Panda Web Security Tools

Why it got a B

An MIT community server from one developer (GitHub pandadad0214, "Panda Federation"), on PyPI and in the official MCP Registry since November 2026. It's a thin wrapper: each tool runs one of the author's Actors on Apify, billed to your own Apify account. Seven checks of public DNS, pages, links and feeds: email_domain_security_checker (SPF, DKIM, DMARC, MTA-STS and BIMI, graded A to F), ai_search_seo_audit, website_change_monitor (compares pages with the last run and can post changes to a webhook you give it), hidden_ai_instructions_scanner (finds text on a page that people can't see but AI agents read), bulk_domain_whois_expiry, broken_link_checker and rss_feed_monitor. It isn't a penetration test or a logged-in scan. Results cost about $0.0005 to $0.004 each; the hidden-text scanner has no per-result price, but its runs still use your Apify platform credit. Each call is capped at $0.50 by default, but the AI can raise that cap to $25 for a call, and PANDA_MAX_CHARGE_USD only changes the default. Every tool is marked read-only, so a client that skips approval for read-only tools won't ask before a call spends money. Text pulled from pages and feeds is untrusted input. The Actors that do the work are closed source, but they run with Apify's limited permissions, so they can't read the rest of your Apify account. No advisories on record. Biggest deduction: the README has you paste your default Apify token, which can use your whole Apify account; create a scoped token that can only run pandadad0214's Actors, with an expiry date, and use that instead.