Security & Passwords

Provides a local-first, governed MCP foundation where QA engineers can check server health and capabilities, read a status resource, use an orientation prompt, and validate non-secret configuration, profiles, and credential references without exposing secrets. External provider integrations, test execution, and release reporting are not yet implemented and remain scaffolded.

Enables MCP-compatible AI clients to run curated Kali Linux security tools such as nmap, gobuster, nikto, sqlmap and netcat inside an isolated microVM sandbox. Commands execute as asynchronous jobs with readable output, cancellation and persistent per-workspace storage, with configurable network, CPU and memory limits.

Enables Hermes to privately invoke Windows MCP tools on a local PC through a Tailscale-only HTTPS path, with security checks and typed power control.

SSL/TLS certificate checker API for AI agents. Verify certificate validity, expiry date, issuer chain, protocol version, cipher strength, and security grade for any domain. Tools: security_check_ssl. Use this for security monitoring, expiry alerting, or SSL audit automation. IMPORTANT: For comprehensive trust assessment (SSL + DNS + WHOIS + headers), use trust_score_evaluate instead. Returns: {valid, expiresIn, issuer, grade, protocol}. No API key required — x402 micropayment $0.002/call on...

Enables pre-launch website checks for link previews, SPA routes, and security headers before sharing URLs.

Provide AI-powered real-time analysis and intelligence on NPM packages, including security, dependencies, performance, and quality metrics. Enable faster and safer package management decisions by integrating with Claude and Anthropic AI. Deliver comprehensive insights such as vulnerability scanning, download trends, and maintenance status to optimize your npm ecosystem.

55 tools. Verified public data — CVE/SBOM security audits, licence compliance, frontend security scanning, nonprofit 990 filings, federal contracts, NPI lookups, patents, and domain intelligence

Trust scoring API for AI agents. Evaluate the trustworthiness of any domain, URL, wallet address, or API endpoint. Returns composite score 0-100 with letter grade (A+ to F), verdict (trusted/moderate/suspicious/dangerous), and 5 detailed sub-scores: SSL/TLS (25%), DNS (15%), WHOIS (25%), Security Headers (20%), Content (15%). For crypto wallets (0x...): returns on-chain trust based on transaction count, balance, and contract verification on Base L2. Tools: trust_score_evaluate (single), trust_...

JWT token decoder API for AI agents. Decode and inspect JSON Web Tokens without verification: extract header (algorithm, type), payload (claims, issuer, audience), expiry timestamp, and signature info. Tools: security_decode_jwt. Use this for debugging authentication flows, inspecting token claims, or verifying token structure. IMPORTANT: This decodes without verifying — for security validation, verify signatures server-side. Returns: {header, payload, claims, expiresAt, algorithm}. No API ...

58-endpoint utility hub - DNS lookup, web scraping, CVE scanning, AI translation, PII detection, domain health audit, company intelligence. Pay per call via x402 on Base.

Enables authorized security auditing of AI-agent supply chains and agent-facing surfaces: deterministic local skill-bundle audits against eight attack patterns, secrets scanning, and scope-gated read-only recon of agent endpoints and MCP surfaces.

Provides on-machine security scanning for Copilot-generated code, including SAST, secrets, dependency, container, and configuration checks, plus AI-specific risk detection, with findings and fixes available via MCP tools.

Enables an MCP client such as Claude Code to inspect and change a stock OpenWrt 25.12+ router over SSH, covering system status, logs, clients, firewall, packages, services, and WireGuard peers. Configuration edits are staged, checked, and armed with an automatic rollback that survives a reboot, all behind deny-by-default per-client grants, an audit log, and masked secrets.

Enables querying SAST code quality and security data from SonarQube and Coverity Connect via MCP, including quality gates, issues, projects, streams, and defects.

Enables any MCP client to delegate a scoped task to a local Ollama model that runs its own tool-calling loop for file operations and web search, with an allow-listed folder security model.

Enables read-only PostgreSQL interaction with enforced SQL security policies, including query validation, row limits, and timeouts.

Enables security teams to determine which ATT&CK techniques lose detection coverage when telemetry sources are removed, by computing set differences over a Sanity content graph and consulting a knowledge base via two Context MCP endpoints.

Enables Zendesk admins to audit business rules, monitor backlog and SLAs, review security, and manage user offboarding through natural language.

Enables a pre-push security gate that scans AI-built apps for leaked secrets, missing row-level security, authorization flaws, unverified webhooks, known CVEs, and backdoors, blocking critical pushes before code reaches main.