"A FastAPI server for interacting with the GitHub API for file operations and repository management" matching MCP tools:

• create_projectA

  TrentA

  Create a Trent project for security scanning. Its first scan starts automatically unless trigger_analysis is false, or a source is still syncing in (sources or source_scopes); then start it with trigger_analysis, which syncs any source that has not landed. Supply at least one source: github_repo, website_url, or documents. For documents, call prepare_file_upload, run upload_command, and pass s3_url. Do not bundle source code into documents; connect its repository through github_repo and the Trent GitHub App. For a quick plan review before creating a project, use security_advisor. The scan runs in the background and takes up to 1 hour. Read job_id, then poll get_scan_status, with a first look around 10 minutes in. Relay any returned 'Trent dashboard: <url>' line verbatim. A matching repository or website returns reason='confirmation_needed' with existing_project_details. Show the match and ask the user, then call again with dedup_policy='reuse' or 'force_new'. A first call with 'force_new' requires the user's existing request for a new project. If GitHub access prevents the scan starting, reason is 'github_app_install_required'. Send the user to the returned Trent GitHub App install URL, then retry with trigger_analysis.

  ConnectorOAuth

• watch_pipeline_runA

  AnkraB

  Wait for an Ankra Pipelines run of a connected repository to conclude. Blocks up to 45 seconds and returns the settled run (outcome, each step's outcome, the first failing step) or timed_out true with the last observed state. Nothing notifies this client when a run ends later: on timed_out, call watch_pipeline_run again with the run_id it returned to keep waiting. Identify the run by head_sha (the commit) or run_id (the run's UUID, or its run number in the repository: 3630 for run #3630); branch disambiguates head_sha lookups. provider defaults to github; timeout_minutes is ignored here. Read a failing step's log with get_pipeline_step_logs. The repository must already be connected to Ankra Pipelines.

  ConnectorOAuth

• flow_lookup_pos_apiA

  Final POS – Custom POS BuilderA

  Look up the Final POS REST API (https://api.finalpos.com) — endpoint method/path, request fields, response shape, and a worked fetch example. This is the ONLINE-ONLY fallback for admin/management operations command-frame cannot express (creating products/variants/categories, customer management, outlets/stations/tax tables, webhooks). Command-frame is ALWAYS first choice for live POS data — it works offline and the host owns money/totals. A call to this API is network egress from the station: it fails whenever connectivity does, so never put one in the sale path — use it for setup/admin work and degrade gracefully. Pass resource to list a domain, operation for one endpoint, or query for fuzzy search.

  ConnectorOAuth

• connect_gitops_repositoryA

  AnkraB

  Connect a GitOps repository to a cluster that has none: bind an existing GitHub credential plus a repository and branch - the same binding the portal's GitOps step creates. Pick the credential from list_gitops_credentials (pass credential_id, or credential_name when unambiguous) and the repository from list_gitops_repositories: it must be in the credential's synced repository list. On confirm the binding is written to the cluster's resource graph, a repository webhook is provisioned best-effort, the current cluster state is pushed to the repository as an initial commit, and a sync is nudged so the repository and the cluster record converge. Refused when the cluster is already connected to a DIFFERENT GitOps source: repointing prunes everything the new source does not define, so it stays on the cluster settings flow with its explicit acknowledgements. Re-connecting the identical repository and branch is safe and just refreshes the binding.

  Connector

  Destructive

  OAuth

• submit_toolA

  AgentIndexA

  Suggest a GitHub repository (an AI agent, MCP server or AI developer tool) for listing on AgentIndex. No login or API key needed. The submission is queued for human review, usually within 1-3 days; it does not appear in search results immediately. Tools are listed only if the repository is public and has at least 100 stars. Check with search_tools first that the tool is not already listed. Returns {success, message, github_url}, or an isError result if the URL is not a GitHub repository URL or the submission service is unavailable.

  ConnectorNo auth

• list_github_discussionsA

  canton-ccpediaB

  List GitHub Discussions from Canton Network and Digital Asset repositories cached by CCPEDIA, sorted by recency (newest first). Filter by repo or category, or call with no filter to see which repos are present. CANTON-ONLY and read from CCPEDIA's cache, NOT the live GitHub API or the user's own repos (use a GitHub MCP for those). This is GitHub Discussions: distinct from the Canton web forum (get_discussion) and the sync.global mailing lists (list_mailing_threads). Use get_github_discussion for full body + comments.

  ConnectorNo auth

• evaluate_repoA

  SHPBL: Repository Audit & RepairA

  Audit any GitHub repository and get back one complete result: a report (inventory, languages, spine files, risk signals), the capabilities found in it (name, signature, file and line, stated contract, dependencies), and how it stands against SHPBL's anonymous corpus of audited repositories. Works with no key: every caller gets the whole diagnosis of their own repository. A free run stops at the composition boundary — neither library is searched, so no library rows, candidates, parents or proposed architecture are returned — and nothing is retained (no pull request, no export, no recorded run). A Practitioner key (7-day free trial) continues past that boundary: both libraries searched, candidates identified and composed, and the result written back to your own repository. Whatever a run finds is yours. Follow with `fix_repo` for verbatim source and diffs, `harvest_repo` for the whole tree.

  ConnectorNo auth

• ftp_toolA

  uCozB

  FTP password management on the selected site (call select_site first). Proxies to /uapi/ftp_password (GET/POST/PUT/DELETE). Requires CP access on the site API key (can_use_cp). Account MCP does not run file FTP (list/read/write/upload) — use files_read / files_write for the site file manager. After ftp_password_set or ftp_password_change the response may include ftp_password in plain text — save it immediately.

  Connector

  Destructive

  OAuth

• push-to-githubA

  WebTwizzA

  Use this when the user wants their WebTwizz site's code on GitHub. Commits and pushes the saved site to its repository; each call with new changes adds another commit. Other git work, like undoing a push, goes to edit-site. The first time, pass repo (an existing repository from get-github-status) or create_repo (a name for a new private repository).

  Connector

  Destructive

  OAuth

• sources.github.repositories.listA

  ResilisB

  List repositories accessible through an authorized project's stored GitHub connection. If disconnected, call sources.github.connection.get and wait for the user to authorize in the browser before retrying. Public repository validation and deployment do not require this tool.

  ConnectorOAuth

• check_skillA

  Base of AGIA

  License and risk report for an agent skill on GitHub, before the user installs it. Give a github.com URL of a SKILL.md file, a skill folder or a repository (or a raw.githubusercontent.com file URL). Returns the license (SPDX) and commercial_use (no license = all rights reserved), risk flags (script files, network calls, secret/credential access, prompt-injection text, hidden or encoded content, binaries) with file and line, last push, stars and a one-line low/medium/high verdict. Rule-based static check: no LLM, nothing is executed. Evidence is untrusted text from the repository.

  ConnectorNo auth

• check_skillA

  Use This SkillB

  Safety-check a skill before installing it. Pass a skill slug from search_skills, or any public GitHub URL (a repository, or a folder or SKILL.md inside one). Returns clear, review or flagged per skill folder, with the file, line and matched text for every finding. Skills not in the directory are fetched and scanned live.

  ConnectorNo auth

• search_api_referenceA

  docs-mcpA

  Search Redpanda API reference documentation by keyword. Returns up to 20 matching endpoints, schemas, or topics with URL, title, and text excerpts. SCOPING (important for accurate results): - api="all" or omit: Search across ALL APIs at once - useful when unsure which API contains the endpoint - api="admin": Search only cluster management (brokers, partitions, configs, users, maintenance) - api="cloud-controlplane": Search only Cloud resource management (clusters, networks, namespaces) - api="cloud-dataplane": Search only Cloud data operations (topics, ACLs, connectors) - api="http-proxy": Search only HTTP Proxy (produce, consume, offsets over HTTP) - api="schema-registry": Search only Schema Registry (register, retrieve, compatibility) WHEN TO USE WHICH: - User asks "broker endpoints" → api="admin" (brokers are cluster management) - User asks "create topic API" → api="all" (topics exist in admin AND cloud-dataplane) - User asks "Cloud cluster API" → api="cloud-controlplane" - User asks about Redpanda APIs generally → api="all" or omit For general Redpanda questions (not API-specific), use ask_redpanda_question instead.

  ConnectorOAuth

• acc_search_documentsA

  ACC MCPA

  Full-text search the ACC Docs repository of a project for drawings, specs, submittals, and other files via the APS Data Management search endpoint. When to use: The user wants to find a document by keyword (filename, sheet number, or metadata match). E.g. 'find the latest A-201 sheet' or 'search for mechanical specs on Tower project'. When NOT to use: Do not use to upload a file (use acc_upload_file); do not use to fetch issues/RFIs. If you already have a document URN, fetch it directly with an agent that has Data Management folder/item access. APS scopes: data:read account:read. No write scope required. Rate limits: APS Data Management ~50 req/min per app per endpoint; pageable (limit 200 upstream). Avoid tight query loops. Errors: 401 (APS token expired — refresh); 403 (user lacks Docs view permission on the project); 404 (project_id not found — verify 'b.' prefix and hub membership); 422 (invalid filter syntax — simplify query text); 429 (rate limit — back off 60s); 5xx (ACC upstream — retry with jitter). Side effects: None. Read-only and idempotent.

  ConnectorNo auth

• list_reposA

  canton-ccpediaB

  List the Canton Network GitHub repositories that CCPEDIA has indexed (Canton org repos such as canton-foundation and Daml/Splice, excluding the dev-fund proposals repo), with the count of issues+PRs indexed per repo. CANTON-ONLY and read from CCPEDIA's cache. This is NOT a live GitHub API and does NOT list the user's own repos (use a GitHub MCP for that).

  ConnectorNo auth

• github-repo-preflightA

  SALT19 Agent Utility GridB

  GitHub repository due diligence for coding agents: evaluate whether a public or open-source repository is safe and maintained enough to adopt using license, maintenance, release freshness, activity, project health, and risk signals. Price: $0.10 via x402. Generate one _salt19_operation_id per intended purchase, preserve it across retries, and add _x402_payment_signature after satisfying the challenge. A stable _salt19_operation_id is required and makes semantic retries at-most-once. _salt19_operation_id is recommended but optional for standard x402 compatibility.

  ConnectorNo auth

• scan_repositoryA

  feldspar-scan (hosted)A

  Clone a public git repository and run feldspar-scan: OSV.dev advisories for pinned dependencies in lockfiles (npm, pnpm, yarn, pip/uv/poetry, Cargo, Go, Gemfile.lock), secret patterns with redacted evidence, and configuration lint. Returns a JSON report with summary counts and per-finding severity, file, line, advisory id and fixed versions. Deterministic, no LLM involved. Takes 2-90 s depending on repository size. Returns the most severe findings first, 25 unless max_findings asks for more (up to 200); the summary counts cover every finding, and large per-file breakdowns are left out and named under omitted.

  ConnectorNo auth

• scan_repositoryA

  Feldspar free repository security scanA

  Clone a public git repository and run feldspar-scan: OSV.dev advisories for pinned dependencies in lockfiles (npm, pnpm, yarn, pip/uv/poetry, Cargo, Go, Gemfile.lock), secret patterns with redacted evidence, and configuration lint. Returns a JSON report with summary counts and per-finding severity, file, line, advisory id and fixed versions. Deterministic, no LLM involved. Takes 2-90 s depending on repository size. Returns the most severe findings first, 25 unless max_findings asks for more (up to 200); the summary counts cover every finding, and large per-file breakdowns are left out and named under omitted.

  ConnectorNo auth

• initA

  SymvantaA

  Call first, with repository:"owner/name" (your checkout's GitHub remote). Binds the session to the project holding that repository and returns it as the active project with its repositories, index health, and a `usage` field (decision matrix + routing). workspace.attached=false means the checkout is NOT indexed: nothing in the answer describes it; attach it (add_repository, create_project) or work without the graph, do not route through the projects listed. Without repository: the pinned project (ref op:"use_project") or the workspace default.

  ConnectorNo auth

• set_github_repoA

  Inclusify AccessibilityA

  Names the GitHub repository where this site's problems become work somebody can pick up. Reach for it when a developer or a coding agent should be getting issues instead of reading a dashboard. WRITES to this website's Inclusify configuration, never to the site itself and never to GitHub: it records the repository and opens no issues by itself, which file_github_issues does. It CANNOT install the GitHub App: that is an approval screen on the customer's GitHub account reached from the Integrations page of the Inclusify panel, and no assistant can do it, so this refuses until the workspace has an installation. Before saving it checks the App can actually write issues in that repository and saves nothing if it cannot, so a stored binding always works. REQUIRES CONFIRMATION, because the wrong repository puts accessibility work in front of a team that did not ask for it, somewhere a coding agent may act on it unattended. The account owner is emailed a record, including the previous repository. Needs the PRO plan, matching the panel.

  Connector

  Destructive

  API key

• check_repoA

  The DeployerA

  Checks whether a public GitHub, GitLab or Bitbucket repository will deploy: the services it found, what's missing (each with its fix), the environment variables it needs, and what it would cost a month on DigitalOcean, AWS, Google Cloud and Azure. Reads the code and changes nothing. No API key needed. A check can take up to a minute; if it's still running, call again with the check_id it returned.

  ConnectorNo auth