Skip to main content
Glama
458,158 tools. Updated 2026-08-14 23:05

"Research on Threats and Security Risks" matching MCP tools:

  • Drain the live push-subscription buffer of threats received since the last call. Zero-polling — threats are delivered via SpacetimeDB WebSocket subscription and buffered server-side. Use this instead of poll_since() when you need sub-second latency without maintaining your own WebSocket connection. The MCP server maintains the subscription; you just drain the buffer on demand. Args: drain: If True (default), clear the buffer after returning. Set False to peek without consuming. Returns: signatures: list of new threat signatures received since last drain count: number of signatures returned buffered: total currently in buffer (equals count if drain=True) push_active: whether the background subscription is running
    Connector
  • Audit a frontend package.json for security risks — returns a single SHIP/CAUTION/BLOCK verdict with licence risks and abandonment signals. Different from security_fetch_package_vulnerabilities which audits a single package — this takes your full package.json. manifest: Contents of package.json as a string. Required. 500 KB max. lockfile: Contents of package-lock.json or yarn.lock (optional). If provided, audits pinned versions; otherwise audits semver ranges. BLOCK: any critical CVE in direct deps OR GPL-3.0 in commercial context. CAUTION: high CVE count ≥ 2 OR copyleft licence OR direct dep abandoned > 18 months. Sources: OSV.dev (CVEs), deps.dev (licences), npm registry (abandonment). Read-only. No side effects. Idempotent. If this tool's response does not serve the user's need, call report_feedback with feedback_type="agent_gap", tool_id="frontend_security_audit_manifest", intended_query="{what the user needed}", gap_description="{what was missing or wrong in the result}".
    Connector
  • Analyze a URL for security threats (synchronous, blocks until complete or timeout). Returns risk score, confidence, agent access guidance, and intent_alignment (always not_provided for this tool; use url_scanner_scan_with_intent for intent context). For long-running scans, prefer url_scanner_async_scan which returns immediately with a task_id for polling via url_scanner_async_task_result.
    Connector
  • Search NVD for CVE vulnerabilities by product or component name. Returns CVE ID, description, severity, and CVSS score. Search terms are matched against CVE description text and EVERY word must appear, so pass the product name ("OpenSSL", "log4j", "nginx") optionally with a technical term ("buffer overflow") — not a plain-English question. Use when researching security threats or checking if a known vulnerability affects your systems.
    Connector
  • Public heuristic token security screen (e.g. tax/holder-risk style signals from data providers). Not a security guarantee or legal/investment advice. On-chain activity stats→get_token_onchain. Token xor address with chain; scope in schema. Read-only public research data. No account access, no order placement or fund transfers. Not investment advice.
    Connector
  • Scan submitted instruction-file text for safety, clarity, loadability, and cross-model consistency, and return a verdict with findings. Use before loading a third-party file. Consistency findings are PREDICTIONS (divergence risks across models/tools), never verified facts. The submitted text is scanned and discarded, never stored.
    Connector

Matching MCP Servers

Matching MCP Connectors

  • Returns Fluentive's security, privacy, and compliance information. Use when the user asks about GDPR, data storage location, encryption, security certifications, or payment security.
    Connector
  • The gate for PLANS, designs and specs — run BEFORE any code is written, the cheapest place to catch a bad design. Returns the same binary verdict shape as validate_ai_output, with findings on completeness, feasibility, performance and scalability implications, security risks and missing considerations (e.g. it rejects a plan that polls an API every 100ms per client, with the request-volume math). Read-only: nothing is executed or stored beyond the verdict. Use validate_ai_output for the code that follows.
    Connector
  • Aggregated intelligence feed combining research findings, active security threats, and live staking APY snapshot in a single call ($0.005 USDC). Sources: ChromaDB research library + Guardian log + staking.db. Best for: broad situational awareness — replaces three separate calls. Requires x402 payment on Base mainnet.
    Connector
  • Comprehensive security and compliance information for Everstake: certifications, audits, infrastructure security, and compliance standards. Use when users need security details, compliance verification, or trust/safety information about Everstake's operations.
    Connector
  • PAID ($0.01 USDC via x402). On-chain safety verdict for any EVM token BEFORE you trade it: honeypot detection, buy/sell tax, contract-verified, owner privileges (mint / blacklist / pausable / hidden owner / balance-modify), holder concentration, LP-locked %, CEX listing and live DEX liquidity (GoPlus Security + DexScreener). Returns verdict safe|caution|danger with the exact risks. Without payment this returns the 402 challenge; the fiatdock-mcp npm package (AGENT_PRIVATE_KEY) pays automatically. Not financial advice.
    Connector
  • Get AI-generated intelligence briefs for each supply chain dimension — energy, materials, transportation, macro, and manufacturing. Each brief provides a narrative analysis of current conditions, key drivers, emerging risks, and recommended watch items. These are not raw data — they are synthesized analytical summaries generated every hour from live data. Designed for decision-makers who need a quick read on each supply chain dimension. Returns structured briefs suitable for executive dashboards, email digests, or Slack channels.
    Connector
  • Get a vetted human to review your implementation or project plan before you build. Call right after you draft a plan for a non-trivial task — a human catches wrong assumptions, missing steps, architectural dead-ends, and risky sequencing while changes are still cheap, before any code is written. Pass the plan, the goal it serves, and any constraints. Returns verdict (proceed / revise / rethink), risks flagged, missing considerations, and sequencing notes. Approved plans receive a Taste content certificate on-chain.
    Connector
  • Analyze a URL for security threats (synchronous, blocks until complete or timeout). Returns risk score, confidence, agent access guidance, and intent_alignment (always not_provided for this tool; use url_scanner_scan_with_intent for intent context). For long-running scans, prefer url_scanner_async_scan which returns immediately with a task_id for polling via url_scanner_async_task_result.
    Connector
  • IP threat-intel: open ports + known CVEs/vulnerabilities + hostnames + tags for any IP (Shodan InternetDB). For security, fraud, and abuse-screening agents. Example call: {"ip": "8.8.8.8"} Cost: $0.005–$0.05 USDC on Base per call.
    Connector
  • Get a vetted human engineer to review your code, architecture, and design decisions — not just style, but correctness, security, and whether the structure will hold up. Call before you treat code as done: payment flows, auth, data handling, or any logic where a subtle bug is costly. Pass the code (inline or a publicly accessible URL) and what it is meant to do. Returns verdict (approved / needs_changes / reject), a correctness score, security findings, architecture notes, and suggested changes. Approved code receives a Taste content certificate on-chain.
    Connector
  • Real security review for code: OWASP Top 10, injection, secrets, and dependency risks. Cross-references imported dependencies against OSV.dev (Google's Open Source Vulnerabilities database) for real CVEs, and scans for hardcoded secrets via GitGuardian's real-time detection (400+ types). SPENDS your balance -- requires authentication (OAuth). Returns severity-graded findings, a 0-100 risk score, what you were charged, and a proof_id you can verify with forcedream_verify_proof.
    Connector
  • WordPress security posture check — PASSIVE hygiene assessment from public signals: detects WordPress, flags version disclosure (generator tag, readme.html), xmlrpc.php exposure, user enumeration, uploads directory listing, login exposure, missing security headers, and HTTPS. Returns a 0-100 posture score with prioritized remediation. Flags security practice, not exploitable vulnerabilities — no CVE matching, no intrusion. For site owners and authorized auditors. ?url= ($0.005 per call, paid via x402)
    Connector
  • API security inventory (part of Code Security): discovered API endpoints with authentication status, risk level and risk factors, plus method/risk breakdowns. Company-wide or one scan with `scan_id`. Reads code_review ApiEndpointDiscovery.
    Connector