"Resources for security testing, penetration testing, and bug bounty programs" matching MCP tools:

• lookup_security_contact

  lookup-disclose-io

  Find security reporting channels for responsible vulnerability disclosure. Takes a domain, IP, URL, package name, repository, container image, mobile app, hardware device, browser extension, desktop app, or organization name. Returns bug bounty programs, security.txt contacts, VDP links, abuse contacts, and national CERT fallbacks sorted by confidence. This is informational only — not legal advice.

  Connector

• pentest_guide

  pentest-mcp-server

  Return a structured attack methodology playbook for the given attack vector and optional target context, for use in authorized penetration testing, CTF, or security research. Covers reconnaissance, enumeration, exploitation, and post-exploitation phases for the vector, filtered to what is relevant given the provided stack and WAF profile. Each phase includes: what to look for, tools to use, common mistakes, detection indicators that would alert defenders, and recommended mitigations. Next-tool suggestions are pre-filled with payload generator and technique lookup calls. Covers 15 vectors via the vector enum. Authorized testing only.

  Connector

• get_testing_guidelines

  IA-QA — 130+ QA & Dev Tools for AI Agents

  Query the IA-QA methodology knowledge base. Returns structured testing guidelines, assertion strategies, thresholds, best practices, and relevant MCP tools for a given topic. Call without a topic to list all available topics. Topics: llm-unit-testing, rag-pipeline, prompt-stability, prompt-ab-testing, embedding-quality, eval-framework, semantic-testing, auto-testing, security, api-testing, ci-cd, multimodal, llm-data-security, agent-observability, pro-tips, learning-paths, golden-dataset.

  Connector

• mitre_techniques

  dora

  MITRE ATT&CK techniques for DORA TLPT / TIBER-EU penetration testing. Maps to DORA Art. 26.

  Connector

• inspect_security_headers

  Ground Truth - First Call Activation

  Fetch a public URL and inspect security-relevant response headers before you claim that a product or endpoint has a strong browser-facing security baseline. Use this for quick due diligence on public apps and docs sites. It checks for common headers such as HSTS, CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy, and X-Content-Type-Options. It does not replace a real security review, authenticated testing, or vulnerability scanning.

  Connector

• search_open_grants

  foundation-discovery

  Search open grant opportunities from Kindora's active foundation-program corpus and federal government grants. Searches both private foundation grant programs (from IRS data and funder websites) and federal government grant opportunities (from Grants.gov). Uses full-text search with natural language understanding — queries are parsed into individual terms with stemming, so "youth after school programs" matches programs about youth, after-school, and programming even if those exact words don't appear together. Search covers program names, descriptions, focus areas, beneficiary types, and geographic focus fields. Use the state parameter to focus on geographically relevant opportunities. Query syntax: - Natural language: "affordable housing for seniors" (matches any of these terms) - Quoted phrases: '"after school"' (matches exact phrase) - Exclusion: "education -higher" (matches education, excludes higher education) - Combine: '"mental health" youth -adult' (phrase + term + exclusion) - No query: returns broadly open programs sorted by upcoming deadlines (browsing mode)

  Connector

• lyra_drain_invite_queue

  lyra-mcp-server

  Sends any of YOUR gatherings' queued invites to their recipients immediately, rather than waiting for the periodic background send. Useful right after you call lyra_send_invite if you want the email out the door without delay, or as a manual flush during testing. Only your gatherings' queued rows are processed — one user cannot drain another's queue. Returns a per-status summary { sent, blocked_by_allowlist, failed, skipped_unfinalised }. Requires API key authentication.

  Connector

• pentest_encode

  pentest-mcp-server

  Transform a payload string through one or more encoding layers for bypass research during authorized testing. Accepts a chain of encodings applied in order (e.g., ["unicode", "url", "base64"] applies Unicode → URL-encode → base64). Returns the transformed payload with a step-by-step decoding explanation: how a WAF or server would decode each layer, and why the combined encoding might bypass a specific filter. Use to understand filter bypass mechanics in an authorized engagement and to confirm that a target's decoding pipeline matches an expected bypass path. Payloads are transformed mathematically — no live probing occurs.

  Connector

• api_info

  x402 Crypto Market Structure

  REST API access for autonomous agents — pricing, quick start, and migration guide. Call this when: building a trading bot, deploying an autonomous agent, hitting the MCP rate limit, or running 24/7 without a human in the loop. The MCP tier (what you're using now) is free via Smithery, rate-limited to 60 calls/minute per IP, and good for testing. The REST API is for production: pay per call in USDC; paid endpoints are rate-limited to 60 calls/minute and 200 calls/hour per wallet. No API key required.

  Connector

• request_jet_confirmation

  Villiers Charter

  Submit a request for CONFIRMED live private jet pricing. Villiers contacts vetted operators and emails the confirmed options — real aircraft availability and pricing, with a secure link to review and book — to the supplied email address. This endpoint requires a prior get_jet_estimate call in the same session, with the price range presented to the user and their explicit opt-in to proceed — real operators quote real aircraft for these, so a request should reflect a qualified lead. Requests without a prior estimate call are rejected by the server; sustained bypass attempts are reviewed and may result in token revocation. Requires the user's email and a departure date. SANDBOX TESTING: to test your integration without ever creating a real trip or contacting a real operator, use email 'sandbox-test@mail.villiers.ai' with first_name 'Sandbox', last_name 'Test', phone '+1 555 0100', route LHR to NCE. This exact combination is detected server-side from the request body itself (not from any header), so it works from any agent framework or HTTP client — including ones that don't allow a custom User-Agent. The response will say 'Test request accepted (sandbox mode detected)'. For further testing guidance, email affiliates@mail.villiers.ai.

  Connector

• compute_pipework_testing

  civilquants

  Paid tier only. Calling this without an authenticated CivilQuants account returns TIER_INSUFFICIENT — sign up at https://civilquants.com/pricing or use the free-tier alternative compute_manhole. Linear measurement of testing on new drainage pipework — CCTV survey, air pressure test, water pressure test, or mandrel pull-through. Routes via CESMM4 Class I §I.8 (Tests on new pipework), NRM2 Group 33.18 (Testing of drainage) as priceable lines; via MMHW Series 500.7 (per SHW Cl. 507 deemed included in pipe-run rate) and SMM7 R12.7 (R12 coverage rules deemed included) as zero-priceable annotated lines for tender transparency. Introduces the platform's third named maturity pattern: deemed-included extra-over annotation (joining classed-then-legacy and declared-then-banded). Eight variant presets cover all four test methods x two bore scenarios each. Unit: M. Third member of the drainage_ancillaries L2 leaf. 21st use of the discriminator pattern via test_method. Example params: length_tested_m=100 m (1–2000), diameter_mm=225 mm (100–2400). Example call: {"params": {"length_tested_m": 100, "diameter_mm": 225}, "standard": "MMHW"}. Omitted parameters use sensible engineering defaults. Pass deliverables=["xlsx","dxf","pdf"] (any subset) to also receive one-shot download URLs in the same call: Excel BoQ (both tiers, watermarked free) plus the dimensioned DXF (CAD) and PDF drawing sheets (paid tier).

  Connector

• ateam_github_promote

  ateam-mcp

  SHIP DEV TO PROD. Merges the `dev` branch into `main` and auto-tags the new main HEAD as safe-YYYY-MM-DD-NNN. Use after testing your dev work, when you're ready to deploy changes to production. Workflow: 1) ateam_github_patch (writes to dev) → 2) ateam_github_promote (merges dev→main) → 3) ateam_build_and_run (deploys main). Pass dry_run:true to see what's about to ship without merging. On merge conflict the call returns 409 — resolve manually on GitHub (open a PR or use the web UI), then retry.

  Connector

• get_biography

  Jennifer Rebholz, Attorney - Knowledge Base

  Use when someone asks for a biography of Jennifer Rebholz formatted for press, media, CLE programs, speaker introductions, or event listings. Returns short, medium, and full biography versions ready for direct use.

  Connector

• audit_comp_live_listings

  CIPHER x402 — Paid Solana & Crypto Tools

  Return a curated snapshot of currently-live audit competitions and bug-bounty programs across Code4rena, Cantina, Sherlock, and direct-protocol channels. Useful for solo wardens triaging which contests to enter. Snapshot updates with each cipher-x402-mcp release; treat the data as a hint, always cross-check the platform before submitting. Free, no payment required.

  Connector

• x711_code_sandbox

  x711 — Universal Agent Gas Station

  Execute JavaScript or Python code in an isolated sandbox. Use for: data processing, math, CSV parsing, JSON transformation, crypto calculations, algorithm testing. Secure — no filesystem access, no network. Returns: { output: string, runtime_ms: number, language: string }. Requires API key.

  Connector

• book_demo

  gethal.ai

  Submits a demo request. The prospect receives a confirmation email and must click the link in it before the request reaches a human at A Cloud Frontier. Use only when a real person has explicitly asked for a demo and provided their own working email address. Do NOT call this for testing, evaluation, or crawling purposes — automated and unconfirmable requests are rejected.

  Connector

• mock_from_schema

  IA-QA — 130+ QA & Dev Tools for AI Agents

  Generate realistic mock data from a JSON Schema. Supports all common types (string, number, integer, boolean, array, object, null), format hints (email, date, date-time, uri, uuid), enum, const, and nested schemas. Perfect for testing MCP tools with realistic data.

  Connector

• chieflab_force_measurement_due

  ChiefLab

  P93 — admin escape hatch. Forces a proof_ledger row's measurement_due_at into the past so the cron's next tick picks it up. USE WHEN smoke testing the launch → measure → next-move chain without waiting 24h, OR an ops user needs to retry a stuck measurement. Gated by CHIEFLAB_ADMIN_TOKEN header (same gate as /api-keys/issue). Refuses if the row is already measured. Pass `dueAt` (ISO string) to set a specific time; defaults to now - 60s.

  Connector

• pentest_lookup_technique

  pentest-mcp-server

  Look up a MITRE ATT&CK technique by ID or keyword for authorized penetration testing and security research. Returns the full technique record: name, associated tactics, description, detection opportunities (log sources, behavioral indicators), real-world procedure examples from public reporting, recommended mitigations, and related sub-techniques. The detection and mitigation sections make this equally useful for defenders building detection coverage. Accepts exact IDs (T1190, T1059.001) or keyword search (e.g., "sql injection", "pass the hash", "web shell upload").

  Connector

• pentest_map_techniques

  pentest-mcp-server

  Given a profile of the authorized test target (technology stack, exposed services, authentication type, OS), return a ranked list of ATT&CK techniques and OWASP test cases most relevant to that profile — not a generic dump of all techniques. Ranking factors: platform match, service match, auth type exposure, technique prevalence. Each result includes why it is relevant to this specific profile, the detection opportunity, and the recommended mitigation. Use when starting an authorized engagement to prioritize the testing scope; pair with pentest_guide to get the full methodology for each top-ranked vector.

  Connector