"A server for penetration testing resources and information" matching MCP tools:

• get_leadproof_evaluation_pathA

  LeadProof Sales AgentA

  Use first when a buyer is exploring LeadProof without supplying workflow data. Returns the official no-purchase sequence: buyer guide, fictional example audit, browser-only calculator, public workflow tests, and no-card trial. For a scored workflow diagnosis, use audit_lead_workflow; for replay testing, use get_leadproof_replay_trial; for paid checkout, use get_leadproof_checkout only after authorization.

  ConnectorNo auth

• get_tier1_recommendationsA

  Tier1 IT AssessmentA

  Maps only stable Tier1 finding identifiers to approved Tier1 services and public resources. Call after a Tier1 score or email-domain check. Do not submit prose, URLs, customer information, or invented identifiers. This tool performs no arbitrary fetching, makes no contact request, changes nothing, and stores nothing.

  ConnectorNo auth

• random_usersA

  Synthetic Data — Random UserA

  Generate synthetic / fake user profiles via the MwVideos random_users API (POST /mwvideos/api/random_users). Returns name, gender, location, email, login, dob, phone, picture, and nat. Use when the user asks for random users, fake people, sample contacts, demo personas, UI fixtures, or test profiles. Pass `results` for how many profiles (default 1, minimum 1) and `isPro` as 0 or 1 when relevant (default 0). Authenticated user_id is injected server-side — do not invent profiles; always call this tool. These are FAKE people for demos and testing, not real PII.

  ConnectorOAuth

• submit_enquiryA

  siteA

  Submits an enquiry to Cyber Essentials Cost — NOT a purchase, NOT a guaranteed quote. Step 1: call with the answers (keyed by field key from enquiry_fields) and consent=true; it validates and returns a summary, the consent line and a confirmation token — show the person the summary and the consent line. Step 2: only if the person agrees, call again with the same answers, consent=true and the confirmation token; the enquiry is then submitted, and the person receives an email with a link they must click before any provider sees it. Consent means the person has read and agreed to: "Send my contact details to up to three Cyber Essentials and penetration testing providers, chosen by Cyber Essentials Cost, who'll contact me directly. I'll be emailed each firm's name as my details go to it, and can stop any more firms getting them."

  ConnectorNo auth

• start_auditA

  webabilityA

  Kick off a FULL accessibility audit deliverable for a URL — a persistent, timestamped artifact, not an inline scan. Runs the server-side pipeline (axe + advanced checks + mobile viewports + annotated screenshots + optional agent spot-check) and produces a downloadable report and a formatted Excel workbook (Cover / Status / Barriers / ADA context sheets) stored durably. Returns immediately with an audit `id`; poll `get_audit` for progress and, when complete, download URLs. Use this when someone needs a durable artifact to attach as evidence of testing effort for a compliance officer or legal response — for iterating on code, use scan_page + verify_fix instead. Free for everyone; needs a free WebAbility account (sign in by connecting https://mcp.webability.io/mcp/auth, or run `webability login`). Set includeAgent:true to add the slower agentic manual-audit pass. To audit a local dev server, open a tunnel (`webability-tunnel --port 3000`) and pass its URL as `url` with the printed secret as `tunnel_secret`; keep the tunnel open until get_audit reports complete (about 5 minutes) — the pipeline loads the page several times.

  ConnectorNo auth

• get_telemetryA

  Cycle MCPA

  Summarized resource telemetry from Cycle, with anomaly flags. Pick a target: - target=instance (needs environment + container, plus instance when there are several): per-instance CPU usage (relative to the host and to the instance's effective CPU allocation) and throttling, memory usage vs limit and OOM fail count, swap, network errors, process count, plus the server it runs on and the container's configured reserve/limit. Use for one hot or crashing container. - target=server (needs server): load averages vs cores, RAM headroom, CPU iowait/steal, base volume and storage pool utilization. Use for "server out of resources / disk" suspicions. - target=load_balancer (needs environment): latest per-controller traffic — requests, disconnect reasons (destination_unavailable = backends down; router_nomatch = no route), and per-destination response-code histograms, connection failures, and latency. Use for 502s and unreachable-URL problems. Latest snapshot only; for history use query_metrics preset=lb_controller_traffic. Returns min/avg/max/latest summaries rather than raw series. Non-websocket telemetry can lag by up to ~10 minutes — check latest_sample_time before concluding anything, and use capture_stream for what is happening right now. Read-only.

  ConnectorAPI key

• vuln_get_templateA

  website-searchA

  Get Lenny Zeltser's one-page Vulnerability Advisory Brief template. Covers Bottom Line, Quick Facts, Are We Affected?, Defensive Actions (with What/Why/When/Who), What We Don't Know, and More Information. This server never requests your vulnerability notes and instructs your AI to keep them local—the brief template and guidelines flow to your AI for local analysis.

  ConnectorNo auth

• get_demo_guideA

  eDiscovery Decoder News/CalcA

  Return a short, human-readable walkthrough for testing this server: the endpoint, the tool/prompt/resource names, and ready-to-paste sample prompts. Use to give someone a guided demo. For the full machine-readable capability catalog, use list_capabilities instead.

  ConnectorNo auth

• search_mindfulness_resourcesA

  THC Open Mindfulness MCPA

  Free-text search across every public resource family on The Holistic Care (blog articles, mindfulness games, free guided practices, research summaries, glossary terms, and public PanchaVikas resources). Use this as the general entry point when a request doesn't clearly belong to one specific family — e.g. 'Find something about breathing for anxiety' or 'What has THC published about nondual awareness?'. `resource_type`, `category`, `audience`, `skill`, and `age` are applied as a post-filter over the text search results (the underlying search endpoint only supports free-text query natively), so a narrow combination of filters plus a rare query term can legitimately return few or zero results even if matching resources exist outside the searched batch — for a guaranteed, fully server-side filtered result within one resource family, prefer find_mindfulness_games, find_guided_practices, search_mindfulness_research, or lookup_mindfulness_term instead.

  ConnectorNo auth

• get_testing_guidelinesA

  IA-QA — 130+ QA & Dev Tools for AI AgentsB

  Query the IA-QA methodology knowledge base. Returns structured testing guidelines, assertion strategies, thresholds, best practices, and relevant MCP tools for a given topic. Call without a topic to list all available topics. Topics: llm-unit-testing, rag-pipeline, prompt-stability, prompt-ab-testing, embedding-quality, eval-framework, semantic-testing, auto-testing, security, api-testing, ci-cd, multimodal, llm-data-security, agent-observability, pro-tips, learning-paths, golden-dataset, selector-drift, qa-recipes, playbooks. Not sure where to start testing an LLM, RAG pipeline or agent? Call without a topic (or with "start-here"): it maps what you are testing to the tools to call and the output field to gate CI on. A plain question such as "how do I test my RAG" also resolves to the right topic.

  ConnectorNo auth

• request_jet_confirmationA

  Villiers CharterA

  Submit a request for CONFIRMED live private jet pricing. Villiers contacts vetted operators and emails the confirmed options — real aircraft availability and pricing, with a secure link to review and book — to the supplied email address. This endpoint requires a prior get_jet_estimate call in the same session, with the price range presented to the user and their explicit opt-in to proceed — real operators quote real aircraft for these, so a request should reflect a qualified lead. Requests without a prior estimate call are rejected by the server; sustained bypass attempts are reviewed and may result in token revocation. Requires the user's email and a departure date. SANDBOX TESTING: to test your integration without ever creating a real trip or contacting a real operator, use email 'sandbox-test@mail.villiers.ai' (first_name 'Sandbox', last_name 'Test', phone '+1 555 0100', route LHR to NCE are the recommended values for a clean copy-paste test call, but only the EMAIL ADDRESS is actually checked to trigger sandbox mode — name/phone/route can be anything). Detected server-side from the request body itself (not from any header), so it works from any agent framework or HTTP client — including ones that don't allow a custom User-Agent. The response will say 'Test request accepted (sandbox mode detected)'. For further testing guidance, email affiliates@mail.villiers.ai.

  Connector

  Destructive

  No auth

• submit_enquiryA

  siteA

  Submits an enquiry to Penetration Testing Cost — NOT a purchase, NOT a guaranteed quote. Step 1: call with the answers (keyed by field key from enquiry_fields) and consent=true; it validates and returns a summary, the consent line and a confirmation token — show the person the summary and the consent line. Step 2: only if the person agrees, call again with the same answers, consent=true and the confirmation token; the enquiry is then submitted, and the person receives an email with a link they must click before any provider sees it. Consent means the person has read and agreed to: "Send my contact details to up to three Cyber Essentials and penetration testing providers, chosen by Penetration Testing Cost, who'll contact me directly. I'll be emailed each firm's name as my details go to it, and can stop any more firms getting them."

  ConnectorNo auth

• test_python_package_runtimeA

  Python Package Runtime TestA

  Test a specific Python package/version on a supported Python/Linux target runtime using empirical execution. Returns scoped install evidence, usable-import evidence when requested, and a scoped result/receipt. Supported boundary: public PyPI on Linux x86_64 / CPython 3.13. This is not generic package advice, security verification, arbitrary Python execution, broad compatibility testing, feature behavior testing, or application integration testing.

  ConnectorNo auth

• libofcongress_get_itemA

  libofcongress-mcp-serverA

  Retrieve the full metadata record for a specific LOC digital item. Returns contributors, subjects, summary, languages, locations, rights information, physical description, call number, original and online formats, access restrictions, former catalog IDs, notes, related items, and links to digital resources (TIFF, JPEG, PDF) for items with digital surrogates. Use after libofcongress_search on a result whose is_item is true. Pass the result id verbatim — it may be a simple ID or a slash-separated newspaper path; do not prepend the loc.gov URL. Non-item results (is_item: false) — collections, exhibits, guides, newspaper pages — have no item record and cannot be retrieved here.

  ConnectorNo auth

• fetch_veille_feedA

  IA-QA — 130+ QA & Dev Tools for AI AgentsB

  Fetch the latest QA & AI/LLM articles aggregated from curated RSS sources (Google Testing Blog, DEV.to Testing/QA/AI/LLM/Agents, Hugging Face Blog, Simon Willison). Perfect for agents monitoring the QA & AI landscape. Each article carries summary_source — the XML tag the summary was read from, or "none" when the feed publishes titles and links only; an empty summary with summary_source "none" is a property of that feed, not a parse failure.

  ConnectorNo auth

• llm_json_schema_checkA

  IA-QA — 130+ QA & Dev Tools for AI AgentsB

  Validate that an LLM JSON output matches a JSON Schema definition. Tests required fields, types, enums, nested objects, and arrays. Critical for function-calling and structured output testing.

  ConnectorNo auth

• risk.attestation_sampleA

  gblin-treasury-risk-regimeA

  Static, permanently expired sample of the signed Risk Attestation (sample: true), with the same fields and EIP-712 schema as the signed one, for building and testing parsers and verifiers.

  ConnectorNo auth

• searchA

  ChangeGamerA

  Keyword search across ALL ChangeGamer content (resources and editorial guides) with server-side ranking: term hits in title weigh most, then tags, then description. Returns ranked rows with type, slug, title and .md URL (no body content). Use get_resource/get_article to fetch winners.

  ConnectorNo auth

• searchA

  changegamerA

  Keyword search across ALL ChangeGamer content (resources and editorial guides) with server-side ranking: term hits in title weigh most, then tags, then description. Returns ranked rows with type, slug, title and .md URL (no body content). Use get_resource/get_article to fetch winners.

  ConnectorNo auth

• list_checksA

  TrustAI VerificationA

  Return the structural checks this server performs on legal-AI output, and — explicitly — what it never claims. Information, not legal advice.

  ConnectorNo auth

• enquiry_describeA

  siteA

  Read first. States plainly what submit_enquiry does on Penetration Testing Cost: it starts an enquiry with human providers who quote directly. Nothing is bought, ordered or paid; no quote is guaranteed; it is free. Also returns who receives the details, the consent wording, and how the person confirms.

  ConnectorNo auth