"TypeScript MCP servers for testing observability and security use cases" matching MCP tools:

• update_notification_preferencesA

  RoutebaseA

  Set YOUR notification preferences for one or more categories. Categories you do not mention keep their current setting. Use resetCategories to drop your override so a category follows the organization default again — an entry in categoriesJson can only set an override, never remove one. Valid categories: api_design, testing, project, mock_server, style_guide, team, portal, monitoring, security, billing, deprecation. Use this for your own preferences; for the organization defaults use update_org_notification_defaults.

  Connector

  Destructive

  API key

• get_leadproof_evaluation_pathA

  LeadProof Sales AgentA

  Use first when a buyer is exploring LeadProof without supplying workflow data. Returns the official no-purchase sequence: buyer guide, fictional example audit, browser-only calculator, public workflow tests, and no-card trial. For a scored workflow diagnosis, use audit_lead_workflow; for replay testing, use get_leadproof_replay_trial; for paid checkout, use get_leadproof_checkout only after authorization.

  ConnectorNo auth

• list_my_casesA

  DuebackA

  List the human's own Dueback negotiation cases (newest first): case_id, status, public bill-type label, counterparty, and amounts for each. Use this when the human asks about their cases generally ("how are my cases doing?") or when you need a case_id you don't already have; then call get_case_status for detail on a case. If the result carries sign_in_required, the human is not signed in and the empty cases list is NOT a report that they have no cases: ask the human to sign in to Dueback, then call list_my_cases again. A 401 is returned as this friendly result, not raised, so unauthenticated probes (e.g. bots hitting the MCP endpoint without credentials) do not surface as Sentry errors.

  ConnectorNo auth

• generate_orm_modelsA

  Diogenes Autonomous Microservice GatewayA

  Compiles SQL DDL schemas into type-safe ORM entities and TypeScript validation schemas (Prisma, Drizzle, SQLAlchemy, Zod). Use when scaffolding application models, generating TypeScript data layers, or synchronizing schemas; for translating raw SQL across dialects, use transpile_sql_dialect instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'schema_ddl' ('orm_target' defaults to 'drizzle_orm_typescript'), supports '?demo=true' or L402 (15 sats), and returns HTTP 400 if invalid.

  ConnectorNo auth

• generate_orm_modelsA

  diogenes-database-intelligence-mcpA

  Compiles SQL DDL schemas into type-safe ORM entities and TypeScript validation schemas (Prisma, Drizzle, SQLAlchemy, Zod). Use when scaffolding application models, generating TypeScript data layers, or synchronizing schemas; for translating raw SQL across dialects, use transpile_sql_dialect instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'schema_ddl' ('orm_target' defaults to 'drizzle_orm_typescript'), supports '?demo=true' or L402 (15 sats), and returns HTTP 400 if invalid.

  ConnectorNo auth

• axint.validateA

  AxintA

  Validate a TypeScript intent definition without generating Swift. Runs the full Axint validation pipeline (134 diagnostic rules) and returns a JSON array of diagnostics: { severity: 'error'|'warning', code: 'AXnnn', line: number, column: number, message: string, suggestion?: string }. Returns an empty array [] when validation passes. Use: use for TypeScript DSL diagnostics before Swift output; use swift.validate for existing Swift. Inputs: source is TypeScript DSL text; strictness options affect diagnostics only and never emit Swift. Effects: read-only diagnostics; writes no files and uses no network.

  ConnectorNo auth

• axint.schema.compileA

  AxintA

  Compile a minimal JSON schema directly to Swift, bypassing the TypeScript DSL entirely. Supports intents, views, components, widgets, and full apps via the 'type' parameter. Uses ~20 input tokens vs hundreds for TypeScript — ideal for LLM agents optimizing token budgets. Use: use for token-light JSON-to-Swift generation; use compile for full TypeScript DSL control and scaffold for TS starters. Inputs: schema kind selects intent, view, widget, or app output; options add companion metadata. Effects: read-only Swift generation; writes no files and uses no network.

  ConnectorNo auth

• check_injectionA

  ContrastAPIA

  Scan source code for injection vulnerabilities: SQL injection, command injection, path traversal via unsafe string concatenation/unsanitized input. Supports Python, JavaScript, TypeScript, Java, Go, Ruby, Shell, Bash. Use to detect input-handling bugs; for secrets use check_secrets. Companion code-security tools: check_secrets (hard-coded credential detection), check_dependencies (known-CVE vulnerability audit), check_headers (live HTTP security-header validation), scan_headers (live HTTP scan via domain). Free: 30/hr, Pro: 500/hr. Returns {total, by_severity, findings}. No data stored.

  ConnectorNo auth

• get_faqA

  CalmActivaA

  Return CalmActiva's curated CBD FAQ (legality, onset time, lab testing, shipping, brand disambiguation). Use for general CBD/brand questions before falling back to web search.

  ConnectorNo auth

• get_demo_guideA

  eDiscovery Decoder News/CalcA

  Return a short, human-readable walkthrough for testing this server: the endpoint, the tool/prompt/resource names, and ready-to-paste sample prompts. Use to give someone a guided demo. For the full machine-readable capability catalog, use list_capabilities instead.

  ConnectorNo auth

• get_security_infoA

  Fluentive MCPA

  Returns Fluentive's security, privacy, and compliance information. Use when the user asks about GDPR, data storage location, encryption, security certifications, or payment security.

  ConnectorNo auth

• hatch_statsA

  Vigi-SkyA

  Return aggregate statistics of the Hatch UFO archive (18,116 cases, 1900-2002): cases by decade and top countries. Use it for the big picture of historical reports; for cases near a place use nearby_cases. Archive data, not 2026 sightings; live read of the Vigi-Sky API.

  ConnectorNo auth

• scan_appA

  MalinoisA

  Runs a passive, outside-in security check of a live web app and returns a letter grade (A–F), each issue in plain language with fix steps, and a report link. Use when the user asks whether their deployed app is safe, before launch, or after a redeploy to confirm a fix. It checks for publicly readable Supabase/Firebase data, secret keys (Stripe, OpenAI, Supabase service_role…) in client JavaScript, downloadable .env/.git files, source maps, permissive CORS and missing security headers. Do not use it for apps the user does not own or is not authorized to test, for localhost or private addresses, or to review source code — it only sees what the public URL serves. Behavior: sends ordinary GET requests like a browser (no login, exploitation or load testing); takes about 10–30 seconds; saves the result as a report page on malinois.app, linked in the response; secrets appear only masked. Each app can be checked at most 20 times per hour.

  ConnectorNo auth

• evictions_list_casesA

  Evictions APIA

  Use this when you need the person’s cases, or the id of a case you do not have. Input: optional `limit` and `cursor`, and `landlordId` for only one landlord’s cases (`none` for the cases with no landlord). Returns the cases of the key’s organization and mode (test or live), newest first, a page at a time, each with its `state` and `nextAction`, and `nextCursor` for the next page (null on the last). Do not use this when you already have the case id (use evictions_get_case). Needs the person’s account: sign-in or an API key.

  ConnectorNo auth

• search_casesA

  Folketinget DkA

  Convenience search over Sag (cases/bills): finds cases whose Danish title (titel) contains a substring. Sorted by most recently updated. Use this to look up legislation/matters by keyword; for full control use query_entity.

  ConnectorNo auth

• axint.scaffoldA

  AxintA

  Generate a starter TypeScript intent file from a name and description. Returns a complete defineIntent() source string ready to save as a .ts file — no files are written, no network requests made. On invalid domain values, returns an error string. The output compiles directly with axint.compile. Use: use to create a small TypeScript intent starter; use templates.get for richer examples and compile for Swift output. Inputs: name must be PascalCase; params define the starter contract; domain defaults to general. Effects: read-only generated TypeScript; writes no files and uses no network.

  ConnectorNo auth

• test_python_package_runtimeA

  Python Package Runtime TestA

  Test a specific Python package/version on a supported Python/Linux target runtime using empirical execution. Returns scoped install evidence, usable-import evidence when requested, and a scoped result/receipt. Supported boundary: public PyPI on Linux x86_64 / CPython 3.13. This is not generic package advice, security verification, arbitrary Python execution, broad compatibility testing, feature behavior testing, or application integration testing.

  ConnectorNo auth

• website_auditA

  Rafid Intelligence NetworkC

  Perform a bounded, passive technical website inspection covering measurable SEO, performance, accessibility, security, UX and crawlability indicators; unavailable checks are reported honestly. When: Use when an agent needs evidence-backed website issues from a public HTTPS URL before estimating remediation or rebuild work. Selection: primary; prefer for passive technical, SEO, accessibility and security checks for a public HTTPS site. Do not use for estimating a build budget or penetration testing. Input is a strict JSON object; see the schema. Price: $0.75 USD per call. A free preview is available through preview_capability before payment. Full execution is paid per call via x402; an unpaid MCP call returns payment instructions.

  ConnectorNo auth

• get_support_summaryA

  BoardMarkA

  How many cases of your company wait for you and how many are open (Help menu badge). `waiting_customer` = cases where the BoardMark team answered and waits for your company (read them with get_support_case); `open` = cases not closed. Support cases = asking the BoardMark team for help. Use them when the user wants help from the BoardMark team or reports a problem with BoardMark itself (a bug, signing in, billing, a feature request) — never for the user's own project work (that is issues: create_issue, search_issues …). Every member of the token's company sees and can answer every case of the company. The BoardMark team's replies arrive in the case thread (get_support_case), and followers also get them by email. Text only: files are attached in the web app (Help → Contact support). Your writes show as "via AI agent".

  ConnectorOAuth

• compile_polyglot_type_schemasA

  Diogenes Autonomous Microservice GatewayA

  Inspects a sample JSON payload (inferring UUID, ISO-8601 datetime, email, integer vs float, and array item types) and compiles strict TypeScript interfaces, Zod schemas, Python Pydantic v2 models, and JSON Schema Draft 2020-12. Use when generating static type definitions and runtime validators in TypeScript and Python from a sample JSON response; for extracting existing function/class symbols and complexity metrics from source code, use analyze_ast_symbol_graph instead. Read-only call (32 KB, 60 RPM): accepts 'sample_json' (with enum defaults), uses '?demo=true' or L402 (20 sats); HTTP 400 if invalid.

  ConnectorNo auth

• compile_polyglot_type_schemasA

  Diogenes Context Compression, Code Patching & Deterministic Solver MCPA

  Inspects a sample JSON payload (inferring UUID, ISO-8601 datetime, email, integer vs float, and array item types) and compiles strict TypeScript interfaces, Zod schemas, Python Pydantic v2 models, and JSON Schema Draft 2020-12. Use when generating static type definitions and runtime validators in TypeScript and Python from a sample JSON response; for extracting existing function/class symbols and complexity metrics from source code, use analyze_ast_symbol_graph instead. Read-only call (32 KB, 60 RPM): accepts 'sample_json' (with enum defaults), uses '?demo=true' or L402 (20 sats); HTTP 400 if invalid.

  ConnectorNo auth