Security & Testing MCP Servers for Microsoft Copilot

Read-only web QA agent: scans a site in a real browser and returns evidence-backed findings

Permission before writes. Gravity→DENYs→Session $0.25. Pilot $100; Gateway $299. Probe free.

Security scanner for AI agents: prompt injection, leaked secrets, PII, and SSRF-risk URL detection.

AI pentesting: run scans, triage vulnerabilities, review PRs, manage schedules and assets.

Deploy AI user personas to validate user journeys at scale. Find UX friction before real users do.

Contract and agent-package scans, phishing URL and OFAC checks, domain and header checks.

Answers EU Digital Product Passport questions: scope, required fields, registry and law changes.

Verified AI voice-clone scam incidents, loss stats, and a family verification protocol. Keyless.

Website security ratings, token verification, and tamper-evident ledger heads from Obelisk Gate.

URLhaus MCP — wraps abuse.ch URLhaus malware URL database (free, no auth)

Privacy-preserving file proofs on Solana. Files are hashed locally. Currently free, no API key.

Sanctions, PEP, watchlist, recall, business, and contract screening. Free tier, no auth required.

Agent supply-chain security, scanner consensus, x402 reliability, and commerce MCP tools.

Read-only smart-contract security intelligence for autonomous agents.

Security grades for MCP servers and npm/PyPI packages, ranked by CISA KEV and EPSS.

Chinese content compliance check: Ad-law banned terms + AI labeling rules, with legal basis provided for each clause.

XFA's remote MCP server — query device posture, compliance, policies & CVEs. Read-only.

ZEN SecDB MCP server for CVE intelligence, CVSS/EPSS scoring, advisories, SSVC, and package audits.

Read-only library of 24 defensive cybersecurity skills: ATT&CK, ATLAS, DFIR, CTEM and more.

Use before citing a page, sharing links or installing a suggested package. Signed receipts.

UAE ICV compliance: governed scores, evidence gaps and actions with deterministic numbers.