Six free deterministic tools for domain posture, website privacy, agent manifests, and OpenAPI contracts
Different engineering and compliance roles face distinct operational risks: business owners and privacy officers need an instant zero-token check for cross-border font and tracker leaks, infrastructure administrators need copy-ready TLS, header, and DMARC directives, and agent developers need to catch poisoned Model Context Protocol (MCP) schemas before production release. Every verifier below runs free of charge and seals its findings with an RFC 6986 digest.
1. Select a specialized verification instrument
Free online domain security check without a token (TLS, HTTP headers, SPF, DMARC, CAA)
Any public domain exposes its transport cipher suite, response headers, and mail anti-spoofing records to every visiting browser. This express verifier reads those public signals through a single cached request, builds ready Nginx and DNS configuration lines, and seals the result with an RFC 6986 digest.
Free website privacy, 152-FZ, and cross-border tracker check without a token
Loading fonts, scripts, or captcha widgets from overseas servers exposes visitor network metadata immediately upon page open. Even before a user interacts with the interface, the browser sends device headers across national borders. This passive scanner inspects the initial homepage response and highlights hidden third-party calls, unguarded cookies, and missing statutory disclosures.
Open Free VerifierFree online MCP server and agent tool manifest security auditor (OWASP agentic top 10)
Connecting a language model to external databases, repositories, and shell utilities through Model Context Protocol (MCP) manifests introduces an execution surface that conventional web firewalls never see. Paste or load a configuration file below to detect poisoned tool descriptions, host-root mounts, and unpinned package runners, and compile a fail-closed gateway policy.
Free online OpenAPI 3.x and Swagger 2.0 security auditor with rule compiler
Backend authorization flaws originate in route and schema contracts long before application code reaches staging. Load an OpenAPI 3.x or Swagger 2.0 document below to uncover unauthenticated state mutations, exposed object identifiers, writable privilege properties, and outbound webhook sinks, then export a route-level filter policy.
Free online static security analyzer for Python AST, Dockerfile, and Nginx
Code generated in rapid sprints frequently introduces string-interpolated database queries, shell invocations, root-level container layers, or permissive cross-origin headers. Paste a Python handler, Dockerfile, or nginx.conf block below for deterministic syntax-tree inspection without executing a single instruction.
Step-by-step domain ownership verification guide (DNS TXT, Nginx) and GOST R 34.11-2012 verifier
While Step-1 express checks read only public homepage metadata without setup, Step-2 deep domain inspection confirms administrative authority via a standard verification token identical to search-console ownership proofs. Generate or download the token file in one click below, follow the three-step placement guide, and verify any GOST R 34.11-2012 audit receipt.
2. Next engineering stages after free verification
User progression from free INDRA diagnostics to runtime action enforcement in MITR (asi5.ru), air-gapped enterprise verification at isslab.ru, and origin asset localization for 152-FZ privacy compliance.
MITR Runtime Z3 gate & mcp-sentinel
Point-in-time checks find configuration bugs before deploy, whereas live autonomous agents require continuous pre-socket enforcement. The MITR gateway proves parameter admissibility in the Z3 SMT solver before any tool call executes.
Air-gapped indra-core on-premise pilot
Internal payment services and restricted networks cannot be tested from a public cloud. The Autonomous Non-Profit Organization Research Institute of System Synthesis delivers offline verification bundles with an in-path zero-damage wire filter.
Origin asset localization & Streebog-256 logging
When the homepage scanner detects external font servers, unconsented analytics tags, or premature cookies, engineering teams combine origin self-hosting and consent gating with tamper-evident cryptographic audit ledgers.
Platform developer and institutional operator
Platform developer and operator: Autonomous Non-Profit Organization "Research Institute of System Synthesis" (Primary State Registration Number 1267700083617, Taxpayer Identification Number 9731161602, Tax Registration Reason Code 773101001, 18 Davydkovskaya Street, Suite VIII, Moscow, 121352). All infrastructure runs without third-party analytics trackers, external font servers, or outside subcontractors, alongside open Apache-2.0 companion packages.
Under the Security 3.0 research and engineering program, the institute develops and operates the MITR runtime action gateway (asi5.ru) and the INDRA verification stand, publishes the monograph Proven Action, and maintains open packages mcp-sentinel and iss-ledger-117.
Enterprise pilot packages and air-gapped delivery
Perimeter posture, transport security & localization
Streebog-256 verification passport.Air-gapped interface verification (indra-core)
OpenAPI schemas and an isolated staging container as input, delivering a thirty-class paired decoy assessment with zero false positives, compiled mcp-sentinel contracts, and a full ledger passport.Autonomous agent runtime gate (MITR)
mcp.json manifests and tool schemas as input, delivering compiled satisfiability policies and pre-socket parameter enforcement.Request the offline kit or schedule a pilot
--no-index --find-links) and standalone verifier scripts are provided for isolated laboratory testing and enterprise pilot evaluations. Submit a work email below without page reload or write directly to af@isslab.ai.