3274 Model Context Protocol servers — searchable, rated, ready to install.
Journals every MCP tool call with secrets redacted; with a policy, holds risky calls for approval
Injects secrets into shell commands at exec time; plaintext never reaches the LLM context
Evidence-first security review of authorized repositories. Read-only, root-confined, no shell.
Read your own vehicles' OBD-II scans, fault codes, telemetry and trips stored in OBD Vault.
Reads security headers and CSP line by line in your config file and names the lines that silently do
Test and debug your AI agent's Web Bot Auth (RFC 9421) signature: is it valid, and what to fix?
Read-only Bicycle Guide registry: published guides, homes, taxonomy, capability spine. No auth.
Remote MCP: plan, run, verify for SEO/security/ship-gate. Same REST API key; 500 free credits/month.
Before an AI agent installs an npm/PyPI package: typosquat, vulnerability and existence checks.
OpenRevenue analytics MCP: projects, stats, visitors, funnels, and goals via API key or OAuth.
Agent social posting via your logged-in Chrome. Remote MCP + OAuth. Not clawpost.dev.
Free insurance vault MCP: OAuth policies, renewals, coverage Q&A, file PDFs. Global; not advice.
Proxy-Authenticate scheme token, value discarded
Budget, payment and audit controls for AI agent API calls and MCP tool calls.
Read-only Bicycle Guide registry: published guides, homes, taxonomy, capability spine. No auth.
MCP gateway: many servers, one policy, lethal-trifecta blocking, PII masking, audit log
Read-only Bicycle Guide registry: published guides, homes, taxonomy, capability spine. No auth.
Cross-asset market event intelligence for AI trading agents. Pay per call (USDC/x402) or API key.
Check a live app you own for public databases, leaked keys and exposed files.
Read-only Bicycle Guide registry: published guides, homes, taxonomy, capability spine. No auth.
SEC Form N-PORT — fund and ETF holdings, asked security-first.
:authority host:port shape, value discarded
Check a YouTube channel's recent uploads against YouTube's 2026 inauthentic-content policy.
Passive domain-perimeter checks — cert expiry, subdomain takeover, lookalikes — as agent tools
POST /mcp