"Parrot Security" matching MCP tools:

• code_get_findingsA

  searchcodeA

  Get detailed code quality findings from a remote public git repository. Returns rule IDs, line numbers, severity, category, descriptions, and source snippets. Supports filtering by file path, severity (error, warning, info), category (security, deprecated, safety, correctness, maintainability, accessibility, modernization, performance, concurrency), and kind (security, quality) — kind=security is every security-category finding in one call, kind=quality is everything else. code_analyze.top_findings shows only the quality half; use kind=security here to see the security-category findings it leaves out. THIS IS NOT THE SECRET SCANNER. kind=security means insecure code — weak hashes, unsafe deserialization, injection-shaped patterns — and it will not find a leaked API key or private key. Leaked credentials are code_analyze.security_summary, which is a different scanner over different rules; the two sets do not overlap, so an audit wants both. Use after code_analyze to drill into specific findings. Shares the same analysis cache — no duplicate work if analyze already ran.

  ConnectorNo auth

• security_headers_checkA

  IA-QA — 130+ QA & Dev Tools for AI AgentsA

  Analyse the HTTP security headers of a public URL OR of raw response headers you paste in. Grades each header (A–F) for: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, X-XSS-Protection, Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy, and Cross-Origin-Embedder-Policy. Returns an overall score (0–100), per-header grades, missing headers, and fix snippets for Express, Nginx, and Apache. For localhost/private targets the remote server cannot reach, pass the `headers` parameter instead of `url`.

  ConnectorNo auth

• get_security_infoA

  Fluentive MCPA

  Returns Fluentive's security, privacy, and compliance information. Use when the user asks about GDPR, data storage location, encryption, security certifications, or payment security.

  ConnectorNo auth

• info_compliance_check_token_securityA

  Gate Info MCPA

  Public heuristic token security screen (e.g. tax/holder-risk style signals from data providers). Not a security guarantee or legal/investment advice. On-chain activity stats→get_token_onchain. Token xor address with chain; scope in schema. Read-only public research data. No account access, no order placement or fund transfers. Not investment advice.

  ConnectorNo auth

• list_security_guidanceA

  RoutebaseA

  List the static security guidance library — one entry per OWASP API-security issue with its remediation text, code examples and references. Pass guidanceId (the guidanceId of a finding) for a single entry. The library is global, not project-specific. Use this for the general library; for advice on one finding use get_finding_remediation.

  ConnectorAPI key

• contact_depscopeA

  DepScopeA

  Inbound ticket: bug/listing/security/anomaly/partnership. USE WHEN: reporting wrong data (`bug`), requesting a new pkg/ecosystem index (`listing`), disclosing a DepScope security issue (`security`), flagging a concrete mismatch in another tool's output vs. authoritative source (`anomaly` — provide tool_called+observed+expected), or partnership/press (`partnership`). RETURNS: {ticket_id} or {anomaly_id}.

  ConnectorNo auth

• get_securityA

  IP Address APIA

  The caller's connection security: TLS version/cipher, HTTP protocol, TCP RTT and bot-detection signals.

  ConnectorNo auth

• get_wp_assessA

  webbersites-x402-data-apiA

  WordPress security posture check — PASSIVE hygiene assessment from public signals: detects WordPress, flags version disclosure (generator tag, readme.html), xmlrpc.php exposure, user enumeration, uploads directory listing, login exposure, missing security headers, and HTTPS. Returns a 0-100 posture score with prioritized remediation. Flags security practice, not exploitable vulnerabilities — no CVE matching, no intrusion. For site owners and authorized auditors. ?url= ($0.005 per call, paid via x402)

  ConnectorNo auth

• get_api_securityA

  aribotA

  API security inventory (part of Code Security): discovered API endpoints with authentication status, risk level and risk factors, plus method/risk breakdowns. Company-wide or one scan with `scan_id`. Reads code_review ApiEndpointDiscovery.

  ConnectorNo auth

• tailscale_delete_keyA

  tailscaleA

  Delete (revoke) an auth key or API access token by id — a security response. Tailscale REST: DELETE /tailnet/{tailnet}/keys/{keyId}.

  Connector

  Destructive

  No auth

• scan_websiteA

  ScanLabsAI Security ScannerA

  Run a ScanLabsAI security scan against a website and return a full Markdown vulnerability report (grouped by severity, with descriptions and remediation) that you can analyse, act on, and the user can save as security-report.md. Checks OWASP Top 10, CVEs, SSL/TLS, security headers and DNS. Use deep=true for a comprehensive scan (40,000+ vectors, slower). Only scan sites the user is authorised to test.

  ConnectorNo auth

• audit_bundleA

  HubVibe Site AuditsA

  Full website audit in one call: accessibility (WCAG 2.1 A/AA via axe-core), on-page SEO, HTTP security headers and page speed / page weight, from a single browser load of one URL. Cheaper than four separate calls; if any part cannot run, nothing is billed. $0.15 per call. Returns: pass (bool) plus wcag{}, seo{}, security{}, performance{} sub-results.

  ConnectorNo auth

• generate_diagramA

  ALM X++ MCP ServerA

  WHEN: generating a visual diagram of D365 table relationships or security chains. Triggers: 'generate diagram', 'diagramme', 'visualize', 'schéma', 'ER diagram', 'entity-relationship', 'relation diagram', 'security diagram', 'show connections'. Generate visual Mermaid diagrams from D365 F&O knowledge base data. Diagrams render directly in Copilot Chat, Cursor, Claude, and markdown viewers. Types: 'er' (entity-relationship diagram for a table and its relations), 'security' (security chain: Role->Duty->Privilege->EntryPoints -- use when you need a VISUAL Mermaid diagram; for the structured text chain with tables of duties/privileges/entry-points use `trace_security_chain` instead). Note: 'flow' (execution flowchart) is disabled -- static call trees are misleading in D365 due to CoC and event handlers.

  ConnectorNo auth

• scan_securityA

  security-toolsA

  Run a free front-end security check on any website and get a letter grade (A to F) plus specific findings. Answers questions like 'is example.com leaking API keys or secrets in its front-end code', 'does this site expose a Stripe/AWS/OpenAI key or a publicly readable database', or 'how is this website's client-side security'. Reads only what the site serves publicly; never logs in or changes anything.

  ConnectorNo auth

• analyze_driftA

  BlackVeil DNS & Email Security ScannerA

  Measure whether a domain's DNS security posture improved or regressed by comparing the current state against a prior scan snapshot. Returns a drift classification (improving/stable/regressing/mixed), score delta, and lists of improvements and regressions. Use to answer "did our security score improve or regress since last time?" — distinct from compare_baseline which checks compliance against a fixed policy (not improvement over time).

  ConnectorNo auth

• aeo_generateA

  mcpA

  Génère (sans appliquer) un artefact AEO, déterministe et gratuit. Types : jsonld, robots, llms, meta, faq (params faqs[]), ai-txt, humans-txt, security-txt, sitemap. jsonld/robots/llms/meta/faq sont applicables (cf. aeo_apply) ; ai-txt/humans-txt/security-txt/sitemap sont à publier par l’agence.

  ConnectorNo auth

• get_service_detailsA

  Aevum SecurityA

  Full details of one Aevum Security service, by slug from list_services.

  ConnectorNo auth

• market_symbol_searchA

  UnquantA

  Find ticker symbols by company name or ticker text for security identification.

  ConnectorNo auth

• aeo_generateA

  mcpA

  Génère (sans appliquer) un artefact AEO, déterministe et gratuit. Types : jsonld, robots, llms, meta, faq (params faqs[]), ai-txt, humans-txt, security-txt, sitemap. jsonld/robots/llms/meta/faq sont applicables (cf. aeo_apply) ; ai-txt/humans-txt/security-txt/sitemap sont à publier par l’agence.

  ConnectorNo auth

• check_email_securityA

  IntoDNS.ai DNS & Email Security ScannerA

  Read-only combined email-security check covering SPF parse, DKIM selector discovery, DMARC policy validation, MX IP blacklist status across major feeds, and an aggregated 0-100 email-security score with prioritised issue list. Single call replaces sequential check_spf + discover_dkim + check_dmarc + check_blacklist for the typical case. Use for one-shot email security overview; use check_sender_requirements specifically for Google/Yahoo bulk-sender compliance, or the individual check_* tools when you need only one signal. No auth, ~3-8s.

  ConnectorNo auth

• post_domain_due_diligenceA

  ProfitCollectorC

  The most comprehensive domain assessment: DNS + mail security (SPF/DKIM/DMARC) + TLS + HTTP headers, scored. The only endpoint in this group that adds mail-security analysis. Use for a one-shot decision-grade verdict on an unfamiliar domain; use /dns/lookup, /ssl/check, /security/headers, /web/audit or /security/posture instead for a single fact or a cheaper signal.

  ConnectorNo auth