"OWASP Dependency-Check" matching MCP tools:

• get-logsA

  mcpA

  Get build and runtime logs for a deployment. If no deployment_id is provided, returns logs for the latest deployment. Use this after calling deploy to monitor build progress and diagnose failures. Logs include: framework detection output, dependency installation, build steps, container startup, and health check results. If a deployment fails, check the logs for error details — common issues include missing dependencies, build errors, or the app not listening on the correct PORT (check the PORT env var — 8080 for auto-detected frameworks, or the EXPOSE value from Dockerfile).

  ConnectorNo auth

• receipts.verifyA

  gblin-treasury-risk-regimeA

  Verify a gblin-receipt/v1 JSON with pure math (no log lookup, no trust in this server): leaf hash, Ed25519 signature, RFC 6962 inclusion proof, C2SP checkpoint signature, verifier-key hash. Same checks as the zero-dependency verify-receipt.mjs you can run offline. For the extra on-chain-anchor consistency check use GET /v1/verify/:index.

  ConnectorNo auth

• watch_domainA

  Dechonet-MCPA

  Start (or reuse) a daily DechoNet watch on a domain so that changes are recorded over time — SSL grade/issuer/expiry, DNS records, HTTP security headers, domain registration, and optionally OWASP posture and impersonation exposure. Use this once when the user cares about a domain beyond a one-off check (their own domain, a client, a vendor, a target under investigation). After this, domain_changes answers "what changed since last time?" from real daily snapshots. Not read-only (it creates a watch record) but idempotent: watching an already-watched domain returns the existing watch. No account, no email, no PII — a watch is keyed by domain+tool and its history page is a public unguessable URL you can share with the user. Rate-limited (a few watches per minute).

  ConnectorNo auth

• watch_domainA

  mcpA

  Start (or reuse) a daily DechoNet watch on a domain so that changes are recorded over time — SSL grade/issuer/expiry, DNS records, HTTP security headers, domain registration, and optionally OWASP posture and impersonation exposure. Use this once when the user cares about a domain beyond a one-off check (their own domain, a client, a vendor, a target under investigation). After this, domain_changes answers "what changed since last time?" from real daily snapshots. Not read-only (it creates a watch record) but idempotent: watching an already-watched domain returns the existing watch. No account, no email, no PII — a watch is keyed by domain+tool and its history page is a public unguessable URL you can share with the user. Rate-limited (a few watches per minute).

  ConnectorNo auth

• check-packageA

  Jeevesus — DugganUSA Threat Intelligence MCPA

  Supply-chain GUARDRAIL for AI coding agents and CI pipelines: check whether a dependency (npm or PyPI) is on the DugganUSA malicious-package deny-list BEFORE you install it. This is the runtime defense against slopsquatting / HalluSquatting / hijacked-package attacks — an AI agent about to run `npm install` or `pip install`, or a CI pre-install hook, calls this FIRST and blocks on a hit. Returns a crisp, machine-actionable verdict: {ecosystem, package, version, malicious, verdict:"block"|"allow"|"review", reason, advice, source}. `malicious:true` = the exact package is on our OSV-curated deny-list (215k+ named-not-heuristic entries across npm + PyPI). `malicious:false` = not on our known-bad list — absence is NOT proof of safety, so still pin and review new deps. If a `version` is supplied and the entry is version-scoped, the check is version-aware; all-versions-malicious packages block on any version. Designed to be the easiest AI-supply-chain guardrail to wire in: one MCP tool call, no auth, in the agent's pre-install step. Same data is available for CI at /api/v1/stix-feed/packages.json. Examples: {"ecosystem":"npm","name":"cxp-jquery"} → malicious:true, verdict:block. {"ecosystem":"pypi","name":"requests"} → malicious:false, verdict:allow.

  ConnectorNo auth

• evaluate_dependency_changeA

  RepoPilotA

  CALL immediately before adding or upgrading an npm dependency. Answers "is this exact version safe to take on" from registry metadata, advisory deltas, provenance, license, and repository evidence, and returns blockers, warnings, a recommendation, and a verification plan. Example: {"dependency":"lodash","to_version":"4.17.21"} — every field is top-level, never nested under a "change" key. Only `dependency` is required — omit to_version to evaluate the latest published version, exactly as `npm install <pkg>` would. to_version also accepts a dist-tag ("latest") or a SemVer range ("^4.17.0"); it resolves to one exact version, reported back in change.to_version. Everything RepoPilot can infer is inferred, and every default, repair, and resolution is listed in input_adjustments. Evaluates only; never installs or edits anything.

  ConnectorNo auth

• owasp_checkA

  Dechonet-MCPA

  Assess a domain's OWASP posture from EXTERNAL OBSERVATION only: the OWASP Secure Headers Project plus the externally observable Top 10 subset — A02 Cryptographic Failures (TLS/cert), A05 Security Misconfiguration (header/info leaks), and A06 Vulnerable & Outdated Components (version disclosure) — returning an A+ to F grade. IMPORTANT SCOPE: this does NOT check A01 (Access Control), A03 (Injection), A04, A07 (Authentication), A08, A09, or A10 (SSRF) — those require authenticated access or active/injection testing and are explicitly reported as out-of-scope, never as "pass". Do not present this as a full OWASP Top 10 assessment. Unlike security_scan this is fully PASSIVE (a normal HTTP GET plus a public CT-log lookup, no port scan), so it is safe and lawful to run on domains you do not own. Use http_security or ssl_check for depth on one layer. Read-only; requires no API key; rate-limited. Returns a text report: grade, per-category findings, the out-of-scope list, and a shareable report link.

  ConnectorNo auth

• owasp_checkA

  mcpA

  Assess a domain's OWASP posture from EXTERNAL OBSERVATION only: the OWASP Secure Headers Project plus the externally observable Top 10 subset — A02 Cryptographic Failures (TLS/cert), A05 Security Misconfiguration (header/info leaks), and A06 Vulnerable & Outdated Components (version disclosure) — returning an A+ to F grade. IMPORTANT SCOPE: this does NOT check A01 (Access Control), A03 (Injection), A04, A07 (Authentication), A08, A09, or A10 (SSRF) — those require authenticated access or active/injection testing and are explicitly reported as out-of-scope, never as "pass". Do not present this as a full OWASP Top 10 assessment. Unlike security_scan this is fully PASSIVE (a normal HTTP GET plus a public CT-log lookup, no port scan), so it is safe and lawful to run on domains you do not own. Use http_security or ssl_check for depth on one layer. Read-only; requires no API key; rate-limited. Returns a text report: grade, per-category findings, the out-of-scope list, and a shareable report link.

  ConnectorNo auth

• axint.upgradeA

  AxintA

  Check the latest Axint package and optionally apply the upgrade while preserving the current agent thread. Use: call when axint.status shows a stale server; not for app dependency upgrades. Inputs: apply defaults false; targetVersion selects the install, while reinstallXcode and writeReport matter only when applying. Effects: destructive when apply=true: can run package installs, refresh Xcode wiring, and write .axint/upgrade; may use npm.

  Connector

  Destructive

  No auth

• aidefense_locate_conceptA

  website-searchA

  Reverse-lookup a single concept ID (MITRE ATLAS technique like 'AML.T0051', OWASP LLM Top 10 risk like 'LLM01', OWASP Agentic Top 10 issue like 'ASI03', or ISO 42001 Annex A clause like 'A.6') across the AI Defense Matrix. Returns which framework the concept belongs to, the asset rows whose alignment cites it, the cells whose evaluation cellPrompts cite it, and those prompts themselves. Useful when a vendor's product is defined by a specific technique ('we defend AML.T0051') and they need to find which matrix cells to claim. Recognizes only concepts with structured IDs; for prose-only frameworks (NIST IR 8596, CSA AICM, Google SAIF, OWASP AI Exchange) use aidefense_get_framework_alignment instead. This server never requests your program docs or product roadmap and instructs your AI to keep them local—the matrix, framework alignments, and playbooks flow to your AI for local analysis.

  ConnectorNo auth

• check_mcp_serverA

  Dredd MCPA

  Pre-flight security verdict for an MCP server invocation. Judges BOTH server-level reputation AND the server's dependency graph (npm/pypi) against the DugganUSA threat-intel corpus (1.13M+ IOCs, Shai-Hulud + typosquat + LOLBin families). Returns BLOCK / ADVISORY / REVIEW / ALLOW with severity, evidence, dep-graph summary, and HMAC-signed response. REVIEW means we hold NO RECORD of this server -- not that it is safe. Treat REVIEW as do-not-proceed-blindly: a brand-new attacker-published server looks exactly like this. ALLOW is only returned when we actually resolved the server and scanned its dependency graph; check known_to_us and dep_graph.scanned to confirm. Use this BEFORE invoking any other MCP server tool, especially ones installed from outside the official MCP Registry.

  ConnectorNo auth

• security_audit_sbom_continuousA

  DataNexus MCPA

  Persistent SBOM watch. Register once, check anytime for new CVEs affecting your dependency snapshot. Silent permanent watch — CycloneDX and SPDX supported. Uses OSV.dev for vulnerability lookup, Redis for persistence with 90-day TTL. Supports CycloneDX 1.4/1.5 and SPDX 2.3 JSON. Input size limit: 500 KB. Returns go_no_go signal on register; new_findings on check. Rate limit: 10/minute. No auth required. For DevSecOps teams monitoring production dependency exposure. If this tool's response does not serve the user's need, call report_feedback with feedback_type="agent_gap", tool_id="security_audit_sbom_continuous", intended_query="{what the user needed}", gap_description="{what was missing or wrong in the result}".

  Connector

  Destructive

  No auth

• impactA

  Enhanciar — company brainA

  Compute the blast radius of changing ``target`` in the key's workspace. Use this before editing code to see what a change ripples into: direct callers/callees, every affected file, the affected tests, the transitive dependency set, and example dependency paths with per-path facts (hops, dependents at the endpoint, whether it lands in a test). There is deliberately no risk score. There was one — thresholds on the transitive count — and it was a verdict the caller could not check or argue with. The counts it was computed from are all here; judge from those. Args: target: A graph node id, wiki page name, file path (``micrograd/engine.py``), or a function fqn (``engine.py::func``). depth: How many hops to traverse the call graph (default 2). Returns the impact dict — ``{target, label, found, direct_callers, direct_callees, affected_files, affected_tests, transitive_nodes, transitive_count, paths, path_facts}``.

  ConnectorNo auth

• check_packageA

  Hextrap MCPA

  Check if a package is allowed by a hextrap firewall and verify it is not a suspected typosquat. Call this BEFORE suggesting any npm, PyPI, or Go dependency to ensure it meets security policy.

  ConnectorAPI key

• dependency-go-no-goA

  SALT19 Agent Utility GridB

  Dependency approval decision for coding agents: decide whether an npm dependency or package is safe to install or adopt and return GO, WARN, or BLOCK using vulnerabilities, security, license, maintenance, deprecation, and package metadata. Price: $0.25 via x402. Generate one _salt19_operation_id per intended purchase, preserve it across retries, and add _x402_payment_signature after satisfying the challenge. A stable _salt19_operation_id is required and makes semantic retries at-most-once. _salt19_operation_id is recommended but optional for standard x402 compatibility.

  ConnectorNo auth

• list_security_guidanceA

  RoutebaseA

  List the static security guidance library — one entry per OWASP API-security issue with its remediation text, code examples and references. Pass guidanceId (the guidanceId of a finding) for a single entry. The library is global, not project-specific. Use this for the general library; for advice on one finding use get_finding_remediation.

  ConnectorAPI key

• style-checkA

  dot•requirementsA

  Get AI style feedback on requirements content against the project's style rubric. Pass 'markdown' to check content you're composing BEFORE creating/editing a document (recommended), or 'document' to check a document's published content. Provide exactly one of the two.

  ConnectorOAuth

• project-add-dependencyA

  Planner (proof-of-done)A

  Declare that one project depends on another (depends-on relationship). Accepts UUID or slug for both sides. Idempotent: if the dependency already exists, returns it with already_existed=true. Self-references are rejected. No cycle detection — the caller is responsible for avoiding circular chains.

  ConnectorNo auth

• adw.adw_339A

  AlpineDataWorks Intelligence ServerB

  Returns a 0-100 software supply-chain vulnerability pressure index (per-package CVSS3 sums over recent npm and PyPI GA releases via deps.dev, max-normalized, basket mean) with weekly history, top_drivers identifying pressure-driving packages, and audit-ready source lineage. Call when the user asks about open-source dependency risk, CVE/CVSS severity trends, npm or PyPI package security, or supply-chain attacks, or when timing dependency upgrades, patch prioritization, or deployment gating. Updates: weekly.

  ConnectorNo auth

• get_dependenciesA

  RubygemsA

  Get the runtime and development dependencies for a specific version of a Ruby gem. Returns each dependency with its version requirement string. Omit version to get the latest.

  ConnectorNo auth

• forcedream_security_scanA

  mcp-serverA

  Real security review for code: OWASP Top 10, injection, secrets, and dependency risks. Cross-references imported dependencies against OSV.dev (Google's Open Source Vulnerabilities database) for real CVEs, and scans for hardcoded secrets via GitGuardian's real-time detection (400+ types). SPENDS your balance -- requires authentication (OAuth). Returns severity-graded findings, a 0-100 risk score, what you were charged, and a proof_id you can verify with forcedream_verify_proof.

  ConnectorNo auth