MCP Servers

Register/verify your domains, queue security scans (headers, TLS, DNS, ports, CVEs + AI-specific checks) and read findings, for AI agents. Install with npx -y eleion-scanner-mcp.

Deterministic AI audit layer: evaluates LLM/agent outputs against configurable policies (jailbreak, safety, quality, wallet, trade, MEV compliance) and writes every verdict to a tamper-evident SHA-256 hash chain — metadata only, never raw content. 17 tools including a full crypto-trading compliance suite. Pay-per-call via x402 (USDC on Base), from $0.01. mcp.fronesislabs.com/mcp

Security & trust layer for AI agents. Scan an MCP server or skill before you install it (scanmcpplugin, scanskill) — flags exfiltration, prompt-injection sinks, dangerous capabilities, install hooks and obfuscation → PROCEED/CAUTION/BLOCK. Plus vetendpoint (endpoint safety verdict before an agent calls or pays it) and 25 more tools: vuln scans, threat intel, compliance (SOC 2/ISO 27001/HIPAA), code security (SAST/secret/dependency), identity — 28 total. Per-call billing via API key or x402 USDC

Free DNS and email security scanner for AI assistants. DNS, SPF, DKIM, DMARC, DNSSEC, MTA-STS, BIMI, TLS/STARTTLS, FCrDNS, CAA, TLSA/DANE, blacklist and full-deliverability checks, plus security-header/CSP analysis and bookmarkable report snapshots, via the IntoDNS.ai API. No signup or API key. npx intodns-mcp

Check whether anything you depend on is known malware, before an agent installs it. checklockfile takes a package-lock.json, yarn.lock or pnpm-lock.yaml and matches every pinned version against published malicious-package advisories in one call, free and with no API key, catching compromised releases like chalk@5.6.1 while leaving their clean releases alone. scanartifact adds deterministic behavioral analysis (no LLM in the serving path) for credential theft, exfiltration, obfuscation, prompt in

Supply-chain gate for agent skills and MCP servers — scans tool definitions for poisoned instructions, pins vetted servers by content hash in a committed lock, and verifies drift in CI; the bundled truecopy-mcp proxy exposes only pinned, unmodified tools from a live server.

Zero-trust local PII and secrets masking server for Cursor, Windsurf, and Claude Desktop. npx pii-masking-run

The read-only safety layer for onchain AI agents. 13 read-only tools on Base + EVM: token/contract safety (honeypot & rug-pull checks cross-referenced across GoPlus + honeypot.is), risky-approval detection, verified-source lookup, balances, ENS + Basenames, gas, and prices. No private keys, no required API keys. npx -y basescope

The first MCP server for Malcolm, the open-source network traffic analysis suite (Zeek + Suricata + Arkime + OpenSearch + NetBox). Gives AI agents structured, threat-hunting access: search and aggregate traffic, discover fields, query Suricata alerts, browse Arkime sessions, and resolve NetBox assets. Read-only by default; opt-in, audited write classes for alerts, tagging, hunts, and PCAP upload. pip install mcp-server-malcolm

Haunt web extraction for AI agents: structured JSON or clean Markdown from permitted public pages, including Cloudflare-protected ones, with honest blocked/login/captcha errors instead of fabricated data

Self-hosted web research for MCP agents: search (SearXNG, with DuckDuckGo fallback), crawl, dense+BM25 rerank, and dedupe into a source-grounded, cited prompt. Local ONNX embeddings by default, or bring an OpenAI-compatible embedding API.

Semantic search over the StitchAPI documentation (the hosted docs MCP): searchdocs returns the most relevant doc sections with deep links, getdoc fetches a full page. Hosted endpoint https://stitchapi.dev/api/mcp, no auth.

MCP bridge for PDF Content Search — full-text PDF search with Apple Vision OCR across thousands of documents in under a second. Advanced filters (date, category, sender, amount), wildcards, boolean operators.

🎖️ - fastCRW — open-source (AGPL-3.0), self-hostable Rust web crawler & search API for AI agents. Tools: scrape, crawl, map, and SearXNG-backed search. Single ~6MB static binary; reproducible 1K-URL benchmarks faster than hosted alternatives. Hosted MCP at fastcrw.com/mcp (Streamable HTTP, OAuth) or self-host.

Search a catalog of 2,000+ AI tools, compare them, find alternatives, and check whether a tool is still active, defunct, or acquired. Hosted remote MCP at https://tooldirectory.ai/api/mcp or npx -y tooldirectory-mcp.

Free web search for AI agents with smart re-ranking. Multi-engine parallel search, zero API keys. Works natively within China's network, no proxy/VPN needed. Install via pip install searchpin && searchpin-setup.

🎖️ - Web search that returns extracted, answer-ready page content (url, title, date, text) instead of links. A Tavily alternative: same speed, 20.2% fewer tokens, higher answer quality (60.7% of decided duels) on a public replayable benchmark. One tool with automatic localization and an optional synthesized answer. Hosted Streamable HTTP at https://mcp.serpdive.com, or run npx -y serpdive-mcp.

Tells AI agents how independently a claim is being reported: syndication-aware source counting (a wire story reprinted by 40 outlets counts as one origin), 0-1 confidence scores, and published error rates in-repo. Measures corroboration, not truth — no stance detection. Keyless, no accounts. Install: npx -y corroborate-mcp.

Japanese-web-native web fetching optimized for low target-site impact and token efficiency. Outline-first progressive disclosure, ShiftJIS/EUC-JP mojibake handling, PDF/CSV extraction, and polite crawling (robots.txt, rate limits, honest User-Agent). Install via npx -y amenbo.

Search the Feedbagel RSS catalog, follow feeds, and route new entries to webhooks.

Licensed, rights-cleared content for AI agents — discover, purchase, verify, and retrieve expert analysis with a verifiable license key per article, on-chain proof, and EU AI Act Article 53 attestation. The alternative to unlicensed scraping for RAG and AI search. npx opedd-mcp

Scans Google News and PR wires for a company's funding rounds, exec moves, product launches, and acquisitions, returned as deduplicated, dated events in flat Clay-ready JSON.

Resolves a company domain or name to its LinkedIn company URL with confidence scoring and firmographic metadata.

Enriches a company domain into firmographics: employee band, industry, HQ, founded year, revenue estimate, logo, and description, with source provenance.