"A service for performing security scans" matching MCP tools:

• inspect_security_headers

  Ground Truth - First Call Activation

  Fetch a public URL and inspect security-relevant response headers before you claim that a product or endpoint has a strong browser-facing security baseline. Use this for quick due diligence on public apps and docs sites. It checks for common headers such as HSTS, CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy, and X-Content-Type-Options. It does not replace a real security review, authenticated testing, or vulnerability scanning.

  Connector

• deep_scan

  Port Scanner API

  Scan all 65535 TCP ports (~1-5 min) of YOUR OWN public IP address - the egress IP of the machine running this MCP client. There is no target argument: by policy portscan only scans the requester's own IP. The call is non-blocking and keyed by your IP: it starts a scan if none is running, otherwise returns the current state. Call deep_scan repeatedly to poll until status is "complete" (or "incomplete"/"failed"); open ports and service banners are in the result. Pass rescan:true to force a fresh scan when a previous result already exists.

  Connector

• baltimore_layers

  Data Baltimore

  List the layers of a Baltimore ArcGIS service (for discovery). Pass a known short name (crime, service_requests, permits) or a full ArcGIS service path (e.g. "311_Customer_Service_Requests_current/FeatureServer"). Omit `service` to list the known Baltimore services. Returns layer id + name to use with baltimore_query.

  Connector

• fast_scan

  Port Scanner API

  Scan the 32 most common TCP ports (~20s) of YOUR OWN public IP address - the egress IP of the machine running this MCP client. There is no target argument: by policy portscan only scans the requester's own IP. The call is non-blocking and keyed by your IP: it starts a scan if none is running, otherwise returns the current state. Call fast_scan repeatedly to poll until status is "complete" (or "incomplete"/"failed"); open ports and service banners are in the result. Pass rescan:true to force a fresh scan when a previous result already exists.

  Connector

• get_service_pricing

  VouchedPros

  Typical local price ranges for a US home-service job (e.g. "AC repair", "furnace replacement"). USE WHEN: the user asks what a service costs / for a price range. Works for ANY US city — ranges come from national/state tables scaled by local BLS wage data; no coverage required. ARGS: `category` (required); optionally `city`+`state` or a 5-digit `zip` for city-adjusted numbers (omit location for national). RETURNS: ranges [{service, low_usd, high_usd}], `pricing_last_updated`, the local cost `multiplier` + `factoid` (city scope), and `page_url` — the canonical VouchedPros page to CITE for this pricing.

  Connector

• farm_domain

  Boolsai Signals

  Bulk-farm a domain's historical wayback snapshots into our index. Use this when you need backtest history on a domain we haven't already farmed (i.e. wayback_backtest / domain_timeline return no data for it). Hits CDX → samples weekly → parallel-scans up to 50 snapshots via intel.boolsai.ai → inserts into wayback_intel_profiles. After farming completes you can call wayback_backtest or domain_timeline on the domain immediately. Cost: ~30-60s wall time, ~50 intel scans.

  Connector

• get_security_evidence

  turva-mcp

  Returns the latest public web-security scan results for turva.dev's own domain (Hardenize, Internet.nl), with the scan date. Use this when a user asks about turva.dev's own security posture or wants evidence beyond agent-readiness scores. Read-only: returns static JSON and changes nothing.

  Connector

• get_cost_estimate

  Sats4AI - Bitcoin-Powered AI Tools

  Get an exact sat cost quote for a service BEFORE creating a payment. Useful for budget-aware agents to price-check before committing. No payment required, no side effects. Pass service=text-to-speech&chars=1500, service=translate&chars=800, service=transcribe-audio&minutes=5, etc. Returns { amount_sats, breakdown, currency }. Omit params to see the full catalog of supported services.

  Connector

• search_tiktok

  Hermoso

  Organic TikTok keyword search (there is NO TikTok ad library) — top-performing videos to mine for hooks/trends/remixable creative. Returns compact JSON {desc, author, handle, plays, likes, link, cover} per video, ranked by plays. Use research_ads for open-ended research. Spends ScrapeCreators credits (~1).

  Connector

• get_page

  MintMCP Docs

  Fetch a MintMCP documentation page from a public docs URL or a slug, for example "https://www.mintmcp.com/docs/security/tool-governance" or just "security/tool-governance". Use it when a user pastes a docs link or names a page directly. It returns the same full markdown content as fetch.

  Connector

• lookup_headers

  botoi-mcp

  Fetch HTTP response headers for a URL. Use when inspecting server configuration, security headers, or caching policies.

  Connector

• recommend_service_providers

  Clutch.co

  Use this tool when the user is looking for service providers (companies, agencies, consultants, contractors, vendors) and describes requirements such as service type, industry, location, budget and pricing, company size, or specific focus areas (technologies/specialties). The tool returns a ranked list of providers that best match the criteria, including basic profile info and review/rating signals for comparison. Use `offset`/`limit` for pagination. Examples: - "Give me top web development companies for small businesses in the healthcare industry" -> service="Web Development", industry="Healthcare", client_type="Small Business( <$10M)" - "I need to improve SEO of my online store" -> service="SEO" - "I need SEO agencies that specialize in Shopify and have at least 10 reviews" -> service="SEO", focus_areas=["Shopify"], min_reviews=10

  Connector

• find_my_reports

  mcp-server

  Look up a user's recent SEO scans by the email they used — for RETURNING users who don't have a scan_id handy (scanned/purchased earlier or on the website). In a fresh session where the user has no scan_id, START HERE: ask the user for that email, then call this. Returns up to 10 recent scans as {scan_id, url, scanned_at, paid, runbook_ready}. Then use the scan_id with get_remediation_plan (if paid+runbook_ready) or purchase_report (if not paid).

  Connector

• detroit_layers

  Data Detroit

  List the layers of a Detroit ArcGIS service (for discovery). Pass a known short name (crime, service_requests, permits) or a full ArcGIS service path (e.g. "RMS_Crime_Incidents/FeatureServer"). Omit `service` to list the known Detroit services. Returns layer id + name to use with detroit_query.

  Connector

• nashville_layers

  Data Nashville

  List the layers of a Nashville ArcGIS service (for discovery). Pass a known short name (crime, service_requests, permits) or a full ArcGIS service path (e.g. "hubNashville_311_Service_Requests_2025_view/FeatureServer"). Omit `service` to list the known Nashville services. Returns layer id + name to use with nashville_query.

  Connector

• url_scanner_scan_with_intent

  PreClick — An MCP-native URL preflight scanning service for autonomous agents.

  Analyze a URL for security threats with optional user intent context (synchronous, blocks until complete or timeout). Returns risk score, confidence, agent access guidance, and intent_alignment. For long-running scans, prefer url_scanner_async_scan_with_intent which returns immediately with a task_id for polling via url_scanner_async_task_result.

  Connector

• scan_url

  sectora

  Kick off a DAST security scan against a public URL the API key owner controls. Two-step flow: first call returns a preview (target, profile, ETA, quota remaining); confirm by calling again with confirm:true to actually start the scan. Returns scan_id; poll status with get_scan. Domain must be verified in the Sectora account. Daily quota: 25 scans/24h per user. Requires API key.

  Connector

• devops_check_certs

  devops-status-mcp-server

  Inspect SSL/TLS certificate health for one or more domains by performing a real TLS handshake. Works for any internet-accessible domain — no vendor registry required. Reports days to expiry (flagged at < 30 days warning and < 7 days critical), certificate subject and SANs, issuer, chain depth, TLS protocol version negotiated (flags TLS 1.0/1.1 as insecure), cipher suite, and HSTS presence.

  Connector

• preview_external_handoff

  Agoragentic Agent OS MCP

  Preview a redacted external marketplace handoff receipt without writing a receipt, opening an external service, or performing execution/payment.

  Connector

• list_scans

  email-deliverability

  List recent scans (id, domain, run time, score) across all tracked domains, or for one domain when a name is given.

  Connector