Security & Testing MCP Servers for HTTP / API

SSRI sha384 digest shape, value discarded

Retired. Use com.stratalize/stratalize.

Zero-storage MCP privacy proxy — PII tokenized before AI inference. ML-DSA-65 signed, Base-anchored.

Find known subdomains of a domain. Passive data; may include historic entries. List or count.

Preflight a short or unknown URL before your agent fetches it. Returns next: fetch or skip.

SWID tagId charset, value discarded

Pay-per-call agent tools: PDF, OCR, translation, news search, prediction markets, web, chain reads.

TLPTOracle — 17-tool TIBER-EU TLPT framework: scope, threat intel, scenarios, reports.

Security reviews, threat models over a repo or website, and remediation tracking, in your editor.

Free crypto scam checks: token and contract risk, scam or sanctioned addresses, phishing links.

Query Truss threat intelligence via hosted MCP (OAuth). Growth+ plans.

Free OFAC SDN wallet screen + sample preview for AI agents on Base. Read-only, no payment surface.

Post-quantum, tamper-evident receipts for agent actions. Ed25519 + ML-DSA-65, offline verify.

Trust scoring for domains, wallets, APIs. SSL+DNS+WHOIS+headers. Score 0-100.

C2PA standard visual authenticity scanner and metadata auditor.

IOCs (URLs, domains, IPs, hashes) shared by the infosec community on X/Twitter. No auth, CC0.

MCP server for visual regression testing: triage a PR's UI diffs from your coding agent.

Website flagged by security vendors? Free scan, then we send the removal requests for you (paid).

Unit 42 malware analysis & threat research. $0.01/query. Register in-session — free testnet funds.

Researches Japanese companies' third-party certifications (ISO 27001, P Mark, ISMAP, etc.) from public sources, returning 5-category verdict

Flags phantom-squatted/typosquatted domains and known-malicious URLs before an agent follows them.