"A Dockerized Python Code Execution Environment" matching MCP tools:

• verifyA

  verifyA

  An outside check on code, executed in a sealed sandbox. Call it before code crosses a consequence boundary: before you merge it, deploy it, publish it, settle a payout on it, or report it done. A self-audit verifies consistency, never completeness: a check written inside the frame that produced the code passes on the code's own assumptions. This is the check that is not you. Also call it when a fix passes your own check but the target still fails; that means your check shares the code's assumption and cannot see the error. INPUT: code (JavaScript/Node or Python 3 source, deterministic only) plus ONE of: contract {fn, examples:[{call,expected}]} (copy call and expected from the test or spec the consequence depends on), or assumption (plain-language claim, weaker read). It checks the code against the contract exactly as given. VERDICTS (synchronous): BROKE: the code violates your contract, with the exact input and a rerunnable proof; do not proceed. HELD: the code meets the contract you gave; proceed on that contract, and nothing more. FINDINGS: a stated property strains under a generated input; check it before proceeding. DROP: not deterministically checkable. PAYMENT: 0.10 USDC per call, x402 v2 on Base, no account. Every delivered verdict is charged, HELD and DROP included. If no verdict is produced, the payment authorization is cancelled and you are not charged.

  ConnectorNo auth

• validate_pythonA

  Python Code ValidatorA

  Check Python source without running it: parse, lint (ruff), type-check (mypy), AST security policy, credential scan. Safe on code you do not trust. Use it on every Python file you generated or edited, before writing it to disk. Alternatives: repair_python to get the corrected source instead of the diagnosis; execute_python to prove the code runs. Auth: a key is required. A free key covers this call, 25 per day, then HTTP 429; get one with POST /v1/keys. Credits are bought without an account, 1 per call: GET /v1/pricing says where to send the xDAI. Or pay for this one call with no key at all: call it without one and the result carries x402 payment requirements ($0.01 in USD Coin on eip155:8453); sign them and repeat the call with the payment in _meta['x402/payment']. Arguments: code: the whole file, 1..200000 bytes of UTF-8 measured after encoding (empty is refused with 400, larger with 413); a fragment is fine, but line and column numbers in the answer count from 1 in what you sent. language: must be 'python'; anything else is 400, and the field may be omitted. Of options only transpile_to (e.g. 'javascript', which returns a translated copy in transpiled) acts here; timeout_s, max_iterations, optimize, examples and expected_output need a pass that rewrites or runs the code, so send code alone. Ignored options are not refused, so a call that sets them looks like it worked; and code that does not parse is answered rather than refused: valid=false with the syntax error located, which is the point. Returns valid, score 0..1, diagnostics (rule, message, line, column), security findings, fixes, fixed_code and runtime; see outputSchema. The code and its verdict are retained to improve the service.

  ConnectorNo auth

• get_strategy_codeA

  quantifymeA

  Get the actual Python code behind a community leaderboard strategy. Use after `browse_community`: pass an entry's `id` here to read its real `feature_engineering()` + `strategy_config()` source so the user can inspect or tweak it. To deploy it unchanged, pass the same id to `one_shot` as `community_id`. Read-only, no signup needed. Args: community_id: The `id` of a community entry (from `browse_community`). Returns: dict with: id, title, username, description, symbol, timeframe, metrics {total_ret, win_rate, profit_factor, n_trades, mdd, sharpe_strat}, and `code` (the full Python source). SHOW the code to the user, and offer to deploy it via one_shot(community_id=...) or tweak it first.

  ConnectorNo auth

• list_skillsA

  civilquantsA

  List the 10 senior-QS skill methodologies CivilQuants exposes (tender review, risk assessment, QS measurement/contract advice, geotechnical + geo-environmental interpretation, earthworks, preliminaries, pavement design, subcontract analysis). Universal discovery — both tiers see the full list. Returns each skill's slug, title, one-line summary and tier; then call get_skill(skill=<slug>) to fetch the methodology body. The skills are paid-tier; a free caller gets a sign-up prompt from get_skill. NOTE: the document-heavy skills (tender review, the interpretation skills) need a code-execution client (Claude Code / Codex / VS Code) plus the chunking pack from get_document_pipeline to run a real tender pack — on a chat connector you can read the methodology but cannot chunk/parse files.

  ConnectorNo auth

• validate_pythonA

  CodeCraftA

  Validates a Python automation script that runs OUTSIDE the game, on three axes: Python syntax (using the real interpreter), Minecraft commands embedded in the script (against the official command index), and the shape of the /connect WebSocket message envelope. For behavior pack scripts use validate_script instead — Python does not run inside a pack. The embedded command check is the most valuable one: a command written from memory can look syntactically fine and still do nothing in the game. Only strings starting with / are treated as commands. If syntax could not be checked, syntaxChecked is false in the result; ok:true alone does not mean the syntax is valid.

  ConnectorNo auth

• run_codeA

  EQVPS — VPS and code sandboxes for AI agentsA

  Run a code snippet inside a sandbox and return {exit_code, stdout, stderr, timed_out, truncated, duration_ms}. `language`: python (Python 3.12), node (Node.js 22) or bash. Install packages first with exec_command (`pip install …` / `npm i …`). The code is passed to the interpreter on stdin, so it cannot read stdin itself. `timeout` seconds (default 30, max 55 per call). LONGER JOBS: set `background: true` — returns a `task_id` immediately (timeout then defaults to the sandbox's remaining lifetime); poll get_task with the returned offsets to read new output and the exit code, kill_task to stop it. The sandbox keeps billing while a task runs and is not idle-deleted. Output is capped at 1 MiB per stream for synchronous calls. Files and installed state persist between calls in the same sandbox. Requires: token + live sandbox_id. Typical: timed_out after 55 s → repeat with background: true.

  ConnectorNo auth

• set-envA

  mcpA

  Set an environment variable for a project. Variables are encrypted at rest (AES-256-GCM) and injected at container runtime. NOTE: DATABASE_URL, PGHOST, PGPORT, PGUSER, PGPASSWORD, and PGDATABASE are all auto-injected for the managed PostgreSQL database — you do NOT need to set any of them manually. The PORT variable is auto-managed: 8080 for auto-detected frameworks (Next.js, Node.js, Python), or auto-detected from the Dockerfile EXPOSE directive for custom Dockerfile builds. IMPORTANT: Changing env vars does NOT auto-redeploy. You must call deploy or use the redeploy API endpoint to apply changes. For Next.js apps, NEXT_PUBLIC_* variables must be set BEFORE deploying since they are embedded at build time.

  Connector

  Destructive

  No auth

• sandbox_backtestA

  dMoERA CreatorB

  Run a sandbox backtest of strategy code without persisting anything. This is the fastest way to test a strategy. The code is run through static checks and a full backtest on historical data, but no Strategy or StrategyVersion rows are created. Use this for rapid iteration. Args: code: Python source code implementing the Strategy contract. Must define a METADATA dict and a class extending Strategy with an on_bar(ctx) -> Signal method. See CREATOR_API.md. domain: Trading domain (e.g. "eth_usdc", "btc_usdc", "sol_usdc"). symbol: Price symbol for historical data (e.g. "ETHUSDT"). user_id: Identifier for trial tracking (used for DSR correction). Returns JSON with: success, metrics (sharpe, sortino, win_rate, total_trades, return_bps, max_drawdown, regime_breakdown, exit_reason_breakdown), or error details if validation failed.

  ConnectorNo auth

• get_quickstartA

  Vector Panda DocumentationA

  The Vector Panda quickstart: install the veep Python SDK, upload a file, and run similarity queries end to end.

  ConnectorNo auth

• deployment_policy_updateA

  SceneplaneA

  Change execution limits, approvals or scripting for an existing deployment; omitted fields remain unchanged. Requires owner/admin and deployments:admin scope for narrowed credentials; only the owner may toggle dangerousScriptingEnabled. May restrict future work or enable arbitrary Blender Python. Validates platform and plan ceilings, records a policy version, and rejects concurrent policy edits. Use deployment_update to rename or enable/disable the workspace, or deployments_list to find its slug. Returns policyVersion and scriptingEnabled.

  Connector

  Destructive

  API key

• cycle_control_environmentA

  Cycle MCPA

  Start or stop a Cycle environment. Starting brings up the environment's service containers: discovery (the environment's private DNS), scheduler, and — only once the environment has a public container — the load balancer. Containers in an environment cannot resolve each other by hostname until discovery is running — start the environment BEFORE deploying or setting up multi-container applications in it. Starting an already-live environment is safe and restarts any stopped services. Each service is itself a container and can be started or restarted individually with cycle_control_container using its container id. Stopping an environment stops its services AND every container in it — treat it as highly disruptive. Both actions are mutations: confirm with the user before calling. Waits up to wait_seconds for the job and returns the environment's state.

  Connector

  Destructive

  API key

• check_injectionA

  ContrastAPIA

  Scan source code for injection vulnerabilities: SQL injection, command injection, path traversal via unsafe string concatenation/unsanitized input. Supports Python, JavaScript, TypeScript, Java, Go, Ruby, Shell, Bash. Use to detect input-handling bugs; for secrets use check_secrets. Companion code-security tools: check_secrets (hard-coded credential detection), check_dependencies (known-CVE vulnerability audit), check_headers (live HTTP security-header validation), scan_headers (live HTTP scan via domain). Free: 30/hr, Pro: 500/hr. Returns {total, by_severity, findings}. No data stored.

  ConnectorNo auth

• get_signup_linkA

  Gonka Second Opinion (multi-model)A

  Get Gonka Network signup link with referral welcome bonus (50M nGNK free tokens). Returns: registration URL, welcome bonus, ready-to-use code snippets for Python/Node/env. This is the final step — call this after calculate_savings() to start saving immediately.

  ConnectorNo auth

• get_environment_pinsA

  RoutebaseA

  List which version each environment currently pins for this spec, whether the pin is frozen, and where it came from. Use this to see what each environment resolves to; to change a pin use promote_version. Requires project context.

  ConnectorAPI key

• dev.code.languagesA

  apibaseB

  List all 71 available programming languages and their IDs for code execution. Common IDs: 71=Python 3.8, 63=JavaScript (Node.js), 62=Java, 54=C++ (GCC), 60=Go, 73=Rust, 51=C#, 46=Bash. Returns full list with compiler/interpreter versions (Judge0 CE)

  ConnectorNo auth

• search_docsA

  Devdocs IoB

  Find which documentation SETS exist whose NAME matches a substring (e.g. "python" → Python 3.x, "react" → React). Returns doc SETS, NOT their content — this does NOT look up a function/method/API name. To search inside a doc for an entry like "Array.map" or "fetch", use search_index (slug + query).

  ConnectorNo auth

• check_secretsA

  ContrastAPIA

  Scan source code (or snippet) for hardcoded secrets — cloud provider keys, API tokens, connection strings, private keys, passwords. Supports Python, JavaScript, TypeScript, Java, Go, Ruby, Shell, Bash. Use to detect leaked credentials before commit; for injection detection use check_injection. Free: 30/hr, Pro: 500/hr. Returns {total, by_severity, findings}. No data stored. The generic password-assignment rule is suppressed when a more-specific credential rule fires on the same line — one targeted finding per leaked secret, not two.

  ConnectorNo auth

• answerA

  Starwell: World Data & StatisticsB

  The flagship: ask a natural-language question about the served official statistics. Returns a COMPUTED answer (real Python runs in a sandbox over the verified store, nothing is estimated by a model), the Plotly chart, the Python code, citations to the official tables, and a verification badge per series. CROSS-SOURCE: one question may join series from DIFFERENT agencies, e.g. unemployment from the US BLS, Statistics Canada and the UK ONS in a single call, for correlations, ratios, and like-for-like comparison. How many series one question may join is set by the caller's plan; asking for more returns a series_limit error naming that cap. Returns a refusal when no served series can answer. Takes 10-40 seconds. Requires a free API key (create at /account on the Starwell host; pass Authorization: Bearer dlk_... or set STARWELL_API_KEY on the starwell-mcp bridge). Keyless calls return key_required.

  ConnectorNo auth

• review_checklistA

  Moltline Code Review & AI-Code VerifierA

  Produce a focused pull-request review checklist for a language or stack. FREE. Covers the things that actually break in production, with extra items per language. Typical input {"language": "python"} returns {"language": "python", "checklist": ["...", ...], "note": "..."}. Use before a review, to decide what to look for. Not for reviewing actual code - pass code to review_diff or security_deep_dive. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.

  ConnectorNo auth

• review_checklistA

  Moltline Code ReviewA

  Produce a focused pull-request review checklist for a language or stack. FREE. Covers the things that actually break in production, with extra items per language. Typical input {"language": "python"} returns {"language": "python", "checklist": ["...", ...], "note": "..."}. Use before a review, to decide what to look for. Not for reviewing actual code - pass code to review_diff or security_deep_dive. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.

  ConnectorNo auth

• get_code_exampleA

  tw-market-dataA

  Emit a copy-pasteable HTTP snippet wired to the real endpoint, header and parameter names. ★ FOR WRITING YOUR OWN CLIENT, NOT FOR GETTING DATA. Every other tool here answers a question; this one hands you source code so your program can ask it directly over HTTPS. Nothing is fetched and no rows come back. ★ THE CONSTANTS ARE READ OUT OF THE SERVER, NOT REMEMBERED. Base URL, the `X-API-Key` header spelling, and the route path all come from the code that serves them. The worst kind of broken example is one that looks right: a mistyped path 404s and the reader blames their own key. ★ AN INTENT IT HAS NO ROUTE FOR IS REFUSED. It will not point at a plausible-looking path it has not confirmed. Python output is passed through Python's own compiler before it is returned; the JavaScript variant is structure-checked only, and says so. ⚠️ The credential in the snippet is an obvious placeholder, never a realistic-looking string — a convincing fake gets pasted, sent, and then fails somewhere nobody can trace. Args: intent, language (python/javascript), ticker, optional as_of.

  ConnectorNo auth