".ENV" matching MCP tools:

• get-logsA

  mcpA

  Get build and runtime logs for a deployment. If no deployment_id is provided, returns logs for the latest deployment. Use this after calling deploy to monitor build progress and diagnose failures. Logs include: framework detection output, dependency installation, build steps, container startup, and health check results. If a deployment fails, check the logs for error details — common issues include missing dependencies, build errors, or the app not listening on the correct PORT (check the PORT env var — 8080 for auto-detected frameworks, or the EXPOSE value from Dockerfile).

  ConnectorNo auth

• update_gvcA

  Control PlaneA

  Update a GVC. Scalars, description, tags, env, pullSecretLinks, and placement `addLocations` MERGE with existing values; remove* counterparts (removeLocations, removeTagKeys, removeEnvNames, removePullSecretLinks) take entries away, and remove* flags (removeLocationQuery, removeTracing, removeLoadBalancer, removeKeda, removeSidecarEnvoy, removeAliasWorkloadLink) delete an optional block entirely. The nested objects (loadBalancer, keda, tracing, sidecarEnvoy, locationOptions, locationQuery) are REPLACED wholesale: always submit the complete object, never a partial patch, or the omitted sub-fields are dropped. Custom domains are configured with the Domain resource (create_domain), not on the GVC. Placement and endpoint changes can redeploy workloads or affect public workload availability.

  Connector

  Destructive

  OAuth

• gov_procurement_multiA

  gapup-mcpC

  Aggregate public procurement tenders (calls for tender / appels d'offres) from multiple government sources simultaneously: TED Europa v3 (27 EU countries, keyless API), BOAMP France (opendatasoft, keyless), UK Contracts Finder (OCDS standard, keyless), SAM.gov United States (requires SAM_GOV_API_KEY env var), and bund.de Germany (HTML scraping, partial). Returns structured tender records with buyer authority, EU CPV sector code, estimated contract value converted to EUR via live FX rates, submission deadlines, and direct notice URLs. Use when: a B2G agent needs to find government contract opportunities matching keywords across multiple jurisdictions; building a pipeline of public tenders for bid/no-bid qualification; monitoring a domain by CPV code; market sizing public sector spend. Key inputs: query (keywords), countries (ISO-2 array), cpv_codes (EU standard codes, e.g. 72000000=IT services, 45000000=construction, 79000000=business services), min_value_eur (filter), published_after (ISO date, defaults to 30 days ago). SLA: <=25s p95 (all sources fetched in parallel, 8s budget per source). Optional env var SAM_GOV_API_KEY enables US federal tenders (free key at api.sam.gov). Quality score: 25 pts if TED EU retrieved, 15 pts per other source retrieved (max 60), 10 pts if >= 10 tenders returned, 5 pts if aggregates computed. Status: failed < 30 / partial 30-59 / final >= 60.

  ConnectorNo auth

• gov_procurement_multiA

  mcp-knowledgeC

  Aggregate public procurement tenders (calls for tender / appels d'offres) from multiple government sources simultaneously: TED Europa v3 (27 EU countries, keyless API), BOAMP France (opendatasoft, keyless), UK Contracts Finder (OCDS standard, keyless), SAM.gov United States (requires SAM_GOV_API_KEY env var), and bund.de Germany (HTML scraping, partial). Returns structured tender records with buyer authority, EU CPV sector code, estimated contract value converted to EUR via live FX rates, submission deadlines, and direct notice URLs. Use when: a B2G agent needs to find government contract opportunities matching keywords across multiple jurisdictions; building a pipeline of public tenders for bid/no-bid qualification; monitoring a domain by CPV code; market sizing public sector spend. Key inputs: query (keywords), countries (ISO-2 array), cpv_codes (EU standard codes, e.g. 72000000=IT services, 45000000=construction, 79000000=business services), min_value_eur (filter), published_after (ISO date, defaults to 30 days ago). SLA: <=25s p95 (all sources fetched in parallel, 8s budget per source). Optional env var SAM_GOV_API_KEY enables US federal tenders (free key at api.sam.gov). Quality score: 25 pts if TED EU retrieved, 15 pts per other source retrieved (max 60), 10 pts if >= 10 tenders returned, 5 pts if aggregates computed. Status: failed < 30 / partial 30-59 / final >= 60.

  ConnectorNo auth

• gov_procurement_multiA

  gapup-mcpC

  Aggregate public procurement tenders (calls for tender / appels d'offres) from multiple government sources simultaneously: TED Europa v3 (27 EU countries, keyless API), BOAMP France (opendatasoft, keyless), UK Contracts Finder (OCDS standard, keyless), SAM.gov United States (requires SAM_GOV_API_KEY env var), and bund.de Germany (HTML scraping, partial). Returns structured tender records with buyer authority, EU CPV sector code, estimated contract value converted to EUR via live FX rates, submission deadlines, and direct notice URLs. Use when: a B2G agent needs to find government contract opportunities matching keywords across multiple jurisdictions; building a pipeline of public tenders for bid/no-bid qualification; monitoring a domain by CPV code; market sizing public sector spend. Key inputs: query (keywords), countries (ISO-2 array), cpv_codes (EU standard codes, e.g. 72000000=IT services, 45000000=construction, 79000000=business services), min_value_eur (filter), published_after (ISO date, defaults to 30 days ago). SLA: <=25s p95 (all sources fetched in parallel, 8s budget per source). Optional env var SAM_GOV_API_KEY enables US federal tenders (free key at api.sam.gov). Quality score: 25 pts if TED EU retrieved, 15 pts per other source retrieved (max 60), 10 pts if >= 10 tenders returned, 5 pts if aggregates computed. Status: failed < 30 / partial 30-59 / final >= 60.

  ConnectorNo auth

• nucleus_wakeup_waitA

  nucleusB

  Quick scan for a PENDING task. Returns the task directly if one is available, or None if no task is ready within the timeout. Default timeout is 5s (non-blocking). The agent should NOT loop on this — tasks arrive via relay push. This is a fallback for when the agent wants to check for tasks without waiting for a relay. No args needed — the role is auto-detected from posture (.brain/posture/current.json) or NUCLEUS_AGENT_ROLES env var.

  ConnectorNo auth

• get_container_logsA

  mcpA

  THE APPLICATION'S OWN LOGS - what `docker logs`/`podman logs` would show for each container in a deployment. This is the tool for 'it deployed fine but it does not work': a 500, a crash loop, a failed DB connection, a missing env var all announce themselves here and NOWHERE else. ⛔ DO NOT use get_instance_logs for this. That returns the VM's SERIAL CONSOLE (kernel messages and cloud-init), which answers a question nobody debugging an app has - and on this platform it goes permanently silent once the machine finishes booting. build_log does not contain runtime output either; it stops when the build does. Default depth answers instantly from the VM's last report; a bigger `tail` or any `since` asks the VM for a fresh pull and takes up to ~15s. Secret-shaped values (PASSWORD=, TOKEN=, API_KEY=) are redacted in transit.

  ConnectorNo auth

• wait_for_deploymentA

  mcpA

  ⭐ CALL THIS INSTEAD OF POLLING. Blocks until the deployment reaches a TERMINAL state (ready, build_failed, error or vm_missing) and returns, in ONE response, everything you would otherwise fetch afterwards: the HTTP status of the PUBLIC url (not the VM's private interface, which can answer 401 while the public path still 502s), the container table with health and restarts, the host's memory/disk/load, and the .env KEY NAMES. Do NOT loop on get_deployment: that is 8-9 round trips per deploy that learn nothing, and then three more asking for what this already returned. ⚠️ A TIMEOUT IS NOT A FAILURE: if it returns timed_out:true the build is simply still running, so call again, optionally with a larger timeout_s. Only status decides success. On build_failed or error, call get_deployment(id) for the full build_log, which is the diagnosis.

  ConnectorNo auth

• springroll.deployA

  SpringRollA

  Registers the project if it is new, attaches whatever source you give it, and deploys it using the application's Deployment workflow. Direct applications go to Production; Staged applications go to Development. Returns the live URL, or a deployment id to poll if the build is still running. **You do not decide whether this project needs git.** Send what you have and SpringRoll works it out: • a pushed git remote → pass `repositoryUrl` (and `ref` if not the default branch) • no remote, or uncommitted work → pass `archive`, a base64 tar+gzip of the source: tar --exclude=node_modules --exclude=.next --exclude=.git --exclude='.env*' \ -czf - . | base64 -w0 • both → SpringRoll builds from git, and falls back to your files if the ref cannot be resolved (an unpushed branch, typically) • neither, on an app that already exists → redeploys its current source Upload SOURCE, not build output: SpringRoll runs the build. node_modules, .next, dist, build, out, coverage and .log files are dropped automatically and reported. Every .env file and .git/ is REFUSED outright, naming the offending path: configuration belongs in SpringRoll, not in the bundle. Upload limits are about 3 MB compressed on the wire (a platform request-body cap, not a preference), 20 MB expanded, 2000 files, 512 KB per file; a project past them should pass `repositoryUrl` instead, which SpringRoll clones directly with no size limit. Sending the same files twice is free, because bundles are addressed by content. Direct to Production skips workflow approvals but keeps production safety checks. Staged applications continue to use explicit promotion and approvals.

  ConnectorNo auth

• immunology_searchA

  CatnapA

  Search the LANL HIV Molecular Immunology Database for T-cell epitopes (CTL/CD8+ or T-helper/CD4+) or antibody binding sites — a different question from catnap_search_neutralization: this is about WHERE on the virus an immune response targets and WHICH HLA restricts it, not how potently an antibody neutralizes. Answers "what CTL epitopes are in HIV Gag", "which antibodies bind the CD4 binding site", "what HLA restricts this epitope", "find epitopes at position 296-331 of Env". Queried LIVE against LANL's own keyless JSON API (no ingest — always current). table selects which of the three response types you get: ctl (CD8+ T-cell), helper (CD4+ T-cell), or ab (antibody binding sites). At least one of mab_name, epitope, protein_name is required. Returns citation, keywords, HXB2 coordinates and (for ab) binding region/neutralizing classification for each match.

  ConnectorNo auth

• discovery_uploadA

  DiscoA

  Upload a dataset file and return a file reference for use with discovery_analyze. Call this before discovery_analyze. Pass the returned result directly to discovery_analyze as the file_ref argument. Provide exactly one of: file_url, file_path, or file_content. Args: file_url: A publicly accessible http/https URL. The server downloads it directly. Best option for remote datasets. file_path: Absolute path to a local file. Only works when running the MCP server locally (not the hosted version). Streams the file directly — no size limit. file_content: File contents, base64-encoded. For small files when a URL or path isn't available. Limited by the model's context window. file_name: Filename with extension (e.g. "data.csv"), for format detection. Only used with file_content. Default: "data.csv". api_key: Disco API key (disco_...). Optional if DISCOVERY_API_KEY env var is set.

  ConnectorNo auth

• discovery_statusA

  DiscoA

  Check the status of a Disco run. Returns current status and progress details: - status: "pending" | "processing" | "completed" | "failed" - job_status: underlying job queue status - queue_position: position in queue when pending (1 = next up) - current_step: active pipeline step (preprocessing, training, interpreting, reporting) - estimated_wait_seconds: estimated queue wait time in seconds (pending only) Poll this after calling discovery_analyze. Use discovery_get_results to fetch full results once status is "completed". Args: run_id: The run ID returned by discovery_analyze. api_key: Disco API key (disco_...). Optional if DISCOVERY_API_KEY env var is set.

  ConnectorNo auth

• discovery_get_resultsA

  DiscoA

  Fetch the full results of a completed Disco run. Returns discovered patterns (with conditions, p-values, novelty scores, citations), feature importance scores, a summary with key insights, column statistics, and suggestions for what to explore next. The response includes a `dashboard_urls` object with direct links to each page of the interactive report — use these to direct the user to the most relevant view: - **summary**: AI-generated overview with key insights, novel findings, and plain-language explanation of the most important findings - **patterns**: Full list of discovered patterns with conditions, effect sizes, p-values, novelty scores, citations, and interactive visualizations - **features**: Feature importances, feature statistics and distribution plots, and correlation matrix - **territory**: Interactive 3D map showing how patterns select different regions of the data Only call this after discovery_status returns "completed". Args: run_id: The run ID returned by discovery_analyze. api_key: Disco API key (disco_...). Optional if DISCOVERY_API_KEY env var is set.

  ConnectorNo auth

• search_case_lawA

  transaction-coordinatorA

  Search free U.S. case law via CourtListener (~3M opinions). Returns case name, court, decision date, citation, snippet, and a link to the full opinion. No auth required. Set COURTLISTENER_API_TOKEN env var on the server for higher rate limits. Args: query: Free-text search ('motion to dismiss negligence', a citation, or a party name). Required. jurisdiction: Two-letter state code ('ca', 'tx', 'ny') or 'us' for federal. Optional. court: CourtListener court ID ('scotus', 'ca9', 'nysupct'). Optional. Takes precedence over jurisdiction when both are given. date_after: ISO date (YYYY-MM-DD). Only return opinions filed on/after this date. Optional. date_before: ISO date (YYYY-MM-DD). Only return opinions filed on/before this date. Optional. limit: Max results. Default 10. Capped at 25.

  ConnectorNo auth

• deploy_composeA

  mcpA

  Deploys a MULTI-CONTAINER app — a repo that ships docker-compose.yml / compose.yaml — onto ONE VM via podman-compose, and exposes one or more services at redu.cloud URLs. Use this instead of deploy_app when the repo is a compose stack. Same prereqs + source modes as deploy_app; always run plan_deploy first. PORT is the HOST port for the exposed service. DB: 'compose' uses the stack's own db container; 'managed' provisions a separate managed Postgres/MySQL/MariaDB VM and appends connection env. For WordPress/WooCommerce cluster intent, do not leave the compose db service/local uploads as state: pass app_profile, cluster_target:true, database:'managed', db_engine:'mariadb' or 'mysql', cluster_media_mode:'media_space', and either media_space_id or create_media_space:true. Redu writes an override file that points the WordPress service at managed DB env and mounts the media space into /var/www/html/wp-content/uploads. Poll get_deployment until ready.

  ConnectorNo auth

• set-envA

  mcpA

  Set an environment variable for a project. Variables are encrypted at rest (AES-256-GCM) and injected at container runtime. NOTE: DATABASE_URL, PGHOST, PGPORT, PGUSER, PGPASSWORD, and PGDATABASE are all auto-injected for the managed PostgreSQL database — you do NOT need to set any of them manually. The PORT variable is auto-managed: 8080 for auto-detected frameworks (Next.js, Node.js, Python), or auto-detected from the Dockerfile EXPOSE directive for custom Dockerfile builds. IMPORTANT: Changing env vars does NOT auto-redeploy. You must call deploy or use the redeploy API endpoint to apply changes. For Next.js apps, NEXT_PUBLIC_* variables must be set BEFORE deploying since they are embedded at build time.

  Connector

  Destructive

  No auth

• audit_mcp_configA

  Moltline Agent Governance & MCP AuditorA

  Audit an MCP server config for risk-ranked posture findings. FREE. Flags exposed machine credentials in the config, required inputs that aren't gated/optional, unpinned versions, over-broad env access, and dangerous auto-run flags. It never echoes any matched secret value back. Typical input {"config": "<mcpize.yaml, mcp.json, or a Claude/Cursor servers block>"} returns {"posture_score": 0-100, "verdict": "...", "findings": [{"line": N, "severity": 1-5, "issue": "...", "fix": "..."}], "note": "..."}. Use on a server configuration document. Not for a skill or instruction file (audit_skill_file) and not for untrusted content an agent is about to read (injection_scan). Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.

  ConnectorNo auth

• audit_mcp_configA

  Moltline Agent GovernanceA

  Audit an MCP server config for risk-ranked posture findings. FREE. Flags exposed machine credentials in the config, required inputs that aren't gated/optional, unpinned versions, over-broad env access, and dangerous auto-run flags. It never echoes any matched secret value back. Typical input {"config": "<mcpize.yaml, mcp.json, or a Claude/Cursor servers block>"} returns {"posture_score": 0-100, "verdict": "...", "findings": [{"line": N, "severity": 1-5, "issue": "...", "fix": "..."}], "note": "..."}. Use on a server configuration document. Not for a skill or instruction file (audit_skill_file) and not for untrusted content an agent is about to read (injection_scan). Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.

  ConnectorNo auth

• get_env_keysA

  mcpA

  WHICH ENVIRONMENT VARIABLES the deployment was actually given, BY NAME - the keys in the env files on the VM (/opt/app-src/.env and friends), never the values. Most of the time the real question is 'did DATABASE_URL get wired, or is the app reading a name I did not set', and the name answers it: you can confirm the DB was connected, spot a typo'd key, and see which of the app's documented variables are missing, without touching a secret. ⛔ VALUES ARE NOT AVAILABLE HERE AND WILL NOT BE. They never leave the VM. If you genuinely need one (a generated admin password, say), SSH in with get_ssh_command and read that single key: `sudo grep '^KEY=' /opt/app-src/.env`. The file is chmod 600 root:root, so it needs sudo. Also reports each file's permission mode, which is how you catch a world-readable env file.

  ConnectorNo auth

• request_external_resourceA

  flootA

  Request the USER'S OWN external credential for this project — their OpenAI or Anthropic API key, an external Postgres connection string (ALWAYS type POSTGRES — a Postgres credential requested as GENERIC is refused, because only POSTGRES gives the user a database: the Databases tab, helpers/db, the typed schema and query_database), or any other service's key (type GENERIC, e.g. Stripe/Resend — secret_env_vars is REQUIRED for GENERIC and the call is refused without it; a var the user can only produce LATER, like a webhook signing secret, goes in optional_env_vars so the dialog doesn't demand it up front). NOT for Floot-managed resources (database/auth/push/oauth/…) — use provision_resource for those; they need no user input. REUSE FIRST: if the project owner already has a matching credential on their account (list_resources section 2), this connects it silently and returns the env var names — no link, no user action, nothing to poll. Pass the name exactly as list_resources shows it to make that happen. Reusing a POSTGRES credential also seeds helpers/db, installs the query stack, and pulls the typed schema helper, so do NOT write those yourself afterwards. Otherwise it returns a secure connect link: SHOW it to the user (UI-capable hosts render a Connect button automatically; on terminal hosts with shell access open it in the user's default browser yourself and paste the URL as plain text) and ask them to open it. The call completes only when the user finishes the connect flow — it never expires. Do NOT block on it: request the credential EARLY, keep building everything that doesn't need the secret (the env var names are known now — reference process.env.X in code before the secret exists), and check the request between tasks; the user may never connect it, and the build must not stall. NEVER ask the user to paste a secret into the chat. On completion you get the env var names — never the secret values. Re-calling with the same type returns the same pending request. If the credential is already connected and holds every value you asked for, you get those env var names and their value SHAPES back immediately and the user is not interrupted — to reopen a dialog because a stored value is wrong, re-call with `instructions` saying what is wrong.

  ConnectorOAuth

• ado_query_workitemsA

  ALM X++ MCP ServerA

  AZURE DEVOPS ONLY -- Query Work Items (Bugs, Tasks, FDDs, User Stories, CRs) in Azure DevOps. [~] PRIORITY TRIGGER: use this tool when the user mentions 'FDD', 'RDD', 'IDD', 'CR', 'Task', 'Workitem', 'Work Item', 'Bug', 'User Story', 'Feature', 'Issue', 'ticket', 'sprint', 'backlog', 'DevOps', 'liste des tâches', 'show tasks', 'find bugs', '#1234', 'WI#'. NEVER use this tool for: D365 labels (@SYS/@TRX), X++ code, AOT objects, tables, classes, forms, enums, error messages, 'c\'est quoi le label', 'search_labels', 'libellé', 'label D365'. For labels -> use search_labels. For D365 code -> use search_d365_code or get_object_details. Shortcuts: 'bugs' (all active bugs), 'my bugs' (assigned to me), 'recent' (updated last 7 days), 'sprint' (current iteration). Or pass any WIQL SELECT statement or a free-text title search. Use '*' with filters only. Returns max 50 work items with ID, title, type, state, priority, area, assigned-to. Requires DEVOPS_ORG_URL + DEVOPS_PAT env vars.

  ConnectorNo auth