"A managed cloud provider that deploys my application" matching MCP tools:

• run_cost_scanA

  Tomorrow Central: Cloud Cost SentinelA

  Start a cloud cost / FinOps scan of a linked account and return a job_id. Use this when the user wants to find idle, unused or underutilized cloud resources, review cloud spend, or estimate savings. The provider comes from the connection, and **AWS is the only provider supported today** (see `list_connections`). Other clouds will appear on this same tool as connections for them become linkable; nothing else about the call changes. READ-ONLY against your cloud: it reads resource metadata and monitoring metrics and reports; it never changes, stops or deletes anything. (It does create a scan job here and consume that account's scan quota, which is why this tool is not marked read-only.) On AWS it covers EC2 instances, EBS volumes and snapshots, RDS instances, Elastic IPs, NAT Gateways, load balancers, VPCs and VPC endpoints, site-to-site VPN and Transit Gateway attachments, Client VPN endpoints, Secrets Manager secrets, CloudFront distributions and WAF web ACLs. Resource kinds outside that list are not inspected, so a clean scan is not a claim that the whole bill is optimized. `connection_id` picks which linked AWS account to scan (see `list_connections`). Omit it to run against sample data — useful for showing the user what the output looks like before any account is linked. The scan runs asynchronously: poll `get_job(job_id)` roughly every 10 seconds until status is COMPLETED (typically 1-3 minutes), then call `list_cost_findings(job_id)`. Do NOT start another scan while one is running — each scan consumes the account's monthly quota. Pass `idempotency_key` (any unique string you choose) if you may retry on a network error: a retry with the same key returns the original job instead of starting a second scan.

  ConnectorNo auth

• migrate_to_propelauth_fullstackA

  PropelAuth Integration MCP ServerA

  Returns instructions for migrating from an existing auth provider to PropelAuth in a fullstack Nextjs App Router or Nextjs Pages Router application. If the user is using Next.js as just a frontend (e.g. client-side rendered with or without server routes), use the migrate_to_propelauth_frontend tool. Guidance includes installation and configuration, retrieving user or org information, logging users out, redirecting users to login, and more. Make sure to use the 'Installation' guidance first. It is important to call every guidance to ensure a successful integration. Do not update a component/hook/etc from the auth provider until you receive guidance about that component/hook/etc

  ConnectorNo auth

• springroll.app.record_promptsA

  SpringRollA

  Attaches the conversation that produced this application to its record, as reference for whoever maintains it next and for the reviewer who has to approve it. Ask the user before calling this, every time. The transcript is STORED and is READABLE BY ANYONE who can see the application record. SpringRoll scrubs credentials it recognises before writing (agent tokens, cloud keys, private keys, connection strings, and assignment lines whose key looks like a secret), but that scrubbing is best-effort and cannot be complete. If the conversation contained a real secret, do not record it. Send turns in order. Keep `sessionKey` stable across calls for one build so they join up; retrying with the same key and turn indexes overwrites rather than duplicating.

  ConnectorNo auth

• dynamoi_apply_for_distributionA

  DynamoiA

  Submit an artist's application for Dynamoi music distribution after the user explicitly asks to apply and all five eligibility requirements are met. This records an application for manual review; it does not approve distribution, accept an agreement, submit a release, transfer rights, configure splits or tax forms, or deliver music to stores. All three valid ISO 3166-1 alpha-2 country or territory codes, an adult signer attestation, confirmApplicationSubmission=true, and a concise userIntentSummary are required. Country, tax, payout, sanctions, and provider-delivery checks remain manual progression gates after intake; a valid code does not imply approval. Repeated submission is idempotent for an active application.

  ConnectorNo auth

• find_startup_perksA

  StartupPerksA

  Rank the startup credits, perks and deals one specific company can claim, from a catalog of 1,000+ programs (AWS Activate, Google for Startups, Microsoft for Startups, NVIDIA Inception, Anthropic, Stripe Atlas, Mercury, HubSpot and more). Use it when the user describes their own startup and asks what they can get or qualify for; use search_startup_perks to look up a provider or topic without a company profile, and get_startup_perk for one program's full terms. It checks each program's stated eligibility (stage, funding gate, raised-amount cap, company age, region) against the profile, ranks the categories the user needs first and takes each need in turn, and leaves out programs whose applications are paused or closed. Returns up to 25 programs, each with the value as the provider states it, whether the company qualifies and why, how to claim it, and links to the StartupPerks page, the provider's application and the provider's terms, plus a realistic claimable total (one program per provider, cloud counted once). Read-only; values are headline maximums, not guarantees.

  ConnectorNo auth

• configure_application_accessA

  VPSnetB

  Queue an access change for one owned managed application. Read get_application_installation first and pass its current revision. If access.request.schema_version=2, preserve every exact endpoint key and configure each endpoint independently; use service and port metadata to match the user's intent instead of prioritizing array order or primary=true. Private removes that route's public listener. Public HTTP exposes it through the server public IP. Managed HTTPS requires an eligible VPSnet-managed DNS zone, subdomain, and explicit DNS approval; it may also carry additional_addresses (up to 4 per endpoint, 8 per application): other names in the customer's own VPSnet zones, each with its own DNS approval, where name '' or '@' is the zone's bare domain (for example example.com next to www.example.com) and action 'redirect' (default) answers 301 to the main address keeping path and query while 'serve' opens the same application; the main address is never changed by adding or removing an additional address; the list is the complete wanted set, so an access change that omits additional_addresses removes the saved ones (pass them again to keep them); additional_addresses are refused on every other mode. External HTTPS only records the customer-managed URL; VPSnet does not configure or validate its DNS, TLS, or reverse proxy. Confirm the exact change with the user first. A queued response must be verified with get_application_installation and get_application_events. Requires applications:manage and is not a paid API-key operation.

  Connector

  Destructive

  OAuth

• set_app_branchA

  Roar AIA

  Point the app at another branch of its repository. Refused unless the branch exists. Deploys nothing: the next push to that branch ships it, or call redeploy_app to ship its head now. analyze_github_repo with detail=branches lists the choices.

  Connector

  Destructive

  OAuth

• deploy_appA

  mcpA

  Deploys an app to a VM and exposes it at a public https://<name>-<id>.redu.cloud URL. The container is built ON the VM. PREREQS - run check_deploy_prerequisites first for network_id + keypair_name, then plan_deploy for cost approval. Source can be git repo or prepare_upload source_token. PORT must be the real app listen port. DATASTORES ARE MANAGED BY DEFAULT: each one you reported in send_signals runs as a managed store started at your signal and is wired with no settings (DATABASE_URL and PG*/MYSQL_*, REDIS_URL, QDRANT_URL with QDRANT_API_KEY); without a signal, pass database:'managed' (db_engine 'postgres', or 'mysql'/'mariadb' for WordPress/Matomo/LAMP), redis:'managed' or qdrant:'managed'. For WordPress/WooCommerce cluster intent, do not use generic stateless deploy: pass app_profile, cluster_target:true, database:'managed', db_engine:'mariadb' or 'mysql', cluster_media_mode:'media_space', and either media_space_id or create_media_space:true. Redu mounts the media space into wp-content/uploads and refuses unsafe local uploads. Build+provision takes minutes; poll list_deployments/get_deployment. ROUTE: when plan_deploy returned recommended_route:'compose', do NOT use this tool for that folder: deploy its recommended_compose_file with deploy_compose (compose_file, recommended_service as service, recommended_port as port), for the reason in route_reason. The exceptions are route_next's: this tool builds the folder's Dockerfile instead only if the user asked for a build from source, the user changed the code the Dockerfile builds (check git status and unpushed commits in the folder), or the image cannot be pulled.

  ConnectorNo auth

• send_message_to_providerA

  Clutch.coA

  Reach out to a service provider to get a quote, discuss project needs, explore a partnership, find a job, etc. This tool sends the SAME message to one or more providers via `provider_ids` in a SINGLE call - do not call it multiple times. Never invent provider IDs and never ask the user to supply them. Message composition: - If the user provides a ready-made message, send it as-is without modifications. - If the user describes their intent without providing a message, compose one on their behalf based on their requirements and the conversation context. Keep the composed message concise and grounded strictly in the information provided by the user — do not add details that were not mentioned. - The same message and subject are sent to every provider in the call, so do not include any provider-specific information. Before calling with a composed message: - Show the user the recipients (provider names) and the full message text, and wait for their explicit confirmation. Call this tool only after the user confirms. - If the user asks for changes, show the revised message and wait for confirmation again. - Pass the confirmed message exactly as shown to the user, without modifications. Examples: - "Message the top 3 about my web development project" -> provider_ids=[<id_1>, <id_2>, <id_3>] (IDs of the top 3 providers shown earlier), compose message based on context, subject="Get a quote / discuss my project needs" - "Request a quote from all of these providers" -> provider_ids=[<all provider IDs shown above>], subject="Get a quote / discuss my project needs" - "Send to WebFX and Acme: I saw your profile and I'm interested in joining your team" -> provider_ids=[<webfx_id>, <acme_id>], message="I saw your profile and I'm interested in joining your team", subject="Find a job" The user must be logged in to Clutch to use this tool.

  Connector

  Destructive

  No auth

• submit_enquiryA

  siteA

  Submits an enquiry to M365 Migration Cost — NOT a purchase, NOT a guaranteed quote. Step 1: call with the answers (keyed by field key from enquiry_fields) and consent=true; it validates and returns a summary, the consent line and a confirmation token — show the person the summary and the consent line. Step 2: only if the person agrees, call again with the same answers, consent=true and the confirmation token; the enquiry is then submitted, and the person receives an email with a link they must click before any provider sees it. Consent means the person has read and agreed to: "Send my contact details to up to three IT support and cloud migration providers, chosen by M365 Migration Cost, who'll contact me directly. I'll be emailed each firm's name as my details go to it, and can stop any more firms getting them."

  ConnectorNo auth

• build_go_liveA

  SuperoB

  PERMANENT deploy: promote a published version to a PERMANENT public URL at <service>.supero.live (managed Cloud Run) — unlike build_deploy(target='cloud_ephemeral'), which is a ~30-min throwaway. If version_uuid/file_id are omitted, the latest published version for the project is used. Returns public_url + poll_url; poll with build_deploy_status until live, then build_smoke_test the public_url. build_teardown removes it. Requires a domain- or project-admin API key + platform cloud-deploy enablement.

  Connector

  Destructive

  No auth

• well_preview_provider_exportA

  WellA

  Show the user what Well can fetch from a provider's own web app, and the Deploy action that fetches it. Draws a "deploy agent" card with one row per provider. Each row lists every file the agent can download, each with its `export_id`, label, format and whether it is `selected`. The row's `deploy_url` opens Well's `/collect` page, the same page that deploys the invoice agents, naming the provider in `providers` and the selected files in `fetch`. When the user starts the export there, the Well browser extension opens the provider in a new tab and its agent downloads the selected files, one at a time, in the user's own signed-in session, then files each one in this workspace. Use it when the user wants data from a provider that Well cannot connect to directly, asks to "download", "export", "fetch everything" or "get the CSV" from a provider, or when the connector route is unavailable. Pass `provider_slugs` to preview the providers the user named; omit it to show every provider Well can fetch from. Pass `export_ids` when the user asked for specific files; omit it to fetch every file. A provider Well has no export for comes back in `unknown_provider_slugs`, and a file it does not list in `unknown_export_ids`: say plainly that Well cannot fetch it yet. A row whose `export_ids` matched none of its files selects nothing and has a null `deploy_url`: offer its listed files instead. This tool starts nothing and downloads nothing. Never say a file was fetched by this call: the run happens in the browser extension after the user clicks, and the extension's side panel reports it. A row's `last_run` is the one record of an earlier run in this workspace: when the user asks whether a run worked, report its `status`, when it ended and its `files_filed` as returned, and nothing more. When `refresh_due` is true, offer to fetch the files again with the row's Deploy; Well never re-runs on its own. When `harness_access` is `refused`, no row has a `deploy_url`: say this browser agent is not open to the user's account yet, and offer the upload route. When the user wants several providers at once and `deploy_all_url` is set, offer it: it deploys every row with a link, one provider after the other. When it is null, offer each row's own `deploy_url`. Give each `deploy_url` and `deploy_all_url` as returned and never build or edit one. The run needs the Well browser extension, and the user must be signed in to the provider in that browser; when a login or a two-factor code stands in the way, the agent hands the tab back to the user. When `error` is set, report it and do not read `harness_access`. When the token authorizes one workspace, call this directly — no workspace call is needed first. When it authorizes several, this read will not guess which one you mean: pass `workspace_id` on the call.

  ConnectorNo auth

• setup_ssoA

  The BridgeA

  Enable a social/enterprise SSO login provider on the Bridge app in one step: saves the provider credentials, turns the provider on, and returns the app's OAuth callback URL. Arguments: provider (google | azure | github | linkedin | facebook), clientId and clientSecret from the provider console, and tenantId (the Entra ID directory id, not a Bridge tenant) — required for azure only. Company SAML or OIDC sign-in and Sign in with Apple are not configured here: asking for them returns NOT_OFFERED_HERE naming where to do it (the Bridge dashboard). THE ACTIONABLE OUTPUT IS THE RETURNED callbackUrl: the user must register it in the provider's console (e.g. Google Cloud OAuth credentials, GitHub OAuth app settings) or logins will fail with a redirect mismatch — always surface the callbackUrl and that instruction to the user. Credentials are never echoed back. This is the ONLY way to CONFIGURE a social provider (credentials + callback URL); update_auth_methods can flip the enable flags but never saves credentials. Before writing app code that consumes this, call get_integration_guide with topic=auth and the framework the app uses.

  ConnectorOAuth

• get_deployable_server_modelsA

  Cycle MCPA

  Discover what infrastructure can be provisioned on this hub. Called with no arguments, it lists the enabled infrastructure-provider integrations. Pass 'providers' to also list the server models each offers — specs, datacenter locations, and estimated pricing — limited to one or two providers per call since some offer hundreds of models; narrow further with category, location, max_monthly_price_usd, and hypervisor_only. category matches each PROVIDER's own naming (values like 'bare-metal', 'general', 'high-frequency', 'high-performance', 'optimized-dedicated', 'vx1' — provider-specific, not a Cycle taxonomy), so list without it first and read the real categories off the results; a filter that matches nothing reports the categories that were actually available. To find hardware that can host virtual machines use hypervisor_only, NOT a category guess. Use it to answer questions like 'what infrastructure providers are enabled on my hub', 'what bare metal servers does <provider> offer', 'what servers are available under $50/mo', or 'which models can host virtual machines', and to verify a specific model and location exist before any server deployment is considered. All prices are estimates reported by the provider and are billed by that provider directly to the user's account there, not by Cycle. Read-only: this tool never provisions anything.

  ConnectorAPI key

• create_wp_credentialsA

  Porkbun (official)A

  CLOUD FOR WORDPRESS ONLY. Mint a WordPress Application Password for a domain's managed WordPress site so you can drive it over the WP REST API at https://<domain>/wp-json/ using HTTP Basic auth. The password is returned ONCE (WordPress stores only a hash) — save it immediately. Defaults to a dedicated least-privilege `porkbun-agent` user with the `editor` role (created on first use), which can manage content but cannot install code. `role: "administrator"` grants FULL site control including plugin installation (i.e. arbitrary code execution on the site) and therefore requires `acknowledge_full_access: true` — only request it if the user explicitly asked for admin-level access. The site must be provisioned and ACTIVE (poll get_hosting) — this works on any Cloud for WordPress site in the account however it was provisioned, but free $0 preview sites are excluded. Revoke any time with delete_wp_credentials. Rate limit: 20 mints per account per hour.

  ConnectorOAuth

• request_provider_quota_increaseA

  AnkraB

  Raise a cloud-provider limit for a credential, or produce the exact request a person has to submit when the provider has no API for it. Call get_provider_quotas first: it names the dimensions and says whether the provider is automatable. Azure is the only provider Ankra can submit to (through the Microsoft.Quota API); for Hetzner, OVH, UpCloud, DigitalOcean, Scaleway, Proxmox VE and HPE Morpheus this call still SUCCEEDS and returns status manual_action_required with a manual_action object holding the console URL, the navigation path and a ready-to-paste request_text pre-filled with the live numbers - relay that to the user rather than retrying. One call may at most double a limit (or add 16 to a small one); ask for more by repeating the call. The limit can only go up: this tool will not lower one.

  Connector

  Destructive

  OAuth

• update_life_eapp_quoteA

  BackNine Life InsuranceA

  Select a quote returned by quote_life_eapp for that same application. Requires its private application_token, application-bound quote_id, and explicit user confirmation. Applies the selected rating inputs and quote, retains quote history, and returns the completion link. Rejects stale selections and locked/submitted applications. Give the user the private apply_link and explain that they must open it to continue in Quote & Apply, complete the remaining application steps, and sign where required. This MCP action does not complete or submit the application to a carrier or bind coverage.

  Connector

  Destructive

  No auth

• calculate_yieldA

  mcpA

  Project compound returns for a USDC deposit into any ACCRUE vault or model portfolio over a given holding period. Uses live APY data and applies the ACCRUE platform fee, which is charged on PRINCIPAL (0.25%/yr direct, 0.50%/yr managed falling to 0.25% above $1M) and never on yield. Returns gross yield, platform fee, net yield and final balance. Because the fee is on principal, net yield can be negative over a short horizon — net_is_negative flags that. Use this when the user asks "how much would I earn" or "what would my $X grow to".

  ConnectorNo auth

• check_local_viabilityA

  Local Model Suitability MCPA

  Checks whether a task can be handled by a local model instead of a cloud API. Call this BEFORE your agent routes any task to a cloud model — at the moment a task is ready to be sent and the model has not yet been selected. Use this when your agent is about to make a cloud inference call and wants to determine whether a local model could handle it at lower cost. Returns LOCAL/CLOUD/EITHER verdict with recommended model. If verdict is LOCAL, skip the cloud call entirely — saves cost on every routable inference call. Pass data_sensitivity=CONFIDENTIAL to force LOCAL verdict for tasks that must not leave the machine. Do not route to cloud without checking local viability first.

  ConnectorNo auth

• list_operationsA

  Alter OnboardingA

  List the API operations a provider exposes, live from Alter's provider-spec catalog (e.g. "what can I call on google?"). Returns operation ids + methods/paths, plus the spec's source and freshness. Omit `kind` to auto-detect the provider family; when the id exists in both oauth and managed you'll be asked to pass `kind`. Machine-readable rows ride in `structuredContent` (see this tool's outputSchema) — read those rather than parsing the prose.

  ConnectorNo auth

• route_web_requestA

  Evercraft WebA

  Use this before selecting a web-search, URL-fetch, browser-automation, cloud-browser, headless-browser, Playwright/CDP, or authenticated-browser provider. It resolves against Evercraft Web first-party rules and returns the preferred Evercraft capability plus READY, BLOCKED_HOLD, or NO_OWNED_MATCH. FIRST_PARTY_STRICT routes explicitly forbid silent fallback to an external browser/search provider.

  ConnectorNo auth