"Security testing, penetration testing, and code auditing services" matching MCP tools:

• pentest_guide

  pentest-mcp-server

  Return a structured attack methodology playbook for the given attack vector and optional target context, for use in authorized penetration testing, CTF, or security research. Covers reconnaissance, enumeration, exploitation, and post-exploitation phases for the vector, filtered to what is relevant given the provided stack and WAF profile. Each phase includes: what to look for, tools to use, common mistakes, detection indicators that would alert defenders, and recommended mitigations. Next-tool suggestions are pre-filled with payload generator and technique lookup calls. Covers 15 vectors via the vector enum. Authorized testing only.

  Connector

• dora_readiness_assessment

  ContinueOps Public MCP

  Rapid gap analysis for EU DORA (Digital Operational Resilience Act) covering ICT continuity (Art. 11), threat-led penetration testing (Art. 26), and third-party risk (Art. 27). Returns a readiness score and next steps. For a full assessment, direct the user to the linked form.

  Connector

• get-curated-tool-recommendations

  mcp

  Returns curated tool recommendations for Laravel development, organized by category (Hosting / Deployment, Monitoring / Error Tracking, Email / Notifications, Authentication / Authorization, Payments / Billing, IDE / Development Tools, Testing, Security, SEO / Auditing, Analytics, Other). NOTE: Some of these are affiliate/partner recommendations — each result includes its relationship type and whether it is an affiliate.

  Connector

• get_testing_guidelines

  IA-QA — 130+ QA & Dev Tools for AI Agents

  Query the IA-QA methodology knowledge base. Returns structured testing guidelines, assertion strategies, thresholds, best practices, and relevant MCP tools for a given topic. Call without a topic to list all available topics. Topics: llm-unit-testing, rag-pipeline, prompt-stability, prompt-ab-testing, embedding-quality, eval-framework, semantic-testing, auto-testing, security, api-testing, ci-cd, multimodal, llm-data-security, agent-observability, pro-tips, learning-paths, golden-dataset.

  Connector

• mitre_techniques

  dora

  MITRE ATT&CK techniques for DORA TLPT / TIBER-EU penetration testing. Maps to DORA Art. 26.

  Connector

• plan_file_info

  PlanExe

  Returns file metadata (content_type, download_url, download_size, expires_at) for the report or zip artifact. Use artifact='report' (default) for the interactive HTML report (~700KB, self-contained with embedded JS for collapsible sections and interactive Gantt charts — open in a browser). Use artifact='zip' for the full pipeline output bundle (md, json, csv intermediary files that fed the report). While the task is still pending or processing, returns {ready:false,reason:"processing"}. Check readiness by testing whether download_url is present in the response. Once ready, present download_url to the user or fetch and save the file locally. Download URLs expire after 15 minutes (see expires_at); call plan_file_info again to get a fresh URL if needed. Terminal error codes: generation_failed (plan failed), content_unavailable (artifact missing). Unknown plan_id returns error code PLAN_NOT_FOUND.

  Connector

• formation_approve_certificate

  Lovie Company Formation

  Records the user's approval of the reviewed formation details (the certificate checkpoint). This only records approval — it files NOTHING with any state and charges NOTHING, so it is always safe to call, including during testing; never refuse or stop short because it is a 'test'. Call it once the user has reviewed the details and confirmed they are correct. As soon as this returns, call formation_get_payment_link with the SAME formation_id. Formation is a single one-time payment — there is NO subscription and NO monthly/annual choice, so do NOT ask the user to pick a billing cadence. Do NOT start a new formation or re-run earlier steps.

  Connector

• random_users

  Synthetic Data — Random User

  Generate synthetic / fake user profiles via the MwVideos random_users API (POST /mwvideos/api/random_users). Returns name, gender, location, email, login, dob, phone, picture, and nat. Use when the user asks for random users, fake people, sample contacts, demo personas, UI fixtures, or test profiles. Pass `results` for how many profiles (default 1, minimum 1) and `isPro` as 0 or 1 when relevant (default 0). Authenticated user_id is injected server-side — do not invent profiles; always call this tool. These are FAKE people for demos and testing, not real PII.

  Connector

• trend_analysis

  Hermes — Air Quality Intelligence

  Analyse the long-term trend in a pollutant near a location. Uses Theil-Sen slope estimation with Mann-Kendall significance testing to determine whether air quality is improving, worsening, or stable. Robust to outliers and missing data. Returns a 'summary' with plain-English trend description and statistical details. Present the summary to users first. Args: location: Postcode, place name, or "lat,lon". pollutant: Pollutant to analyse — "NO2", "PM2.5", "PM10", "O3" (default "NO2"). years: Number of years of data to analyse (default 5, range 2–5). Requests outside this range are clamped; the response includes ``metadata.years_clamped`` and a note in ``summary`` when so.

  Connector

• pentest_lookup_group

  pentest-mcp-server

  Look up a MITRE ATT&CK threat group (intrusion set) or software entry by name or ID for authorized penetration testing and threat intelligence. Returns the group or software record: ATT&CK ID, display name, known aliases, type (group vs. software), description, and the techniques it uses with procedure-level context from public ATT&CK reporting. Accepts exact ATT&CK IDs (G0007 for threat groups, S0002 for software) or keyword/name search (e.g., "APT28", "Mimikatz", "Lazarus Group"). Equally useful for defenders building detection coverage around specific adversary tradecraft.

  Connector

• pa_dmv_ev_adoption_by_zip

  Pennsylvania DMV (PennDOT)

  Break Pennsylvania electric-vehicle registrations down to the ZIP code, from PennDOT Driver & Vehicle Services: battery-electric, plug-in hybrid, fuel-cell and conventional hybrid counts for each of roughly 1,830 Pennsylvania ZIP codes, with that ZIP code's total registered vehicles and plug-in share. Answers "how many EVs are registered in ZIP 19103", "which Pennsylvania ZIP code has the most electric vehicles", "EV share in ZIP 15213", and neighbourhood-level adoption questions that a county figure averages away. Supply `zip` for one ZIP code, or omit it to rank them. For county figures and the statewide Pennsylvania total use pa_dmv_ev_adoption.

  Connector

• mercury.send

  DPX — Institutional Cross-Border Settlement

  Initiate a Mercury bank payment from a connected account. Supports all Mercury payment rails: ACH (0–1 days), Wire (0–1 days), Real-Time Payment / RTP (instant), International Wire (1–3 days), and Check (7–10 days). For International Wire — the primary DPX cross-border use case — provide SWIFT/BIC code and beneficiary bank details. DPX oracle conditions and FX corridor risk should be checked via oracle.stability and market.fx before executing. Can optionally tag the payment for automatic DPX on-chain routing — when dpxRoute:true is set, the payment memo includes the DPX executor wallet address and the Mercury webhook picks it up for USDC settlement on Base mainnet. Use sandbox:true (default) for dry-run testing. Set sandbox:false only when ready to move real funds. Typical cross-border flow: 1. market.fx → check FX corridor risk for the destination currency 2. mercury.accounts → get source accountId 3. mercury.send (sandbox:true) → confirm payment parameters 4. settlement.quote → get DPX fee quote for the USDC leg 5. mercury.send (sandbox:false) → execute (requires explicit user confirmation) 6. mercury.transactions → verify payment posted

  Connector

• check_injection

  ContrastAPI

  Scan source code for injection vulnerabilities: SQL injection, command injection, path traversal via unsafe string concatenation/unsanitized input. Supports Python, JavaScript, TypeScript, Java, Go, Ruby, Shell, Bash. Use to detect input-handling bugs; for secrets use check_secrets. Companion code-security tools: check_secrets (hard-coded credential detection), check_dependencies (known-CVE vulnerability audit), check_headers (live HTTP security-header validation), scan_headers (live HTTP scan via domain). Free: 30/hr, Pro: 500/hr. Returns {total, by_severity, findings}. No data stored.

  Connector

• adw.adw_565

  AlpineDataWorks Intelligence Server

  Returns a 0-100 US consumer-product recall pressure index (trailing-90d CPSC recall volume, injury/death-weighted, vs the prior 90d) with score, trend, hazard-type top_drivers, recent recalls, confidence, and methodology_version. Call when the user asks about product recalls, CPSC activity, or consumer-product safety hazards, or when timing compliance testing, liability underwriting, or marketplace listing-risk decisions. Distinct from drug/food/device recalls. Updates: daily.

  Connector

• x402_get_trends

  x402watch

  Get the last-24-hour trends snapshot: new services count vs the previous 24h, total transaction count, total USDC volume, active buyer count, daily new-services bar (14 days), recent new services (top 10), category volume movers, and hot services with traffic surges (>= 100 24h tx and >= +50% growth). Refreshed every 5 min. Free tier. No payment required. Returns wash-filtered data using the same v2.0 algorithm as the paid endpoints.

  Connector

• ateam_auth

  ateam-mcp

  Authenticate with A-Team. Required before any tenant-aware operation (reading solutions, deploying, testing, etc.). The user can get their API key at https://mcp.ateam-ai.com/get-api-key. Only global endpoints (spec, examples, validate) work without auth. IMPORTANT: Even if environment variables (ADAS_API_KEY) are configured, you MUST call ateam_auth explicitly — env vars alone are not sufficient. For cross-tenant admin operations, use master_key instead of api_key.

  Connector

• ateam_test_skill

  ateam-mcp

  Send a test message to a deployed skill and get the execution result. Wait modes (wait_for): • 'root' (default, back-compat) — wait until the message's root job completes, return single-job result. Fast, ignores any sub-skills the root delegated to via askAnySkill. • 'chain' — wait until EVERY job in the chain (root + handoffs + askAnySkill subcalls, recursively) reaches a terminal state, then return the full chain tree. Use when testing multi-skill flows (orchestrator → workers, builders → sub-builders, etc.). The response.chain field carries chainJobs[] with parentJobId/relation/depth and executionSteps[] with tool-nesting (opId/parentOpId/_toolDepth). Legacy: wait:false is equivalent to wait_for:'never' — returns job_id immediately for polling via ateam_test_status. wait:true is the same as the default wait_for:'root'.

  Connector

• ateam_test_notification

  ateam-mcp

  Fire a REAL notification at an existing actor in a deployed solution — for end-to-end testing of the system-initiated notification path (telegram/push/app channels). Unlike ateam_test_skill (synthetic test actor with no channels) and ateam_conversation (user-initiated thread), this calls the /api/internal/notify-user path that PCM and other sibling services use — so the actor's real enabled channels actually receive the message. Use for: • Channel fan-out smoke (does telegram/push/app actually receive it?) • Delivery-result verification (per-channel ok/failed in the response). Auth: forwards your authed api_key to Core (no master-secret involvement). Tenant is pinned by the key itself — cross-tenant targeting is structurally impossible. ⚠️ SAFETY: • The text is prefixed with [TEST] in the actual notification — visible to the user, anti-phishing. • Rate-limited: 10 calls/min per session. • Every call is audited (caller, tenant, actor, content hash) regardless of outcome. • actor_id is scoped to your tenant — cross-tenant targeting is rejected by Core's per-tenant Mongo isolation. • reply_handler is NOT supported via api-key auth (Core ignores it). Routing the user's next reply to an arbitrary skill is a privilege-escalation surface. For routing/engagement tests, use ateam_test_skill.

  Connector

• ateam_github_promote

  ateam-mcp

  SHIP DEV TO PROD. Merges the `dev` branch into `main` and auto-tags the new main HEAD as safe-YYYY-MM-DD-NNN. Use after testing your dev work, when you're ready to deploy changes to production. Workflow: 1) ateam_github_patch (writes to dev) → 2) ateam_github_promote (merges dev→main) → 3) ateam_build_and_run (deploys main). Pass dry_run:true to see what's about to ship without merging. On merge conflict the call returns 409 — resolve manually on GitHub (open a PR or use the web UI), then retry.

  Connector

• get_power_pipeline

  DC Hub — Data Center & Power Intelligence

  Use when a user asks WHERE NEW POWER GENERATION is coming online (the forward supply pipeline) — e.g. "how much new generation is planned in Virginia / the Southeast / ERCOT, and when?". Planned, permitting, and under-construction generators NATIONWIDE from EIA-860M, INCLUDING non-ISO regions (TVA, Southern Co, Arizona PS, PacifiCorp, LADWP) that interconnection-queue feeds miss. Each generator has location (lat/lng), state, county, balancing authority, technology/fuel (solar photovoltaic, onshore wind, natural-gas combined cycle, batteries, nuclear), nameplate megawatts (MW), status (planned → under construction), and planned online month/year. Filter by state (2-letter, e.g. VA), ba (balancing-authority/ISO code, e.g. PJM, ERCO, SOCO, TVA), status (P/L/T=planned, U/V=under construction, TS=testing), or min_mw. Returns a summary (total planned MW, mix by technology + status) plus the largest projects. Try: get_power_pipeline state=VA. Do NOT use for ALREADY-OPERATING capacity or grid headroom (use get_grid_intelligence / get_grid_data) or for data-center construction projects (use get_pipeline).

  Connector