Security & Testing MCP Servers for Windsurf (legacy)

Password strength scoring with entropy, crack time estimation, common password detection. x402.

PEM fence check, key discarded

PGP armor fence check, key discarded

Phoenix/rebrand relink detection: links a debarred principal to a newly-formed business entity.

PhoneInfoga - International Phone Number OSINT

Detect PII in text: emails, phones, SSNs, credit cards, IPs. Regex + Luhn. x402.

AbuseIPDB MCP — wraps AbuseIPDB v2 API (api.abuseipdb.com/api/v2)

Shodan InternetDB MCP — wraps Shodan InternetDB (internetdb.shodan.io)

urlscan.io MCP.

VirusTotal MCP — file / URL / domain / IP reputation (BYO key)

PolicyOracle - 12 policy lifecycle tools: drafting, approval, distribution, attestation.

Email, phone, domain, URL & OFAC verification; phishing and IBAN checks via x402.

MCP server for Proofpoint TAP — threat intelligence, forensics, quarantine, and email security.

AI code security audits via x402 USDC: $0.01 scans, $0.50 audits, $5 auto-fixes. SAST/SCA.

AI-driven penetration testing - 22 security tools behind safety-hardened MCP endpoints

Signed, deterministic compliance state per object per jurisdiction, resolved upstream

Detects catastrophic-backtracking (ReDoS) regex risk via AST parsing, with JS-safe rewrites.

RegisterOracle - 10-tool DORA Art.28 register: ICT third-party, contracts, criticality.

Free scam checks for links, wallets, emails, and breach exposure. No signup.

Audit GitHub repos for malicious and supply-chain code before you depend on them.

ROT5 digit transform length, input discarded