"A server for file search, project analysis, and code refactoring on macOS" matching MCP tools:

• discovery_analyzeA

  DiscoA

  Run Disco on tabular data to find novel, statistically validated patterns. This is NOT another data analyst — it's a discovery pipeline that systematically searches for feature interactions, subgroup effects, and conditional relationships nobody thought to look for, then validates each on hold-out data with FDR-corrected p-values and checks novelty against academic literature. This is a long-running operation. Returns a run_id immediately. Use discovery_status to poll and discovery_get_results to fetch completed results. Use this when you need to go beyond answering questions about data and start finding things nobody thought to ask. Do NOT use this for summary statistics, visualization, or SQL queries. Public runs are free but results are published. Private runs cost credits. Call discovery_estimate first to check cost. Private report URLs require sign-in — tell the user to sign in at the dashboard with the same email address used to create the account (email code, no password needed). Call discovery_upload first to upload your file, then pass the returned file_ref here. Args: target_column: The column to analyze — what drives it, beyond what's obvious. file_ref: The file reference returned by discovery_upload. analysis_depth: Search depth (1=fast, higher=deeper). Default 1. visibility: "public" (free) or "private" (costs credits). Default "public". title: Optional title for the analysis. description: Optional description of the dataset. excluded_columns: Optional JSON array of column names to exclude from analysis. column_descriptions: Optional JSON object mapping column names to descriptions. Significantly improves pattern explanations — always provide if column names are non-obvious (e.g. {"col_7": "patient age", "feat_a": "blood pressure"}). author: Optional author name for the report. source_url: Optional source URL for the dataset. use_llms: Slower and more expensive, but you get smarter pre-processing, summary page, literature context and pattern novelty assessment. Only applies to private runs — public runs always use LLMs. Default false. api_key: Disco API key (disco_...). Optional if DISCOVERY_API_KEY env var is set.

  Connector

  Destructive

  No auth

• wait_for_otpA

  PalmyrA

  Wait for an SMS verification code / OTP to arrive on a Palmyr phone number you own, and return the parsed code. Blocks up to timeout_s (default 60, max 90) checking every ~2s — one call replaces hand-rolled polling of phone_read_messages during account signups and 2FA flows. Messages that arrived up to lookback_s seconds (default 10) BEFORE the call also match, so a code that landed early is not missed — pass lookback_s=0 when reusing a number across signups so a stale code can't be re-served. Default extraction handles standalone 4-8 digit codes, 'code is/code:' tokens, and Google-style G-XXXXXX; pass pattern to override (max 256 chars; a pattern that blows its per-match budget is dropped mid-wait and pattern_timeout: true is reported). Returns { found: true, code, message_text } on a hit or { found: false, waited_s } on timeout (not an error — just call again). Costs 0.02 USDC, paid per-action via x402.

  ConnectorNo auth

• code_searchA

  searchcodeA

  Fast code search across any public git repo. Returns file paths, line numbers, and code snippets with context. Supports regex, boolean queries, fuzzy matching, and structural filters (declarations, usages, strings, comments). Dependency/build directories excluded by default. Searching for leaked secrets? Call code_analyze instead and read security_summary — it runs a real secret and credential scanner over the whole repository, where searching for key prefixes like "sk-", "ghp_" or "AIza" only matches the spellings you happened to think of.

  ConnectorNo auth

• generate_framework_analysisA

  jeda-aiA

  Runs a specific framework against a user's inputs and produces a full analysis: prose explanation + structured fields + a self-contained SVG visualisation. Powered by the Jeda.ai · Visual AI framework knowledge graph. ALWAYS call `recommend_framework` FIRST to obtain a valid framework_id -- it returns the exact namespaced slug to pass here. Framework ids are namespaced by category (e.g. SWOT = "cms_swot-analysis", Porter's 5 Forces = "cms_porters-five-forces"); a bare slug like "swot-analysis" will 404. REQUIRED post-processing on success: the response's first text block contains a `curl -fsSL` save-directive for the SVG. Save the file locally and surface it as a file chip — do NOT summarise the visual in prose. Input: framework_id (namespaced slug from `recommend_framework`) + user_inputs object (per-framework field set), OR a free-text `raw_prompt` fallback. Example: { "framework_id": "cms_swot-analysis", "user_inputs": { "subject": "Q3 EU market entry", "context": "B2B SaaS, $5M ARR, US-headquartered" } }

  ConnectorNo auth

• validate_pythonA

  Python Code ValidatorA

  Check Python source without running it: parse, lint (ruff), type-check (mypy), AST security policy, credential scan. Safe on code you do not trust. Use it on every Python file you generated or edited, before writing it to disk. Alternatives: repair_python to get the corrected source instead of the diagnosis; execute_python to prove the code runs. Auth: a key is required. A free key covers this call, 25 per day, then HTTP 429; get one with POST /v1/keys. Credits are bought without an account, 1 per call: GET /v1/pricing says where to send the xDAI. Or pay for this one call with no key at all: call it without one and the result carries x402 payment requirements ($0.01 in USD Coin on eip155:8453); sign them and repeat the call with the payment in _meta['x402/payment']. Arguments: code: the whole file, 1..200000 bytes of UTF-8 measured after encoding (empty is refused with 400, larger with 413); a fragment is fine, but line and column numbers in the answer count from 1 in what you sent. language: must be 'python'; anything else is 400, and the field may be omitted. Of options only transpile_to (e.g. 'javascript', which returns a translated copy in transpiled) acts here; timeout_s, max_iterations, optimize, examples and expected_output need a pass that rewrites or runs the code, so send code alone. Ignored options are not refused, so a call that sets them looks like it worked; and code that does not parse is answered rather than refused: valid=false with the syntax error located, which is the point. Returns valid, score 0..1, diagnostics (rule, message, line, column), security findings, fixes, fixed_code and runtime; see outputSchema. The code and its verdict are retained to improve the service.

  ConnectorNo auth

• request_uploadA

  BankstatementlyA

  Mint a single-use upload URL for pushing a conversation-attached PDF to Bankstatemently before converting it. Use this ONLY when you have no other way to reference the attached file (no pdf_file/pdf_url equivalent for this host) — e.g. a code-execution sandbox that can see the file on disk but has no URL for it. Playbook: (1) check your sandbox's uploads/attachments directory first — if the file isn't there yet, the mount can lag behind the conversation; ask the user to re-attach or wait a moment and check again before calling this tool. (2) Call request_upload to get upload_url and upload_id. (3) PUT the raw PDF bytes to upload_url with header Content-Type: application/pdf, e.g.: `curl -X PUT "<upload_url>" -H "Content-Type: application/pdf" --data-binary @<path-to-file>`. (4) Once the PUT succeeds, call convert_statement with upload_id set to the same value — never pdf/pdf_url/pdf_file for this flow. The URL and token are single-use and expire quickly; call request_upload again for a fresh one if the PUT fails partway through — never retry a failed PUT against the same URL. If the PUT fails with a network error or a "host not allowed"-style denial, the sandbox is likely blocking outbound requests to api.bankstatemently.com — tell the user to add api.bankstatemently.com to their host's code-execution allowed-domains setting (on claude.ai: Settings → Capabilities → Code execution) and retry. To convert several statements at once, pass count (1-100) instead of calling this tool once per file: the response returns "uploads", an array of that many { upload_id, upload_url } pairs — PUT each file to its own upload_url, then make ONE convert_statement call with upload_ids set to every upload_id. Free to use — no credits consumed (conversion itself still costs credits, same as any other convert_statement call).

  ConnectorNo auth

• list_class_relationsA

  Drupal Code QueryA

  List the contrib classes that extend, implement or use a core class, interface or trait, one row per edge with file and line, paged. Example: "who subclasses FormBase". Call-site counts: list_symbol_users. The symbol's status: lookup_core_symbol. - target: with or without the leading backslash. An unknown target is refused with a pointer at lookup_core_symbol; a fragment there lists candidates. rel_kind: one of extends, implements, uses_trait. project: one machine name. - Development branches only. edge_count: every edge. project_count: projects. count: edges after the per_project cap. project_edges on each row: the project's full count. per_project=50 with project= lists one project in full. - Rows are ordered by project installs, project, source_fqn. Each row: project, branch, installs, source_fqn, rel_kind, file, line, project_edges. limit ≤ 100. next_offset is absent on the last page.

  ConnectorNo auth

• xer_parserA

  Critical Path PartnersA

  Parse a Primavera P6 XER file and return a TABLE SUMMARY (not the full row-level data — XER row dumps explode the MCP context window). For each table in the XER, returns the table name, field list, and record count. Per-row data is intentionally omitted — for forensic / DCMA / windows analysis use the dedicated tools (``forensic_windows_analysis``, ``critical_path_validator``, etc.) which consume the parsed XER internally and return analytical summaries, not raw rows. Use this tool to confirm an XER is parseable, list its tables, see the data date / project name from PROJECT, or count activities in TASK before deciding which deeper tool to run. Args: xer_path: server-side filesystem path to the XER file. xer_content: full text of the XER file (alternative for hosted/remote use). Supply EXACTLY ONE of path/content. Returns: { "filepath": absolute path, "encoding_used": "utf-8" | "cp1252" | ..., "ermhdr": file header dict (P6 version, export user, etc.), "tables": [{"name", "fields", "record_count"}, ...], "table_count": int, "total_records": int, "project_summary": { "proj_id", "proj_short_name", "proj_long_name", "data_date", "plan_end_date" } (from first PROJECT row, if any) }

  ConnectorNo auth

• secureflows_lint_integrationA

  secure-flowsA

  Checks source you already generated against the secureFlows integration rules. Needs no secureFlows token; safe at scaffolding time. Pass every auth/session-related file in one call — some checks are evaluated across the whole set. Two kinds of findings: • scope "file" — a forbidden construct is present (localStorage token, legacy /app/login, fetch-based logout, client-side JWT decode, empty catch, restore non-auth errors clearing session UI, Continue CTA gated on null session, ...), reported at an exact file:line. • scope "project" — REQUIRED handling is missing everywhere you passed in: detecting 401/410 but never clearing the token, never handling 403, or handling 403 without the BILLING_GRACE_LOCK carve-out. These are the defects that actually dominate real generated apps, and no "forbidden pattern" check can see them, because the bug is an absence. Heuristic text analysis, not a parser or a type checker. It can miss things it has no rule for, and a project check can be satisfied by the right keyword in the wrong place. It is a fast first pass — not a substitute for the Agent implementation checklist in SKILL.md, and specifically not for the checks that need a running app (auth-guard mount races, the fresh-reload check). Fix every "error" before calling an integration done; treat "needs_review" as a lead.

  ConnectorNo auth

• secureflows_lint_integrationA

  secureflows-mcpA

  Checks source you already generated against the secureFlows integration rules. Needs no secureFlows token; safe at scaffolding time. Pass every auth/session-related file in one call — some checks are evaluated across the whole set. Two kinds of findings: • scope "file" — a forbidden construct is present (localStorage token, legacy /app/login, fetch-based logout, client-side JWT decode, empty catch, restore non-auth errors clearing session UI, Continue CTA gated on null session, ...), reported at an exact file:line. • scope "project" — REQUIRED handling is missing everywhere you passed in: detecting 401/410 but never clearing the token, never handling 403, or handling 403 without the BILLING_GRACE_LOCK carve-out. These are the defects that actually dominate real generated apps, and no "forbidden pattern" check can see them, because the bug is an absence. Heuristic text analysis, not a parser or a type checker. It can miss things it has no rule for, and a project check can be satisfied by the right keyword in the wrong place. It is a fast first pass — not a substitute for the Agent implementation checklist in SKILL.md, and specifically not for the checks that need a running app (auth-guard mount races, the fresh-reload check). Fix every "error" before calling an integration done; treat "needs_review" as a lead.

  ConnectorNo auth

• searchA

  GUTHMANN® Berlin Real EstateA

  Semantic search over guthmann.estate — market insights, reports, neighborhood portraits, listing exposés, project pages and the company's own pages. Hybrid retrieval (vector + keyword, no reranking); one result per page with title, description, image, best-matching snippet and score. Use it for questions that need prose (analysis, context, advice); use the data tools for exact numbers and `listings` for what is currently for sale — the search index follows the website with up to six hours of delay. Parameters: - q: natural-language query, in the language of the pages you want (min 2 characters) - locale: "de" | "en" — language of the indexed pages (default: en) - section: comma-separated filter — "listings" (exposés), "projects" (new-build projects), "market-intelligence" (insights, reports, portraits), "pages" (company, services, guides); omit for all - limit: 1-20 pages (default: 10) Key response fields: - url, title, description, image, section, language - snippet (best-matching text passage), score (0-1)

  ConnectorNo auth

• update_projectA

  3DLogo.ioA

  Use when the user wants an existing project changed without opening the studio: its title, whether it is public (a public project has a share page and, for meshes, a public GLB URL), and on logo and coin projects the style: material, lighting room, background, motion, depth, font, the wordmark on text projects; on coins also the look, coin and mark colours, and the blank edge. Only the fields given change. Making a project public needs a saved render. Style changes render the next time the project is opened and saved. Do not use for a share link that keeps the project private (create_share_link) or to make something new (create_text_logo_project, duplicate_project).

  ConnectorOAuth

• lookup_provider_taxonomyA

  mcpB

  Look up a NUCC provider taxonomy code (the specialty codes used on HIPAA transactions + NPI registrations) or search by keyword. Returns classification + type + optional specialization. Source: NUCC Health Care Provider Taxonomy Code Set (public; CMS-accepted). WHEN TO USE: Resolving a NUCC provider taxonomy code to its specialty description. WHEN NOT: For finding a provider by specialty in a region (not yet implemented).

  ConnectorNo auth

• datailo_connect_verifyA

  Datailo: one MCP connection to tenders, EU regulation and lawA

  Finish signing in. Call it RIGHT AFTER datailo_connect with the request_id and no code: it waits up to 45 s for the user to click Confirm in the email and returns as soon as they do (call again if it returns waiting — do not ask the user to report the click). If the user reads you the six-digit code, pass it as code. On success a durable dat_ key is issued (shown once) and, for clients without a connection session, a `session` value to pass on every later call; then carry on with what the user asked for.

  ConnectorNo auth

• start_card_issuer_linkA

  Laso FinanceA

  Send the account holder a code to link the card issuer Starts the one-time card issuer link: the card issuer sends a one-time code to the account holder. Then call `POST /verify-card-issuer-link` with the code they enter. **The account holder, never the agent, receives and enters the code.** Send your human to their own inbox (or phone) and have them type the code into your interface. Never try to read the account holder's email or messages yourself, and never ask for their email password or access. **Where the code goes.** An account with an email on file always gets the code at that email; `email` and `phone` are ignored for it. An account with no email (a wallet-only sign-in) must send exactly one of `email` or `phone` (E.164). The response names the destination masked, never in full. **Limits.** Codes last 10 minutes. At most 5 codes can be sent per account in any rolling hour (`429`, with `Retry-After`). Sending a new code replaces the previous one, which then stops working. **Prerequisite:** Laso identity verification (`403 kyc_required` otherwise, with a `kyc_url`). If the account is already linked, this answers `200` with `status: linked` and sends nothing, so calling it twice is safe. **This route is free.**

  ConnectorOAuth

• get_indicatorA

  Ine PtA

  Fetch data values for an INE (Statistics Portugal) indicator. Pass the indicator code (varcd) and optionally a `dims` object mapping dimension slots ("Dim1","Dim2",...) to dimension-value codes to select a slice (codes come from indicator_meta). Omit a Dim slot to return all of its values. Requires varcd — INE has no keyword/search endpoint, so look the code up on https://www.ine.pt first.

  ConnectorNo auth

• network_listenersA

  ReMCPB

  Use this when the user asks to inspect listening ports on a paired computer to diagnose local services, unexpected exposure or port conflicts. Reads the OS TCP listener inventory on Windows and macOS, and TCP/UDP listeners on Linux; process details depend on OS permissions. It does not connect to ports, scan remote hosts or change firewall rules.

  ConnectorOAuth

• add_antigravity_submitA

  openFlowB

  Finish connecting a Google Antigravity account started with add_antigravity_start. `code` is the value of `?code=...` on the antigravity.google/oauth-callback page the user landed on; `state` is what add_antigravity_start returned. Returns {status, account_id, account_email, requires_project}. By default this also creates the GCP project in one step (`complete=True`) and adds `project_id`. Pass `complete=False` to defer and call `complete_antigravity_account(account_id)` later. If auto-onboarding fails the result keeps `requires_project: true` and carries `onboard_error`; retry with `complete_antigravity_account(account_id)`. Errors: "unknown state" (start again) or "google_api_error" (the code was rejected or already used; start again).

  ConnectorNo auth

• taskhold_createA

  TaskholdA

  File work for later: a bug, a refactor, a follow-up you aren't doing now (it lands in To Do). To file and start work at once, use taskhold_begin. Pass parent_task_id to add one step to an existing task (taskhold_plan for several). Returns the new id, status (todo) and priority. Fails if parent_task_id isn't found or is itself a step (steps don't nest), if project_id doesn't exist (pass project by name instead), or at the account's task ceiling.

  ConnectorNo auth

• delete_projectA

  NovenceA

  IRREVERSIBLE. Permanently delete a hosting project: the live site, preview URLs, and custom domain stop serving (HTTP 410), every deployed and staged file is erased, forms stop accepting submissions, site MCP and owner-edit go away, and project-scoped API keys and pending invites are revoked. There is no undo and no restore. Owner only. Only call this when the human has explicitly asked to delete this specific project; never to clean up after a failed deploy or to start over (redeploy instead). confirm must equal the project's exact name or suffix — get it from get_project and read it back to the human first. Calling again on a deleted project returns alreadyDeleted=true.

  Connector

  Destructive

  No auth

• validate_projectA

  PtallyA

  Server-side schema validation of a project config. Returns { valid: true/false, errors: [...] } with the JSON path, keyword, and message for each issue. Prefer local validation against get_schema during authoring; use this as a ground-truth check, including on an amended model before handing it back to the user as a file. Pass exactly one of inline `project` or a base64-gzipped `project_gz` (if the inline form is too large for your client); passing neither or both returns an error result.

  ConnectorNo auth