"Research on Threats and Security Risks" matching MCP tools:

• frontend_security_audit_manifestA

  DataNexus MCPA

  Audit a frontend package.json for security risks — returns a single SHIP/CAUTION/BLOCK verdict with licence risks and abandonment signals. Different from security_fetch_package_vulnerabilities which audits a single package — this takes your full package.json. manifest: Contents of package.json as a string. Required. 500 KB max. lockfile: Contents of package-lock.json or yarn.lock (optional). If provided, audits pinned versions; otherwise audits semver ranges. BLOCK: any critical CVE in direct deps OR GPL-3.0 in commercial context. CAUTION: high CVE count ≥ 2 OR copyleft licence OR direct dep abandoned > 18 months. Sources: OSV.dev (CVEs), deps.dev (licences), npm registry (abandonment). Read-only. No side effects. Idempotent. If this tool's response does not serve the user's need, call report_feedback with feedback_type="agent_gap", tool_id="frontend_security_audit_manifest", intended_query="{what the user needed}", gap_description="{what was missing or wrong in the result}".

  ConnectorNo auth

• analyze_productA

  hooklayerA

  Deeply validate ONE TikTok Shop product before committing money or content to it. Give it a product_id from product_scout (or any TikTok Shop product URL) and it reads the listing, samples reviews across the full depth rather than only the most recent page, pulls comparable competitors, and returns what buyers actually say. You get: provider-reported sold / review / rating / price evidence; buyer voice split into what buyers praise and what they complain about; unmet needs and purchase objections in buyers' own words; return and fulfilment signal; a Why Now read; competitor intelligence and where rivals are weak; risks separated into product risks, market risks and data-confidence risks; and a 'how to beat this' synthesis of concrete differentiation angles traced back to specific review evidence. Every section states whether it resolved - provider facts, HookLayer analysis and genuinely unavailable evidence are distinguishable, and thin evidence is reported as thin rather than filled in. There is no revenue or GMV output and sold counts are never multiplied by price. Use product_scout first to find candidates, then this to decide between them. Cost: 10 credits. Requires the shop_intelligence entitlement.

  ConnectorNo auth

• url_scanner_scanA

  PreClick — An MCP-native URL preflight scanning service for autonomous agents (formerly URLCheck).A

  Analyze a URL for security threats (synchronous, blocks until complete or timeout). Returns risk score, confidence, agent access guidance, and intent_alignment (always not_provided for this tool; use url_scanner_scan_with_intent for intent context). For long-running scans, prefer url_scanner_async_scan which returns immediately with a task_id for polling via url_scanner_async_task_result.

  ConnectorNo auth

• url_scanner_scanA

  PreClick — An MCP-native URL preflight scanning service for autonomous agents.A

  Analyze a URL for security threats (synchronous, blocks until complete or timeout). Returns risk score, confidence, agent access guidance, and intent_alignment (always not_provided for this tool; use url_scanner_scan_with_intent for intent context). For long-running scans, prefer url_scanner_async_scan which returns immediately with a task_id for polling via url_scanner_async_task_result.

  ConnectorNo auth

• get_security_infoA

  Fluentive MCPA

  Returns Fluentive's security, privacy, and compliance information. Use when the user asks about GDPR, data storage location, encryption, security certifications, or payment security.

  ConnectorNo auth

• get_new_threatsA

  Nullcone Threat IntelligenceA

  Drain the live push-subscription buffer of threats received since the last call. Zero-polling — threats are delivered via SpacetimeDB WebSocket subscription and buffered server-side. Use this instead of poll_since() when you need sub-second latency without maintaining your own WebSocket connection. The MCP server maintains the subscription; you just drain the buffer on demand. Args: drain: If True (default), clear the buffer after returning. Set False to peek without consuming. Returns: signatures: list of new threat signatures received since last drain count: number of signatures returned buffered: total currently in buffer (equals count if drain=True) push_active: whether the background subscription is running

  ConnectorNo auth

• validate_planA

  Verificate MCPA

  The gate for PLANS, designs and specs — run BEFORE any code is written, the cheapest place to catch a bad design. Returns the same binary verdict shape as validate_ai_output, with findings on completeness, feasibility, performance and scalability implications, security risks and missing considerations (e.g. it rejects a plan that polls an API every 100ms per client, with the request-volume math). Read-only: nothing is executed or stored beyond the verdict. Use validate_ai_output for the code that follows.

  ConnectorNo auth

• search_cvesA

  NvdA

  Search NVD for CVE vulnerabilities by product or component name. Returns CVE ID, description, severity, and CVSS score. Search terms are matched against CVE description text and EVERY word must appear, so pass the product name ("OpenSSL", "log4j", "nginx") optionally with a technical term ("buffer overflow") — not a plain-English question. Use when researching security threats or checking if a known vulnerability affects your systems.

  ConnectorNo auth

• get_environmental_risk_forecastA

  GOES HealthA

  Forecast outdoor environmental health risks at a location, based on weather and air quality forecasts. Use this for plans later today or in the next 8 days; use get_environmental_risk for right now. Returns a list of times (in UTC, ISO 8601), each with risk scores (0=none, 1=low, 2=medium, 3=high). Risks missing from a time don't apply then (e.g. frostbite on a warm afternoon). Safety tips aren't included; get them from get_environmental_risk.

  ConnectorNo auth

• info_compliance_check_token_securityA

  Gate Info MCPA

  Public heuristic token security screen (e.g. tax/holder-risk style signals from data providers). Not a security guarantee or legal/investment advice. On-chain activity stats→get_token_onchain. Token xor address with chain; scope in schema. Read-only public research data. No account access, no order placement or fund transfers. Not investment advice.

  ConnectorNo auth

• token_safetyA

  FiatDockA

  PAID ($0.0045 USDC via x402). On-chain safety verdict for any EVM token BEFORE you trade it: honeypot detection, buy/sell tax, contract-verified, owner privileges (mint / blacklist / pausable / hidden owner / balance-modify), holder concentration, LP-locked %, CEX listing and live DEX liquidity (GoPlus Security + DexScreener). Returns verdict safe|caution|danger with the exact risks. Without payment this returns the 402 challenge; the fiatdock-mcp npm package (AGENT_PRIVATE_KEY) pays automatically. Not financial advice.

  ConnectorNo auth

• check_complianceA

  Agent BrokerA

  Free, instant pre-flight for the compliance gate: runs the SAME TCPA/GDPR/CASL/CAN-SPAM/10DLC checks as send_message and call_business, in preview mode -- nothing is sent, nothing changes. Tells you whether a send would be permitted before you pay, and if not, names the exact rule and how to fix it. De-risks a paid send the way check_booking_link de-risks a paid booking. [free, no key]

  ConnectorNo auth

• check_complianceA

  Sanctions ScreeningA

  Free, instant pre-flight for the compliance gate: runs the SAME TCPA/GDPR/CASL/CAN-SPAM/10DLC checks as send_message and call_business, in preview mode -- nothing is sent, nothing changes. Tells you whether a send would be permitted before you pay, and if not, names the exact rule and how to fix it. De-risks a paid send the way check_booking_link de-risks a paid booking. [free, no key]

  ConnectorNo auth

• check_complianceA

  SMS and WhatsApp MessagingA

  Free, instant pre-flight for the compliance gate: runs the SAME TCPA/GDPR/CASL/CAN-SPAM/10DLC checks as send_message and call_business, in preview mode -- nothing is sent, nothing changes. Tells you whether a send would be permitted before you pay, and if not, names the exact rule and how to fix it. De-risks a paid send the way check_booking_link de-risks a paid booking. [free, no key]

  ConnectorNo auth

• check_complianceA

  Compliance CheckA

  Free, instant pre-flight for the compliance gate: runs the SAME TCPA/GDPR/CASL/CAN-SPAM/10DLC checks as send_message and call_business, in preview mode -- nothing is sent, nothing changes. Tells you whether a send would be permitted before you pay, and if not, names the exact rule and how to fix it. De-risks a paid send the way check_booking_link de-risks a paid booking. [free, no key]

  ConnectorNo auth

• research.topic-deep-researcherA

  blindoracleB

  Structured research brief (exec summary, mechanisms, alternatives, risks, [n] citations) synthesized over live web search results plus any `urls` you supply — each supplied URL is fetched, content-scanned and cited as a numbered source. It is a $0.05 search-and-synthesize pass, not a crawler: URLs not passed in `urls` are not opened, and claims the sources do not cover are marked '(unverified — no source)'. Settlement proof: ProofOfSettledOutcome (kind 30120). Deeper than research.topic-news-scanner; web + supplied documents vs content.youtube-research's video-only pool. Refuses, with no charge, when ≥5 fetched web sources cannot be fetched. (x402: $0.05 USDC per call)

  ConnectorOAuth

• report_marketA

  AgentRXIB

  Investor-grade market research brief on any market: deep multi-source web research plus market-size searches, key players, news, recent research papers, prediction markets and US grant activity. A model writes market size (with sources and ranges), segments, players, business models, drivers, trends, risks and entry opportunities, an attractiveness score and a PDF. 60-150 s; async=true recommended. If too few sources answer you are not charged (with async=true the core source is checked before the job is queued and charged). Costs $5 USDC per call (x402).

  ConnectorNo auth

• forcedream_security_scanA

  mcp-serverA

  Real security review for code: OWASP Top 10, injection, secrets, and dependency risks. Cross-references imported dependencies against OSV.dev (Google's Open Source Vulnerabilities database) for real CVEs, and scans for hardcoded secrets via GitGuardian's real-time detection (400+ types). SPENDS your balance -- requires authentication (OAuth). Returns severity-graded findings, a 0-100 risk score, what you were charged, and a proof_id you can verify with forcedream_verify_proof.

  ConnectorNo auth

• scan_websiteA

  ScanLabsAI Security ScannerA

  Run a ScanLabsAI security scan against a website and return a full Markdown vulnerability report (grouped by severity, with descriptions and remediation) that you can analyse, act on, and the user can save as security-report.md. Checks OWASP Top 10, CVEs, SSL/TLS, security headers and DNS. Use deep=true for a comprehensive scan (40,000+ vectors, slower). Only scan sites the user is authorised to test.

  ConnectorNo auth

• cyber_security_consultantA

  Cybercentry VerificationA

  Ask a cyber security question and get an expert answer backed by real-time threat intelligence, covering current threats, best practice and compliance. Costs $1.00 per call, paid in USDC over x402.

  ConnectorNo auth

• check_complianceA

  Agent BrokerA

  Free, instant pre-flight for the compliance gate: runs the SAME TCPA/GDPR/CASL/CAN-SPAM/10DLC checks as send_message and call_business, in preview mode -- nothing is sent, nothing changes. Tells you whether a send would be permitted before you pay, and if not, names the exact rule and how to fix it. De-risks a paid send the way check_booking_link de-risks a paid booking. [free, no key]

  ConnectorNo auth