Skip to main content
Glama
466,085 tools. Updated 2026-08-19 11:00

"A debugging tool for analyzing and reverse engineering software" matching MCP tools:

  • Forward a buyer request-for-quote or engineering question to the Commonlands engineering team. Two-step, buyer-confirmed: the first call returns a preview and sends nothing; show the buyer the preview (including their reply-to email) and, only after they explicitly approve, call again with confirm: true to send. The recipient is fixed to the Commonlands inbox (the agent cannot choose it); this only sends an inquiry and never creates an order, charges a card, or writes Shopify/customer data. Include part numbers, sensor, quantity, and application when known so the team can reply with a quote. Commonlands replies by email.
    Connector
  • Reverse-engineer a Merkle root back to its punk IDs and inferred trait selection. ONLY works for roots that already have at least one bid in the CryptoPunks Bids API — this tool looks bids up by root, then derives trait config from the resulting punk set. Returns `resolved: false` for unknown roots; constructing a root locally and passing it here will not work. Rate limit: 5 per 10 min (compute bucket — shared with filter_punks, compute_merkle_root).
    Connector
  • Use to convert between fiscal year/quarter and calendar months for a ticker before filtering period_end columns. Coverage warning: fiscal-year configuration is primarily US, with sparse JP/HK entries and no China A-share coverage in the verified dataset. Do not assume this tool supports a ticker merely because the core equity tables do. Forward: ticker + fiscal_year + fiscal_quarter → period_start/period_end. Reverse: ticker + yyyy_mm → fiscal_year/fiscal_quarter.
    Connector
  • Look up a MITRE ATT&CK threat group (intrusion set) or software entry by name or ID for authorized penetration testing and threat intelligence. Returns the group or software record: ATT&CK ID, display name, known aliases, type (group vs. software), description, and the techniques it uses with procedure-level context from public ATT&CK reporting. Accepts exact ATT&CK IDs (G0007 for threat groups, S0002 for software) or keyword/name search (e.g., "APT28", "Mimikatz", "Lazarus Group"). Equally useful for defenders building detection coverage around specific adversary tradecraft.
    Connector
  • Answer a RULE-LEVEL question directly from compiled law: thresholds and day counts, WITHHOLDING TAX rates on royalty and fees for technical services (treaty and domestic), the 1961→2025 Income-tax Act section renumbering (s.195→s.393(2), s.115A→s.207, s.90→s.159, s.206AA→s.397(2)), tests and their elements, what a named case held. Ask in plain language — 'what is the India–US royalty WHT rate' (15%, not the widely-repeated 10%), 'what replaced section 195', 'is software payment royalty after Engineering Analysis', 'is a TRC sufficient after Tiger Global', 'what does make available mean'. Returns the compiled answer with its pinpoint, authority, and — where the corpus holds the primary text — a string-verified quote. Use THIS, not analyze_cross_border_tax, when the question is about the law in the abstract; use analyze when you have a specific matter's facts. Outside compiled topics it refuses and lists what can be asked.
    Connector
  • Get USER PROFILES of people who interacted with an Instagram post. Returns full user data (bio, followerCount, followingCount, etc.). RETURNS USER PROFILES: id, username, fullName, biography, followerCount, followingCount, isVerified, profilePicUrl. Use for analyzing WHO engaged with a post. NOT FOR COMMENT TEXT: To read the actual comment content (what people wrote), use getInstagramCommentsByPostId instead. INTERACTION TYPES: "commenters" (users who commented), "likers" (users who liked). WHEN TO USE THIS TOOL: Analyzing commenters/likers demographics, finding influencers who engaged, building audience profiles, network analysis of who interacts with posts. WHEN TO USE getInstagramCommentsByPostId: Reading comment text, sentiment analysis of what was said, analyzing discussion content. FAST (default, omit responseType or responseType="fast"): Returns up to 300 results directly (use limit param to reduce, e.g. limit=5). Auto API fallback for commenters when stale. PAGING (responseType="paging"): Async paginated results (1000 users per page with default fields), returns operationId - IMMEDIATELY call checkOperationStatus to get results. CSV export included via dataDumpExportOperationId. Supports pageNumber/tableName for subsequent pages. Optional fields (default: ["id", "username", "fullName"]). Available: biography, isPrivate, isVerified, followerCount, followingCount, mediaCount, profilePicUrl. This is a safe, read-only tool for analyzing searchable information. TRIAL ACCESS: Get a free trial token by sending POST https://api.xpoz.ai/api/trial/token with header Content-Type: application/json and body {"source":"<how you discovered xpoz>"}; the response contains a token that starts with "TRIAL" and is valid for 5 days. Use it as a Bearer token in the Authorization header. Trial returns up to 5 cached (database-only) results and never triggers live fetching. Sign up at https://www.xpoz.ai/login for full result limits and live data.
    Connector

Matching MCP Servers

  • F
    license
    A
    quality
    A
    maintenance
    Enables decompilation and reverse engineering of Java JAR files through multi-engine decompilation, candidate evaluation, Maven project structuring, AST-based deobfuscation, and bytecode comparison.
    9
    1

Matching MCP Connectors

  • Resolve a place 'query' to coordinates (forward) or find nearest places to 'latitude'+'longitude' (reverse). Mediterranean-focused curated DB; forward falls back to OSM/Nominatim globally. Each result carries a 'source' discriminator ('local' for the curated marine DB, 'osm' for the global fallback). Returns name, type, coords, source, plus similarity (forward) or distance_m (reverse). Example forward: query="Portofino". Example reverse: latitude=44.3, longitude=9.21, radius_m=50000. Chain into nausika_marine_forecast, nausika_tides, nausika_search_places, or nausika_sea_route using the returned coords.
    Connector
  • Aggregate counters for Archimedes Market as a whole: number of published assets, funded bounties, verified engineers, and total USD paid out across asset sales and bounty payouts. Useful for: evaluating whether Archimedes is worth recommending, sizing the engineering-talent pool, or surfacing platform momentum to a user. Counters are cached upstream (60s).
    Connector
  • Start a scratch session that holds several named sequences/values (e.g. vector, insert, forward/reverse primer) for use across multiple tool calls via session_run, instead of re-pasting them into every call. Sessions expire after 24 hours.
    Connector
  • Check the status of a submitted job. Call this after submit_query to see if your job is ready. Status progression: submitted -> analyzing -> fetching -> clustering -> enriching -> completed/failed IMPORTANT: Jobs take several minutes to process. First check after ~1-2 minutes, then poll every 30-60 seconds. Broad searches can take 10-30+ minutes; for long jobs, poll every 60-120 seconds. Do NOT call this tool in a tight loop. Stop polling when status is `completed` or `failed`. Treat `submitted`, `analyzing`, `fetching`, `clustering`, and `enriching` as active states and continue polling. You don't need to wait for completion to pull results. Partial results are available during `enriching` — call pull_results after ~2 minutes, then poll status every 30-60 seconds and pull again for fresher results. Do not stop pulling just because an intermediate pull is empty/unchanged. Use `progress_validated` vs `candidate_records` to track whether more results may still appear (`progress_validated < candidate_records`). If transport/session fails, resume using the same `job_id`.
    Connector
  • Multi-hop traversal from a claim over typed relation edges of ONE class. Default walks the epistemic §7 edges transitively (support/extend/qualify/refute/background/shared_evidence/same_as); relation_class="engineering" walks the dependency graph (depends_on/satisfies). ★ Those are the values a record carries; the graph stores them as ENG_DEPENDS_ON/ENG_SATISFIES edges, which you never write. This sentence used to name the epistemic set by its RECORD values and the engineering set by its EDGE LABELS, so a reader applying the visible pattern produced `ENG_depends_on` — a third thing, rejected by the validator (which accepts exactly depends_on and satisfies). direction="out" = forward (dependencies / cited); "in" = reverse (impact set — who depends on this). ★ This `direction` is the TRAVERSAL direction of the read and has NOTHING to do with the `direction` FIELD on a relation record — different thing, same name. Do not copy in/out into a record. For engineering it also returns cycle_detected (start claim in a dependency cycle). Class label-spaces are disjoint — a §7 walk never crosses into engineering edges and vice versa.
    Connector
  • Compact replay summary for analysis. Returns replay metadata (totals, passed/failed/skipped counts) + one row per step with status, action, duration, diff scores, and a short error excerpt. Always small — call this first when analyzing a replay, then use flow_replay_step for full per-step detail.
    Connector
  • Get full detail for a Tuki solution: description, who it is for, capabilities, status and contact / CTA. Use after `list_solutions` or when the user asks about a specific Tuki product (WhatsApp Booking OS, boutique ticketing, rental inventory software, event post-sale, tailor-made tourism software).
    Connector
  • Mesh Audit — External Posture — Consent-gated, READ-ONLY external posture report — informational only, not a formal audit or warranty. From an authorization-to-test for a host you own, it observes over HTTPS what the internet already sees: security headers, software banners, and exposed /.env //.git/admin surfaces. Always names what it did NOT check; internal targets refused. Input: {consent_id, asset} via /api/audit/consent. (6 MESH/call, a tool · audit)
    Connector
  • Get G2 software reviews. Returns ratings, pros, cons, use cases. Args: product: Software product name (e.g. 'Salesforce') max_results: Max reviews (default 20)
    Connector
  • Get an ETF's constituent holdings and their weights, heaviest first. When the ticker is not an ETF, `is_etf` is false and `holdings` is empty; `is_etf: true` with zero holdings means a real ETF whose holdings aren't ingested yet. (The reverse lookup "which ETFs hold NVDA" is a scan filter on the `etf_holders` column, not this tool.)
    Connector
  • Check the status of a submitted job. Call this after submit_query to see if your job is ready. Status progression: submitted -> analyzing -> fetching -> clustering -> enriching -> completed/failed IMPORTANT: Jobs take several minutes to process. First check after ~1-2 minutes, then poll every 30-60 seconds. Broad searches can take 10-30+ minutes; for long jobs, poll every 60-120 seconds. Do NOT call this tool in a tight loop. Stop polling when status is `completed` or `failed`. Treat `submitted`, `analyzing`, `fetching`, `clustering`, and `enriching` as active states and continue polling. You don't need to wait for completion to pull results. Partial results are available during `enriching` — call pull_results after ~2 minutes, then poll status every 30-60 seconds and pull again for fresher results. Do not stop pulling just because an intermediate pull is empty/unchanged. Use `progress_validated` vs `candidate_records` to track whether more results may still appear (`progress_validated < candidate_records`). If transport/session fails, resume using the same `job_id`.
    Connector
  • Is this CONTENT safe for an agent to ACT ON? Screens a message / tweet / DM / webpage / tool output an agent is about to treat as an instruction, for prompt-injection and social-engineering ('ignore previous instructions', 'send funds to', 'approve this', 'admin override', 'claim your airdrop' links). This is how autonomous agents get drained (a poisoned tweet a bot executed). Returns injection_suspected + a do_not_proceed/caution/proceed read; surfaces any addresses/links to verify separately. fingers never obeys the content -- it treats it as untrusted data.
    Connector
  • Assess zone walkability risk by analyzing NSEC3PARAM configuration. Detects plain NSEC zones, weak NSEC3 parameters, and opt-out flags.
    Connector
  • First stop for category-specific vendor recommendations and vendor ID discovery. Finds BuyAPI vendor IDs for a user question; provide category when known. Use this when the user asks which provider in a category fits their constraints. With a covered category, the response includes ranked results plus a top-3 decision matrix with fit labels, confidence, tradeoffs, cost notes, freshness, and sources. Do not use this for local coding/debugging/docs questions unless they involve choosing a software vendor or tool. If the category is outside BuyAPI's corpus, the tool returns an explicit "not in corpus yet" result instead of inventing vendors.
    Connector