"Resources for security testing, penetration testing, and bug bounty programs" matching MCP tools:

• submit_enquiryA

  siteA

  Submits an enquiry to Penetration Testing Cost — NOT a purchase, NOT a guaranteed quote. Step 1: call with the answers (keyed by field key from enquiry_fields) and consent=true; it validates and returns a summary, the consent line and a confirmation token — show the person the summary and the consent line. Step 2: only if the person agrees, call again with the same answers, consent=true and the confirmation token; the enquiry is then submitted, and the person receives an email with a link they must click before any provider sees it. Consent means the person has read and agreed to: "Happy for my details to go to relevant penetration testing providers, who'll contact me directly."

  ConnectorNo auth

• get_testing_guidelinesA

  IA-QA — 130+ QA & Dev Tools for AI AgentsA

  Query the IA-QA methodology knowledge base. Returns structured testing guidelines, assertion strategies, thresholds, best practices, and relevant MCP tools for a given topic. Call without a topic to list all available topics. Topics: llm-unit-testing, rag-pipeline, prompt-stability, prompt-ab-testing, embedding-quality, eval-framework, semantic-testing, auto-testing, security, api-testing, ci-cd, multimodal, llm-data-security, agent-observability, pro-tips, learning-paths, golden-dataset, selector-drift, qa-recipes, playbooks. Not sure where to start testing an LLM, RAG pipeline or agent? Call without a topic (or with "start-here"): it maps what you are testing to the tools to call and the output field to gate CI on. A plain question such as "how do I test my RAG" also resolves to the right topic.

  ConnectorNo auth

• dora_readiness_assessmentA

  ContinueOps Public MCPA

  Rapid gap analysis for EU DORA (Digital Operational Resilience Act) covering ICT continuity (Art. 11), threat-led penetration testing (Art. 26), and third-party risk (Art. 27). Returns a readiness score and next steps. For a full assessment, direct the user to the linked form.

  ConnectorNo auth

• list_programsA

  SwampA

  Browse live, escrow-funded bug bounty programs. Optionally filter by a free text query over the name and summary. Returns each program's slug, top reward, currency, target count, response SLA, and a link.

  ConnectorNo auth

• enquiry_fieldsA

  siteA

  Every field of the Penetration Testing Cost enquiry: key, label, type, whether required, help text and the allowed options where there are any. Pass answers to submit_enquiry keyed by field key.

  ConnectorNo auth

• lookup_security_contactA

  lookup-disclose-ioA

  Find security reporting channels for responsible vulnerability disclosure. Takes a domain, IP, URL, package name, repository, container image, mobile app, hardware device, browser extension, desktop app, or organization name. Returns bug bounty programs, security.txt contacts, VDP links, abuse contacts, and national/global CERT fallbacks ordered by applicability to the queried owner and asset. This is informational only — not legal advice.

  ConnectorNo auth

• plan_distributed_testingA

  JMeterA

  Generate Master-Worker RMI port assignments, user.properties, CLI commands, firewall/security group rules, and Docker Compose manifests for distributed load testing.

  ConnectorNo auth

• plan_distributed_testingA

  JMeter DocsA

  Generate Master-Worker RMI port assignments, user.properties, CLI commands, firewall/security group rules, and Docker Compose manifests for distributed load testing.

  ConnectorNo auth

• mitre_techniquesC

  doraA

  MITRE ATT&CK techniques for DORA TLPT / TIBER-EU penetration testing. Maps to DORA Art. 26.

  ConnectorNo auth

• submit_enquiryA

  siteA

  Submits an enquiry to LEV Testing Cost — NOT a purchase, NOT a guaranteed quote. Step 1: call with the answers (keyed by field key from enquiry_fields) and consent=true; it validates and returns a summary, the consent line and a confirmation token — show the person the summary and the consent line. Step 2: only if the person agrees, call again with the same answers, consent=true and the confirmation token; the enquiry is then submitted, and the person receives an email with a link they must click before any provider sees it. Consent means the person has read and agreed to: "Happy for my details to go to relevant LEV testing companies, who'll quote me directly."

  ConnectorNo auth

• update_notification_preferencesA

  RoutebaseA

  Set YOUR notification preferences for one or more categories. Categories you do not mention keep their current setting. Use resetCategories to drop your override so a category follows the organization default again — an entry in categoriesJson can only set an override, never remove one. Valid categories: api_design, testing, project, mock_server, style_guide, team, portal, monitoring, security, billing, deprecation. Use this for your own preferences; for the organization defaults use update_org_notification_defaults.

  Connector

  Destructive

  API key

• get_leadproof_evaluation_pathA

  LeadProof Sales AgentA

  Use first when a buyer is exploring LeadProof without supplying workflow data. Returns the official no-purchase sequence: buyer guide, fictional example audit, browser-only calculator, public workflow tests, and no-card trial. For a scored workflow diagnosis, use audit_lead_workflow; for replay testing, use get_leadproof_replay_trial; for paid checkout, use get_leadproof_checkout only after authorization.

  ConnectorNo auth

• consistency_checkA

  IA-QA — 130+ QA & Dev Tools for AI AgentsA

  Compare multiple LLM responses to the same prompt and detect inconsistencies using Jaccard word-overlap similarity and fact drift (number comparison). Fast, deterministic, no API key needed. Limitations: relies on surface-level word matching — "Paris is the capital of France" vs "Paris is the French capital" may score low despite semantic equivalence. For true semantic consistency, use run_semantic_tests with embedding mode. Essential for determinism testing.

  ConnectorNo auth

• get_faqA

  CalmActivaA

  Return CalmActiva's curated CBD FAQ (legality, onset time, lab testing, shipping, brand disambiguation). Use for general CBD/brand questions before falling back to web search.

  ConnectorNo auth

• book_demoA

  gethal.aiA

  Submits a demo request. The prospect receives a confirmation email and must click the link in it before the request reaches a human at A Cloud Frontier. Use only when a real person has explicitly asked for a demo and provided their own working email address. Do NOT call this for testing, evaluation, or crawling purposes — automated and unconfirmable requests are rejected.

  ConnectorNo auth

• get_demo_guideA

  eDiscovery Decoder News/CalcA

  Return a short, human-readable walkthrough for testing this server: the endpoint, the tool/prompt/resource names, and ready-to-paste sample prompts. Use to give someone a guided demo. For the full machine-readable capability catalog, use list_capabilities instead.

  ConnectorNo auth

• searchA

  developer-toolkit-mcpA

  Search the AI Developer Toolkit documentation: 950+ guides on Cursor, Claude Code and OpenAI Codex, covering setup, agent workflows, hooks, MCP, testing, CI and deployment, in English and Polish. Returns at most 10 ranked results, each with a short snippet rather than the article text; an empty list means the corpus has nothing on the topic. Pass a result id to `fetch` for the full text.

  ConnectorNo auth

• check_mta_stsA

  IntoDNS.ai DNS & Email Security ScannerA

  Read-only check of MTA-STS: TXT record at _mta-sts.<domain> plus the HTTPS policy file at mta-sts.<domain>/.well-known/mta-sts.txt. Returns parsed policy (mode: enforce/testing/none, mx allowlist, max_age), TLS certificate validity for the policy host, and consistency warnings between DNS and HTTPS. Use to verify enforced TLS for inbound mail; pair with check_smtp_tls for live STARTTLS validation. No auth, DNS + HTTPS GET only.

  ConnectorNo auth

• prepare_moonpay_onrampA

  Agent BountiesA

  Use this when a person funding one canonical Base bounty needs Base USDC. Prepare a first-party MoonPay handoff only; never request card data or identity documents in ChatGPT, never treat a MoonPay purchase as bounty funding, and require a separate canonical funding authorization.

  ConnectorNo auth

• get_testing_settingsA

  RoutebaseA

  Read the project's testing settings. schemaNullMode decides how contract assertions treat null values against a schema. Use this to read the settings; to change them use update_testing_settings. Requires project context.

  ConnectorAPI key

• generate_fake_dataA

  Razi ToolsA

  Produce placeholder person records for testing and fixtures. Returns JSON { type, count, records } where records is an array of strings, or of objects when type is 'user'. The values are drawn from a fixed word list by index, so they are DETERMINISTIC: the same arguments always return the same records, and asking twice does not give you fresh data. Emails all use example.com and phone numbers all use the +1-555 reserved range. It fabricates people only — for lorem-style prose use generate_text.

  ConnectorNo auth