"A manager for organizing and handling tools" matching MCP tools:

• security_deep_dive

  Moltline Code Review

  Run an OWASP-oriented security pass over a source file. PREMIUM (license). Checks injection sinks, auth/session handling, crypto misuse, SSRF/deserialization, and unsafe file/path handling — each finding cites the line, the OWASP risk class, and a concrete fix direction. Typical input {"code": "<file contents>"} returns {"issues": N, "findings": [{"line": N, "class": "A03 Injection", "fix": "...", "code": "..."}], "owasp_note": "..."}. Use on one source file when vulnerabilities are the question. Not for style or structure (complexity_report), and never a substitute for a security professional on high-risk code. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.

  Connector

• secureflows_lint_integration

  secure-flows

  Checks source you already generated against the secureFlows integration rules. Needs no secureFlows token; safe at scaffolding time. Pass every auth/session-related file in one call — some checks are evaluated across the whole set. Two kinds of findings: • scope "file" — a forbidden construct is present (localStorage token, legacy /app/login, fetch-based logout, client-side JWT decode, empty catch, restore non-auth errors clearing session UI, Continue CTA gated on null session, ...), reported at an exact file:line. • scope "project" — REQUIRED handling is missing everywhere you passed in: detecting 401/410 but never clearing the token, never handling 403, or handling 403 without the BILLING_GRACE_LOCK carve-out. These are the defects that actually dominate real generated apps, and no "forbidden pattern" check can see them, because the bug is an absence. Heuristic text analysis, not a parser or a type checker. It can miss things it has no rule for, and a project check can be satisfied by the right keyword in the wrong place. It is a fast first pass — not a substitute for the Agent implementation checklist in SKILL.md, and specifically not for the checks that need a running app (auth-guard mount races, the fresh-reload check). Fix every "error" before calling an integration done; treat "needs_review" as a lead.

  Connector

• secureflows_lint_integration

  secureflows-mcp

  Checks source you already generated against the secureFlows integration rules. Needs no secureFlows token; safe at scaffolding time. Pass every auth/session-related file in one call — some checks are evaluated across the whole set. Two kinds of findings: • scope "file" — a forbidden construct is present (localStorage token, legacy /app/login, fetch-based logout, client-side JWT decode, empty catch, restore non-auth errors clearing session UI, Continue CTA gated on null session, ...), reported at an exact file:line. • scope "project" — REQUIRED handling is missing everywhere you passed in: detecting 401/410 but never clearing the token, never handling 403, or handling 403 without the BILLING_GRACE_LOCK carve-out. These are the defects that actually dominate real generated apps, and no "forbidden pattern" check can see them, because the bug is an absence. Heuristic text analysis, not a parser or a type checker. It can miss things it has no rule for, and a project check can be satisfied by the right keyword in the wrong place. It is a fast first pass — not a substitute for the Agent implementation checklist in SKILL.md, and specifically not for the checks that need a running app (auth-guard mount races, the fresh-reload check). Fix every "error" before calling an integration done; treat "needs_review" as a lead.

  Connector

• projects_get

  SUNAGO Matrix

  List projects the signed-in user can see for project management (RLS-scoped). Do not use this to choose where to log time; use timelog_get_loggable_projects for time registration. IMPORTANT - status 'Completed' does NOT always mean finished. A nightly automation moves any project past its end_date to Completed and archives it, and the manager still has to decide whether to confirm it or reactivate it with a new end date. Those projects carry awaiting_manager_decision: true, and reporting one as 'completed' is wrong: the work is unresolved, not done. Filter with awaiting_decision: true (optionally with a manager) to answer 'what is waiting for me'. DEFAULTS TO ACTIVE PROJECTS ONLY - not archived, and not Completed, Cancelled or Archived. Say so when you answer ("you have 20 active projects"), and read meta.scope_note. Pass scope: archived or all when the question spans finished work - project economics over time, what was delivered last year. One exception, handled for you: projects awaiting a manager decision ARE archived, so awaiting_decision: true widens the scope to include them rather than returning an empty list. Max limit 200 - the response always carries pagination.total (full match count) plus has_more/next_cursor. NEVER count or total projects from one page while has_more is true.

  Connector

• get_pm_playbook

  AIOProductOS MCP

  How to operate as a product manager on AIOProductOS. No arguments and no side effects — returns the same operating guide as plain text every call (deterministic): how to ground in the product brain, keep work welded to the spine (insight→feature→task→outcome), prioritise on evidence (affected accounts + MRR + reach), and what 'done' means. Call it FIRST, before planning or prioritising, to load the house rules the other tools assume.

  Connector

• shippingrates_local_charges

  ShippingRates MCP Server

  Get local charges at a port for a specific carrier — Terminal Handling Charges (THC), documentation fees (BL/DO), seal fees, and other port-specific charges. Use this when calculating total shipping costs at origin or destination. Combine with shippingrates_dd_calculate for a complete port cost picture, or use shippingrates_total_cost for an all-in-one landed cost estimate. PAID: $0.05/call via x402 (USDC on Base or Solana). Without payment, returns 402 with payment instructions. Returns: Array of { charge_type, charge_name, amount, currency, container_type, direction } for all applicable charges at the port.

  Connector

• set_attention_budget

  freedom-mcp

  Set the founder's attention budget — the maximum pending review cards before they are 'overloaded' (a whole number 1–100; default 7) — for a manager or the founder. Use when the founder (or a manager on their behalf) wants to raise or lower their overload threshold (e.g. "set my overload threshold to 10", "I can handle more pending cards before you flag me", "lower my attention budget to 5"). This is the founder's OWN constraint, so it is gated: an autonomous agent CANNOT change it (surface a recommendation instead); only a human-present company manager can. Always call get_attention_budget first and explain why a change helps the founder. [sensitive-tier — first use may require a manager's approval; a from-now-on approval makes future calls seamless, a just-once approval re-asks next time.]

  Connector

• reliefweb_get_training

  reliefweb-mcp-server

  Fetch a training listing by ReliefWeb numeric ID with the full description, registration instructions, event link, cost and fee information, dates, languages, and organizing source. Use after reliefweb_search_training, which returns summaries without the description, registration instructions, or cost detail. Reaches concluded listings as well as current ones. A record over the response budget comes back as a section outline naming every section and its byte size; re-call with sections to pull only the ones needed. Nothing is truncated on either path.

  Connector

• add_team_member

  freedom-mcp

  Add one human teammate to the current company by email. Creates a Command Center approval card (sensitive, every call). On approve: invite email + roster row. Required: email, role (job title, or team / manager). Optional: name. No bulk. No permission designer — team is the default access; pass role=manager for the manager preset. Use when the operator (or CoS) needs to add a person who is not yet on get_team_members. Routing: Add / invite a human teammate by email → this tool (approval card). For AI agents use interview_for_hire. To see who is already on the company use get_team_members. [sensitive-tier — EVERY call needs a manager's approval (per-send human rail): each request queues its own approval card and sends exactly once on approve. There is no standing grant for this tool.]

  Connector

• load_backtesting_workflow

  Shibui Finance

  Backtesting and simulation guardrails: survivorship, drawdown, Sharpe, day-of-week. REQUIRES get_database_schema then get_query_patterns to be called first (in that order). Call BEFORE writing SQL when the user asks to backtest, simulate, validate a strategy, test "what happens after X", compare forward returns, measure win rates or hit rates, compute Sharpe, drawdown, profit factor, rotation strategies, basket returns, or any hypothetical return over past data. Contains hard rules for survivorship bias, outlier handling, sampling design, day-of-week filters, and risk-adjusted metrics (Sharpe, Sortino, drawdown). Can be combined with other workflow tools.

  Connector

• decode_log

  FabTally Decode

  PAID $0.003 (x402, USDC on Base). FLAGSHIP: decode EVM event LOGS to human-readable JSON. Give {chain, tx_hash} to decode every log in a transaction, OR {chain, address, topics[], data} for a single log; optional {abi}. Returns each event's name, canonical signature and named/typed args — correctly handling tuple/array/nested params, anonymous events, and indexed vs non-indexed. Resolves the ABI via Sourcify/Blockscout + 4byte event signatures when none is supplied. Without payment returns the x402 challenge; pass x_payment to settle.

  Connector

• federation_journal_read

  ComOS Federation

  Replay your agent journal oldest→newest (CO 230-001). Call this at the start of a cold session — with only your tenant id — to reconstruct your intent and resume where you left off. Pairs with federation_journal_append. Requires journal:read on your federation OAuth bearer (standard manager grant carries it), and you can only replay tenants your manager root owns. Returns: The journal entries oldest→newest (up to limit). Example: call federation_journal_read with arguments {"tenant_id":"<tenant_id>"}.

  Connector

• get_connector_client

  Valet

  Get how a page served from a Valet site talks to the connectors attached to it. It is the pair to get_design_system: consult that tool for the artifact's identity, this one for how it talks to its connectors. Call it before writing any page code that fetches from a connector. Returns the same-origin request contract and a paste-whole session helper that handles both sessionless and stateful connectors, plus the rules a page has to follow: handling a 403, recovering a lapsed session, and never caching a response on the caller's behalf. This needs no Valet account. It answers with static guidance about how pages work — nothing here reads an organization or a site — so an agent can call it before running any OAuth flow.

  Connector

• brief_to_blueprint

  hooklayer

  Turn a brand brief that just landed into a one-page creative blueprint the manager can forward to the creator and to the brand contact — hook + template + hashtag combo + trend-velocity check + shoot instructions, in one call. Use when a brand sends a product and needs content on a tight turnaround (e.g. "product arrived, need content in 48 hours") and the manager needs a defensible direction with no research time. Chains find_viral_template + trend_pulse + score_hook + predict_virality upstream but exposes them as one MCP tool so agents don't stitch them manually. Cost 7 credits (bundle discount vs firing the chain manually). Returns a blueprint object with verdict (GO | NEEDS_MORE_DATA | NO_GO) and verdict_reason, a hook (text + trend_still_alive: up-slope | plateau | fading | unknown), script, hashtags, shoot notes, risk flags, and manager talking points, plus a quality object (level + reason) describing completeness; when quality.level is not "full", or verdict is NEEDS_MORE_DATA or NO_GO, the blueprint is a starting point rather than a shippable direction.

  Connector

• check_injection

  ContrastAPI

  Scan source code for injection vulnerabilities: SQL injection, command injection, path traversal via unsafe string concatenation/unsanitized input. Supports Python, JavaScript, TypeScript, Java, Go, Ruby, Shell, Bash. Use to detect input-handling bugs; for secrets use check_secrets. Companion code-security tools: check_secrets (hard-coded credential detection), check_dependencies (known-CVE vulnerability audit), check_headers (live HTTP security-header validation), scan_headers (live HTTP scan via domain). Free: 30/hr, Pro: 500/hr. Returns {total, by_severity, findings}. No data stored.

  Connector

• shippingrates_local_charges

  FreightGate MCP Server

  Get local charges at a port for a specific carrier — Terminal Handling Charges (THC), documentation fees (BL/DO), seal fees, and other port-specific charges. Use this when calculating total shipping costs at origin or destination. Combine with shippingrates_dd_calculate for a complete port cost picture, or use shippingrates_total_cost for an all-in-one landed cost estimate. PAID: $0.05/call via x402 (USDC on Base or Solana). Without payment, returns 402 with payment instructions. Returns: Array of { charge_type, charge_name, amount, currency, container_type, direction } for all applicable charges at the port.

  Connector

• shippingrates_local_charges

  ShippingRates MCP Server (Apify)

  Get local charges at a port for a specific carrier — Terminal Handling Charges (THC), documentation fees (BL/DO), seal fees, and other port-specific charges. Use this when calculating total shipping costs at origin or destination. Combine with shippingrates_dd_calculate for a complete port cost picture, or use shippingrates_total_cost for an all-in-one landed cost estimate. PAID: $0.05/call via x402 (USDC on Base or Solana). Without payment, returns 402 with payment instructions. Returns: Array of { charge_type, charge_name, amount, currency, container_type, direction } for all applicable charges at the port.

  Connector

• shippingrates_cfs_tariffs

  ShippingRates MCP Server (Apify)

  Get Container Freight Station (CFS) handling tariffs — charges for LCL (Less than Container Load) cargo consolidation and deconsolidation at port warehouses. Use this for LCL shipments to estimate warehouse handling costs. Returns per-unit handling rates, minimum charges, and storage fees at the specified port. Not relevant for FCL (Full Container Load) shipments. PAID: $0.05/call via x402 (USDC on Base or Solana). Without payment, returns 402 with payment instructions. Returns: Array of { facility, service_type, cargo_type, rate_per_unit, unit, minimum_charge, currency }.

  Connector

• event_meetups

  DC Member API

  GET /events/:eventID/meetups — List event meetups Returns the approved member-organized meetups for an event, sorted chronologically. Only approved meetups are returned. **Access:** any active DCer who can see the event can view approved meetup listings + attendee lists. Only RSVPing to a meetup (and the resulting chat-channel access) requires a valid ticket. **Time-zone handling:** meetups use explicit wall-clock fields (`date` = YYYY-MM-DD, `startTime` / `endTime` = HH:mm) plus the event's `timezone` (IANA). Pair them when localizing.

  Connector

• oxylabs_scrape

  Oxylabs

  Scrape any URL via the Oxylabs Web Scraper API (rotating proxies, anti-bot handling) and return the page HTML with its upstream status code. Set render_js:true to load the page in a headless browser first — use for JS-heavy sites. Calls are synchronous proxying and can take 10-30 seconds. BYOK: _apiKey is "username:password" from the Oxylabs dashboard. Example: oxylabs_scrape({ url: "https://example.com", _apiKey: "myuser:mypass" })

  Connector