Security & Testing MCP Servers for Windsurf (legacy)

MCP server for Pentest-Tools.com: run scans, manage findings and reports via your preffered LLM.

Web-app QA for AI agents: 73 Playwright tools — auth, E2E, a11y/SEO/GEO, Web Vitals + Lighthouse

Public phishing feed: suspicious/confirmed phishing URLs detected hourly. No auth, CC0.

Secure password generator MCP.

Pulsedive MCP — threat-intelligence IOC enrichment (pulsedive.com)

Shodan MCP — wraps the full Shodan REST API (api.shodan.io)

Approved test intent, reviewed Playwright automation and run evidence, inside your editor.

Safe to sign? EVM, Solana, XRPL, Algorand txs, permits, tokens; OFAC wallet screen: green/orange/red

QuantumOracle — 18 post-quantum crypto tools: Kyber, Dilithium, hybrid schemes, migration.

PQC scanner for GitHub repos and smart contracts. Detects quantum-vulnerable ECDSA/RSA.

Takes the people out of text before a model sees it, and puts them back in the reply.

Resemble AI: deepfake detection, media intelligence, and watermarking actions, plus docs tools.

ResilienceOracle - 10 operational resilience tools: BIA, RTO/RPO, scenario testing.

MCP server for RoboShadow's Rubicon Platform Data API.

Rust crate vulns: CVEs, patched versions. $0.01/query. Register in-session — free testnet funds.

Protect your AI agents and IDEs from malicious open-source packages.

Sanctions screening for KYC/AML — check Czech companies and individuals against EU Financial Sanctions (FSF) and US OFAC SDN lists

OFAC sanctions screening for AI agents: 1,050 wallets, 19,389 SDN names, <100ms. Free tier, no key.

Detects leaked secrets & API keys: 32+ provider rules (AWS, GitHub, Stripe, OpenAI…), zero deps.

Bonafido: is a domain a real business site? Verdict, trust score, risk flags.

Scan a web page for accessibility, security, privacy, quality and SEO issues, with fixes.