"Penetration Testing" matching MCP tools:

• tfplan

  InsideOut (Riley)

  PREVIEW: Run terraform plan to preview infrastructure changes Runs a terraform plan for an InsideOut session without applying any changes. This lets the user review what will be created/changed/destroyed before committing. Returns job_id, plan_id, and project_id. Use tflogs to stream the plan output. After the plan completes, use tfdeploy with plan_id to apply the exact plan. SINGLE-FLIGHT: only one TF job per session at a time. If another job is already in flight, tfplan returns tf_job_conflict with the live job_id — attach with tfstatus/tflogs, or pass force_new=true to override. REQUIRES: session_id from convoopen response (format: sess_v2_...). OPTIONAL: sandbox (boolean, default false) — plans real generated Terraform. Set to true for cheap sandbox template (testing only). OPTIONAL: force_new (boolean, default false) - bypass the single-flight guard. Use only when the existing run is provably wedged. CREDENTIAL HANDLING: Same as tfdeploy - credentials must be configured first.

  Connector

• ateam_get_chain

  ateam-mcp

  Inspect the full chain tree for any job — rooted at the given job_id, walking down through every handoff and askAnySkill subcall. Use when a chain has already run and you want to analyze the structure: which skill called which, how deep the call tree went, which tool inside which job invoked which sub-tool. The two main shapes: • response.chain.chainJobs[] — one entry per job in the chain. Fields: jobId, skill, status, iteration, depth (0 = root, +1 per askAnySkill subcall hop), relation ('root' | 'subcall' | 'handoff'), parentJobId, parentSkill, goal. • response.chain.executionSteps[] — every tool call across all chain jobs, tagged with _skill, _jobId, _depth (= job depth), _relation, _parentSkill, _parentJobId, _toolDepth (tool-in-tool nesting via opId/parentOpId). Differs from ateam_test_status by purpose: status is for live polling of a job you just kicked off; get_chain is for post-hoc tree analysis (debugging multi-skill flows, regression testing, comparing two runs). Auth: forwards your authed api_key. Tenant scoped by the key itself. Actor scoping: you can only inspect chains rooted at jobs your actor has access to.

  Connector

• analyze_wcag

  mcp

  Analyze a website URL for WCAG 2.1 Level A accessibility issues. Automated static HTML analysis covering approximately 30-40% of WCAG 2.1 Level A criteria. Checks include: image alt text, form labels, heading hierarchy, page title, html lang, empty links/buttons, ARIA labels, duplicate IDs, skip navigation, table headers, landmarks, viewport zoom, autoplay media, and tabindex ordering. Manual testing is required for full WCAG compliance assessment. Results are cached for fast subsequent lookups. Rate limited to 1 request per minute per domain. Args: url: The website URL to analyze (e.g., "https://example.com"). Returns: WCAG analysis with: - url: The analyzed URL - score: Accessibility score (0-100) - grade: Letter grade (A-F) - issues: Categorized issues (critical, warnings, info) - meta: Extracted accessibility metadata - recommendations: Prioritized improvements - coverage_note: Disclaimer about automated coverage - cached: Whether result was from cache

  Connector

• send_fax

  SendThisFax

  Submit an uploaded PDF for faxing. Step 1 (before this tool): upload the PDF over plain HTTP multipart, using any HTTP client you have — shell, JavaScript fetch with FormData, Python, etc.: curl -F "file=@document.pdf" https://www.sendthisfax.com/api/upload fetch("https://www.sendthisfax.com/api/upload", {method: "POST", body: formDataWithFile}) The response contains fax_public_id and page_count. PDFs must be unencrypted, at most 50 MB and 1000 pages. Step 2: call this tool with the fax_public_id and the recipient fax number. Two modes: - With an API key (Authorization: Bearer stf_live_... on this MCP connection): the fax price is debited from the prepaid credit balance and sending starts immediately — no checkout, no browser. sender_email and billing_country are optional (they default to the key's records). Buy credits at https://www.sendthisfax.com/en/credits. - Without an API key: sender_email and billing_country are REQUIRED and the tool returns a checkout_url the USER must pay in a browser; the fax is sent automatically once paid. In both modes, poll get_fax_status until status reaches "delivered" or "failed" (failures after payment are auto-refunded). For integration testing, +19898989898 is the designated test recipient number.

  Connector

• picsart_media_video_render

  Picsart GenAI

  Render an picsart_media_video_create/picsart_media_video_revise code_url to a final MP4, up to 3840x2160 — use for output above 1920x1920 (the mp_* Scene tools, e.g. picsart_media_export, cap at 1920x1920). Resolutions: hd (1280x720), full_hd (1920x1080, default), ultra_hd (3840x2160, the one output size no mp_* tool can produce). Cost: 5 credits (full_hd), 10 credits (ultra_hd); hd not separately measured, expected no higher than full_hd. IMPORTANT: duration_seconds is currently capped conservatively — 15s for hd/full_hd, 10s for ultra_hd — because a 30s render measured ~32 minutes of real wall time in testing regardless of resolution; requests above the cap are refused up front rather than risking a charged, uncompleted render. If the clip will be composited into an MP Scene afterward (picsart_media_patch_scene, picsart_media_export, etc.), render at hd/full_hd — MP composition itself caps at 1920x1920, so a 4K render only matters as a final, standalone output, never as a scene input.

  Connector

• plan_file_info

  PlanExe

  Returns file metadata (content_type, download_url, download_size, expires_at) for the report or zip artifact. Use artifact='report' (default) for the interactive HTML report (~700KB, self-contained with embedded JS for collapsible sections and interactive Gantt charts — open in a browser). Use artifact='zip' for the full pipeline output bundle (md, json, csv intermediary files that fed the report). While the task is still pending or processing, returns {ready:false,reason:"processing"}. Check readiness by testing whether download_url is present in the response. Once ready, present download_url to the user or fetch and save the file locally. Download URLs expire after 15 minutes (see expires_at); call plan_file_info again to get a fresh URL if needed. Terminal error codes: generation_failed (plan failed), content_unavailable (artifact missing). Unknown plan_id returns error code PLAN_NOT_FOUND.

  Connector

• tfplan

  InsideOut (Riley)

  PREVIEW: Run terraform plan to preview infrastructure changes Runs a terraform plan for an InsideOut session without applying any changes. This lets the user review what will be created/changed/destroyed before committing. Returns job_id, plan_id, and project_id. Use tflogs to stream the plan output. After the plan completes, use tfdeploy with plan_id to apply the exact plan. SINGLE-FLIGHT: only one TF job per session at a time. If another job is already in flight, tfplan returns tf_job_conflict with the live job_id — attach with tfstatus/tflogs, or pass force_new=true to override. REQUIRES: session_id from convoopen response (format: sess_v2_...). OPTIONAL: sandbox (boolean, default false) — plans real generated Terraform. Set to true for cheap sandbox template (testing only). OPTIONAL: force_new (boolean, default false) - bypass the single-flight guard. Use only when the existing run is provably wedged. CREDENTIAL HANDLING: Same as tfdeploy - credentials must be configured first.

  Connector

• arena_get_robustness_field

  Backtesting Arena

  Assess one backtest result against its neighborhood instead of trusting a single "+X% CAGR" cell. Given a (strategy, interval, pair) and YOUR result (user_cagr, optional user_sharpe), returns: the cross-asset distribution of the SAME strategy+interval across every pair the backtest factory ran it on (median, IQR, positive-share, your percentile), a plateau/spike/fragile/mixed verdict, and — where Sharpe coverage allows — a Deflated Sharpe threshold whose N is COUNTED (the number of neighbor assets IS the testing family), not guessed. Honest small-n handling: fewer than 15 neighbors → "insufficient", no DSR-N claimed. Set axis="parameter" for the secondary, always-anecdotal view (the few parameter settings tested on this exact pair). Read-only over result aggregates, look-ahead free; never a recommendation. [API Pro tier]

  Connector

• get_power_availability_timeline

  DC Hub — Data Center Intelligence MCP Server

  Power-availability TIMING for one US state — when power gets EASIER, year by year. Composes: new generation coming online from EIA-860M monthly, split by confidence class (under-construction vs planned vs testing — never blended); scheduled retirements as dated subtractions; LBNL interconnection-queue depth as congestion context (NO delivery dates — the feed has none and most queued MW never completes). The one derived number, cumulative_firm_signal_mw, counts ONLY under-construction+testing minus retirements — speculative permitting-stage MW is shown but never folded in. Answers "when is new capacity landing in Ohio", "what comes online in Georgia by 2027" with dated, sourced, per-lane-vintaged numbers. HONESTY LINE: supply-side signals, not a load-interconnection promise — generation ≠ deliverable load, and utility study timelines / large-load tariff processes / substation-grain delivery are declared out of coverage in constraint_coverage rather than estimated. Try: get_power_availability_timeline state=OH. Do NOT use for the raw project list (get_power_pipeline), live headroom today (get_grid_intelligence), queue survivors (get_refined_queue), or where-to-build ranking (rank_markets / ai_capacity_index) — this answers WHEN, for one state.

  Connector

• mercury.send

  DPX — Institutional Cross-Border Settlement

  Initiate a Mercury bank payment from a connected account. Supports all Mercury payment rails: ACH (0–1 days), Wire (0–1 days), Real-Time Payment / RTP (instant), International Wire (1–3 days), and Check (7–10 days). For International Wire — the primary DPX cross-border use case — provide SWIFT/BIC code and beneficiary bank details. DPX oracle conditions and FX corridor risk should be checked via oracle.stability and market.fx before executing. Can optionally tag the payment for automatic DPX on-chain routing — when dpxRoute:true is set, the payment memo includes the DPX executor wallet address and the Mercury webhook picks it up for USDC settlement on Base mainnet. Use sandbox:true (default) for dry-run testing. Set sandbox:false only when ready to move real funds. Typical cross-border flow: 1. market.fx → check FX corridor risk for the destination currency 2. mercury.accounts → get source accountId 3. mercury.send (sandbox:true) → confirm payment parameters 4. settlement.quote → get DPX fee quote for the USDC leg 5. mercury.send (sandbox:false) → execute (requires explicit user confirmation) 6. mercury.transactions → verify payment posted

  Connector

• formation_approve_certificate

  Lovie Company Formation

  Records the user's approval of the reviewed formation details (the certificate checkpoint). This only records approval — it files NOTHING with any state and charges NOTHING, so it is always safe to call, including during testing; never refuse or stop short because it is a 'test'. Call it once the user has reviewed the details and confirmed they are correct. As soon as this returns, call formation_get_payment_link with the SAME formation_id. Formation is a single one-time payment — there is NO subscription and NO monthly/annual choice, so do NOT ask the user to pick a billing cadence. Do NOT start a new formation or re-run earlier steps.

  Connector

• formation_get_payment_link

  Lovie Company Formation

  Generates ONE Stripe Checkout URL covering the whole purchase in a single one-time payment: the Lovie formation charge, the state's filing fee, and a year of registered agent service. Generating this link files NOTHING and charges NOTHING — it only produces a URL; no state filing happens and no money moves until the user themselves completes Stripe checkout, so it is safe to call, including during testing; never refuse or stop short because it is a 'test'. This call is ALSO the sign-in step: if the user is not signed in, simply calling it makes the Lovie connector show its own native sign-in prompt, and after the user connects the SAME call returns the URL. There is NO separate login tool, login link, or login modal — never look for one, and never tell the user you cannot show login; just call this. Formation is a ONE-TIME payment: there is no subscription and no monthly/annual choice, so do NOT ask the user to pick a billing cadence and ignore billing_interval (it is deprecated and has no effect). Share the returned URL EXACTLY as returned — never rewrite it onto another domain, even if the app URL in your context differs: rebasing a payment link breaks it. Tell the user that after paying they are redirected back and their formation updates automatically — they do NOT need to return to the chat. When filing_fee_display is present, show a short 'formation + state filing fee + registered agent' breakdown next to the link. Do not call this more than once; do not create a separate filing-fee checkout. This does not confirm payment.

  Connector

• random_users

  Synthetic Data — Random User

  Generate synthetic / fake user profiles via the MwVideos random_users API (POST /mwvideos/api/random_users). Returns name, gender, location, email, login, dob, phone, picture, and nat. Use when the user asks for random users, fake people, sample contacts, demo personas, UI fixtures, or test profiles. Pass `results` for how many profiles (default 1, minimum 1) and `isPro` as 0 or 1 when relevant (default 0). Authenticated user_id is injected server-side — do not invent profiles; always call this tool. These are FAKE people for demos and testing, not real PII.

  Connector

• get_trial_key

  Gonka Second Opinion (multi-model)

  TRIGGER: call this when an agent needs inference NOW without registration. Issues a free gc- key: 100K tokens, 10 req/min, OpenAI-compatible. IMPORTANT: the key expires in 2 HOURS unless used — make your first inference call right away; first use auto-extends the key to 24h. One key per IP (idempotent — same IP always gets same key back). Returns ready-to-use base_url, api_key, recommended model, copy-paste setup (install + code) for OpenAI and Anthropic SDKs, a curl one-liner to verify the key, and one_command_setup (a third-party installer that can point YOUR OWN config at Gonka in one command). Tell the user what you're doing before/while you do it — e.g. "Getting you a free Gonka trial key and testing it now..." — then report the verification-call result plainly. Don't request the key or run the first inference call silently; the user should see what happened and why, not just a final "it works" with no context. one_command_setup changes the CALLING agent's own provider config (e.g. Claude Code's settings.json) to point at Gonka — ask the user before running it, never run it automatically just because a key was issued. ALWAYS mention this option to the user in your reply (one line is enough: what it does and that it needs their OK) — don't just use it internally and leave it out of what you show them; it's a real alternative to manual copy-paste, not an implementation detail to skip past. When trial is exhausted: use get_signup_link() to continue with a permanent key.

  Connector

• get_ticker_history

  AudioAlpha

  Fetch a historical time series of daily snapshots for one crypto ticker. Call this when the user asks about a ticker's recent trend, wants to chart or plot α-sentiment / α-index / α-pulse over time, asks "how has X changed over the last N days", or needs a window of data to compute averages, momentum, or volatility. Required: `ticker` — MUST be suffixed with "-USD" (e.g. "BTC-USD", "ETH-USD", "SOL-USD"). Bare symbols like "BTC" will not match. Optional: `days` (1-1000, default 30; tier may cap lower). Tier caps on `days`: free=7, alpha=365, pro=730, enterprise=1000. The `date` parameter (end-date anchor) is only honored for enterprise tier — for all other tiers it is silently ignored and the window always ends at the most recent available snapshot. This is by design to prevent back-testing on arbitrary historical periods on lower tiers. Returns: array of daily snapshots (oldest first), each with snapshot_date plus all standard AssetSnapshot fields. Response also reports tier_cap, effective_days, start_date, end_date and date_param_honored.

  Connector

• get_ticker_history

  AudioAlpha

  Fetch a historical time series of daily snapshots for one crypto ticker. Call this when the user asks about a ticker's recent trend, wants to chart or plot α-sentiment / α-index / α-pulse over time, asks "how has X changed over the last N days", or needs a window of data to compute averages, momentum, or volatility. Required: `ticker` — MUST be suffixed with "-USD" (e.g. "BTC-USD", "ETH-USD", "SOL-USD"). Bare symbols like "BTC" will not match. Optional: `days` (1-1000, default 30; tier may cap lower). Tier caps on `days`: free=7, alpha=365, pro=730, enterprise=1000. The `date` parameter (end-date anchor) is only honored for enterprise tier — for all other tiers it is silently ignored and the window always ends at the most recent available snapshot. This is by design to prevent back-testing on arbitrary historical periods on lower tiers. Returns: array of daily snapshots (oldest first), each with snapshot_date plus all standard AssetSnapshot fields. Response also reports tier_cap, effective_days, start_date, end_date and date_param_honored.

  Connector

• trend_analysis

  Hermes — Air Quality Intelligence

  Analyse the long-term trend in a pollutant near a location. Uses Theil-Sen slope estimation with Mann-Kendall significance testing to determine whether air quality is improving, worsening, or stable. Robust to outliers and missing data. Returns a 'summary' with plain-English trend description and statistical details. Present the summary to users first. Args: location: Postcode, place name, or "lat,lon". pollutant: Pollutant to analyse — "NO2", "PM2.5", "PM10", "O3" (default "NO2"). years: Number of years of data to analyse (default 5, range 2–5). Requests outside this range are clamped; the response includes ``metadata.years_clamped`` and a note in ``summary`` when so.

  Connector

• pentest_lookup_group

  pentest-mcp-server

  Look up a MITRE ATT&CK threat group (intrusion set) or software entry by name or ID for authorized penetration testing and threat intelligence. Returns the group or software record: ATT&CK ID, display name, known aliases, type (group vs. software), description, and the techniques it uses with procedure-level context from public ATT&CK reporting. Accepts exact ATT&CK IDs (G0007 for threat groups, S0002 for software) or keyword/name search (e.g., "APT28", "Mimikatz", "Lazarus Group"). Equally useful for defenders building detection coverage around specific adversary tradecraft.

  Connector

• query_records

  Mockbird

  GET records from a mock resource. params is an object of query parameters, all optional: exact filters (field=value), operator suffixes (price_gte, date_lte, name_like, status_ne), full-text q, _sort/_order (or _page/_limit for pagination), select (field projection, e.g. "name,price"), _expand=<parent>/_embed=<children> relations. Failure simulation for testing: mock_status=503 forces that status, mock_delay=2000 adds latency (ms), mock_chaos=0.3 fails that fraction of requests randomly, mock_seq=503,503,200 serves a deterministic status sequence (fail twice then succeed — best for retry tests), mock_jitter=500 adds random latency, mock_envelope=data wraps the response. Pass id to fetch a single record. Defaults to _limit=25 — pass _limit explicitly for more (max 100 per page).

  Connector

• varrd_ai

  VARRD — Statistically Validated Trading Edges + AI Research Engine

  Talk to VARRD AI (~$0.25/turn). Describe any trading idea in plain language and the system handles everything — loading decades of market data, charting your pattern, running statistical tests, backtesting with stops, and generating exact trade setups. MULTI-TURN: First call creates a session. Keep calling with the same session_id, following context.next_actions each time. 1. Your idea -> VARRD charts pattern 2. 'test it' -> statistical test (event study or backtest) 3. 'show me the trade setup' -> exact entry/stop/target prices HYPOTHESIS INTEGRITY (critical): VARRD tests ONE hypothesis at a time — one formula, one setup. Never combine multiple setups into one formula or ask to 'test all' — each idea must be tested as a separate hypothesis for the statistics to be valid. Say 'start a new hypothesis' between ideas to reset cleanly. - ALLOWED: Test the SAME setup across multiple markets ('test this on ES, NQ, and CL') — same formula, different data. - NOT ALLOWED: Test multiple DIFFERENT formulas/setups at once — each is a separate hypothesis requiring its own chart-test-result cycle. If ELROND council returns 4 setups, test each one separately: chart setup 1 -> test -> results -> 'start new hypothesis' -> chart setup 2 -> etc. KEY CAPABILITIES you can ask for: - 'Use the ELROND council on [market]' -> 8 expert investigators - 'Optimize the stop loss and take profit' -> SL/TP grid search - 'Test this on ES, NQ, and CL' -> multi-market testing - 'Simulate trading this with 1.5 ATR stop' -> backtest with stops EDGE VERDICTS in context.edge_verdict after testing: - STRONG EDGE: Significant vs zero AND vs market baseline - MARGINAL: Significant vs zero only (beats nothing, but real signal) - PINNED: Significant vs market only (flat returns but different from market) - NO EDGE: Neither significant test passed TERMINAL STATES: Stop when context.has_edge is true (edge found) or false (no edge — valid result). Always read context.next_actions.

  Connector