Skip to main content
Glama
510,486 tools. Updated 2026-09-04 06:48

"A server that scans projects for security vulnerabilities and recommends fixes" matching MCP tools:

  • Scans an MCP server manifest or endpoint for security vulnerabilities — prompt injection in tool descriptions, exfiltration vectors, unbounded resource access, privilege escalation, schema mismatches, transport security issues, and over-permissive scopes. Returns a structured risk report with severity levels and remediation guidance.
    Connector
  • Scans for security vulnerabilities - hardcoded passwords in HTML, exposed API keys, missing TLS, missing rate limiting, exposed bot tokens, and insecure file permissions.
    Connector
  • Run an OWASP-oriented security pass over a source file. PREMIUM (license). Checks injection sinks, auth/session handling, crypto misuse, SSRF/deserialization, and unsafe file/path handling — each finding cites the line, the OWASP risk class, and a concrete fix direction. Typical input {"code": "<file contents>"} returns {"issues": N, "findings": [{"line": N, "class": "A03 Injection", "fix": "...", "code": "..."}], "owasp_note": "..."}. Use on one source file when vulnerabilities are the question. Not for style or structure (complexity_report), and never a substitute for a security professional on high-risk code. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.
    Connector
  • Get Lenny Zeltser's Security Assessment one-page executive brief template. Standalone variant of `assessment_get_template` for callers that only want the brief without the long-form report. This server never requests your assessment notes or report and instructs your AI to keep them local—the templates and guidelines flow to your AI for local analysis.
    Connector
  • Known vulnerabilities (CVE / GHSA / PYSEC / GO advisories) for a package, via OSV.dev. Pass version to filter to advisories affecting that exact version, or omit it for the package's full advisory history. Each result carries the OSV id, cross-id aliases, a severity word grade (LOW|MODERATE|HIGH|CRITICAL), the cvss vector string, affectedRanges with fixed-version events, references, and cwes. A clean package returns count: 0 with an empty list (not an error). ecosystem is CASE-SENSITIVE — use OSV's spelling (npm, PyPI, Go, crates.io, Maven, NuGet, RubyGems, …). Use scan_vulnerabilities_batch for lockfile batch scans.
    Connector
  • A powerful metrics-based project filtering and sorting tool that works with cryptocurrency assets based on their metrics and allows for ordered, paginated results. The tool allows for filtering assets by a metric and sorting them according to that same metric in ascending or descending metric, or just to sort the assets by a metric without filtering. This tool allows you to discover projects that meet specific criteria by analyzing their metrics over time periods. You can filter projects by absolute values (greater_than/less_than thresholds) or by percentage changes, or just sort projects by some metric. ## When to use vs other metric tools This tool scans the whole asset universe and returns one aggregated value per matching asset — use it for "which assets satisfy X" and "top N by X". It never returns a timeseries: for the values of a metric over time for already-known slugs use `fetch_metric_data_tool`. To check that a metric exists (or fix a mistyped metric/slug) use `metrics_and_assets_discovery_tool`. ## Use Cases - Get top 10 assets by marketcap, sorted in descending order - Get top 50 assets with highest dev_activity_1d - Find assets with price more than $10 - Discover tokens whose price increased by more than 50% in the last 30 days - Screen for projects with market cap less than $100M - Identify assets that have dev_activity_1d decline by more than 20% in the past month ## Examples - Get projects that have a price_usd in the last 24 hours and it's greater_than $500. Get the first 20 ordered by price_usd in descending order `{metric: "price_usd", operator: :greater_than, threshold: 500.0, from: "utc_now-24h", to: "utc_now", sort: "desc, page: 1, page_size: 20}` - Find projects whose price_usd today is 25% higher than 7 days ago, sorted by the highest percent increase in descending order. Get the first 100. `{metric: "price_usd", operator: :percent_up, threshold: 25.0, from: "utc_now-7d", to: "utc_now", sort: "desc", page: 1, page_size: 100}` - Projects with current market cap less_than $50M. Get 100 such projects, ordered by marketcap in descending order. `{metric: "marketcap_usd", operator: :less_than, threshold: 50000000.0, from: "utc_now-1d", to: "utc_now", sort: "desc", page: 1, page_size: 100}` Here is how the filtering works: - For absolute value operators - `greater_than` and `less_than` - fetch the `metric` for each asset in the interval `from`-`to`, aggregting it using the specified `aggregation` method (defaulting to the metric's default). - For percent change operators - `percent_up` and `percent_down` - fetch the `metric` for each asset in the interval `from-`to`, as well as in the same length interval immediately before `from`. The two resulting values are compared to calculate the percentage change. Some metrics like price_usd and marketcap_usd are aggregated with `LAST` aggregation by default, meaning that the last known value in the queried interval is used. For percent change, this means that the tool compares the last known price immediately before `from` and the last known price before `to`. Other metrics like transaction_volume_usd and social_volume_total (and most other volume metrics) are aggregated by default with SUM aggregation, meaning that the total combined sum in the queried interval is used. For these metrics length of the time window is vital. A common mistake is to try to check if the social_total_total for the last 5 minutes is greater_than some threshold. Five minutes is not enough for social volume to accumulate enough. In such scenarios use a longer time window like 1 day or more.
    Connector

Matching MCP Servers

  • F
    license
    Not graded
    quality
    B
    maintenance
    This MCP server provides secure access to databases for AI agents, enforcing authentication, authorization, human approval, logging, and notifications to prevent dangerous actions.
  • A
    license
    Not graded
    quality
    A
    maintenance
    Project management CLI + MCP server for AI agents. Register projects once, open them anywhere, sync to S3, auto-init git, and wire into the hasna ecosystem.
    4,335
    Apache 2.0

Matching MCP Connectors

  • Task tracking built for coding agents. Work is leased, so two agents never take the same SubTask.

  • World Bank Projects & Operations MCP.

  • Lists the projects in this organization, each with its id, name, and framework. Read-only, takes no arguments, and returns only the projects the calling credential may see. Call it first in a session: the returned id is the project_id that every other tool in this server requires, and guessing that id fails. It does not return components, packages, or tokens - use list_components, list_packages, or get_style_tokens for those.
    Connector
  • Report the current moment's performance state for the account this server is configured with: the score right now and whether now is a peak, a dip, or a neutral window. Returns the current score, the window type, a plain-language recommendation, and today's peak and dip times. Meant as a cheap check before an agent recommends, schedules or starts demanding work. Choose this tool for "right now". Use whenpeak_best_window to find a slot later today, and whenpeak_quick_predict when working from sleep the user describes rather than stored history. Requires WHENPEAK_API_KEY on the server and reads that one account's history, so it is only meaningful where the server runs with the user's own key. Without a key it returns a not_configured error rather than failing. Read-only and stores nothing, but each call counts against that account's monthly quota.
    Connector
  • One call that returns a completed audit's SUMMARY, full per-section DETAIL, and deduplicated prioritized FIXES together — so you don't have to chain get_audit → get_audit_detail → get_fixes. Use `expand` to trim the payload ('summary' | 'detail' | 'fixes' | 'all'; default 'all'). Same ownership, tier gating, and sanitization as those tools. For an in-progress audit it returns the status so you can keep polling. The detail layer includes Wave-B surfaced sections (author/E-E-A-T, freshness, images, hreflang, per-bot access, Action microformats, OpenAPI sub-metrics, Google Intelligence, product readability, site maturity, methodology) and Wave-C deterministic signals (content quality, video/locale, USE sub-metrics, trust claims) each with an availability state.
    Connector
  • Analyze a URL for security threats (synchronous, blocks until complete or timeout). Returns risk score, confidence, agent access guidance, and intent_alignment (always not_provided for this tool; use url_scanner_scan_with_intent for intent context). For long-running scans, prefer url_scanner_async_scan which returns immediately with a task_id for polling via url_scanner_async_task_result.
    Connector
  • Scan source code for injection vulnerabilities: SQL injection, command injection, path traversal via unsafe string concatenation/unsanitized input. Supports Python, JavaScript, TypeScript, Java, Go, Ruby, Shell, Bash. Use to detect input-handling bugs; for secrets use check_secrets. Companion code-security tools: check_secrets (hard-coded credential detection), check_dependencies (known-CVE vulnerability audit), check_headers (live HTTP security-header validation), scan_headers (live HTTP scan via domain). Free: 30/hr, Pro: 500/hr. Returns {total, by_severity, findings}. No data stored.
    Connector
  • Produce a deterministic remediation REQUEST bundle (rubric + fix schema + per-finding metadata + fingerprints) for YOU (the host agent) to fix. This tool calls no model and needs no key. For each finding, propose the corrected FULL file content, then VERIFY with verify_fix and keep only fixes that clear the finding. Never touch files with secrets; never auto-merge. Pass 'findings' from scan_path --format json.
    Connector
  • Get your agent's real mailing address beta endpoint when the account has explicit beta access: street address + mailbox number for approved accounts. For generally available inbound context, use list_inbound_forwarding_addresses instead; that returns a private intake alias for scans, PDFs, photos, provider notices, and notes from addresses the operator already uses.
    Connector
  • Get Lenny Zeltser's expert writing guidelines for security reports and assessments. Provides guidance on tone, structure, clarity, executive summaries, and avoiding common writing mistakes. Includes rating-sheet items (the four lens sheets: structure, look, words, tone) as concrete reference points for grounded feedback. Works for any security document. This server never requests your documents and instructs your AI to keep them local—guidelines flow to your AI for local analysis. Note: For incident response reports specifically, use the ir_* tools which provide deeper section-by-section review criteria.
    Connector
  • Search NVD for CVE vulnerabilities by product or component name. Returns CVE ID, description, severity, and CVSS score. Search terms are matched against CVE description text and EVERY word must appear, so pass the product name ("OpenSSL", "log4j", "nginx") optionally with a technical term ("buffer overflow") — not a plain-English question. Use when researching security threats or checking if a known vulnerability affects your systems.
    Connector
  • Pre-flight security verdict for an MCP server invocation. Judges BOTH server-level reputation AND the server's dependency graph (npm/pypi) against the DugganUSA threat-intel corpus (1.13M+ IOCs, Shai-Hulud + typosquat + LOLBin families). Returns BLOCK / ADVISORY / REVIEW / ALLOW with severity, evidence, dep-graph summary, and HMAC-signed response. REVIEW means we hold NO RECORD of this server -- not that it is safe. Treat REVIEW as do-not-proceed-blindly: a brand-new attacker-published server looks exactly like this. ALLOW is only returned when we actually resolved the server and scanned its dependency graph; check known_to_us and dep_graph.scanned to confirm. Use this BEFORE invoking any other MCP server tool, especially ones installed from outside the official MCP Registry.
    Connector
  • Analyse the HTTP security headers of a public URL OR of raw response headers you paste in. Grades each header (A–F) for: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, X-XSS-Protection, Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy, and Cross-Origin-Embedder-Policy. Returns an overall score (0–100), per-header grades, missing headers, and fix snippets for Express, Nginx, and Apache. For localhost/private targets the remote server cannot reach, pass the `headers` parameter instead of `url`.
    Connector
  • The complete parameter contract for qart.uk's dithered photo QR recipe — an error-diffused technique (after andrew-t) that dithers a photograph into the space around each QR module, so the finished 1-bit image reads as a picture and still scans. THIS TOOL GENERATES NOTHING. There is no API for the technique and no endpoint that will run it for you: it is a browser-side generator, and this tool returns the parameters, ranges, defaults and algorithm order so that YOU can implement it or instruct someone who will. Pair it with get_qr_matrix, which supplies the module grid and the function-pattern map the algorithm needs. It also returns the honest limits, which matter before anyone prints anything: no scan verdict is computed anywhere in this path, error correction wants to stay at H, and stricter detectors (zbar) reject output that phone-grade detectors accept. Treat a dithered code as untested until someone scans the actual printed sheet.
    Connector
  • Find security problems in a repository: a deep, whole-codebase review. Spawns a one-shot audit that scans the repo across a kind-aware taxonomy (secrets + git history, vulnerable/abandoned deps, injection, SSRF, path traversal, deserialization, crypto, info-leak, plus web authz/session/CORS, library API-misuse, game client-trust, or infra/CI as applicable) and posts findings to the project's Security review for human triage. You review the findings, then send the ones worth fixing into the loop as Requests; no fix is applied automatically. Billable; one audit in-flight per project. (Triggering is disabled while the feature is hardened for production: a project not on the operator allowlist — empty by default — returns a message instead of spawning; earlier results stay visible.) Requires a paid plan; a free or trial workspace gets a message telling the user to upgrade.
    Connector
  • Get a security advisory (vulnerability) by its key. Returns a security advisory by key — e.g. a GHSA id taken from a version's advisoryKeys — including the title, CVE aliases, CVSS v3 score and vector, and a link to the full record on osv.dev. Use this only when you already have an advisory ID from get_package_version's advisoryKeys — there is no search here. To find out whether a version has vulnerabilities at all, call get_package_version first; this tool explains one advisory in depth.
    Connector