Security & Testing MCP Servers for Windsurf (legacy)

Contract and agent-package scans, phishing URL and OFAC checks, domain and header checks.

Verified AI voice-clone scam incidents, loss stats, and a family verification protocol. Keyless.

Sanctions, PEP, watchlist, recall, business, and contract screening. Free tier, no auth required.

Security grades for MCP servers and npm/PyPI packages, ranked by CISA KEV and EPSS.

Chinese content compliance check: Ad-law banned terms + AI labeling rules, with legal basis provided for each clause.

ZEN SecDB MCP server for CVE intelligence, CVSS/EPSS scoring, advisories, SSVC, and package audits.

Read-only library of 24 defensive cybersecurity skills: ATT&CK, ATLAS, DFIR, CTEM and more.

Scan a deployed site for an exposed Supabase service_role key and audit Row Level Security.

Use before citing a page, sharing links or installing a suggested package. Signed receipts.

UAE ICV compliance: governed scores, evidence gaps and actions with deterministic numbers.

Acceptance tests for any web app, however it's built: full journeys on apps you're allowed to test.

Record how any CLI behaves and check that a rewrite behaves the same (golden tests).

The Compliance Knowledge Marketplace. Accessible to people and AI. Find it on Complyzard.

Free website check: HTTPS setup and security headers, scored with plain-English fixes. No account.

Search and read Cyber Library, a free structured cybersecurity knowledge base. Read-only, no auth.

Shows an AI assistant the last cypress run: command log, errors, screenshots, DOM of failed tests.

Inspects live IPv4/IPv6 DNS resolution, TLS certificate issuer/expiry, and HTTP security grade.

Edge Case Museum MCP — 'Your code works. Except for these wonderfully terrible inputs.'

Test your AI agents for security and safety weaknesses, and re-verify the fixes.

Accessibility scans with evidence, public reports, and fresh checks after fixes.

Is this name on Japan's MOF asset-freeze list? Hosted, list-change history kept. Reference only.