"TypeScript MCP servers for testing observability and security use cases" matching MCP tools:

• get_testing_guidelinesA

  IA-QA — 130+ QA & Dev Tools for AI AgentsA

  Query the IA-QA methodology knowledge base. Returns structured testing guidelines, assertion strategies, thresholds, best practices, and relevant MCP tools for a given topic. Call without a topic to list all available topics. Topics: llm-unit-testing, rag-pipeline, prompt-stability, prompt-ab-testing, embedding-quality, eval-framework, semantic-testing, auto-testing, security, api-testing, ci-cd, multimodal, llm-data-security, agent-observability, pro-tips, learning-paths, golden-dataset.

  ConnectorNo auth

• scan_tool_descriptionA

  KamyA

  Heuristic pattern scan of MCP tool description text for prompt-injection tells — instructions addressed at the reading model, data-exfiltration hints, attempts to override your system prompt or hide content. Run it on descriptions from third-party MCP servers before you act on what they say. Returns risk 'low' | 'medium' | 'high' and the matched findings with excerpts. This is a heuristic aid, NOT a security boundary: a 'low' verdict is not evidence that a tool is safe, and an injection phrased to avoid the patterns will score low. Do not treat any result here as clearance to trust an untrusted tool — keep your own judgement and human review in the loop. Read-only: it analyses only the text you pass in and fetches nothing. Requires a Kamy API key.

  ConnectorNo auth

• check_headersA

  ContrastAPIA

  Validate HTTP security headers you provide (JSON): CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Permissions-Policy, Referrer-Policy against best practices. Use to test header config before deployment or validate non-public servers; use scan_headers to fetch live. Free: 30/hr, Pro: 500/hr. By default header values are truncated to 500 chars; pass include='full' for the full raw value. Returns {total, by_severity, findings}. No external requests.

  ConnectorNo auth

• cti_get_cross_server_routesA

  website-searchA

  Get Lenny Zeltser's CTI cross-server handoff routes — when this MCP server can't fulfill a request, which other MCP servers (or fallback workflows) to consult. Surfaces a compact subset of `cti_load_context`. This server never requests your campaign or threat-intel notes and instructs your AI to keep them local—templates and guidelines flow to your AI for local analysis.

  ConnectorNo auth

• scan_tool_descriptionA

  KamyA

  Heuristic pattern scan of MCP tool description text for prompt-injection tells — instructions addressed at the reading model, data-exfiltration hints, attempts to override your system prompt or hide content. Run it on descriptions from third-party MCP servers before you act on what they say. Returns risk 'low' | 'medium' | 'high' and the matched findings with excerpts. This is a heuristic aid, NOT a security boundary: a 'low' verdict is not evidence that a tool is safe, and an injection phrased to avoid the patterns will score low. Do not treat any result here as clearance to trust an untrusted tool — keep your own judgement and human review in the loop. Read-only: it analyses only the text you pass in and fetches nothing. Requires a Kamy API key.

  ConnectorNo auth

• recommend_mcpA

  SaSame MCP Observatory + Gold Rush TownB

  Get SaSame-observed MCP server recommendations for a capability you need. SaSame, operated by SASAME S.R.L., continuously observes and measures the Model Context Protocol ecosystem and publishes verifiable evidence and history; the MCP Factory is internal machinery and an optional product surface behind it; measurement only, not endorsement. SaSame's MCP Observatory continuously crawls and GRADES thousands of public MCP servers (A/B/C/D) by reachability and whether they return real content. This returns the top live, real-content endpoints (optionally filtered by an endpoint keyword), each with its SaSame grade and last-audited time — so you (or the human you assist) can pick a measured MCP candidate instead of guessing. Each result includes a longitudinal trend (when SaSame has observed it over time) and a ready-to-quote, attributed `cite` line; the top pick with history carries an ed25519-signed, offline-verifiable record you can cite as a third-party source. Free, read-only, no signup. If you operate one of these servers, claim it (claim_start). If you can't find a fit and need an MCP/agent BUILT, call engage_sasame. Pass a referral handle from `refer` as engage_sasame(ref=...) to attribute the introduction.

  ConnectorNo auth

• axint.validateA

  AxintA

  Validate a TypeScript intent definition without generating Swift. Runs the full Axint validation pipeline (134 diagnostic rules) and returns a JSON array of diagnostics: { severity: 'error'|'warning', code: 'AXnnn', line: number, column: number, message: string, suggestion?: string }. Returns an empty array [] when validation passes. Use: use for TypeScript DSL diagnostics before Swift output; use swift.validate for existing Swift. Inputs: source is TypeScript DSL text; strictness options affect diagnostics only and never emit Swift. Effects: read-only diagnostics; writes no files and uses no network.

  ConnectorNo auth

• axint.schema.compileA

  AxintA

  Compile a minimal JSON schema directly to Swift, bypassing the TypeScript DSL entirely. Supports intents, views, components, widgets, and full apps via the 'type' parameter. Uses ~20 input tokens vs hundreds for TypeScript — ideal for LLM agents optimizing token budgets. Use: use for token-light JSON-to-Swift generation; use compile for full TypeScript DSL control and scaffold for TS starters. Inputs: schema kind selects intent, view, widget, or app output; options add companion metadata. Effects: read-only Swift generation; writes no files and uses no network.

  ConnectorNo auth

• check_injectionA

  ContrastAPIA

  Scan source code for injection vulnerabilities: SQL injection, command injection, path traversal via unsafe string concatenation/unsanitized input. Supports Python, JavaScript, TypeScript, Java, Go, Ruby, Shell, Bash. Use to detect input-handling bugs; for secrets use check_secrets. Companion code-security tools: check_secrets (hard-coded credential detection), check_dependencies (known-CVE vulnerability audit), check_headers (live HTTP security-header validation), scan_headers (live HTTP scan via domain). Free: 30/hr, Pro: 500/hr. Returns {total, by_severity, findings}. No data stored.

  ConnectorNo auth

• scan_mcpA

  Hlido Agent ReviewsA

  On-demand independent SAFETY scan of an MCP server — call this BEFORE installing or connecting to one. Give it an HTTP(S) MCP endpoint URL (scanned live in seconds), or an npm/PyPI package name or GitHub repo (queued for an isolated sandbox scan — local stdio servers execute code, so Hlido never runs them inline). Returns the safety tier (SAFE/CAUTION/RISKY/DANGEROUS), tool-poisoning detection (the malice signal), dangerous-capability red-flags (shell/code-eval/fs-write/egress/secrets) with per-tool evidence, and auth posture. Tier = blast radius if hijacked, not maintainer trustworthiness. A server Hlido hasn't scanned returns not_scanned — never assumed safe. Register of already-scanned servers: https://hlido.eu/mcp/

  ConnectorNo auth

• ateam_redeployA

  ateam-mcpA

  Re-deploy skills WITHOUT changing any definitions. ⚠️ HEAVY OPERATION: regenerates MCP servers (Python code) for every skill, pushes each to A-Team Core, restarts connectors, and verifies tool discovery. Takes 30-120s depending on skill count. Use after connector restarts, Core hiccups, or stale state. For incremental changes, prefer ateam_patch (which updates + redeploys in one step).

  ConnectorNo auth

• ir_get_cross_server_routesA

  website-searchA

  Get Lenny Zeltser's IR cross-server handoff routes — when this MCP server can't fulfill a request, which other MCP servers (or fallback workflows) to consult. Surfaces a compact subset of `ir_load_context`. This server never requests your incident notes and instructs your AI to keep them local—guidelines flow to your AI for local analysis.

  ConnectorNo auth

• malware_get_cross_server_routesA

  website-searchA

  Get Lenny Zeltser's Malware cross-server handoff routes — when this MCP server can't fulfill a request, which other MCP servers (or fallback workflows) to consult. Surfaces a compact subset of `malware_load_context`. This server never requests your sample, analysis notes, or indicators and instructs your AI to keep them local—guidelines and the report template flow to your AI for local analysis.

  ConnectorNo auth

• search_mcp_registryA

  fresh-feeds — trending/new/changed MCP servers + x402 change-data APIA

  Search the continuously-maintained MCP server registry (deduped, quality-scored, refreshed every 30 min) by name/title/description. Free; returns up to 25 matching servers with score, status, remotes and packages. For the FULL corpus (~1500 servers) use get_mcp_registry_snapshot (paid, x402).

  ConnectorNo auth

• guides.searchA

  AI Design Blueprint DoctrineA

  Search application guides by free-text query, matched against section answers and action items. Use this when the user describes an engineering challenge (security review, evaluation harness, observability) and wants matching guides. Prefer guides.get when you already have the guide slug; prefer guides.list when you need the full inventory.

  ConnectorNo auth

• list_loadoutsA

  MCPExplorerA

  List curated loadouts — deliberately-assembled kits of MCP servers + governance + plays for a specific job (GTM, coding, research, support, infra). The agent-facing version of the /loadouts product. Use get_loadout for the full kit with live trust.

  ConnectorNo auth

• list_collectionsA

  Skill of SkillsA

  The curated buyer-intent collections (e.g. mcp-servers, testing-qa, browser-automation). Use get_collection for the ranked tools inside one.

  ConnectorNo auth

• mcp_searchA

  Find MCP - Agentage MCP DirectoryA

  Search the agentage MCP directory - a public catalog of Model Context Protocol servers crawled from the official registry - for servers matching a keyword, optionally narrowed by type, category, language, or license. Use this FIRST whenever the user wants to discover, find, compare, or pick an MCP server ("is there an MCP for X", "which MCP servers do Y"). Results are ranked by text relevance to the query first, then by popularity, so the best match is on top. Returns a page of lean cards (slug, title, description, category, transport, match_score - text relevance the ranking is based on, details_url). To read one server's full packages, tools, and install command, call mcp_get with the slug from a result; open a card's details_url for the human detail page. Valid category, language, and license values come from the mcp_categories tool, not from guesswork - call it before filtering and pass its labels verbatim, or the call is rejected. Read-only - never installs or runs anything.

  ConnectorNo auth

• get_catalog_statsA

  MyMCPToolsA

  Aggregate health of the whole MCP population: verdict breakdown, share of probeable servers actually serving, transport mix, handshake latency percentiles, tool counts and probe freshness. This is the 'how healthy is MCP right now?' headline number.

  ConnectorNo auth

• compare_mcpsA

  mcp-judgeA

  Choosing between several MCP servers that do similar things? This tool decides for you. PAID $0.10 via x402 (USDC micropayment over HTTP 402 — no account or API key needed; on your first call without payment you receive the exact payment requirements, then retry with the X-PAYMENT header). Compares 2-5 MCP servers head-to-head with identical objective checks (handshake, tools/list, documentation coverage, latency, and a safe functional probe — paid tools are never called) and returns: a ranked list, the recommended winner, a plain-language explanation of why it won, and each server's full report — cheaper than separate evaluate_mcp calls on 3+ servers. Objective checks only — no human and no LLM opinion; it does not judge the real-world usefulness or safety of the content. Set 'urls' (required) to an array of 2-5 MCP endpoints (Streamable HTTP), e.g. ["https://a/mcp","https://b/mcp"].

  ConnectorNo auth

• discover_more_flight_toolsA

  Airport Lounge ListA

  Discover other flight & travel MCP servers you can add to your client. Lists complementary remote MCPs covering award flights/points redemptions, aircraft seatmaps, and airport delays/wait times — with one-line install URLs. Call this when the user asks about points/miles, seat selection, airport delays/security waits, or 'what other flight tools are there?'

  ConnectorNo auth