"Assistance with Cyber Security Investigations" matching MCP tools:

• inspect_security_headers

  Ground Truth - First Call Activation

  Fetch a public URL and inspect security-relevant response headers before you claim that a product or endpoint has a strong browser-facing security baseline. Use this for quick due diligence on public apps and docs sites. It checks for common headers such as HSTS, CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy, and X-Content-Type-Options. It does not replace a real security review, authenticated testing, or vulnerability scanning.

  Connector

• package_health

  dynamic-feed

  Health & security posture of a software package (npm / PyPI / Go / Maven / Cargo / NuGet / RubyGems) from deps.dev (Google Open Source Insights, keyless): latest version, license, count of known security advisories, the OpenSSF Scorecard (0-10 security-posture score for the source repo + its weakest checks) and popularity (stars/forks). The "should I depend on this?" check — pairs with check_vulnerability (is a version vulnerable) and software_version (is the runtime current). Args: package (e.g. "lodash", "requests"), ecosystem (npm|pypi|go|maven|cargo|nuget|rubygems), version (optional — defaults to the latest). Every value is returned in an Ed25519-signed, provenance-stamped envelope (source and observation time) you can verify offline against /.well-known/keys, no account required.

  Connector

• domain_report

  ContrastAPI

  Query DNS, WHOIS, SSL, subdomains, and threat intel for a domain in one call. By default dns.txt is filtered to security-relevant entries (SPF, DMARC, DKIM, MTA-STS, TLS-RPT) and dns.total_txt_records reports the honest pre-filter count; pass include_all_txt=true for the raw TXT list. Use as a starting point for domain investigations; use audit_domain for live headers + tech stack. Response carries next_calls — chain with subdomain_enum (always emitted), ssl_check + tech_fingerprint (when an A record resolves) for the standard recon depth without re-prompting. Free: 30/hr, Pro: 500/hr. Returns domain report with DNS records, WHOIS data, SSL cert, risk score, email config, threat status, recommendation, and next_calls.

  Connector

• usaspending_disaster_spending

  usaspending-mcp-server

  Fetch disaster and emergency supplemental spending (COVID-19, hurricanes, infrastructure law, etc.) broken down by agency, CFDA assistance program, recipient, or geography. Use the dimension parameter to select the breakdown axis: overview (top-level totals), agency, cfda, recipient, or geography. Filter by DEF codes (Disaster/Emergency Funding codes) to isolate a specific emergency appropriation. DEF codes appear in usaspending_get_award account_obligations_by_defc and usaspending_get_agency def_codes fields.

  Connector

• disaster_recovery_profile

  livedatalink

  One-call disaster-history and recovery read for a US area (county or place), keyed by NAME + state - distinct from location_risk_report, which scores a single site by address/lat-lon. Joins FEMA's OpenFEMA disaster declarations (the area's federally-declared disaster history: incident types, frequency, most-recent event, and the federal-assistance signal - which programs, Individual Assistance / Individuals & Households / Public Assistance / Hazard Mitigation, were authorized) with optional US Census ACS county population for exposure context (keyed off the FIPS codes the FEMA records carry; needs a Census key and degrades gracefully) and an optional best-effort parcel record for property context when an address is given (Maryland statewide / Texas-Harris County only). Returns a readable profile with a headline banding the area's disaster exposure LOW / MODERATE / HIGH from the declaration record. The FEMA leg is keyless and is the core signal; a source that fails is noted, not fatal. INFORMATIONAL public-record synthesis, NOT an insurance rating, a property flood-risk score, or a professional risk assessment.

  Connector

• get_product_recommendation

  Custom Blinds Shop

  Translate a customer's primary concern into a product recommendation. primary_concern must be one of: blockout, heat, glare, moisture, privacy, security, automation. Optionally narrow by room (bedroom, lounge, etc.), location, budget, and aesthetic. Returns a recommended product_id with rationale — pass it to get_price or configure_product next. Security concern routes to brochure MCP (Garden Route customers only).

  Connector

• get_security_evidence

  turva-mcp

  Returns the latest public web-security scan results for turva.dev's own domain (Hardenize, Internet.nl), with the scan date. Use this when a user asks about turva.dev's own security posture or wants evidence beyond agent-readiness scores. Read-only: returns static JSON and changes nothing.

  Connector

• asvs_chapters

  Owasp

  Table of contents for the OWASP ASVS 5.0 (Application Security Verification Standard): the 17 chapters (V1–V17) with names and requirement counts per assurance level. Use to discover which chapter to pull with asvs_requirements.

  Connector

• estimate_borrowing_power

  mortgage-tools

  Estimate indicative borrowing capacity, assessed at a buffered rate (APRA +3% serviceability buffer). A rough proxy for guidance — a broker models real capacity across 30+ lenders. Not credit assistance. Args: annual_income: Gross annual household income in AUD. monthly_expenses: Average monthly living expenses in AUD. existing_monthly_debt: Existing monthly loan/card commitments in AUD. interest_rate_pct: Assumed product interest rate (buffer is added on top). term_years: Loan term in years. deposit: Cash deposit available in AUD (added to the purchase budget).

  Connector

• get_page

  MintMCP Docs

  Fetch a MintMCP documentation page from a public docs URL or a slug, for example "https://www.mintmcp.com/docs/security/tool-governance" or just "security/tool-governance". Use it when a user pastes a docs link or names a page directly. It returns the same full markdown content as fetch.

  Connector

• nhtsa_search_investigations

  nhtsa-vehicle-safety-mcp-server

  Search NHTSA defect investigations from the ODI flat file — covering Preliminary Evaluations (PE), Engineering Analyses (EA), Defect Petitions (DP), Recall Queries (RQ), Audit Queries (AQ), and additional ODI types. make, model, and component are structured filters against the investigation record's vehicle associations. All filters are ANDed. Investigations may link to a resulting recall campaign via recallCampaign.

  Connector

• aidefense_cross_map

  website-search

  Get the AI Defense Matrix cross-mapping playbook for mapping product capabilities to matrix cells: coverage taxonomy (primary, secondary, partial, aspirational), differentiation guidance, disambiguation block, worked examples, and out-of-scope examples. The response always includes an inScopeCheck. Products that USE AI to solve a non-AI security problem (deepfake detection, AI-for-fraud, AI features added to existing SIEM, SOAR, or EDR tools) belong in the Cyber Defense Matrix at https://cyberdefensematrix.com. Pairs naturally with product_load_context(productFocus: 'ai_security') for follow-on positioning and GTM work. This server never requests your program docs or product roadmap and instructs your AI to keep them local—the matrix, framework alignments, and playbooks flow to your AI for local analysis.

  Connector

• usaspending_get_award

  usaspending-mcp-server

  Fetch full details of a federal award by its generated unique award ID. Returns contract or assistance award data including recipient info, agency hierarchy, period of performance, place of performance, funding account linkages (account_obligations_by_defc), parent IDV information, and subaward count. Use generated_internal_id values from usaspending_search_awards as input. Recipient hashes can be passed to usaspending_get_recipient; NAICS codes can be used in usaspending_search_awards filters. For IDV-category awards (category="idv"), use usaspending_get_idv_awards to list the child contracts and task/delivery orders placed under them.

  Connector

• vehicle_report

  title-check

  Generate a pre-purchase report for a titled asset by VIN (cars, trucks, RVs, trailers, heavy equipment) or HIN (recreational boats). Returns open federal NHTSA recalls (severity-ranked), consumer-complaint crash/fire/injury/death counts, open investigations, VIN check-digit + factory decode, and the exact next-step sources for lien & title-brand. Public NHTSA/USCG data — not an official title record; lien/salvage need a state/NMVTIS check, which the report links.

  Connector

• aeo_generate

  mcp

  Génère (sans appliquer) un artefact AEO, déterministe et gratuit. Types : jsonld, robots, llms, meta, faq (params faqs[]), ai-txt, humans-txt, security-txt, sitemap. jsonld/robots/llms/meta/faq sont applicables (cf. aeo_apply) ; ai-txt/humans-txt/security-txt/sitemap sont à publier par l’agence.

  Connector

• url_scanner_scan_with_intent

  PreClick — An MCP-native URL preflight scanning service for autonomous agents.

  Analyze a URL for security threats with optional user intent context (synchronous, blocks until complete or timeout). Returns risk score, confidence, agent access guidance, and intent_alignment. For long-running scans, prefer url_scanner_async_scan_with_intent which returns immediately with a task_id for polling via url_scanner_async_task_result.

  Connector

• url_scanner_async_scan

  PreClick — An MCP-native URL preflight scanning service for autonomous agents (formerly URLCheck).

  Submit a URL for asynchronous security analysis. Returns immediately with a task_id. Poll with url_scanner_async_task_status to check progress, then url_scanner_async_task_result to get the scan result. Async counterpart of url_scanner_scan for clients without native MCP Tasks support.

  Connector

• url_scanner_async_scan_with_intent

  PreClick — An MCP-native URL preflight scanning service for autonomous agents (formerly URLCheck).

  Submit a URL with optional user intent for asynchronous security analysis. Returns immediately with a task_id. Poll with url_scanner_async_task_status to check progress, then url_scanner_async_task_result to get the scan result. Async counterpart of url_scanner_scan_with_intent for clients without native MCP Tasks support.

  Connector

• url_scanner_async_scan

  PreClick — An MCP-native URL preflight scanning service for autonomous agents.

  Submit a URL for asynchronous security analysis. Returns immediately with a task_id. Poll with url_scanner_async_task_status to check progress, then url_scanner_async_task_result to get the scan result. Async counterpart of url_scanner_scan for clients without native MCP Tasks support.

  Connector

• username_lookup

  ContrastAPI

  Search for username across 15+ social/dev platforms (GitHub, Reddit, X/Twitter, LinkedIn, Instagram, TikTok, Discord, YouTube, Keybase, HackerOne, etc.). Use for OSINT investigations and identity verification. Free: 30/hr, Pro: 500/hr. Returns {username, total_found, platforms: [{name, exists, url, status_code}]}.

  Connector