Security & Testing MCP Servers for VS Code

Website security ratings, token verification, and tamper-evident ledger heads from Obelisk Gate.

URLhaus MCP — wraps abuse.ch URLhaus malware URL database (free, no auth)

Privacy-preserving file proofs on Solana. Files are hashed locally. Currently free, no API key.

Sanctions, PEP, watchlist, recall, business, and contract screening. Free tier, no auth required.

Agent supply-chain security, scanner consensus, x402 reliability, and commerce MCP tools.

Read-only smart-contract security intelligence for autonomous agents.

Security grades for MCP servers and npm/PyPI packages, ranked by CISA KEV and EPSS.

Chinese content compliance check: Ad-law banned terms + AI labeling rules, with legal basis provided for each clause.

XFA's remote MCP server — query device posture, compliance, policies & CVEs. Read-only.

ZEN SecDB MCP server for CVE intelligence, CVSS/EPSS scoring, advisories, SSVC, and package audits.

Read-only library of 24 defensive cybersecurity skills: ATT&CK, ATLAS, DFIR, CTEM and more.

Scan a deployed site for an exposed Supabase service_role key and audit Row Level Security.

Use before citing a page, sharing links or installing a suggested package. Signed receipts.

UAE ICV compliance: governed scores, evidence gaps and actions with deterministic numbers.

Acceptance tests for any web app, however it's built: full journeys on apps you're allowed to test.

Record how any CLI behaves and check that a rewrite behaves the same (golden tests).

The Compliance Knowledge Marketplace. Accessible to people and AI. Find it on Complyzard.

Free website check: HTTPS setup and security headers, scored with plain-English fixes. No account.

Shows an AI assistant the last cypress run: command log, errors, screenshots, DOM of failed tests.

Inspects live IPv4/IPv6 DNS resolution, TLS certificate issuer/expiry, and HTTP security grade.

Edge Case Museum MCP — 'Your code works. Except for these wonderfully terrible inputs.'