Security & Testing MCP Servers for Windsurf (legacy)

Free WCAG 2.2/ADA/508 accessibility MCP: scan, AI fixes, verify, vision audit, localhost tunnel

Local QA MCP: scan URLs, inspect pages, generate Playwright repros, and run tests.

Deterministic axe-core accessibility scans (WCAG 2.1 AA, EN 301 549, PDF/UA) via your account.

Fail-closed Cedar policy gate + Ed25519 signed receipts for agent tool calls. Denies on any error.

MCP gateway for QA/SDET work: Playwright, files, GitHub, Jira, Postgres & more in one connection.

CVE, KEV, EPSS, SBOM and advisory lookups; per-CVE exposure from Shodan data (© Shodan). Keyless.

Public-metadata domain intelligence CLI and MCP server using DNS, certificate transparency, and unauthenticated identity discovery.

Panther Labs MCP Server

1,451 security controls across 261 frameworks with bidirectional mapping

Read-only Postgres/Supabase RLS audit with a rolled-back probe that proves who can read which rows.

MCP server for using the REMnux malware analysis toolkit via AI assistants

Local crypto inventory for developers and AI agents; coverage and limits inside the CBOM.

AI-powered OSINT agent & MCP server. 20 tools: email, breach, IP, WHOIS, DNS, Shodan, GitHub & more.

Provar MCP: AI-powered Salesforce test automation. Generate, validate, migrate, and run tests.

MCP server for accessible agentic coding — WCAG audit tools for AI coding agents

Scans files for leaked secrets and API keys

MCP gateway: many servers, one policy, lethal-trifecta blocking, PII masking, audit log

MCP proxy server with behavioral profiling, security scanning, risk gating, and safe execution

MCP server for accessing CIRCL CVE SEARCH API - search CVE data, vulnerabilities, and security information

Load-test a URL, ping it by phase, ramp to find the capacity, compare runs: JSON reports, guardrails

MCP server for the SCF Controls Platform — 187 tools for controls, evidence, risk, and TPRM.