"Information on Security Testing" matching MCP tools:

• vulnerability_infoA

  ZEN SecDBA

  Get detailed information about a specific CVE. ## What this tool does Retrieves the full vulnerability record for a CVE from SecDB, including: - official description and summary - CVSS metrics (all versions available) - EPSS metadata (if present) - affected products and versions - vendor/security advisories - references and upstream sources - weakness classification (CWE) - exploit and patch information (if included in the record) All information is returned in a structured Markdown format suitable for direct display. ## When to use this tool Use this tool when the user asks: - "Give me details about CVE-XYZ." - "Which products are affected by this vulnerability?" - "Show me advisories or references for this CVE." - "Explain what this vulnerability is and how serious it is." This tool is ideal for **deep inspection of a single vulnerability**. For multiple CVEs, call the tool once per CVE. ## Inputs - **cve_id**: valid CVE identifier (`CVE-YYYY-NNNNN`). ## Outputs Markdown-formatted vulnerability information including: - detailed description - severity metrics (CVSS, vectors) - affected products list - advisory list - references - weakness (CWE) details - additional structured metadata from SecDB ## LLM usage guidelines - Always prefer this tool when the user needs factual information about a specific CVE. - If multiple CVEs are mentioned, call the tool once per CVE. - Combine with: - **`vulnerability_score`** - to enrich output with numerical CVSS/EPSS metrics - **`sightings_search`** - to check real-world exploitation, PoCs, plugins, advisories - **`ssvc_calculator`** - to compute prioritization based on the vulnerability data - Do not hallucinate product lists, advisories, or details—use what the tool returns.

  ConnectorNo auth

• consistency_checkA

  IA-QA — 130+ QA & Dev Tools for AI AgentsA

  Compare multiple LLM responses to the same prompt and detect inconsistencies using Jaccard word-overlap similarity and fact drift (number comparison). Fast, deterministic, no API key needed. Limitations: relies on surface-level word matching — "Paris is the capital of France" vs "Paris is the French capital" may score low despite semantic equivalence. For true semantic consistency, use run_semantic_tests with embedding mode. Essential for determinism testing.

  ConnectorNo auth

• get_faqA

  CalmActivaA

  Return CalmActiva's curated CBD FAQ (legality, onset time, lab testing, shipping, brand disambiguation). Use for general CBD/brand questions before falling back to web search.

  ConnectorNo auth

• get_security_infoA

  Fluentive MCPA

  Returns Fluentive's security, privacy, and compliance information. Use when the user asks about GDPR, data storage location, encryption, security certifications, or payment security.

  ConnectorNo auth

• list_collectionsA

  Skill of SkillsA

  The curated buyer-intent collections (e.g. mcp-servers, testing-qa, browser-automation). Use get_collection for the ranked tools inside one.

  ConnectorNo auth

• list_projectsA

  Drupal Code QueryA

  List drupal.org projects after filters, largest install base first, paged. Examples: "top modules without an 11.4 branch", "themes over 10k installs without security coverage". One project: project_profile. Its pending records: project_upgrade_report. - Filters combine: type, min_installs, security (covered, not-covered, revoked), core_minor (+ missing), era (d8plus, pre_d8). All apply to count and rows. - core_minor reads the composer constraint of the newest release on each development branch. A minor counts when any patch of it satisfies the constraint. An unreleased tip change is not seen. missing=true keeps projects with no branch declaring it: the upgrade gap list. - Row: machine_name, title, type, installs, security, status, dev_branches (branch, installs, core_minors, era), latest_release. count: projects. next_offset is absent on the last page.

  ConnectorNo auth

• contrast_scanA

  ContrastAPIA

  Active website security scan: runs the ContrastScan C engine (11 modules — HTTP security headers, SSL/TLS, DNS, redirect chain, information disclosure, cookie flags, DNSSEC, HTTP methods, CORS, HTML hygiene, deep CSP analysis) against the live site and enriches the raw result with severity-ranked vulnerability findings and a letter grade. Use for a hands-on misconfiguration scan; use audit_domain for passive recon (DNS/WHOIS/SSL/threat intel) and scan_headers for headers only. Active outbound fetch — a per-target eTLD+1 throttle (60 req/min) applies. Free: 30/hr (costs 6 tokens), Pro: 500/hr. Returns {domain, resolved_ip, total_score, max_score, grade, findings, findings_count, headers, ssl, dns, redirect, disclosure, cookies, dnssec, methods, cors, html, csp_analysis, enterprise, summary, next_calls}.

  ConnectorNo auth

• get_billingA

  EchoRelayA

  Get the project's credit balances (paid + testing) and which ledger it settles on. `billingModel` is `prepaid` (metered against the credit balance) or `invoiceable` (an Enterprise account, settled on the contract — its credit fields read empty/zero by design, not because it is out of credits). A zero balance is not on its own a reason to stop: live traffic is never refused for an empty balance, and a free-tier project is exempt from live credit billing entirely. Only the testing pool refuses when exhausted (402 `testing_credits_exhausted`). Read this before concluding from any other field that a project cannot send.

  ConnectorNo auth

• get_usersA

  JsonplaceholderA

  Fetch all fake users for testing. Returns name, username, email, address, phone, website, and company details.

  ConnectorNo auth

• contact_depscopeA

  DepScopeA

  Inbound ticket: bug/listing/security/anomaly/partnership. USE WHEN: reporting wrong data (`bug`), requesting a new pkg/ecosystem index (`listing`), disclosing a DepScope security issue (`security`), flagging a concrete mismatch in another tool's output vs. authoritative source (`anomaly` — provide tool_called+observed+expected), or partnership/press (`partnership`). RETURNS: {ticket_id} or {anomaly_id}.

  ConnectorNo auth

• fetch_veille_feedA

  IA-QA — 130+ QA & Dev Tools for AI AgentsA

  Fetch the latest QA & AI/LLM articles aggregated from curated RSS sources (Google Testing Blog, DEV.to Testing/QA/AI/LLM/Agents, Hugging Face Blog, Simon Willison). Perfect for agents monitoring the QA & AI landscape. Each article carries summary_source — the XML tag the summary was read from, or "none" when the feed publishes titles and links only; an empty summary with summary_source "none" is a property of that feed, not a parse failure.

  ConnectorNo auth

• llm_json_schema_checkA

  IA-QA — 130+ QA & Dev Tools for AI AgentsA

  Validate that an LLM JSON output matches a JSON Schema definition. Tests required fields, types, enums, nested objects, and arrays. Critical for function-calling and structured output testing.

  ConnectorNo auth

• data_ip_threatA

  GoCreative Agent APIB

  IP threat-intel: open ports + known CVEs/vulnerabilities + hostnames + tags for any IP (Shodan InternetDB). For security, fraud, and abuse-screening agents. Example call: {"ip": "8.8.8.8"} Cost: $0.005–$0.05 USDC on Base per call.

  ConnectorNo auth

• get_api_securityA

  aribotA

  API security inventory (part of Code Security): discovered API endpoints with authentication status, risk level and risk factors, plus method/risk breakdowns. Company-wide or one scan with `scan_id`. Reads code_review ApiEndpointDiscovery.

  ConnectorNo auth

• submit_enquiryA

  Aevum SecurityA

  Submits a business enquiry to Aevum Security on behalf of the caller's principal. Creates a real enquiry that a person reads and replies to within 1 business day; it cannot be withdrawn once submitted. Returns the enquiry id as proof of receipt. [MUTATING: requires an agent key passed as Authorization: Bearer on the HTTP connection]

  Connector

  Destructive

  No auth

• scan_websiteA

  ScanLabsAI Security ScannerA

  Run a ScanLabsAI security scan against a website and return a full Markdown vulnerability report (grouped by severity, with descriptions and remediation) that you can analyse, act on, and the user can save as security-report.md. Checks OWASP Top 10, CVEs, SSL/TLS, security headers and DNS. Use deep=true for a comprehensive scan (40,000+ vectors, slower). Only scan sites the user is authorised to test.

  ConnectorNo auth

• run_survival_modeA

  TrendIdeaA

  Run a Survival Mode simulation that throws a random crisis at your startup and evaluates how your idea would hold up, testing founder resilience. This spends credits and records a simulation result on the idea. Not read-only; pass an ideaId you own and make sure you have enough credits (check get_credits_balance).

  ConnectorNo auth

• scan_domainA

  IntoDNS.ai DNS & Email Security ScannerA

  Run the fast IntoDNS.ai DNS and email security scan (~3-8s). Returns a letter grade A+ to F, numeric score 0-100, structured issue list, prioritised recommendations, full DNS/email/web/security result sections, and canonical citation URLs. Read-only — no domain mutation, no destructive side effects. The default tool for agent-visible scan evidence; use get_everything_report for a deeper single-shot report including web/blacklist/sender data, or start_deep_scan for slower Internet.nl-grade analysis. After running, use explain_issue or generate_dns_fix on any returned issue. No auth.

  ConnectorNo auth

• rug_scoreA

  x402 BazaarA

  One 0-100 risk gate (security + holders + liquidity) — Deterministic 0-100 rug-probability score combining security flags, holder concentration, LP lock and liquidity depth — with the exact signals that drove it. A fast numeric gate for trading agents. Higher = riskier. Required input: address. Priced $0.03 per call over x402 on Base; send a prepaid x-credit-token header for unlimited calls, or get 1 free call/day per tool. No wallet or API key required.

  ConnectorNo auth

• scan_securityA

  security-toolsA

  Run a free front-end security check on any website and get a letter grade (A to F) plus specific findings. Answers questions like 'is example.com leaking API keys or secrets in its front-end code', 'does this site expose a Stripe/AWS/OpenAI key or a publicly readable database', or 'how is this website's client-side security'. Reads only what the site serves publicly; never logs in or changes anything.

  ConnectorNo auth

• list_checksA

  TrustAI VerificationA

  Return the structural checks this server performs on legal-AI output, and — explicitly — what it never claims. Information, not legal advice.

  ConnectorNo auth