Security & Testing MCP Servers for VS Code

Preflight for AI agents, signed: one call; wallet, domain, IP abuse, package checks and CVEs.

Public phishing feed: suspicious/confirmed phishing URLs detected hourly. No auth, CC0.

Detect and redact PII and secrets before text reaches an LLM, with reversible placeholders.

FIRST.org EPSS (Exploit Prediction Scoring System) MCP.

GreyNoise Community MCP — internet scanner classification (free tier with key)

IPQualityScore MCP — wraps the IPQualityScore fraud-prevention API

MITRE ATT&CK MCP — STIX bundles from github.com/mitre/cti.

PhishTank MCP — wraps PhishTank API (checkurl.phishtank.com)

Security Feeds MCP.

SecurityTrails MCP — wraps SecurityTrails API (securitytrails.com)

ThreatFox MCP — abuse.ch indicator-of-compromise feed (free, key required)

Discover Playwright workflows, start runs, and inspect results in Playrunner Cloud.

Approved test intent, reviewed Playwright automation and run evidence, inside your editor.

Poly1305 hex length, input discarded

Poly1305 tag length, input discarded

Scan the open TCP ports of your own public IP. Fast (32) or deep (65535). No key, no signup.

Post-quantum CMMC compliance scanner & AI agent attestation. FIPS 140-3, ML-DSA-65, 36K+ mappings.

PreClick scans links for threats and confirms intent match with high accuracy before agents click.

Check an npm/PyPI package before an AI agent installs it: 5 focused supply-chain tools.

Free enterprise-grade due diligence for your app, run by your coding agent. Then the full SDLC.

Free AI test helpers: injection inputs, OWASP mapping, release plans, response and tool-call packs.