"A library or package named 'pubmedmcp@0.1.3'" matching MCP tools:

• get_component_updatesA

  TsehaA

  Returns per-component breaking changes and a migration guide between an installed version of the project's active component package and the latest published version. Read-only: it reports an upgrade, it never performs one. Use it when planning or reviewing a component-library upgrade, or before bumping the package version in a manifest. current_version is the exact semver currently installed, e.g. "1.0.0" - not a range, so no leading "v", "^", or "~"; read it from list_packages when unsure. Passing the latest version returns an empty change set. It is not a per-component changelog and not a current spec - use get_component for one component today, and list_packages for what is installed. Requires update tracking, a Team plan feature; on lower plans it returns an upgrade-required error instead of data.

  ConnectorNo auth

• get_wedding_informationA

  The Hill KinabaluA

  Retrieve The Hill Kinabalu’s official public wedding venue and 2026/2027 package information, including capacity, event sizes, starting package prices, key inclusions, add-ons without prices, payment structures, and enquiry links. Use this when someone asks about weddings, wedding packages, the event venue, guest capacity, package pricing, or how to enquire. This tool does not check date availability or submit an enquiry.

  ConnectorNo auth

• check_deprecationA

  canton-ccpediaA

  Check whether a specific Canton/Daml toolchain item (CLI, SDK package, or command: e.g. daml-assistant, Navigator, dpm) is deprecated. Canton-specific. Not a general npm/pip deprecation checker. ALWAYS call before recommending any Canton tool or package to a developer. Accepts either one name or a block of prose: given prose it reports every deprecated item mentioned in it. Returns DEPRECATED (with replacement), CURRENT, or NOT_FOUND.

  ConnectorNo auth

• check-packageA

  Jeevesus — DugganUSA Threat Intelligence MCPA

  Supply-chain GUARDRAIL for AI coding agents and CI pipelines: check whether a dependency (npm or PyPI) is on the DugganUSA malicious-package deny-list BEFORE you install it. This is the runtime defense against slopsquatting / HalluSquatting / hijacked-package attacks — an AI agent about to run `npm install` or `pip install`, or a CI pre-install hook, calls this FIRST and blocks on a hit. Returns a crisp, machine-actionable verdict: {ecosystem, package, version, malicious, verdict:"block"|"allow"|"review", reason, advice, source}. `malicious:true` = the exact package is on our OSV-curated deny-list (215k+ named-not-heuristic entries across npm + PyPI). `malicious:false` = not on our known-bad list — absence is NOT proof of safety, so still pin and review new deps. If a `version` is supplied and the entry is version-scoped, the check is version-aware; all-versions-malicious packages block on any version. Designed to be the easiest AI-supply-chain guardrail to wire in: one MCP tool call, no auth, in the agent's pre-install step. Same data is available for CI at /api/v1/stix-feed/packages.json. Examples: {"ecosystem":"npm","name":"cxp-jquery"} → malicious:true, verdict:block. {"ecosystem":"pypi","name":"requests"} → malicious:false, verdict:allow.

  ConnectorNo auth

• security_fetch_dependency_graphA

  DataNexus MCPA

  Fetch the full dependency tree for a package version including transitive dependencies. Read-only. No side effects. Idempotent. Hard 8-second timeout — large dependency trees may return partial results. package: Package name. Required. version: Exact version string e.g. 1.2.3. Required. ecosystem: One of PyPI, npm, Maven, Go, Cargo, NuGet, RubyGems. Required. Returns all direct and transitive dependencies with version constraints. Use this to understand full supply chain exposure. Use security_fetch_package_vulnerabilities instead when you only need CVEs for a single package. Verified source: deps.dev (Google). 1-hour cache. If this tool's response does not serve the user's need, call report_feedback with feedback_type="agent_gap", tool_id="security_fetch_dependency_graph", intended_query="{what the user needed}", gap_description="{what was missing or wrong in the result}".

  ConnectorNo auth

• search_docsA

  @imqueueA

  Search the official @imqueue docs (guides, tutorial, CLI manual, articles) and every exported symbol of every @imqueue package that publishes a generated API reference, returning the most relevant pages with their URLs. Each result names the package it belongs to. Takes a plain question or an exact symbol name such as 'RedisQueue.send', 'PgPubSub.listen' or 'watcherCheckDelay'. Answers 'how do I do X in @imqueue' and confirms a signature before code is written against it. Every result carries the page URL, which get_doc reads in full. Some capabilities are covered by two mutually exclusive packages — @imqueue/pg-prisma vs @imqueue/pg-sequelize, @imqueue/opentelemetry vs @imqueue/datadog — so for a query like 'tracing' or 'database', call list_packages for the choosing rule rather than taking whichever package ranks first, and pass `package` here to search within the one you settled on.

  ConnectorNo auth

• recommend_iconsA

  SupericonsA

  Recommend a coherent icon set for up to 20 named UI slots in one call. Uses task context to narrow ambiguous meanings. When context is insufficient, returns needs_clarification with labeled interpretation options instead of guessing. Invalid inputs and service failures return a plain-language reason and a next step instead of a bare protocol error. Returns one recommendation and optional alternatives for each resolved slot, with explicit public library labels and visual preview URLs where available. Library key si means Supericons, not Simple Icons.

  ConnectorNo auth

• recommend_iconsA

  SupericonsA

  Recommend a coherent icon set for up to 20 named UI slots in one call. Uses task context to narrow ambiguous meanings. When context is insufficient, returns needs_clarification with labeled interpretation options instead of guessing. Invalid inputs and service failures return a plain-language reason and a next step instead of a bare protocol error. Returns one recommendation and optional alternatives for each resolved slot, with explicit public library labels and visual preview URLs where available. Library key si means Supericons, not Simple Icons.

  ConnectorNo auth

• get_latest_releaseA

  canton-ccpediaA

  Get the single latest release (version tag, publish date, and GitHub release-notes link) for ONE NAMED Canton-ecosystem package: canton, daml, dpm, or splice. Canton-specific. Requires a package name as input. Use when the user names a specific package ("what's the latest daml release", "latest canton version"); use get_current_versions instead for a cross-package snapshot of all four at once or MainNet/TestNet deployment status.

  ConnectorNo auth

• resolve_serverA

  MCPLookupA

  Resolve a named MCP server, vendor, product, package, repository, Registry identifier, or endpoint to a canonical MCPLookup identity. Returns at most five reviewed candidates with query-relative identity and publisher explanations, a compact trust assessment, and current connection options. This is the best fit when a particular artifact or product is known; find_servers covers open-ended capability discovery, while trust_lookup returns the full current evidence record for an exact canonical name.

  ConnectorNo auth

• scan_composerA

  Drupal Code QueryA

  Which of a site's drupal/* packages need a new release for a target core, and which have none? Send composer.lock and composer.json once; do not query one package at a time. The answer is the release scan for every package, plus extra.patches as check_patches items. Constraints are read by composer's own semver library. - composer_lock: the whole file, or its path to get the upload command. A real lock does not fit a call. With the path, the files go from disk to the api by curl and only the plan comes back. composer_json: adds constraints and extra.patches. patches_file and patches_lock: the two documents a site on cweagans/composer-patches 2.x keeps its patches in, since such a site declares none under extra.patches. Sent as text with a lock path, the command lists every patch to send. target_core: 11.4, 11.4.5, or latest for the newest core the site's constraint allows. Without patches, target_from holds the package whose constraint decided latest. When the site requires no core package, latest is the installed core and target_from says so. Empty scans against the installed core (target_is_installed): what can be updated without a core upgrade. - installed_unknown: the release data does not have the installed version; the row offers no older release. installed_from_tag: the project's git tag answered instead. Neither is a finding about the site. - A sub-module has no releases of its own; drupal.org packages it as a metapackage built from its project's release. Its row says submodule_of and has that project's answer. The lock's type, require and extra.drupal.datestamp fields pair a metapackage with its project. - rows, problems first. no_release: no published release supports the target; latest_any and dev_branch say what exists. update: a compatible release the site does not have; latest, latest_core. unknown: not a drupal.org project in the bundle; note says where its releases are. current: installed_supports and nothing newer needed; such a row has package, installed and installed_supports only. counts covers every package even when rows are cut. - candidates, on every row that is not current: the newest three releases, each with version, core constraint, date and supports_target. project_profile adds installs and branches to the same three. - patches: one item per declared patch with the installed version filled in. Pass them to check_patches after composer update; local paths need the file text. A patch on a package outside drupal/ gets no item and no row; outside_drupal lists it. - patches:true answers with plan instead: every patch judged against the release its package would install for target_core. plan.counts: the verdict tally. plan.package_counts: the scan tallies. plan.no_release: the packages that block the target. plan.patches: one row per patch needing a decision (conflicts, unknown, merged, and an applies that only a lenient apply took). plan.applying: the number that apply with nothing to decide. The scan rows are not in a plan; call again without patches for them. - A patch whose package has no release for the target is judged against the branch when the lock installs a dev version. Otherwise it is unknown, with the reason in note. plan.warnings: a package is in no_release because of something the site controls. Each warning gives the requirement to change: its own constraint, or its minimum stability. A row's project for reroll_patch is its package without the drupal/ prefix. - A plan never has a re-rolled diff. plan.next_step points at reroll_patch, one call per patch, when any patch needs a re-roll. - bundle_date: when the release data was published. A release after it is invisible here. Confirm a no_release with composer show or drupal.org before acting.

  ConnectorNo auth

• find_company_emailsA

  PeopleSearch.imA

  Given a company domain or name, return the contactable role-based email addresses discovered for that organization (such as contact@, sales@, support@), each with a confidence level. Use this for reaching a company inbox, not a specific named person (for a named person use find_people or find_linkedin_profile). Spends 2 credits, refunded if none are found.

  ConnectorNo auth

• list_shared_responsesA

  RoutebaseA

  List the reusable responses of the shared library. Scope 'project' (default) reads the current project's library, 'org' the organization-wide one. Each entry carries the id and rowVersion needed to update or link it. Use this to browse or find an id; to create, change or delete one use manage_shared_response.

  ConnectorAPI key

• call_toolA

  Singularity - MCP Discovery & Security GatewayA

  Execute a first-party public tool through the audited Singularity gateway: weather (current conditions for a city), npms_lookup (npm package info), pypi_lookup (PyPI package info), web_search (DuckDuckGo instant answers). The call is scope-checked, trust-checked, and written to the audit log; denied or failed calls return the reason. Use list_public_tools to see what's available, and find_solutions to be told which slugs fit a problem.

  ConnectorOAuth

• call_toolA

  Singularity — MCP Discovery & Security GatewayA

  Execute a first-party public tool through the audited Singularity gateway: weather (current conditions for a city), npms_lookup (npm package info), pypi_lookup (PyPI package info), web_search (DuckDuckGo instant answers). The call is scope-checked, trust-checked, and written to the audit log; denied or failed calls return the reason. Use list_public_tools to see what's available, and find_solutions to be told which slugs fit a problem.

  ConnectorOAuth

• find_formA

  EmbossA

  Find a blank government form in the Emboss library by name or number, ready to fill. Search the library of blank US federal forms by name, number or alias (w9, W-9, form w 9 and taxpayer identification all find the same form). Returns each match's slug, title, agency, revision and page count. Send the whole query once, and do not search as the user types: each search spends one of the account's rate-limit slots. Pass a slug as create_form's library argument to start from that form. Free.

  ConnectorOAuth

• gripforge_attachA

  GripForgeC

  Attach a prop (sword, shield, gun, staff/scythe…) onto a rigged character. Finds the hand bone across naming schemes, scales the prop to the character, seats the grip, closes the fist, and returns a bind + ready-to-paste Three.js / Unity / Godot snippets. Pass Library ids (character_id / prop_id) or https URLs. attach_id reuses an existing armed bind GLB as the character. prop_id_2 attaches a second held item (off-hand) onto the first result. The bind (+ armed GLB when export_glb) is saved in Library — not a second credit. To write files into an open repo, use the npm MCP package gripforge_library_pull.

  ConnectorNo auth

• resolve-library-idA

  xpay✦ DevTools CollectionC

  Resolves a package/product name to a Context7-compatible library ID and returns matching libraries. You MUST call this function before 'query-docs' to obtain a valid Context7-compatible library ID UNLESS the user explicitly provides a library ID in the format '/org/project' or '/org/project/version' in their query. Selection Process: 1. Analyze the query to understand what library/package the user is looking for 2. Return the most relevant match based on: - Name similarity to the query (exact matches prioritized) - Description relevance to the query's intent - Documentation coverage (prioritize libraries with higher Code Snippet counts) - Source reputation (consider libraries with High or Medium reputation more authoritative) - Benchmark Score: Quality indicator (100 is the highest score) Response Format: - Return the selected library ID in a clearly marked section - Provide a brief explanation for why this library was chosen - If multiple good matches exist, acknowledge this but proceed with the most relevant one - If no good matches exist, clearly state this and suggest query refinements For ambiguous queries, request clarification before proceeding with a best-guess match. IMPORTANT: Do not call this tool more than 3 times per question. If you cannot find what you need after 3 calls, use the best result you have.

  ConnectorNo auth

• query_vulnerabilitiesA

  NPMScanA

  Query OSV.dev for known vulnerabilities affecting an npm package, optionally scoped to one exact version (e.g. to check whether a version pinned in a lockfile is safe). Returns isVulnerable and highestSeverity as a direct answer, plus each finding's severity, a plain-language summary, CVE aliases, and the fixedVersion to upgrade to — not a raw advisory dump. Also cross-checks the name/version against the npm registry: isVulnerable:false on a package that does not actually exist there (typo, wrong ecosystem) would otherwise look identical to a genuinely clean result — see packageExists/existenceCheckNote. A name or version not found on the registry does NOT discard already-fetched OSV data or short-circuit into an error: OSV/GHSA advisory data is independent of the package's current registry listing, and a package/version pulled from npm for being malicious (unpublished/yanked) is exactly the case where real vulnerability data must still be reported, not hidden behind a 404. Use before recommending, installing, or upgrading a package.

  ConnectorNo auth

• query_vulnerabilitiesA

  NPMScanA

  Query OSV.dev for known vulnerabilities affecting an npm package, optionally scoped to one exact version (e.g. to check whether a version pinned in a lockfile is safe). Returns isVulnerable and highestSeverity as a direct answer, plus each finding's severity, a plain-language summary, CVE aliases, and the fixedVersion to upgrade to — not a raw advisory dump. Also cross-checks the name/version against the npm registry: isVulnerable:false on a package that does not actually exist there (typo, wrong ecosystem) would otherwise look identical to a genuinely clean result — see packageExists/existenceCheckNote. A name or version not found on the registry does NOT discard already-fetched OSV data or short-circuit into an error: OSV/GHSA advisory data is independent of the package's current registry listing, and a package/version pulled from npm for being malicious (unpublished/yanked) is exactly the case where real vulnerability data must still be reported, not hidden behind a 404. Use before recommending, installing, or upgrading a package.

  ConnectorNo auth

• check_dependencyA

  RepoPilotA

  CALL when the user or agent is about to add, upgrade, trust, fork, or deploy an npm package or public GitHub repository. Returns a lean repository-level recommendation, confidence, evidence gaps, CVEs, maintenance, ownership, license, CI/tests, Scorecard, freshness, and next actions. DO NOT use for code navigation. Pass exactly one of repo or package. A favourable result does not validate an exact package version or compatibility.

  ConnectorNo auth