"An overview of penetration testing (pentest)" matching MCP tools:

• reliefweb_get_disaster

  reliefweb-mcp-server

  Fetch a disaster record by ReliefWeb numeric ID including description, affected countries, GLIDE number, profile overview, key content links, and active appeals or response plans. Use after reliefweb_search_disasters to retrieve full details. Each curated list also has an archive, which the record leaves out. Two alternative selectors, at most one per call: sections names parts of the record to return, archive pages one list's archived entries in place of the record. Description and profile overview can together run to tens of KB for major disasters. A record over the response budget comes back as a section outline naming every section and its byte size. Nothing is truncated on any path.

  Connector

• cabgo_about

  Cabgo Builder

  Public (no auth): describe what Cabgo is. Returns the full product catalog — what kinds of apps an operator can launch, pricing, who Cabgo is for, and how to onboard. Use ONLY when the user explicitly asks what Cabgo is, what it does, or wants an overview. **Do NOT call this as a pre-step before cabgo_create_my_app** — when the user wants to create / launch an app, go directly to cabgo_create_my_app without fetching context first.

  Connector

• tasks

  mcp

  Shared task tracker (TAPI) with append-only history. Single entry point — pick an operation. list = overview with computed status/completion (roots only by default). get = slug|id → single task + architecture versions. history = slug|id → full history, with_content=true fetches MD from S3. create = slug+title(+description, parent_id, related_to, tags, scope). add_history = slug|id+type+summary — the primary way to report progress, notes, snippets, blockers and architecture docs; supports snoozed_until. update = slug|id + any of title/description/parent_id/related_to/tags — metadata only, logs an audit note; status and completion stay history-driven via add_history. delete = slug|id+confirm:true — soft delete, refused while the task has children. search = AND-match on distinctive words across title/description/slug + history summaries. export = Markdown overview grouped by status.

  Connector

• get_coverage

  mcp

  [free] What we hold and how fresh, plus a live example mint that is guaranteed to have data. Call this first. We index every pump.fun and letsbonk migration since our start date — testing with an older token you already know will return nothing and tell you nothing about us.

  Connector

• pentest_lookup_group

  pentest-mcp-server

  Look up a MITRE ATT&CK threat group (intrusion set) or software entry by name or ID for authorized penetration testing and threat intelligence. Returns the group or software record: ATT&CK ID, display name, known aliases, type (group vs. software), description, and the techniques it uses with procedure-level context from public ATT&CK reporting. Accepts exact ATT&CK IDs (G0007 for threat groups, S0002 for software) or keyword/name search (e.g., "APT28", "Mimikatz", "Lazarus Group"). Equally useful for defenders building detection coverage around specific adversary tradecraft.

  Connector

• clear_sandbox

  MisarMail MCP Server

  Delete every email captured in the sandbox. The sandbox holds messages intercepted during testing so they are never delivered to real recipients. This DELETES ALL of them and cannot be undone — but it touches only intercepted test mail, never sent campaigns, real inbox messages, contacts, or templates. Takes no parameters and offers no filter: it is all or nothing. Requires an API key. Clearing an already-empty sandbox is harmless. Read anything you still need from the sandbox before calling this.

  Connector

• get_savvly_product_info

  savvly

  Get complete product information about Savvly, an SEC-registered security offering longevity protection — use it whenever the user asks what Savvly is, how it works, its expenses, eligibility, or payouts, or wants an overview. Pass `section` to focus the answer (default 'all'). It renders an interactive product overview card the user expects to see. These facts come from Savvly's own current records; the response includes primary sources (e.g. SEC filings) for reference.

  Connector

• list_domains

  OpenDataModels MCP server

  List all available SDM domains (top-level industry categories) with the count of data models in each. Use this as the entry point when the user wants an overview of what sectors are covered, or before calling list_models_by_domain. No parameters required. Example: list_domains({})

  Connector

• getMarketOverview

  qubitsok — Quantum Computing Jobs, Papers & Researchers

  Get a snapshot of the quantum computing landscape — no parameters needed. Use when the user asks broad questions like "how's the quantum job market?", "what are trending topics?", or wants an overview of the quantum computing industry. Returns: total active jobs, top hiring companies, jobs by role type, papers published this week, total researchers tracked, and trending technology tags. For specific job/paper/researcher searches, use the dedicated search tools instead.

  Connector

• adcritter_build_app

  AdCritter for Builders

  Start here when building an application. Returns an overview of what the AdCritter platform offers and a catalog of feature guides you can query with the adcritter_guidance tool to learn how to build each part of the app. Call adcritter_guidance(key) for any feature area to get detailed building instructions with API endpoints and response shapes.

  Connector

• hallucination_check

  IA-QA — 130+ QA & Dev Tools for AI Agents

  Word-overlap based hallucination check: verifies if an LLM answer's words and numbers appear in the provided source/context. Fast, deterministic, no API key needed. Limitations: not semantic — does not understand synonyms or paraphrases. For true semantic grounding, use run_semantic_tests with embedding mode. Essential for quick RAG accuracy testing.

  Connector

• get_skill_clusters

  nü people Job Server

  Returns the current skill cluster data for public jobs on the nü people website. Use this tool when the user wants an overview of which skills or technologies are currently in demand.

  Connector

• list_collections

  Skill of Skills

  The curated buyer-intent collections (e.g. mcp-servers, testing-qa, browser-automation). Use get_collection for the ranked tools inside one.

  Connector

• provider_profile

  telecom-truth

  Canonical profile of a US internet provider by name (handles brand variants, e.g. 'ATT', 'Google Fiber'). Returns the canonical identity, FCC registration numbers, technologies filed, the live profile URL, and — when precomputed — an answer pack of grounded sections (overview, coverage, measured-vs-claimed speeds, competition, recent signals, trajectory). Use it to disambiguate providers before making claims about them.

  Connector

• library_get_family

  luxalgo-mcp-server

  A family's hub page as markdown — the written overview of that school of analysis plus its complete concept roster. Use after library_list_families, or when the user asks about a whole area like 'SMC' or 'Wyckoff'.

  Connector

• pentest_map_techniques

  pentest-mcp-server

  Given a profile of the authorized test target (technology stack, exposed services, authentication type, OS), return a ranked list of ATT&CK techniques and OWASP test cases most relevant to that profile — not a generic dump of all techniques. Ranking factors: platform match, service match, auth type exposure, technique prevalence. Each result includes why it is relevant to this specific profile, the detection opportunity, and the recommended mitigation. Use when starting an authorized engagement to prioritize the testing scope; pair with pentest_guide to get the full methodology for each top-ranked vector.

  Connector

• pentest_generate_payloads

  pentest-mcp-server

  Generate payload templates for authorized testing against systems the tester owns or is permitted to test. Payloads are annotated templates — each includes why it works in the specified context, what vulnerability class it tests, detection signatures that WAF/IDS products might fire, and recommended mitigations. Context-awareness is core: an XSS payload for an HTML attribute differs entirely from one for a JS template literal, and both differ from a DOM-based sink. When a WAF profile is specified, bypass variants reference known public research for that WAF product. All payloads are illustrative templates for authorized testing only.

  Connector

• get_design_system

  standby-design-mcp

  Decode a standby.design URL (or raw hash) and return an overview of the full design system: color palette, type scale, spacing & layout, shape tokens, and icons — plus per-tool edit links. Always give the standby.design/system URL to the user — the link is the deliverable.

  Connector

• fr_entreprise-360_partial

  x402-farm

  Lite overview of a French company by SIREN or name: legal identity, activity code, headcount bracket and current administrative status, drawn from the official INSEE Sirene registry. This is the cheaper preview of the full 360 profile, meant to let an agent confirm it has the right company before paying for depth. — $0.02/call, paid per request via x402 (USDC).

  Connector

• get_vision_report

  switch

  Fetch one of your finished Video Analysis reports by report_id (from analyze_video_report or list_vision_reports). Returns the complete structured report: overview scores and takeaways, the timeline of scenes, audio, visual, story, speech, the recreation section with every master prompt, and metadata, plus recreation_prompt (the ready to run prompt) at the top level. While an analysis is still running this reports processing; poll it every 20 to 30 seconds.

  Connector