"Information on Security Testing" matching MCP tools:

• update_notification_preferencesA

  RoutebaseA

  Set YOUR notification preferences for one or more categories. Categories you do not mention keep their current setting. Use resetCategories to drop your override so a category follows the organization default again — an entry in categoriesJson can only set an override, never remove one. Valid categories: api_design, testing, project, mock_server, style_guide, team, portal, monitoring, security, billing, deprecation. Use this for your own preferences; for the organization defaults use update_org_notification_defaults.

  Connector

  Destructive

  API key

• get_briefingA

  the drainA

  Before security-sensitive tooling or agent operations: find recent threads relevant to a task, with source links, provenance and matching keywords. Keyword overlap on title, tags and excerpt over the last 200 active threads; not semantic search and not the full archive (use search for that). Seeds excluded by default.

  ConnectorNo auth

• get_billingA

  EchoRelayA

  Get the project's credit balances (paid + testing) and which ledger it settles on. `billingModel` is `prepaid` (metered against the credit balance) or `invoiceable` (an Enterprise account, settled on the contract — its credit fields read empty/zero by design, not because it is out of credits). A zero balance is not on its own a reason to stop: live traffic is never refused for an empty balance, and a free-tier project is exempt from live credit billing entirely. Only the testing pool refuses when exhausted (402 `testing_credits_exhausted`). Read this before concluding from any other field that a project cannot send. On a Pro or Scale plan billed for overage, `overage` reports the billing cycle running now: `usedCredits`, `overageCredits` (beyond the allowance and prepaid credits), `amount` so far in minor units of `currency` (null when it cannot be worked out), `windowEndsAt`, `throttled` (true while this cycle's request limit is halved because spend passed five times the plan's credits) and `throttledUntil` (when the halved limit ends, or null); it is absent otherwise. On Pro or Scale, `overageBilling` is the account's own overage setting, changed with set_overage_billing.

  ConnectorNo auth

• get_security_evidenceA

  turva-mcpA

  Returns the latest public web-security scan results for turva.dev's own domain (Hardenize, Internet.nl site and mail), each with its scan date. Use this when a user asks about turva.dev's own security posture or wants evidence beyond agent-readiness scores. For the agent-readiness score itself, which is a separate measurement, use get_agent_readiness instead. Read-only: returns static JSON that is compiled into the Worker, so it changes nothing and updates only on deploy.

  ConnectorNo auth

• get_leadproof_evaluation_pathA

  LeadProof Sales AgentA

  Use first when a buyer is exploring LeadProof without supplying workflow data. Returns the official no-purchase sequence: buyer guide, fictional example audit, browser-only calculator, public workflow tests, and no-card trial. For a scored workflow diagnosis, use audit_lead_workflow; for replay testing, use get_leadproof_replay_trial; for paid checkout, use get_leadproof_checkout only after authorization.

  ConnectorNo auth

• get_advisoryA

  dependency-trustA

  Get a security advisory (vulnerability) by its key. Returns a security advisory by key, for example a GHSA id taken from a version's advisoryKeys, including the title, CVE aliases, CVSS v3 score and vector, and a link to the full record on osv.dev. Use this only when you already have an advisory ID from get_package_version's advisoryKeys. There is no search here. To find out whether a version has vulnerabilities at all, call get_package_version first; this tool explains one advisory in depth.

  ConnectorNo auth

• graph_noticesA

  Lattice: CVE, MITRE ATT&CK and detection graph for security agentsA

  Return the licence and attribution notices for the data sources behind an answer. Other tools list notice ids with their answers. Pass those ids here to get, for each notice, its title, what it applies to, the obligation it places on you (for example attribution wording or a share-alike condition) and the notice text. Long texts are cut and flagged text_truncated, with text_url pointing to the full text. When to call it: before you quote, republish or build on anything the graph returned, and then quote what the obligation requires. Unknown ids are reported in unknown rather than failing. What it is not for: it returns no security facts, and it is source licence information, not legal advice. It only reads and gives the same answer each time for a snapshot.

  ConnectorNo auth

• valuation_impairmentA

  Intangible Asset Valuation MCP ServerA

  Impairment testing: goodwill impairment and intangible impairment under US GAAP (ASC 350) or IFRS (IAS 36). Method selects the formula. Use for annual or triggering-event impairment testing; goodwill_impairment compares a reporting unit's carrying value with its fair value. To compute the initial goodwill or allocation use valuation_goodwill_ppa; for the underlying asset fair values use the relevant asset-type tool. Per method: goodwill_impairment needs carrying_value + fair_value (optional: reporting_unit, standard); intangible_impairment needs carrying_value (optional: fair_value, recoverable_amount, standard). fair_value is required for ASC350; recoverable_amount is required for IAS36. Only method is required; all other parameters are method-dependent — supply those the selected method names and omit the rest (defaults apply where defined). Rates and premiums are decimals (0.10 = 10%). Pure arithmetic: no I/O and no external calls, rounded to 2 decimals; parameters belonging to other methods are accepted and ignored. An unknown method, or a missing method-required parameter, returns an error instead of a value.

  ConnectorNo auth

• security_advisorA

  TrentA

  Consult a principal security engineer on a security topic. Send specific code, a plan, a config, or a security question. For a full codebase scan, use create_project and trigger_analysis. Choose one input: content for small inline text, or content_document for a large design document uploaded with prepare_file_upload. The upload keeps the file out of the context window. Supplying both inputs is refused. Use this selective consultation when feedback can still change a decision about authentication, authorization, secrets, sensitive data, new network exposure, cryptography, infrastructure, IAM, or filesystem or command execution. Send the relevant plan or diff. Reserve calls for those decisions, and respect a user's request to skip consultation. The tool answers immediately from the content sent. Report it as an advisory review of that content, with CRITICAL, HIGH, MEDIUM, or LOW severity labels. Trent's full assessment requires a scan. Each call starts a new conversation unless you pass thread_id. The thread_id and resumed fields describe continuation. A reply with detected_repository and onboarding_hint identifies a local repository awaiting a Trent project. Say existing project findings were unavailable to this review, and offer create_project.

  ConnectorOAuth

• make_offerA

  HaggleBoardA

  Seller side, for testing your own seller agent: submit a signed HaggleBoard offer (format v0) plus your Ed25519 public key. You see the need through a disclosure filter and only your own messages. Not affiliated with any store, brand or platform. HaggleBoard is not a party to any sale.

  ConnectorNo auth

• nyfed_repo_operationsA

  Nyfed MarketsA

  NY Fed Desk repo and reverse repo (ON RRP) operation RESULTS — the actual auctions the Desk ran, not a daily rate aggregate. Each operation: total submitted/accepted USD, counterparty counts, award rate(s), breakdown by security type (Treasury/Agency/MBS/SRF). No start_date/end_date -> today's operation(s) only (empty on weekends/holidays). With start_date/end_date -> a date-range search. Use for "today's ON RRP usage", "reverse repo take-up this week vs last", "who's using the SRF". Different from fred_get_series('RRPONTSYD') which only has the daily accepted total, no per-operation detail.

  ConnectorNo auth

• code_get_findingsA

  searchcodeA

  Get detailed code quality findings from a remote public git repository. Returns rule IDs, line numbers, severity, category, descriptions, and source snippets. Supports filtering by file path, severity (error, warning, info), category (security, deprecated, safety, correctness, maintainability, accessibility, modernization, performance, concurrency), and kind (security, quality) — kind=security is every security-category finding in one call, kind=quality is everything else. code_analyze.top_findings shows only the quality half; use kind=security here to see the security-category findings it leaves out. THIS IS NOT THE SECRET SCANNER. kind=security means insecure code — weak hashes, unsafe deserialization, injection-shaped patterns — and it will not find a leaked API key or private key. Leaked credentials are code_analyze.security_summary, which is a different scanner over different rules; the two sets do not overlap, so an audit wants both. Use after code_analyze to drill into specific findings. Shares the same analysis cache — no duplicate work if analyze already ran.

  ConnectorNo auth

• list_projectsA

  Drupal Code QueryA

  List drupal.org projects after filters, largest install base first, paged. Examples: "top modules without an 11.4 branch", "themes over 10k installs without security coverage". One project: project_profile. Its pending records: project_upgrade_report. - Filters combine: type, min_installs, security (covered, not-covered, revoked), core_minor (+ missing), era (d8plus, pre_d8), member_of (+ max_depth). All apply to count and rows. - core_minor reads the composer constraint of the newest release on each development branch. A minor counts when any patch of it satisfies the constraint. An unreleased tip change is not seen. missing=true keeps projects with no branch declaring it: the upgrade gap list. - member_of keeps one root's members, direct and transitive; max_depth (needs member_of) drops members past that many requires away. A filtered list adds membership: root_release, complete, unread_count and unread (up to 20, package + cause). - Row: machine_name, title, type, installs, security, status, dev_branches (branch, installs, core_minors, era), latest_release, cms_depth, member_of_count. cms_depth is the row's membership depth under the cms root; member_of_count is how many roots include it. A project in no root has neither; a project that is not a cms member has member_of_count alone. count: projects. next_offset is absent on the last page.

  ConnectorNo auth

• submit_enquiryA

  siteA

  Submits an enquiry to LEV Testing Cost — NOT a purchase, NOT a guaranteed quote. Step 1: call with the answers (keyed by field key from enquiry_fields) and consent=true; it validates and returns a summary, the consent line and a confirmation token — show the person the summary and the consent line. Step 2: only if the person agrees, call again with the same answers, consent=true and the confirmation token; the enquiry is then submitted, and the person receives an email with a link they must click before any provider sees it. Consent means the person has read and agreed to: "Send my contact details to up to three workplace health and safety assessors, chosen by LEV Testing Cost, who'll contact me directly. I'll be emailed each firm's name as my details go to it, and can stop any more firms getting them."

  ConnectorNo auth

• submit_enquiryA

  siteA

  Submits an enquiry to Vacant Property Security Cost — NOT a purchase, NOT a guaranteed quote. Step 1: call with the answers (keyed by field key from enquiry_fields) and consent=true; it validates and returns a summary, the consent line and a confirmation token — show the person the summary and the consent line. Step 2: only if the person agrees, call again with the same answers, consent=true and the confirmation token; the enquiry is then submitted, and the person receives an email with a link they must click before any provider sees it. Consent means the person has read and agreed to: "Send my contact details to up to three security system and vacant property security firms, chosen by Vacant Property Security Cost, who'll contact me directly. I'll be emailed each firm's name as my details go to it, and can stop any more firms getting them."

  ConnectorNo auth

• eventlog_searchA

  Netmon (demo)A

  Search Windows Event Log entries ingested from Netmon agents. Wraps GET /api/eventlog/list (permission: logs); tag-scoped server-side. Severity is the raw Windows EventRecord.Level: 'logalways'=0 (what Security-channel audit events carry), 'critical'=1, 'error'=2, 'warning'=3, 'information'=4, 'verbose'=5 — pass names or ints. Note 0 is NOT Information. Window: `hours` (1-168, default 24) OR `start_time`+`end_time`. `limit` defaults to 50 (max 500). `total` in the response is the full match count — if it exceeds `limit`, narrow the window or add severity/source/message filters rather than bumping limit. Example: eventlog_search({severity: "error", hours: 4})

  ConnectorNo auth

• test_automationA

  SendingA

  Runs ONE contact through the automation with compressed waits, even if it is still a DRAFT, using the latest written version. It is for testing a flow before activating it: with thirteen days of waits the only alternative is activating it on the real world and finding the bug thirteen days later, on real people. `timeScale` divides the waits (1440 by default: one day becomes one minute). WARNING: the messages are REALLY sent to that contact, so use an address of your own. The test run does not take the 'one enrollment per contact' slot: it can be repeated, and the person can still enter for real when you go live. Step-by-step outcomes are read with get_automation_log.

  Connector

  Destructive

  API key

• pre_trade_checkA

  AgentPay — trust routing + spend caps for x402 agentsA

  One-call pre-trade sanity check: 'I want to long $X of SYMBOL — is now sane?' Combines live orderbook slippage at YOUR size, cross-exchange funding (carry cost), open-interest crowding, and contract security (GoPlus) into a single ok/caution/avoid verdict with a per-factor breakdown. Major ERC-20 addresses (LINK, UNI, ARB, OP, AAVE, PEPE, SHIB) resolve automatically; native assets (BTC, ETH, SOL, ...) report security n/a; an unrecognized token without token_address reads 'unknown' and caps the verdict at caution — an unscreened contract can never read 'ok'. Replaces four API integrations and the judgment layer on top of them. Raw component data embedded so you can apply your own thresholds. Stacks tokens (STX, sBTC, USDCx, stSTX, ZEST, LEO, USDh, aeUSDC, stBTC) add the Bitflow DEX venue: price impact at YOUR size from a live route quote, the pools and bins the swap crosses, and their TVL; STX and sBTC keep their CEX perp legs, DEX-only tokens report funding/OI n/a and contract risk unscreened (no GoPlus coverage on Stacks). Use when: An agent (or human) is about to enter a position and wants one verdict covering liquidity, carry, crowding, and security — instead of four raw feeds plus its own synthesis. Not for: you need a single raw factor — funding_rates, open_interest, orderbook_depth or token_security are free; you are not about to size a position. This call settles $0.01 on-chain. Returns: verdict (ok/caution/avoid), factors{liquidity,carry,crowding,security} each with level + reason, components{orderbook_depth,funding_rates,open_interest}, symbol, side, size_usd Example response: {"symbol":"ETH","side":"long","size_usd":50000,"venue":"cex","verdict":"caution","factors":{"liquidity":{"level":"ok","slippage_pct":0.011,"bucket_usd":50000,"reason":"fills within 0.011% of best ask"},"carry":{"level":"caution","median_funding_pct":0.062,"annualized_pct":67.9,"reason":"longs paying elevated funding"},"crowding":{"level":"ok","long_short_ratio":1.4,"oi_change_24h_pct":3.2,"reason":"positioning unremarkable"},"security":{"level":"n/a","reason":"ETH is a native chain asset — no token contract to screen"}},"not_checked":["security"]} Price: $0.01 USDC per call (x402 over MCP: an unpaid call returns PaymentRequired; pay via _meta x402/payment)

  ConnectorNo auth

• search_cfrA

  US Federal Regulations (CFR)A

  Search the CFR. Use this when the user asks which US federal regulations or compliance rules cover a topic, including an OSHA, EPA or FDA rule, for example "which regulations mention respirator fit testing?", "find the rules on electronic signatures in title 21" or "where does the CFR define small business?". Pass 2 to 4 words and, if known, the CFR title to search in. A section must hold every word; when nothing does, the search drops the last words and says which query matched (matchedQuery). Returns the best matching sections with citation, heading, an excerpt, the agency and a link; use get_cfr_section to read one in full. This is general information, not legal advice. Do not use it for recent rulemaking news (use search_federal_register), statutes, state law or court decisions.

  ConnectorNo auth

• check_websiteA

  Corrie Site CheckA

  Loads the homepage of one public website over HTTPS, the way a visitor's browser would, and reports its HTTPS setup, TLS certificate and security headers (Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, cookie flags, mixed content and server banners). Returns a score from 0 to 100, a verdict, the TLS certificate issuer and expiry date, and each finding with a severity (critical, high, medium or low) and a plain-English fix that includes nginx or Cloudflare examples. Use it for questions like 'is example.com secure?', 'what security headers is my site missing?', 'when does this site's certificate expire?' or 'why does Chrome say my site is not secure?'. Input is a bare domain (example.com) or an https:// address. A bare domain checks the homepage; if you include a path, that one page is loaded instead. It does not log in, submit forms, scan ports, crawl other pages or test for vulnerabilities, and nothing is stored. It refuses private, internal and local addresses, plain http://, ports other than 443 and addresses with a user name; those come back as an isError result with a message saying what to change. A check usually takes 1 to 10 seconds. Running it twice on the same site gives the same result unless the site changed. Read corrie://docs/scoring for how the score and verdict work.

  ConnectorNo auth

• evaluate_solana_token_riskA

  Diogenes Web3, DeFi & 402 Security MCPA

  Evaluates Solana SPL and Token-2022 rug-pull risk by checking mint/freeze authorities, permanent delegates, transfer hooks, and returning reason codes with slot height. Use when making a pre-trade security decision on whether an SPL or Token-2022 mint is safe to trade; for DEX liquidity and metadata lookup via x402, use inspect_solana_token_liquidity instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'token_address' ('risk_profile' defaults to 'strict_decentralized'), supports '?demo=true' or L402 (20 sats), and returns HTTP 400 if invalid.

  ConnectorNo auth