Audit remote MCP servers: connectivity, latency, tools/list schemas, duplicate names, descriptions and mutating-tool signals.

MCP Server Risk Auditor

trovevault/mcp-server-risk-auditor

Audits MCP server manifests for tool, permission, credential, prompt-injection, exfiltration, and execution risks. Export data, run via API, schedule and monitor runs, or integrate with other tools.

Package Security & License Auditor MCP Server. Check package licenses, known vulnerabilities, and metadata across npm, PyPI, and Cargo ecosystems — all from your AI agent. Tools check_package — License, version, description, maintainers audit_vulns — Known CVEs via OSV.dev database

MCP Server Discovery & Quality Scanner

express_kingfisher/mcp-server-discovery-scanner

Programmatic Model Context Protocol (MCP) server registry scanner. Scrapes Glama MCP registry, audits remote/local configurations, checks JSON schemas, and calculates custom quality and developer scores.

Launch QA Auditor

relaunch_dept/launch-qa-auditor

Audit public launch pages before customers see them. Get a scored report of delivery, SEO, social-preview, placeholder-copy, heading, and image-alt issues for up to 10 URLs.

AI Citation Auditor

dbott23/ai-citation-auditor

Check whether ChatGPT, Perplexity, Gemini, and Claude cite your domain as a source when they answer buyer questions. Reports citation rate, rank, and the exact URL cited, per query and per engine, with run-over-run deltas. Pay per check — no API keys needed.

Core Web Vitals Auditor · Bulk Lighthouse for many URLs

siccscha/core-web-vitals-auditor

Bulk Lighthouse for many URLs — no PageSpeed API key needed. Real Chrome runs measure LCP, CLS, TBT, performance/SEO/accessibility/best-practices scores and ranked fix opportunities, mobile and desktop. Optional real-user CrUX field data. URLs that fail to measure are free.

Client-ready MCP server for recruiter and HR agents. Search city regulations ($0.25) and run full hiring compliance audits ($1.00) with citations, freshness checks, and billing metadata across NYC, Austin, Los Angeles, Chicago, and London.

Free Firebase Firestore security audit: static analyzer for firestore.rules + a live anonymous probe. Detects 'if true' wide-open rules, expired test-mode, auth-only patterns and open storage, then confirms which are truly exposed. HTML report with paste-ready fix snippets. By Renzo Madueno.

Real Subdomain Finder

onescales/real-subdomain-finder

Discover every subdomain for any domain. Queries 40+ OSINT sources including cert transparency, DNS archives & web scanners. Results enriched with DNS validation, HTTP probing, and subdomain takeover detection. Simple Subdomain Lookup that works!

Extract Instagram profiles, posts, stories, hashtags, and engagement metrics. Influencer research and social media analytics without an API key.