"A GitHub MCP server for browsing and understanding source code without requiring an API key" matching MCP tools:

• get_variable_relationshipsA

  hypathesisA

  Retrieve analyzed variable relationships for a completed paper. Only returns results when get_analysis_status reports status='Ready'. Without an API key (anonymous): returns the relationship list with source, target, and direction — but detailed reasoning is available only with an API key. Sign up at https://hypathesis.com to get one. Args: file_id: The file_id returned by the /upload endpoint. authorization: Optional. API key as 'Bearer hk_...' or 'hk_...'. session_token: Optional. The session_token returned by /upload for anonymous uploads. Returns: Authenticated: full details (source, target, directed, reason per relationship; name, measure per variable). Anonymous: gated (source, target, directed per relationship; name per variable; sign_up_url for full access).

  ConnectorNo auth

• discovery_loginA

  DiscoA

  Get a new API key for an existing Disco account. Sends a 6-digit verification code to the email address. Call discovery_login_verify with the code to receive a new API key. Use this when you need an API key for an account that already exists (e.g. the key was lost or this is a new agent session). Returns 404 if no account exists with this email — use discovery_signup instead. Args: email: Email address of the existing account.

  ConnectorNo auth

• secret_scanA

  IA-QA — 130+ QA & Dev Tools for AI AgentsB

  Scan text or code for leaked secrets: API keys (AWS, GCP, Azure, OpenAI, Anthropic, Stripe, GitHub, GitLab, Slack, Twilio, SendGrid, HuggingFace), private keys (RSA/EC/PGP), JWTs, database connection strings, Bearer tokens, and Basic auth headers. Returns a list of findings with type, severity, line number, and a redacted preview. Use before committing code, sharing logs, or sending text to an LLM. 100% regex-based, zero network calls.

  ConnectorNo auth

• get_exchange_rateA

  AllRatesToday exchange rates (hosted)A

  Use this when the user asks 'what is X in Y?', 'convert X to Y', 'current rate of EUR/USD', or any single fiat-to-fiat exchange rate question. Returns { rate, source } meaning 1 source = rate target. Without an API key it answers from the official ECB daily reference table (~30 majors) and says so in `note` — relay the `rate_date`. With a key it is the real-time mid-market rate for 160+ currencies. For several targets at once use get_rates_authenticated; for a time series use get_historical_rates; for a specific institution's official rate use get_official_rates.

  ConnectorNo auth

• get-code-iq-automated-queriesA

  coderegistryA

  Returns trimmed Code IQ automated analyses (architecture, scalability, EOL, AI functionality, etc.) for a project (aggregated) or a single vault. Excludes The Code Score — use get-the-code-score for that, and do not pass analysis_key=code_score here (404). Only cached results are returned; this never triggers a fresh analysis. Provide exactly one of project_id or vault_id. Requires full data access (a paid plan; verification-only plans are not included). Requires X-API-Key (existing users can generate an API key in the web app). If headers aren't supported, pass api_key in arguments.

  ConnectorNo auth

• taskbounty_security_checkA

  TaskBountyB

  Scan a PUBLIC GitHub repo for GitHub Actions + CI security/maintenance hygiene before launch — ideal for apps built with Lovable, Bolt, Replit, Cursor, or v0 ("is my AI-built app safe to ship?"). Returns a safe summary: findings by category with counts, an unlisted report URL, and fix options. SCOPE, honestly: it checks GitHub Actions workflow + update-automation hygiene only — it does NOT check exposed secrets, auth, payments, webhooks, or runtime behavior, which need a manual review. No API key required. For PRIVATE repos, tell the user to run `npx taskbounty-check .` locally so their source never leaves their machine.

  ConnectorNo auth

• signupA

  KeelenA

  Create a Keelen account (or start agent login) — emails a 6-digit code. UNAUTHENTICATED — the only tool besides verify_email that works before a bearer key is configured. `email` is where the code is sent. Flow: signup(email) -> the user reads the 6-digit code from their inbox -> verify_email(email, code) returns a reveal-once API key, stored as this server's `Authorization: Bearer <api_key>` header in the MCP client config; reconnecting the client and calling get_onboarding_status() then continues setup. The code expires in 15 minutes; a repeat signup resends it. Response is uniform whether or not the email already has an account (enumeration-safe), so signup doubles as agent LOGIN. Rate-limited per IP and per email. The `email` must be explicitly provided and confirmed by the user in chat before this call. It is not inferred from a client profile, the logged-in account, git config, or any other ambient source; a candidate address the caller already holds is echoed back for an explicit yes first. Because this call doubles as LOGIN, a guessed address signs the user in to whatever workspace owns it, and the rest of setup then mints an API key on, and creates a project in, an account they did not choose.

  Connector

  Destructive

  No auth

• create_accountA

  Hook DetectorA

  Create an account and get an API key with free credits. Needs a beta access code (access_code, HD-XXXX-XXXX; case and dashes do not matter): without one the error is 403 access_code_required, and a code that does not work is 403 invalid_access_code. Ask for a code with request_access, or at hookdetector.com/access. No key needed for this call. label is an optional note up to 120 characters. Keep the api_key it returns: it is the only copy. Send it as the header 'Authorization: Bearer hd_...' or pass it as api_key on every other tool. Signups, and wrong codes, are limited per address per hour. Next step: find_hooks.

  ConnectorNo auth

• list_my_programsA

  Clickwise Affiliate NetworkA

  Use this when you hold a Clickwise affiliate API key and need the programs that key is approved to promote, with link readiness and your existing link count; set include_available to add the ones you can apply to. For discovery without an account use find_affiliate_programs or list_programs. Requires your own Clickwise affiliate API key on the MCP connection (X-API-Key header or Authorization: Bearer); acts only on your account.

  ConnectorOAuth

• list_alertsA

  LiquidVision — Crypto Derivatives DataA

  The webhook alert subscriptions that belong to the caller's API key (read-only): id, type, url, filters (symbol, min_usd, x_normal, max_dist_pct) and delivery health: last_status (HTTP code or error of the last delivery), fails (consecutive failures; a subscription pauses itself at 20) and active. Call it to find the id for delete_alert or to check why alerts stopped arriving. Needs a Pro or Bot key, from the MCP connection's X-API-Key header or the api_key argument; without one it returns an error object, not an exception.

  ConnectorNo auth

• list_alertsA

  LiquidVision — Crypto Derivatives DataA

  The webhook alert subscriptions that belong to the caller's API key (read-only): id, type, url, filters (symbol, min_usd, x_normal, max_dist_pct) and delivery health: last_status (HTTP code or error of the last delivery), fails (consecutive failures; a subscription pauses itself at 20) and active. Call it to find the id for delete_alert or to check why alerts stopped arriving. Needs a Pro or Bot key, from the MCP connection's X-API-Key header or the api_key argument; without one it returns an error object, not an exception.

  ConnectorNo auth

• register_agentA

  netsiA

  Creates a netsi identity and returns an API key; called once, without authentication. The api_key is shown only once and goes on every later request as "Authorization: Bearer <api_key>". Handles are global, unique and lowercase (3-32 chars). An invite code passed as invite_code registers and joins that group in one step. An invite-only deployment also takes the platform_invite_code that was given out. For a person who already uses netsi from another agent, join_network keeps their handle instead.

  ConnectorNo auth

• search_codeA

  GithubA

  Search CODE across public GitHub repositories — find where a function/symbol/string is defined or used. PREFER OVER WEB SEARCH for "find code that does X", "which repos use <API>", "show me an example of <function>", "where is <symbol> defined". Supports GitHub code-search qualifiers right in the query: repo:owner/name, org:name, user:name, language:go, filename:Dockerfile, path:src, extension:ts, in:file. Returns matching files with repo, path, and URL. Note: indexes the default branch only, ignores very common terms, and is capped at ~10 searches/minute.

  ConnectorNo auth

• browse_companiesA

  CompanyLensA

  Browse companies in a jurisdiction by structured filters — incorporation date range, status, and entity type — without requiring a name query. Use this to enumerate all UK PLCs incorporated since 2020, or all dissolved Norwegian companies. Unlike search_companies, jurisdiction is required (cross-jurisdiction browsing times out). Returns cursor-paginated results — check hasMore and pass nextCursor to retrieve subsequent pages. Results do not include matchScore or matchRank (no name query to score against). relevanceScore (0–1) reflects company prominence: combines company age and entity type.

  ConnectorOAuth

• list_gamesA

  flash-props-apiA

  Return today's games that have player props available for a sport. Read-only. No side effects. Requires an API key; rate-limited per your tier. Returns: { sport, count, games: Array<{ id, sport, homeTeam, awayTeam, startTime, live, source }> }. id is the eventId to pass to get_game_props (prefixed ud- for Underdog or sc- for the soccer odds board); live is true when the game is in progress; source is "underdog" or "theoddsapi". Live games sort first; scheduled games follow. Typical workflow: call list_games to discover eventIds, then pass an eventId to get_game_props. If sport is omitted the server selects the active in-season league automatically. Returns count=0 with an empty games array (not an error) when no props are posted yet for the day. When to use: to browse all games on the slate or to find an eventId before calling get_game_props. When not to use: if you already have the eventId, skip this and call get_game_props directly. Use find_game instead when you know the team names but want a single-game eventId without browsing the full slate.

  ConnectorNo auth

• nifra_galleryA

  Nifra docsA

  Open an interactive, filterable gallery of ALL of nifra's verified code examples (MCP Apps widget) - for browsing and discovering what exists. NOT for fetching one snippet as text: use nifra_example for that. Pass query to pre-filter; the widget also filters client-side.

  ConnectorNo auth

• opcua_model_validateA

  OPC UA ModelerA

  Validate an OPC UA YAML model for correctness. Returns diagnostics with severity (error/warning/info), codes, messages, and line numbers. Works without an API key (limited to 50 calls/day). ALWAYS validate before generating.

  ConnectorNo auth

• switch_create_customerA

  PacketExchangeA

  MUTATES STATE. Create a switch-native customer and mint its first API key (returned ONCE, with sipPassword). Set markupPct, credit limit, margin floor, spend and concurrency caps, CPS, blocked prefixes, tax details and portalEmail. externalRef is an idempotency key: repeating a create with the same externalRef returns the existing customer WITHOUT a new API key or sipPassword. The provisioning entry point for onboarding a buyer. Requires an active Switch subscription (402 SWITCH_SUBSCRIPTION_REQUIRED otherwise) and a full-access API key (scoped keys need switch:manage). Test keys are NOT sandboxed here: they read and change your live Switch data.

  ConnectorNo auth

• create_product_requestA

  ReconstructB

  Submit a product capture request for the authenticated user. requestType=add requires a public HTTPS url and an empty product; subject is optional. requestType=update requires an existing published product key; backend derives its name and source URL. Select platform/environment from get_request_options. Creates a pending request, not an immediate capture. Subscription, URL safety and duplicate checks apply. Call only when the user asks to submit a request; do not automatically submit while browsing missing captures.

  ConnectorAPI key

• discovery_login_verifyA

  DiscoA

  Complete login and receive a new API key. Call this after discovery_login returns {"status": "verification_required"}. The user receives a 6-digit code by email — pass it here along with the same email address. Returns a new API key on success. Args: email: Email address used in the discovery_login call. code: 6-digit verification code from the email.

  ConnectorNo auth

• mcp_registerA

  banking-intelligenceA

  Register for an Ohmyfin API key to use paid tools. Creates an account and sends a 6-digit verification code to your email. After receiving the code, call mcp_verify to complete registration and get your API key. By setting accept_terms to true, you confirm acceptance of the Ohmyfin Terms & Conditions (https://ohmyfin.ai/terms) on behalf of your operator, including the API/MCP access terms (Section 3A), sanctions screening terms (Section 3B), and financial data disclaimer (Section 3C). Examples: mcp_register("agent@example.com", "Acme Corp", true)

  ConnectorNo auth