs. software), description, and the techniques it uses with procedure-level context from public ATT&CK reporting. Accepts exact ATT&CK IDs (G0007 for threat groups, S0002 for software) or keyword/name search (e.g., "APT28", "Mimikatz", "Lazarus Group"). Equally useful for defenders building detection coverage around specific adversary tradecraft.
    Connector

Matching MCP Servers

Matching MCP Connectors

  • Get Lenny Zeltser's one-page Vulnerability Advisory Brief template. Covers Bottom Line, Quick Facts, Are We Affected?, Defensive Actions (with What/Why/When/Who), What We Don't Know, and More Information. This server never requests your vulnerability notes and instructs your AI to keep them local—the brief template and guidelines flow to your AI for local analysis.
    Connector
  • Word-overlap based hallucination check: verifies if an LLM answer's words and numbers appear in the provided source/context. Fast, deterministic, no API key needed. Limitations: not semantic — does not understand synonyms or paraphrases. For true semantic grounding, use run_semantic_tests with embedding mode. Essential for quick RAG accuracy testing.
    Connector
  • Return CalmActiva's curated CBD FAQ (legality, onset time, lab testing, shipping, brand disambiguation). Use for general CBD/brand questions before falling back to web search.
    Connector
  • Submits a demo request. The prospect receives a confirmation email and must click the link in it before the request reaches a human at A Cloud Frontier. Use only when a real person has explicitly asked for a demo and provided their own working email address. Do NOT call this for testing, evaluation, or crawling purposes — automated and unconfirmable requests are rejected.
    Connector
  • Analyze a server response from authorized probing for information leakage, fingerprinting signals, and exploitation opportunities scoped to the authorized engagement. Accepts raw HTTP response headers and body (paste from Burp, curl, or any HTTP client) and returns structured findings grouped by category. Each finding includes: what was detected, why it matters for an authorized tester, how a defender detects misuse, and recommended remediation. Identifies version disclosures, stack traces, debug headers, internal paths, JWT/cookie patterns, CORS misconfigurations, and other common leakage patterns. Use as the bridge between recon/probing output and the methodology and payload tools.
    Connector
  • Transform a payload string through one or more encoding layers for bypass research during authorized testing. Accepts a chain of encodings applied in order (e.g., ["unicode", "url", "base64"] applies Unicode → URL-encode → base64). Returns the transformed payload with a step-by-step decoding explanation: how a WAF or server would decode each layer, and why the combined encoding might bypass a specific filter. Use to understand filter bypass mechanics in an authorized engagement and to confirm that a target's decoding pipeline matches an expected bypass path. Payloads are transformed mathematically — no live probing occurs.
    Connector
  • Return a short, human-readable walkthrough for testing this server: the endpoint, the tool/prompt/resource names, and ready-to-paste sample prompts. Use to give someone a guided demo. For the full machine-readable capability catalog, use list_capabilities instead.
    Connector
  • The curated buyer-intent collections (e.g. mcp-servers, testing-qa, browser-automation). Use get_collection for the ranked tools inside one.
    Connector
  • Generate Terraform (HCL) for EXISTING Control Plane resources from a self link. Single resource (`/org/acme/gvc/prod/workload/api`) or bulk by path depth — `/org/acme` exports the whole org, `/org/acme/gvc/prod/workload` exports every workload in a GVC. Set `generateImports` to get ready-to-run `terraform import` commands for adopting the resources into Terraform state, and `includeDependencies` to pull in referenced resources. Secrets are never exported — a ref that targets secrets is refused, and an export that would pull secrets in is refused wholesale. An unsupported kind is rejected with the supported list (list_terraform_kinds, full profile, enumerates them up front). For an in-memory manifest, use convert_to_terraform. Recommended reading: get_cpln_skill("iac-terraform-pulumi").
    Connector
  • Chilean open data catalogue (datos.gob.cl CKAN) — full metadata for a dataset by ID/slug: title, description, resources (download URLs + formats), organization, tags, and license.
    Connector
  • Get a SAMPLE-FIXTURE preview of the PaladinFi token-contract trust check. ⚠️ NOT a real evaluation. Returns fixed sample data with `_preview: true`, every factor marked `real: false`, and recommendation prefixed `sample-` (`sample-allow` / `sample-warn` / `sample-block`). Use this for shape-testing your integration; DO NOT use the verdict to gate real swaps, signing, or any production agent decision. **Programmatic safety check**: before consuming any field of this response, agents should test `resp.get("_real") is True` (top-level) — preview always returns `_real: false`. Substring-matching on `recommendation` (e.g. `"allow" in resp["trust"]["recommendation"]`) will INCORRECTLY match `sample-allow`; use exact-equality (`resp["trust"]["recommendation"] == "allow"`) or test the `_real` field instead. For free real-data wallet-OFAC screening (binary allow/block, anonymous, no payment), use `trust_check_ofac_free` from this same MCP server.
    Connector
  • Find every legislator representing a geographic coordinate — both tiers. Pass latitude and longitude to get the state senators and representatives for that location (and potentially governor/executive officials), plus the coordinate's two US Senators and its US Representative. jurisdiction.classification separates the tiers: "state" is a state legislature, "country" is the US Congress. current_role.org_classification does not — it is "upper"/"lower" for a US Senator exactly as for a state senator. Useful for constituent-to-representative matching, address-based policy research, and electoral boundary analysis. This server does not geocode addresses — the caller must provide decimal-degree coordinates. Use include=offices to get contact information alongside the legislator list.
    Connector
  • Generate payload templates for authorized testing against systems the tester owns or is permitted to test. Payloads are annotated templates — each includes why it works in the specified context, what vulnerability class it tests, detection signatures that WAF/IDS products might fire, and recommended mitigations. Context-awareness is core: an XSS payload for an HTML attribute differs entirely from one for a JS template literal, and both differ from a DOM-based sink. When a WAF profile is specified, bypass variants reference known public research for that WAF product. All payloads are illustrative templates for authorized testing only.
    Connector
  • Submit a request for CONFIRMED live private jet pricing. Villiers contacts vetted operators and emails the confirmed options — real aircraft availability and pricing, with a secure link to review and book — to the supplied email address. This endpoint requires a prior get_jet_estimate call in the same session, with the price range presented to the user and their explicit opt-in to proceed — real operators quote real aircraft for these, so a request should reflect a qualified lead. Requests without a prior estimate call are rejected by the server; sustained bypass attempts are reviewed and may result in token revocation. Requires the user's email and a departure date. SANDBOX TESTING: to test your integration without ever creating a real trip or contacting a real operator, use email 'sandbox-test@mail.villiers.ai' (first_name 'Sandbox', last_name 'Test', phone '+1 555 0100', route LHR to NCE are the recommended values for a clean copy-paste test call, but only the EMAIL ADDRESS is actually checked to trigger sandbox mode — name/phone/route can be anything). Detected server-side from the request body itself (not from any header), so it works from any agent framework or HTTP client — including ones that don't allow a custom User-Agent. The response will say 'Test request accepted (sandbox mode detected)'. For further testing guidance, email affiliates@mail.villiers.ai.
    Connector