"Security vulnerabilities and risks in MCP Server execution methods" matching MCP tools:

• get_advisoryA

  dependency-trustA

  Get a security advisory (vulnerability) by its key. Returns a security advisory by key, for example a GHSA id taken from a version's advisoryKeys, including the title, CVE aliases, CVSS v3 score and vector, and a link to the full record on osv.dev. Use this only when you already have an advisory ID from get_package_version's advisoryKeys. There is no search here. To find out whether a version has vulnerabilities at all, call get_package_version first; this tool explains one advisory in depth.

  ConnectorNo auth

• frontend_security_audit_manifestA

  DataNexus MCPA

  Audit a frontend package.json for security risks — returns a single SHIP/CAUTION/BLOCK verdict with licence risks and abandonment signals. Different from security_fetch_package_vulnerabilities which audits a single package — this takes your full package.json. manifest: Contents of package.json as a string. Required. 500 KB max. lockfile: Contents of package-lock.json or yarn.lock (optional). If provided, audits pinned versions; otherwise audits semver ranges. BLOCK: any critical CVE in direct deps OR GPL-3.0 in commercial context. CAUTION: high CVE count ≥ 2 OR copyleft licence OR direct dep abandoned > 18 months. Sources: OSV.dev (CVEs), deps.dev (licences), npm registry (abandonment). Read-only. No side effects. Idempotent. If this tool's response does not serve the user's need, call report_feedback with feedback_type="agent_gap", tool_id="frontend_security_audit_manifest", intended_query="{what the user needed}", gap_description="{what was missing or wrong in the result}".

  ConnectorNo auth

• analyze_productA

  hooklayerA

  Deeply validate ONE TikTok Shop product before committing money or content to it. Give it a product_id from product_scout (or any TikTok Shop product URL) and it reads the listing, samples reviews across the full depth rather than only the most recent page, pulls comparable competitors, and returns what buyers actually say. You get: provider-reported sold / review / rating / price evidence; buyer voice split into what buyers praise and what they complain about; unmet needs and purchase objections in buyers' own words; return and fulfilment signal; a Why Now read; competitor intelligence and where rivals are weak; risks separated into product risks, market risks and data-confidence risks; and a 'how to beat this' synthesis of concrete differentiation angles traced back to specific review evidence. Every section states whether it resolved - provider facts, HookLayer analysis and genuinely unavailable evidence are distinguishable, and thin evidence is reported as thin rather than filled in. There is no revenue or GMV output and sold counts are never multiplied by price. Use product_scout first to find candidates, then this to decide between them. Cost: 10 credits. Requires the shop_intelligence entitlement.

  ConnectorNo auth

• check_websiteA

  Corrie Site CheckA

  Loads the homepage of one public website over HTTPS, the way a visitor's browser would, and reports its HTTPS setup, TLS certificate and security headers (Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, cookie flags, mixed content and server banners). Returns a score from 0 to 100, a verdict, the TLS certificate issuer and expiry date, and each finding with a severity (critical, high, medium or low) and a plain-English fix that includes nginx or Cloudflare examples. Use it for questions like 'is example.com secure?', 'what security headers is my site missing?', 'when does this site's certificate expire?' or 'why does Chrome say my site is not secure?'. Input is a bare domain (example.com) or an https:// address. A bare domain checks the homepage; if you include a path, that one page is loaded instead. It does not log in, submit forms, scan ports, crawl other pages or test for vulnerabilities, and nothing is stored. It refuses private, internal and local addresses, plain http://, ports other than 443 and addresses with a user name; those come back as an isError result with a message saying what to change. A check usually takes 1 to 10 seconds. Running it twice on the same site gives the same result unless the site changed. Read corrie://docs/scoring for how the score and verdict work.

  ConnectorNo auth

• check_injectionA

  ContrastAPIA

  Scan source code for injection vulnerabilities: SQL injection, command injection, path traversal via unsafe string concatenation/unsanitized input. Supports Python, JavaScript, TypeScript, Java, Go, Ruby, Shell, Bash. Use to detect input-handling bugs; for secrets use check_secrets. Companion code-security tools: check_secrets (hard-coded credential detection), check_dependencies (known-CVE vulnerability audit), check_headers (live HTTP security-header validation), scan_headers (live HTTP scan via domain). Free: 30/hr, Pro: 500/hr. Returns {total, by_severity, findings}. No data stored.

  ConnectorNo auth

• get_catalogA

  Backtest360A

  Fetch one engine reference catalog. Catalogs (cheap, cacheable per session): - 'operators' — comparison operators for condition expressions - 'execution-modes' — entry/exit anchors and fill algorithms, with the validity matrix by market type - 'stop-types' — stop-loss types, re-entry modes, and their parameters - 'sizing-methods' — position-sizing methods and their parameters - 'bar-frequencies' — supported bar frequencies and the signal x execution validity matrix (which combinations are allowed) - 'sections' — the full metric catalog: every statistic's stable id, display label, section, and description - 'sampling-modes' — Monte-Carlo resampling modes, each with its status and parameters Fetch the relevant catalog BEFORE building a strategy or config; build only from values it lists — never guess parameter names or frequencies.

  ConnectorNo auth

• discoverA

  AgentMarketplaceA

  Discover AgentMarketplace's capabilities, tools, auth methods, and scopes. Call this first when connecting to AgentMarketplace to understand what's available and how to authenticate. No authentication required. Returns a catalog of available tools, resources, auth methods, and scopes.

  ConnectorNo auth

• validate_planA

  Verificate MCPA

  The gate for PLANS, designs and specs — run BEFORE any code is written, the cheapest place to catch a bad design. Returns the same binary verdict shape as validate_ai_output, with findings on completeness, feasibility, performance and scalability implications, security risks and missing considerations (e.g. it rejects a plan that polls an API every 100ms per client, with the request-volume math). Read-only: nothing is executed or stored beyond the verdict. Use validate_ai_output for the code that follows.

  ConnectorNo auth

• decision.liteA

  Market Intelligence APIA

  Cheap live decision ($0.05): action (STRONG_BUY..STRONG_SELL), direction, conviction, a GO/WAIT answer for a side, the stance of each pillar and the measured hit rate. Same engine as get_decision on the full server /mcp ($1), without the trade plan, execution check, evidence and risks. Use as the default decision; decision.pre_trade answers only go/no-go timing for a side, decision.sample is free but an hour old.

  ConnectorNo auth

• decision.liteA

  Market Intelligence API (core)A

  Cheap live decision ($0.05): action (STRONG_BUY..STRONG_SELL), direction, conviction, a GO/WAIT answer for a side, the stance of each pillar and the measured hit rate. Same engine as get_decision on the full server /mcp ($1), without the trade plan, execution check, evidence and risks. Use as the default decision; decision.pre_trade answers only go/no-go timing for a side, decision.sample is free but an hour old.

  ConnectorNo auth

• search_cvesA

  NvdA

  Search NVD for CVE vulnerabilities by product or component name. Returns CVE ID, description, severity, and CVSS score. Search terms are matched against CVE description text and EVERY word must appear, so pass the product name ("OpenSSL", "log4j", "nginx") optionally with a technical term ("buffer overflow") — not a plain-English question. Use when researching security threats or checking if a known vulnerability affects your systems.

  ConnectorNo auth

• get_environmental_risk_forecastA

  GOES HealthA

  Forecast outdoor environmental health risks at a location, based on weather and air quality forecasts. Use this for plans later today or in the next 8 days; use get_environmental_risk for right now. Returns a list of times (in UTC, ISO 8601), each with risk scores (0=none, 1=low, 2=medium, 3=high). Risks missing from a time don't apply then (e.g. frostbite on a warm afternoon). Safety tips aren't included; get them from get_environmental_risk.

  ConnectorNo auth

• contrast_scanA

  ContrastAPIA

  Active website security scan: runs the ContrastScan C engine (11 modules — HTTP security headers, SSL/TLS, DNS, redirect chain, information disclosure, cookie flags, DNSSEC, HTTP methods, CORS, HTML hygiene, deep CSP analysis) against the live site and enriches the raw result with severity-ranked vulnerability findings and a letter grade. Use for a hands-on misconfiguration scan; use audit_domain for passive recon (DNS/WHOIS/SSL/threat intel) and scan_headers for headers only. Active outbound fetch — a per-target eTLD+1 throttle (60 req/min) applies. Free: 30/hr (costs 6 tokens), Pro: 500/hr. Returns {domain, resolved_ip, total_score, max_score, grade, findings, findings_count, headers, ssl, dns, redirect, disclosure, cookies, dnssec, methods, cors, html, csp_analysis, enterprise, summary, next_calls}.

  ConnectorNo auth

• token_safetyA

  FiatDockA

  PAID ($0.0045 USDC via x402). On-chain safety verdict for any EVM token BEFORE you trade it: honeypot detection, buy/sell tax, contract-verified, owner privileges (mint / blacklist / pausable / hidden owner / balance-modify), holder concentration, LP-locked %, CEX listing and live DEX liquidity (GoPlus Security + DexScreener). Returns verdict safe|caution|danger with the exact risks. Without payment this returns the 402 challenge; the fiatdock-mcp npm package (AGENT_PRIVATE_KEY) pays automatically. Not financial advice.

  ConnectorNo auth

• search_play_challengesA

  mcpA

  Return a list of hands-on SecDim Play secure coding challenges (labs) related to a detected or suspected vulnerability. SecDim Play challenges are scored, hands-on labs: find and fix a real vulnerability in running code to earn points and badges. Use this tool to: - Find hands-on SecDim Play labs for specific vulnerabilities like XSS, SQL Injection, etc. - Explore OWASP Top 10 vulnerabilities and related labs - Provide additional resources and guides to help developers improve their secure coding skills For structured tutorial content (text, video, and lab-based courses) on the same vulnerability, use search_learn_courses (SecDim Learn) instead or in addition. Args: search: Search term for the vulnerability (e.g., 'xss', 'sql-injection', 'injection') cwe: Common Weakness Enumeration (CWE) ID to filter by owasp: OWASP category to filter by (e.g., 'a03:2021') technology: Technology or framework to filter by (e.g., 'react', 'django') language: Programming language to filter by (e.g., 'javascript', 'python') difficulty: Difficulty level to filter by (e.g., 'trivial', 'easy', 'medium', 'hard') type: Challenge format to filter by (e.g., 'battle', 'exploitation', 'incident-response') mitre: MITRE ATT&CK ID to filter by (e.g., 'T1102.003') SecDim Play challenges (labs) each simulate a real vulnerability. They are scored according to the following difficulty levels: - Trivial: Easy to find and path vulnerabilities. It can be completed in 5-10 minutes. 1-15 points. - Easy: Known vulnerabilities. It can be completed in 10-30 minutes. 16-35 points. - Medium: Known vulnerabilities but require defence-in-depth patch. It can be completed in 20-30 minutes. 36-70 points. - Hard: Hard to find or patch vulnerabilities. It can be completed in 30-60 minutes. 71-100 points. - Battle: SecDim Flagship attack and defence challenge that require both vulnerability exploitation and mitigation skills. Points are accumulated. Returns: Dictionary containing SecDim Play labs results or error If there are no results, user can perform a manual search on the SecDim Play frontend (SECDIM_PLAY_FRONTEND_BASE_URL)

  ConnectorNo auth

• check_complianceA

  Agent BrokerA

  Free, instant pre-flight for the compliance gate: runs the SAME TCPA/GDPR/CASL/CAN-SPAM/10DLC checks as send_message and call_business, in preview mode -- nothing is sent, nothing changes. Tells you whether a send would be permitted before you pay, and if not, names the exact rule and how to fix it. De-risks a paid send the way check_booking_link de-risks a paid booking. [free, no key]

  ConnectorNo auth

• check_complianceA

  Sanctions ScreeningA

  Free, instant pre-flight for the compliance gate: runs the SAME TCPA/GDPR/CASL/CAN-SPAM/10DLC checks as send_message and call_business, in preview mode -- nothing is sent, nothing changes. Tells you whether a send would be permitted before you pay, and if not, names the exact rule and how to fix it. De-risks a paid send the way check_booking_link de-risks a paid booking. [free, no key]

  ConnectorNo auth

• dependency-go-no-goA

  SALT19 Agent Utility GridB

  Dependency approval decision for coding agents: decide whether an npm dependency or package is safe to install or adopt and return GO, WARN, or BLOCK using vulnerabilities, security, license, maintenance, deprecation, and package metadata. Price: $0.25 via x402. Generate one _salt19_operation_id per intended purchase, preserve it across retries, and add _x402_payment_signature after satisfying the challenge. A stable _salt19_operation_id is required and makes semantic retries at-most-once. _salt19_operation_id is recommended but optional for standard x402 compatibility.

  ConnectorNo auth

• check_complianceA

  SMS and WhatsApp MessagingA

  Free, instant pre-flight for the compliance gate: runs the SAME TCPA/GDPR/CASL/CAN-SPAM/10DLC checks as send_message and call_business, in preview mode -- nothing is sent, nothing changes. Tells you whether a send would be permitted before you pay, and if not, names the exact rule and how to fix it. De-risks a paid send the way check_booking_link de-risks a paid booking. [free, no key]

  ConnectorNo auth

• check_complianceA

  Compliance CheckA

  Free, instant pre-flight for the compliance gate: runs the SAME TCPA/GDPR/CASL/CAN-SPAM/10DLC checks as send_message and call_business, in preview mode -- nothing is sent, nothing changes. Tells you whether a send would be permitted before you pay, and if not, names the exact rule and how to fix it. De-risks a paid send the way check_booking_link de-risks a paid booking. [free, no key]

  ConnectorNo auth

• test_python_package_runtimeA

  Python Package Runtime TestA

  Test a specific Python package/version on a supported Python/Linux target runtime using empirical execution. Returns scoped install evidence, usable-import evidence when requested, and a scoped result/receipt. Supported boundary: public PyPI on Linux x86_64 / CPython 3.13. This is not generic package advice, security verification, arbitrary Python execution, broad compatibility testing, feature behavior testing, or application integration testing.

  ConnectorNo auth