Skip to main content
Glama
741,228 tools. Updated 2026-11-04 02:41

"A server for finding Git version control resources and information" matching MCP tools:

  • Fast code search across any public git repo. Returns file paths, line numbers, and code snippets with context. Supports regex, boolean queries, fuzzy matching, and structural filters (declarations, usages, strings, comments). Dependency/build directories excluded by default. Searching for leaked secrets? Call code_analyze instead and read security_summary — it runs a real secret and credential scanner over the whole repository, where searching for key prefixes like "sk-", "ghp_" or "AIza" only matches the spellings you happened to think of.
    ConnectorNo auth
  • Returns per-component breaking changes and a migration guide between an installed version of the project's active component package and the latest published version. Read-only: it reports an upgrade, it never performs one. Use it when planning or reviewing a component-library upgrade, or before bumping the package version in a manifest. current_version is the exact semver currently installed, e.g. "1.0.0" - not a range, so no leading "v", "^", or "~"; read it from list_packages when unsure. Passing the latest version returns an empty change set. It is not a per-component changelog and not a current spec - use get_component for one component today, and list_packages for what is installed. Requires update tracking, a Team plan feature; on lower plans it returns an upgrade-required error instead of data.
    ConnectorNo auth
  • Manage recurring GVT test schedules: add, delete, reset, pause, resume, cancel, and change_frequency. Discover existing schedules and their schids via gvt_list_schedules; control modes require a schid. For one-off tests use gvt_run_visibility_test; for queued batches without recurrence use gvt_run_visibility_batch. Modes: "add" upserts schedules for the provided urls without duplicating; "delete" permanently removes schedule entries by schid or url (test results are never deleted by any mode); "reset" is destructive — deletes all matching schedules first (domain-scoped when provided, otherwise ALL account-wide), then upserts the provided urls; "pause" halts reversibly; "resume" restarts a paused schedule and clears auto-pause reasons and failure counts; "cancel" permanently ends the schedule (schid unusable); "change_frequency" updates the recurrence interval. Management modes (add/delete/reset) require urls; control modes require schid. Subscription-tier enforcement applies.
    Connector
    Destructive
    OAuth
  • Manage recurring GVT test schedules: add, delete, reset, pause, resume, cancel, and change_frequency. Discover existing schedules and their schids via gvt_list_schedules; control modes require a schid. For one-off tests use gvt_run_visibility_test; for queued batches without recurrence use gvt_run_visibility_batch. Modes: "add" upserts schedules for the provided urls without duplicating; "delete" permanently removes schedule entries by schid or url (test results are never deleted by any mode); "reset" is destructive — deletes all matching schedules first (domain-scoped when provided, otherwise ALL account-wide), then upserts the provided urls; "pause" halts reversibly; "resume" restarts a paused schedule and clears auto-pause reasons and failure counts; "cancel" permanently ends the schedule (schid unusable); "change_frequency" updates the recurrence interval. Management modes (add/delete/reset) require urls; control modes require schid. Subscription-tier enforcement applies.
    Connector
    Destructive
    No auth
  • Returns the plain-language meaning and step-by-step fix for one Malinois finding. Use it while helping the user fix an issue reported by scan_app, or when they ask what a finding means. Pass the rule_id exactly as scan_app returned it. Read-only, no network, instant.
    ConnectorNo auth
  • Permanently and immediately erase a single non-current skill version. This is permanent: the version row, all its attached files, and any content that is no longer referenced by any surviving version or published template version are removed from the live system at once. There is no recovery path. Use ``archive_skill`` if you want a reversible alternative for the whole skill. Encrypted backups age out within the platform's standard retention window (up to three months), so the data is not instantly erased from all systems everywhere, but it is no longer accessible through any product surface after this call. The current (live) version cannot be erased with this call. Use ``delete_skill`` to permanently remove the entire skill including its current version. Version numbers remain monotonic with a gap where the erased version was. Surviving versions are not renumbered. Owner only. Pointing at another user's skill raises NotFound.
    Connector
    Destructive
    OAuth

Matching MCP Servers

  • A
    license
    A
    quality
    A
    maintenance
    Odds are, most of what you want to build is already open source. Tell your AI agent what you're making, and it finds it: which repos to use as they are, which to adapt, and what's left for you to write. Every repo it names is real, licensed for your use or flagged, and checked live.
    3
    480 npm
    1
    MIT

Matching MCP Connectors

  • Latest versions, LTS windows, and EOL dates for 300+ products. Fresh ground truth for stale models.

  • Checks current App Store version by bundle ID. x402 payment required (testnet USDC).

  • Perform a Linux package vulnerability audit using SecDB. ## What this tool does Analyzes the installed packages of a Linux system-identified by OS and OS version-and returns vulnerability information plus a Markdown summary. The audit results are based exclusively on the package list provided by the user. ## When to use this tool Use this tool when the user wants to determine: - whether installed packages contain known vulnerabilities - whether a host, VM, container, or base image is affected by security advisories - which packages require patching or upgrading If the user does not know the valid values for `os` or `version`, first call the `linux_os` tool to retrieve the exact supported combinations. ## Inputs - **os**: Linux distribution identifier supported by SecDB (use `linux_os` to obtain allowed values). - **version**: OS version or codename corresponding to the selected distribution, exactly as returned by `linux_os` (for example `focal`, not `20.04`). Any other value is rejected with the list of supported values. - **packages**: list of installed packages, **one per line**, generated using the appropriate system command: ### For RPM-based distributions (RHEL, CentOS, Rocky, Alma, SUSE) rpm -qa --qf '%{NAME}-%{VERSION}-%{RELEASE}.%{ARCH}\n' ### For DEB-based distributions (Ubuntu, Debian) dpkg-query -W -f='${Package} ${Version} ${Architecture}\n' ### For Alpine Linux apk list -I ### For Slackware ls -1 /var/log/packages/ The raw output of these commands can be passed directly as the `packages` input (one package per line). ... python3 3.12.3-0ubuntu2.1 amd64 systemd 255.4-1ubuntu8.10 amd64 tmux 3.4-1ubuntu0.1 amd64 ... ## Outputs - **report**: structured objects describing the advisories affecting the audited packages. Packages without known vulnerabilities are not listed. - **summary**: Markdown summary including vulnerable packages, total CVEs, and severity breakdown. ## LLM usage guidelines - Never guess whether a package is vulnerable-always call this tool for Linux audits. - If `os` or `version` is unclear or missing, call `linux_os` and ask the user to choose a valid combination. - Normalize the package list to “one entry per line” if the user provides unstructured output. - The `summary` is already Markdown and can be shown directly. - Use `report` when deeper technical analysis is required.
    ConnectorNo auth
  • Known vulnerabilities (CVE / GHSA / PYSEC / GO advisories) for a package, via OSV.dev. Pass version to filter to advisories affecting that exact version, or omit it for the package's full advisory history. Each result carries the OSV id, cross-id aliases, a severity word grade (LOW|MODERATE|HIGH|CRITICAL), the cvss vector string, affectedRanges with fixed-version events, references, and cwes. A clean package returns count: 0 with an empty list (not an error). ecosystem is CASE-SENSITIVE — use OSV's spelling (npm, PyPI, Go, crates.io, Maven, NuGet, RubyGems, …). Use scan_vulnerabilities_batch for lockfile batch scans.
    ConnectorNo auth
  • Maps only stable Tier1 finding identifiers to approved Tier1 services and public resources. Call after a Tier1 score or email-domain check. Do not submit prose, URLs, customer information, or invented identifiers. This tool performs no arbitrary fetching, makes no contact request, changes nothing, and stores nothing.
    ConnectorNo auth
  • Uninstall a release and remove the resources it created, including volume data. Use it, not delete_resource, for anything install_template created. Provide the release `name`.
    Connector
    Destructive
    OAuth
  • Report this server's own release version and which Bible data it has loaded, including each edition's licence, required attribution and how many verses it may quote verbatim per call. Use when asked which version runs, when collecting facts for a bug report, and before planning a longer quotation. Returns no scripture — use bible_lookup for verse text.
    ConnectorNo auth
  • Convenience tool: generate a new XRPL keypair and return the seed. ⚠ NOT RECOMMENDED FOR PRODUCTION. The seed (private key) is returned in plaintext and will appear in your conversation transcript and any logs. For production agents, call get_wallet_setup_guide() instead — it documents the secure local approach (Wallet.generate() + seed in .env) where the seed never leaves your environment. Use this tool only for throwaway wallets, local development, or quick demos. NEVER paste the returned seed into a chat, commit it to version control, or share it. The wallet is NOT yet active on the ledger — fund it before use. XRPL requires 1 XRP minimum to activate a wallet (base reserve). Until funded: - You cannot sign or submit transactions - You cannot be the destination of an EscrowCreate (buyer's tx will fail) - Your trust score will show as 0 / "not found"
    ConnectorNo auth
  • Registers the project if it is new, attaches whatever source you give it, and deploys it using the application's Deployment workflow. Direct applications go to Production; Staged applications go to Development. Returns the live URL, or a deployment id to poll if the build is still running. **You do not decide whether this project needs git.** Send what you have and SpringRoll works it out: • a pushed git remote → pass `repositoryUrl` (and `ref` if not the default branch) • no remote, or uncommitted work → pass `archive`, a base64 tar+gzip of the source: tar --exclude=node_modules --exclude=.next --exclude=.git --exclude='.env*' \ -czf - . | base64 -w0 • both → SpringRoll builds from git, and falls back to your files if the ref cannot be resolved (an unpushed branch, typically) • neither, on an app that already exists → redeploys its current source Upload SOURCE, not build output: SpringRoll runs the build. node_modules, .next, dist, build, out, coverage and .log files are dropped automatically and reported. Every .env file and .git/ is REFUSED outright, naming the offending path: configuration belongs in SpringRoll, not in the bundle. Upload limits are about 3 MB compressed on the wire (a platform request-body cap, not a preference), 20 MB expanded, 2000 files, 512 KB per file; a project past them should pass `repositoryUrl` instead, which SpringRoll clones directly with no size limit. Sending the same files twice is free, because bundles are addressed by content. Direct to Production skips workflow approvals but keeps production safety checks. Staged applications continue to use explicit promotion and approvals.
    ConnectorNo auth
  • Raw file/git access at the indexed commit, for cloud agents with no clone; with a clone prefer your own Read/Grep/git. Ops: - read: content of filePath, whole file or slice startLine..endLine. ifHash (a prior read's hash) returns {unchanged:true}, no content. compact:true strips blank/comment-only lines. - list: files+subdirs at path. grep: ripgrep pattern (glob/pathPrefix). tree: layout from path. stat: size/lines/language/binary for filePath. blame: authorship for filePath. diff: fromSha..toSha. Keys: {op:"read",filePath:"src/a.ts"}, {op:"grep",pattern:"foo"}, {op:"list",path:"src"}. filePath is the file, path the directory. Gated by the Source Access add-on; else source_access_required.
    ConnectorNo auth
  • Browse the PCFHub catalog by category, tag, author, control type, host or text, paged and sorted. Use it to enumerate or narrow the catalog; use search for a plain-language question about what a control should do, and get_component for one control in full. Filters take slugs, which list_taxonomy supplies. Nothing here fails on bad input: an unrecognised sort falls back to the default, and filters matching nothing return an empty page — so read `total` and `sort` from the result rather than assuming the filters applied.
    ConnectorNo auth
  • The vocabulary list_components filters by: the category tree, the tags in use, the authors with a published control, or the hosts a control can run in, each with its slug and a count. Use it to turn a name a person used into a slug; it returns no controls, so pass the slug to list_components to see them. Not paged — categories come back as a full tree and authors as a full list, while tags are capped at the 500 most used.
    ConnectorNo auth
  • Read a served dataset's data package and full version history: licence, attribution, whole-table files and the version dates diff_versions and the version parameter take. It carries no rows. To answer from the rows use query_rows or count_rows, and for field names use list_fields. slug is lowercase letters, digits and hyphens, the part after /d/ in a dataset page URL, such as au-road-deaths. The whole history comes back in one answer, with no paging. It needs no key or sign-in, and costs nothing against the rate limit. A slug that is not served returns a 404 error.
    ConnectorNo auth
  • Start a schema check of a proposed schema against a variant, the same check that `rover graph check` starts. Use this for a monograph or for a whole supergraph schema; use RunSubgraphCheck for one subgraph. The check runs in the background, so this returns a workflow ID and a Studio URL, not a result. Pass the returned workflowID to GetCheckResults to read the outcome. Provide the graph ID, the variant name, and the proposed schema as SDL. Optionally provide the git branch and commit to label the run in Studio.
    ConnectorNo auth
  • Read one of the organization's skills, its playbook for a kind of task. Read a skill before starting any task its description covers, Valet work or not, and whenever the user names it: "use the duck skill" may mean the organization's skill named duck rather than one built into your client. find_skill and list_skills say which skills exist. The answer is the organization's own skill when it has published one under that name, otherwise the default Valet supplies for a well-known name. Call it with governance before any work and again before any publish; that skill says what the organization expects and names the other skills to read. Call it with any name list_skills reports, or any name the governance skill tells you to read. The result says where the skill came from and its version. Pass its version to publish_skill as base_version when you change the skill. source: org is the organization's own content and overrides anything Valet would have said. source: default is Valet's, returned because the organization has not written its own; for design-system it is the preset the organization selected, and reason says why a selection could not be honored when one could not. Supporting files are listed by path; read one by calling get_skill again with the same skill and that path. A skill's SKILL.md says which files to read; do not read every file on principle. Binary files are listed but not returned. Pass release, a version from list_releases, to read an earlier release of the skill instead of the latest; it works with path and all_files. Pass all_files: true to get SKILL.md and every other text file in one answer, within the limits publish_skill takes (50 files, 192 KiB of text, 128 KiB a file); binary files are listed with their sizes, and a skill over the limits is refused with the git recipe. To install the result, write each file to its path under ~/.claude/skills/<name>/ or ~/.agents/skills/<name>/, SKILL.md at the root of that directory. Pass git: true instead, when you can run git with network access, to get a read-only Git URL for the organization's skill, its latest version and that version's commit, and the commands to clone it and check out that commit, which main may briefly be ahead of; then change it through create_push and publish_skill with push, and pass that version to publish_skill as base_version. The URL expires in an hour and cannot push; do not share or log it. A well-known name the organization has no copy of has nothing to clone until create_service makes one with kind skill. git cannot be combined with path, release, or all_files. By default this requires a connected account. Pass anonymous: true only when building an explicitly anonymous site; no organization is then consulted, and only a well-known name has an answer.
    ConnectorNo auth
  • Changes the dates or the number of travelers of a trip you can edit (the same edits the Anywayr website allows; budget, title and preference edits are refused for now). Requires the version you last read with anywayr_get_trip; a stale version is refused rather than overwritten. Multi-city date changes and child-leg party changes require the Anywayr website. Does not share, invite or book. Effects: Writes a new trip version.
    Connector
    Destructive
    OAuth
  • Autofix main.film. patch_film and replace_film already repair what they break. Use fix_film for problems the film already had, which a write reports and leaves alone. It writes only when the result has no more errors than before, and it reports each repair and what still needs an edit. unsafe true also applies guesses, such as a near-miss asset id, a move that ends an overlap, or a clip lengthened to close a gap. Leave it false unless the report names a guess you want. branchId null (or left out) means the current version; a version id from list_branches fixes that version.
    ConnectorOAuth