Security & Testing MCP Servers for Zed

Pseudonymizes PII before your LLM and returns a cryptographically signed receipt per response.

11-scanner SAST/DAST MCP server with closed-loop remediation, SBOM/SARIF, and CI integrations

Was this document edited, did its redactions hold, is it safe for a model to read — Tamperlens API.

Find the Unicode that hides meaning: bidi controls, invisibles, homoglyphs and mixed scripts.

Scans code, IaC and AI-agent config for security problems. Read-only — nothing can be edited.

MCP server for VibeScan — scan projects for leaked secrets and security issues

MCP server for JavaScript endpoint discovery and attack surface mapping. Discovers JS files from 23+ passive sources, extracts API

Register/verify your domains, queue security scans, and read findings (CVE, severity).

Send a password or API key as a link that opens once. Encrypted client-side, so we cannot read it.

Finds the 12 settings that break when public TLS certificates fall to 100 days on 2027-03-15: openss

Manage Koru Shield DNS filtering: profiles, rules, categories, schedules, and logs.

Privacy protection: scans, tracker detection, data broker opt-outs.

Crypto security, honeypot detection, wallet analysis, and token risk scoring across 31 blockchains.

Reads security headers and CSP line by line in your config file and names the lines that silently do

Finds authorization holes in Next.js + Supabase apps and live Supabase databases. No API key.

Live honeypot threat intel: attacker IPs, IOCs, credentials, payloads, actors.

Ten checks on the export paragraph of a repository that ships encryption

Audits firestore.rules and storage.rules for public access, expired test-mode dates and missing owne

Detect hardcoded secrets in source and config. Reports masked previews, never the values.

Independent security review for AI-built apps: exposed secrets, broken auth, unsafe data access.

SOC 2 Type II compliance for trust services criteria (security, availability, processing