- Conduid
- Marketplace
- cognis-digital
MCP servers by cognis-digital
cognis-digital publishes 91 live MCP servers on GitHub. Listed by trust score; the score reflects each repository's own health, security checks, and documentation.
Txgraph
Builds a transaction graph from ledger/account data and surfaces structuring, layering, and mule-network patterns for AML triage.
Uncensored Fleet
Deploy a local multi-model LLM fleet (llama.cpp) with an agent harness, hermes memory, and a one-command CLI
Geolens
Image geolocation toolkit — EXIF, sun-shadow, OCR, reverse-search
Fedramplens
FedRAMP boundary visualizer & OSCAL-format SSP/POAM generator
Blescope
Sniff and decode BLE GATT traffic, fingerprint device profiles, and assert on insecure pairing/characteristics in CI against a capture.
Fwxray
Diff two firmware images and surface exactly what changed: new binaries, flipped config flags, added certs, and shifted entropy regions.
Yararun
Run simple YARA-style string/regex rules over a directory
Otaverify
Validate OTA update packages end-to-end: signature chains, rollback protection, anti-downgrade counters, and delta-patch integrity.
Crackq
Self-hosted password cracking queue — multi-user hashcat with audit log
Pcapsummary
Summarize flows/talkers/protocols from a pcap text export
Privacyshell
Hardened browser profile generator — Firefox / LibreWolf / Brave
Approvewarden
Scans any wallet for dangerous ERC-20/721/1155 token approvals and infinite allowances, scoring drainer exposure and emitting revoke transactions.
Phishcheck
Score URLs/emails for phishing signals (lookalike, auth, intent)
Dnsrecon
Aggregate DNS recon (records, zone hints, takeover candidates)
Cookieaudit
Audit Set-Cookie flags (Secure/HttpOnly/SameSite) from a response dump
Headerscan
Grade HTTP security headers (CSP/HSTS/XFO) A-F from a response dump
Raisedeck
Build and maintain an investor-update + data-room manifest from a metrics YAML, rendering monthly MRR/burn/runway updates with consistent KPIs.
Baadiff
Scan a repo or infra manifest for HIPAA Security Rule gaps and produce a Business Associate readiness scorecard.
Agentsmith
Config-first scaffolding and orchestration for multi-agent workflows
Mcpscaffold
Scaffolder, validator & test harness for local MCP servers
Payloadlab
Static malicious payload analyzer — PE/ELF/LNK/macro/OneNote
Geoaoi
Area-of-interest geospatial helper: bounding boxes, geofence checks, and change-event diffs from coordinate logs.
Orgchart
Org charts and headcount plans generated from CSV / HRIS export
Vendorvet
Third-party / vendor risk questionnaires with SBOM cross-ref
K8saudit
Audit Kubernetes manifests against CIS-style security rules
Dpiaforge
DPIA and EU AI Act impact-assessment generator
Schemadrift
Schema-change detector and data-contract tests
Yaragen
Generate candidate YARA rules from sample files/strings
Binhunt
Game/desktop binary integrity scanner that fingerprints executables, detects common packers/obfuscators, and diffs against a known-good baseline to catch tampering.
Fhirlint
Validate FHIR R4/R5 resources and bundles against profiles (US Core, etc.) with precise, line-level error reporting.
Obscan
Conformance and security linter for Open Banking / FAPI APIs: validates OAuth flows, consent scopes, and PSD2 endpoints against the spec.
Mevscope
Replays a tx or address history to attribute sandwich, frontrun, and backrun MEV extraction with per-trade loss accounting.
Apidiff
Breaking-change detector for OpenAPI / GraphQL across commits
Paywatch
Recurring-charge and subscription detector from bank/Plaid CSV
Deeplinkfuzz
Fuzzes Android/iOS deep links, intents, and custom URL schemes against an emulator/device to surface unvalidated-redirect, injection, and component-hijack bugs.
Sanctscan
Screens counterparties and transactions against OFAC/EU/UN sanctions lists with fuzzy name matching and explainable hit scoring.
Webhookvty
Verifies and replays signed payment webhooks (Stripe/Adyen/PayPal/Plaid) locally, catching signature, idempotency, and replay-attack bugs.
Probesite
Synthetic uptime and Playwright checks exported to Prometheus
Dripcheck
Lint email sequences and drip campaigns for deliverability: SPF/DKIM/DMARC, link health, unsubscribe presence, and CAN-SPAM/GDPR compliance.
Apkpeek
One-command static triage of Android APK/AAB binaries: surfaces hardcoded secrets, exported components, dangerous permissions, and insecure manifest flags as a single SARIF report.
Honeyurl
Generate canary URLs/tokens + a matcher for trip events
Ssrfind
Find SSRF-prone sinks and unvalidated URL fetches in code
Memtriage
Triage memory-dump artifacts: strings, IOCs, suspicious processes from a dump export
Privacyspoof
AdGuard/uBlock blocklists + UA/geo/cookie/session spoofing with a browser compatibility matrix
Sbomgate
Continuous SBOM diff & vulnerability watch with maintainer-change tracking
Rtosmap
Statically map task structures, stack usage, and ISR call graphs in FreeRTOS/Zephyr firmware to flag stack overflows and priority-inversion risks.
Gasprofiler
Per-opcode and per-function gas profiler that flags unbounded loops, DoS-prone patterns, and regressions against a committed baseline.
Narrativediff
News bias & framing diff across 50+ outlets per event
Embedaudit
Embedding / vector-store drift and poisoning audit
Hookcraft
Generates ready-to-run Frida instrumentation scripts from a YAML intent (e.g. 'bypass SSL pinning', 'dump crypto keys') and verifies they attach to a target process.