"Security testing, penetration testing, and code auditing services" matching MCP tools:

• get_testing_guidelines

  IA-QA — 130+ QA & Dev Tools for AI Agents

  Query the IA-QA methodology knowledge base. Returns structured testing guidelines, assertion strategies, thresholds, best practices, and relevant MCP tools for a given topic. Call without a topic to list all available topics. Topics: llm-unit-testing, rag-pipeline, prompt-stability, prompt-ab-testing, embedding-quality, eval-framework, semantic-testing, auto-testing, security, api-testing, ci-cd, multimodal, llm-data-security, agent-observability, pro-tips, learning-paths, golden-dataset.

  Connector

• mitre_techniques

  dora

  MITRE ATT&CK techniques for DORA TLPT / TIBER-EU penetration testing. Maps to DORA Art. 26.

  Connector

• inspect_security_headers

  Ground Truth - First Tool Call

  Fetch a public URL and inspect security-relevant response headers before you claim that a product or endpoint has a strong browser-facing security baseline. Use this for quick due diligence on public apps and docs sites. It checks for common headers such as HSTS, CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy, and X-Content-Type-Options. It does not replace a real security review, authenticated testing, or vulnerability scanning.

  Connector

• pentest_encode

  pentest-mcp-server

  Transform a payload string through one or more encoding layers for bypass research during authorized testing. Accepts a chain of encodings applied in order (e.g., ["unicode", "url", "base64"] applies Unicode → URL-encode → base64). Returns the transformed payload with a step-by-step decoding explanation: how a WAF or server would decode each layer, and why the combined encoding might bypass a specific filter. Use to understand filter bypass mechanics in an authorized engagement and to confirm that a target's decoding pipeline matches an expected bypass path. Payloads are transformed mathematically — no live probing occurs.

  Connector

• run_and_report

  Keploy

  Run test suites and return results with failures and coverage. !! DO NOT USE for local-app "tests for my changes" flows !! This tool sends the run to the SaaS backend which REJECTS private/localhost URLs ("IPv6 address is private / reserved"). It only works when base_url points at a PUBLIC, non-loopback address (a staging/prod deployment). For local-app testing, use record_sandbox_test / replay_sandbox_test instead — they drive the keploy local agent which happily records against http://localhost.

  Connector

• check_injection

  ContrastAPI

  Scan source code for injection vulnerabilities: SQL injection, command injection, path traversal via unsafe string concatenation/unsanitized input. Supports Python, JavaScript, TypeScript, Java, Go, Ruby, Shell, Bash. Use to detect input-handling bugs; for secrets use check_secrets. Companion code-security tools: check_secrets (hard-coded credential detection), check_dependencies (known-CVE vulnerability audit), check_headers (live HTTP security-header validation), scan_headers (live HTTP scan via domain). Free: 30/hr, Pro: 500/hr. Returns {total, by_severity, findings}. No data stored.

  Connector

• lyra_drain_invite_queue

  lyra-mcp-server

  Sends any of YOUR gatherings' queued invites to their recipients immediately, rather than waiting for the periodic background send. Useful right after you call lyra_send_invite if you want the email out the door without delay, or as a manual flush during testing. Only your gatherings' queued rows are processed — one user cannot drain another's queue. Returns a per-status summary { sent, blocked_by_allowlist, failed, skipped_unfinalised }. Requires API key authentication.

  Connector

• find_room

  capitolguide

  Find a Capitol office by ROOM CODE (e.g. 'SH-217', '2310 Rayburn', '167 Russell', 'H-232'), by MEMBER NAME (e.g. 'Cornyn', 'Ted Cruz', 'Womack'), or by COMMITTEE ('Senate Judiciary', 'Ways and Means', 'House Armed Services'). A room code returns the decoded location plus who currently holds it; a name returns that member's current office; a committee returns its office / principal hearing room. Member & committee assignments are the 119th Congress (volatile, live-source-stamped).

  Connector

• compute_pipework_testing

  civilquants

  Paid tier only. Calling this without an authenticated CivilQuants account returns TIER_INSUFFICIENT — sign up at https://civilquants.com/pricing or use the free-tier alternative compute_manhole. Linear measurement of testing on new drainage pipework — CCTV survey, air pressure test, water pressure test, or mandrel pull-through. Routes via CESMM4 Class I §I.8 (Tests on new pipework), NRM2 Group 33.18 (Testing of drainage) as priceable lines; via MMHW Series 500.7 (per SHW Cl. 507 deemed included in pipe-run rate) and SMM7 R12.7 (R12 coverage rules deemed included) as zero-priceable annotated lines for tender transparency. Introduces the platform's third named maturity pattern: deemed-included extra-over annotation (joining classed-then-legacy and declared-then-banded). Eight variant presets cover all four test methods x two bore scenarios each. Unit: M. Third member of the drainage_ancillaries L2 leaf. 21st use of the discriminator pattern via test_method. Example params: length_tested_m=100 m (1–2000), diameter_mm=225 mm (100–2400). Example call: {"params": {"length_tested_m": 100, "diameter_mm": 225}, "standard": "MMHW"}. Omitted parameters use sensible engineering defaults. Pass deliverables=["xlsx","dxf","pdf"] (any subset) to also receive one-shot download URLs in the same call: Excel BoQ (both tiers, watermarked free) plus the dimensioned DXF (CAD) and PDF drawing sheets (paid tier).

  Connector

• varrd_ai

  VARRD — Statistically Validated Trading Edges + AI Research Engine

  Talk to VARRD AI (~$0.25/turn). Describe any trading idea in plain language and the system handles everything — loading decades of market data, charting your pattern, running statistical tests, backtesting with stops, and generating exact trade setups. MULTI-TURN: First call creates a session. Keep calling with the same session_id, following context.next_actions each time. 1. Your idea -> VARRD charts pattern 2. 'test it' -> statistical test (event study or backtest) 3. 'show me the trade setup' -> exact entry/stop/target prices HYPOTHESIS INTEGRITY (critical): VARRD tests ONE hypothesis at a time — one formula, one setup. Never combine multiple setups into one formula or ask to 'test all' — each idea must be tested as a separate hypothesis for the statistics to be valid. Say 'start a new hypothesis' between ideas to reset cleanly. - ALLOWED: Test the SAME setup across multiple markets ('test this on ES, NQ, and CL') — same formula, different data. - NOT ALLOWED: Test multiple DIFFERENT formulas/setups at once — each is a separate hypothesis requiring its own chart-test-result cycle. If ELROND council returns 4 setups, test each one separately: chart setup 1 -> test -> results -> 'start new hypothesis' -> chart setup 2 -> etc. KEY CAPABILITIES you can ask for: - 'Use the ELROND council on [market]' -> 8 expert investigators - 'Optimize the stop loss and take profit' -> SL/TP grid search - 'Test this on ES, NQ, and CL' -> multi-market testing - 'Simulate trading this with 1.5 ATR stop' -> backtest with stops EDGE VERDICTS in context.edge_verdict after testing: - STRONG EDGE: Significant vs zero AND vs market baseline - MARGINAL: Significant vs zero only (beats nothing, but real signal) - PINNED: Significant vs market only (flat returns but different from market) - NO EDGE: Neither significant test passed TERMINAL STATES: Stop when context.has_edge is true (edge found) or false (no edge — valid result). Always read context.next_actions.

  Connector

• plan_file_info

  PlanExe

  Returns file metadata (content_type, download_url, download_size, expires_at) for the report or zip artifact. Use artifact='report' (default) for the interactive HTML report (~700KB, self-contained with embedded JS for collapsible sections and interactive Gantt charts — open in a browser). Use artifact='zip' for the full pipeline output bundle (md, json, csv intermediary files that fed the report). While the task is still pending or processing, returns {ready:false,reason:"processing"}. Check readiness by testing whether download_url is present in the response. Once ready, present download_url to the user or fetch and save the file locally. Download URLs expire after 15 minutes (see expires_at); call plan_file_info again to get a fresh URL if needed. Terminal error codes: generation_failed (plan failed), content_unavailable (artifact missing). Unknown plan_id returns error code PLAN_NOT_FOUND.

  Connector

• ai_filters_test

  DialogBrain

  Test a message against an AI filter to check whether it would match. This tool embeds the provided message using Voyage AI and computes the cosine similarity between the message vector and the filter's stored reference vector. It returns the similarity score, whether the message would match (similarity >= threshold), and the filter's threshold value. Use this to: - Verify a filter works as intended before using it in a trigger - Tune the threshold by testing borderline messages - Debug why a message did or did not match a filter in production Returns: {similarity: float, matched: bool, threshold: float} Note: This tool calls the Voyage AI embedding API to embed the test message.

  Connector

• pentest_map_techniques

  pentest-mcp-server

  Given a profile of the authorized test target (technology stack, exposed services, authentication type, OS), return a ranked list of ATT&CK techniques and OWASP test cases most relevant to that profile — not a generic dump of all techniques. Ranking factors: platform match, service match, auth type exposure, technique prevalence. Each result includes why it is relevant to this specific profile, the detection opportunity, and the recommended mitigation. Use when starting an authorized engagement to prioritize the testing scope; pair with pentest_guide to get the full methodology for each top-ranked vector.

  Connector

• load_backtesting_workflow

  Shibui Finance

  Load backtesting workflow for signal testing, forward returns, win rates. REQUIRES get_database_schema then get_query_patterns to be called first (in that order). Call BEFORE writing SQL when the user asks to backtest, test a strategy, check "what happens after X", compare forward returns, measure win rates, "is it better to buy when X vs Y", evaluate trading signals historically, or compute any hypothetical return over past data. Contains hard rules for survivorship bias, outlier handling, sampling design, and risk-adjusted metrics (Sharpe, Sortino, drawdown). Can be combined with other workflow tools.

  Connector

• scan_skill

  SecurityScan

  Scan a GitHub repository or skill URL for security vulnerabilities. This tool performs static analysis and AI-powered detection to identify: - Hardcoded credentials and API keys - Remote code execution patterns - Data exfiltration attempts - Privilege escalation risks - OWASP LLM Top 10 vulnerabilities Requires a valid X-API-Key header. Cached results (24h) do not consume credits. Args: skill_url: GitHub repository URL (e.g., https://github.com/owner/repo) or raw file URL to scan Returns: ScanResult with security score (0-100), recommendation, and detected issues. Score >= 80 is SAFE, 50-79 is CAUTION, < 50 is DANGEROUS. Example: scan_skill("https://github.com/anthropics/anthropic-sdk-python")

  Connector

• pentest_lookup_technique

  pentest-mcp-server

  Look up a MITRE ATT&CK technique by ID or keyword for authorized penetration testing and security research. Returns the full technique record: name, associated tactics, description, detection opportunities (log sources, behavioral indicators), real-world procedure examples from public reporting, recommended mitigations, and related sub-techniques. The detection and mitigation sections make this equally useful for defenders building detection coverage. Accepts exact IDs (T1190, T1059.001) or keyword search (e.g., "sql injection", "pass the hash", "web shell upload").

  Connector

• test_webhook

  Trillboards DOOH Advertising

  Send a test event to a webhook endpoint. WHEN TO USE: - Verifying webhook endpoint is working - Testing integration during development - Debugging webhook delivery issues RETURNS: - success: Boolean indicating delivery success - response_code: HTTP response code from endpoint - response_time_ms: Response time in milliseconds - error: Error message if delivery failed EXAMPLE: User: "Test my webhook with a device.online event" test_webhook({ webhook_id: "wh_mmmpdbvj_8b7c5a59296d", event: "device.online" })

  Connector

• x711_code_sandbox

  x711 — Universal Agent Gas Station

  Execute JavaScript or Python code in an isolated sandbox. Use for: data processing, math, CSV parsing, JSON transformation, crypto calculations, algorithm testing. Secure — no filesystem access, no network. Returns: { output: string, runtime_ms: number, language: string }. Requires API key.

  Connector

• ateam_github_promote

  ateam-mcp

  SHIP DEV TO PROD. Merges the `dev` branch into `main` and auto-tags the new main HEAD as safe-YYYY-MM-DD-NNN. Use after testing your dev work, when you're ready to deploy changes to production. Workflow: 1) ateam_github_patch (writes to dev) → 2) ateam_github_promote (merges dev→main) → 3) ateam_build_and_run (deploys main). Pass dry_run:true to see what's about to ship without merging. On merge conflict the call returns 409 — resolve manually on GitHub (open a PR or use the web UI), then retry.

  Connector

• chieflab_force_measurement_due

  ChiefLab

  P93 — admin escape hatch. Forces a proof_ledger row's measurement_due_at into the past so the cron's next tick picks it up. USE WHEN smoke testing the launch → measure → next-move chain without waiting 24h, OR an ops user needs to retry a stuck measurement. Gated by CHIEFLAB_ADMIN_TOKEN header (same gate as /api-keys/issue). Refuses if the row is already measured. Pass `dueAt` (ISO string) to set a specific time; defaults to now - 60s.

  Connector