"A server for finding aeronautical information and resources" matching MCP tools:

• feed_sources

  data-breach-detector

  List the public disclosure feeds this server aggregates, how many disclosures are cached per source, each source's newest item and an honest staleness flag, plus cache ages. Takes no arguments. Also states the scope plainly: public feeds only — no .onion access, no arbitrary fetching or crawling, no credential or PII output. Check this first if another tool's answer looks thin: a stale live feed is a finding, not background noise.

  Connector

• fetch

  OneQAZ Trading Intelligence

  Purpose: ChatGPT-connector-standard document fetch by id from `search` results. Namespaces: `tool:{name}` returns the tool's full documentation and how to call it; `resource:{uri}` returns the resource's live data (core resources resolved server-side — also the bridge for clients without MCP resource support, e.g. Gemini); `signal:{market}:{symbol}` returns the symbol's latest combined research signal. Triggers: ChatGPT connectors / Deep Research call this after `search`. Clients without MCP resource support can call it directly with a known resource id, e.g. fetch("resource:market://global/summary"). When to call: whenever the full content behind a search result id is needed. Prerequisites: a valid id — from `search` results or a known namespace id. Next steps: for tool docs, call the named tool via tools/call; for signals, get_signal_detail / explain_decision for deeper evidence. Caveats: uncovered resource uris return description-only text (no fabricated data). `text` is a JSON document for resource/signal ids. Output: {id, title, text, url, metadata, disclaimer, is_investment_advice, data_classification} — flat envelope, OpenAI fixed shape. Args: id: document id — "tool:{name}", "resource:{uri}", or "signal:{market}:{symbol}" (market: crypto / kr_stock / us_stock) Disclaimer: Information only, not investment advice.

  Connector

• search

  OneQAZ Trading Intelligence

  Purpose: ChatGPT-connector-standard discovery search over OneQAZ's live surface — tools, resources, and the latest strong combined signals across crypto / kr_stock / us_stock. Returns result ids consumable by the `fetch` tool. Triggers: ChatGPT connectors and Deep Research call this automatically for any user query routed to OneQAZ ("bitcoin signal", "prediction accuracy", "korean stocks today", ...). Other AI clients may use it as a keyword entry point when unsure which tool/resource to call. When to call: first step of connector-style discovery. MCP-native clients can instead browse tools/list + resources/list directly. Prerequisites: none. Next steps: pass any result id to `fetch` for the full document. Caveats: corpus is rebuilt at most every 10 minutes (tool/resource catalog + top-20 strong signals per market). Empty results list means no match. Output: {results: [{id, title, url}], disclaimer, is_investment_advice, data_classification} — flat envelope, OpenAI fixed shape. Args: query: free-text search string (English/Korean, symbols like BTC/AAPL) Disclaimer: Information only, not investment advice.

  Connector

• well_get_entity

  Well

  Read ONE entity with its sub-resources nested in a single call. Convenience over well_get_schema + well_query_records: resolves the field paths for you and returns the single record with its related data expanded. depth (relation-nesting BOUNDARY, 1-3, default 1): 1 = the entity + its direct sub-resources (emails, phones, locations, …) 2 = + the sub-resources' related scalars 3 = the full level-3 graph (LARGER payload — use when you need the whole picture) Stops at depth 3. Aggregates are excluded. Each child collection is capped at 50 rows; for a full list or to page a large child collection, use well_query_records on that child root instead.

  Connector

• cti_get_cross_server_routes

  website-search

  Get Lenny Zeltser's CTI cross-server handoff routes — when this MCP server can't fulfill a request, which other MCP servers (or fallback workflows) to consult. Surfaces a compact subset of `cti_load_context`. This server never requests your campaign or threat-intel notes and instructs your AI to keep them local—templates and guidelines flow to your AI for local analysis.

  Connector

• get_tier1_recommendations

  Tier1 IT Assessment

  Maps only stable Tier1 finding identifiers to approved Tier1 services and public resources. Call after a Tier1 score or email-domain check. Do not submit prose, URLs, customer information, or invented identifiers. This tool performs no arbitrary fetching, makes no contact request, changes nothing, and stores nothing.

  Connector

• get_resource_schema

  Control Plane

  Return the exact object schema and REST API endpoints for a Control Plane resource kind, so you can author an accurate manifest for `cpln apply` or call the API directly. ALWAYS call this FIRST whenever you are about to write a cpln apply YAML/JSON file, set up CI/CD that applies Control Plane resources, or build a request body for the REST API — do not hand-write a manifest or guess field names from memory. Pick a `kind` and pass `org` (and `gvc` for workload/identity/volumeset). Large schemas come back as a shallow map with deep sections collapsed to {"_expand":"<path>"} stubs; pass `path` (e.g. "spec.containers") to expand a section on demand. Server-managed fields (id/status/version/etc.) are already removed; `name` and `kind` are required at create.

  Connector

• get_corpus_coverage

  SRI — MCP Server Inspector

  No arguments. Returns how many MCP servers have been read at source level, and the share of them with each category of finding (credential access, network egress, install-time execution, prompt-injection surface). Use this to judge whether checking a specific server is worth it before you look one up. It reports aggregate counts only - no per-server findings, and no verdict about any individual server.

  Connector

• scenario.get

  Cloud World Model

  Hydrate one built-in scenario from the live Cloud World Model scenario library. Prerequisite: a scenario id returned by scenario.list. Returns the complete selected scenario graph, including resources and connections plus optional seed, resilienceConfig, protectedResilienceConfig, traffic/failure presets, and real-world incident metadata. The response includes both title and name for compatibility; pass resources and connections, and optionally seed/resilienceConfig, to simulation.create when you need to edit or inspect the graph. For the shorter handoff, pass the id as scenarioId instead. The likely next tool is simulation.create.

  Connector

• get_hiring_signal

  bitcoin-signals

  Hiring velocity across tracked Bitcoin and crypto-infrastructure employers, counted from their live ATS boards. Returns { as_of, companies[], note, why, disclaimer }; each company carries company, ticker, category, ats, careers_url, open_roles, open_roles_30d_ago, open_roles_90d_ago and the derived delta_30d, delta_90d and pct_30d. Example: {"company": "coinbase"} for one employer, or {} for every employer tracked. When a company filter matches no tracked employer the response adds coverage_note and tracked_count, saying that the name is outside the tracked set — a limit of coverage, not a finding about whether that company is hiring. Information, not financial advice.

  Connector

• web_search_exa

  exa

  Search the web for any topic and get clean, ready-to-use content. Best for: Finding current information, news, facts, people, companies, or answering questions about any topic. Returns: Clean text content from top search results. Query tips: describe the ideal page, not keywords. "blog post comparing React and Vue performance" not "React vs Vue". Use category:people / category:company to search through Linkedin profiles / companies respectively. If highlights are insufficient, follow up with web_fetch_exa on the best URLs.

  Connector

• remediate_findings

  quantakrypto pqc-tools (hosted)

  Produce a deterministic remediation REQUEST bundle (rubric + fix schema + per-finding metadata + fingerprints) for YOU (the host agent) to fix. This tool calls no model and needs no key. For each finding, propose the corrected FULL file content, then VERIFY with verify_fix and keep only fixes that clear the finding. Never touch files with secrets; never auto-merge. Pass 'findings' from scan_path --format json.

  Connector

• get_hiring_signal

  CoinBucha

  Hiring velocity across tracked Bitcoin and crypto-infrastructure employers, counted from their live ATS boards. Returns { as_of, companies[], note, why, disclaimer }; each company carries company, ticker, category, ats, careers_url, open_roles, open_roles_30d_ago, open_roles_90d_ago and the derived delta_30d, delta_90d and pct_30d. Example: {"company": "coinbase"} for one employer, or {} for every employer tracked. When a company filter matches no tracked employer the response adds coverage_note and tracked_count, saying that the name is outside the tracked set — a limit of coverage, not a finding about whether that company is hiring. Information, not financial advice.

  Connector

• vuln_get_template

  website-search

  Get Lenny Zeltser's one-page Vulnerability Advisory Brief template. Covers Bottom Line, Quick Facts, Are We Affected?, Defensive Actions (with What/Why/When/Who), What We Don't Know, and More Information. This server never requests your vulnerability notes and instructs your AI to keep them local—the brief template and guidelines flow to your AI for local analysis.

  Connector

• get_categories

  Radix Wiki

  Get the wiki tag hierarchy with page counts per category. Useful for understanding what content exists, and for finding a valid tagPath before writing.

  Connector

• web_snapshot

  Robot Actions — Remote Device Control

  Accessibility tree of the DESKTOP grid browser page (by pageId), as text — for finding elements and understanding layout. Not a device: the equivalent for a phone or tablet is webpage_snapshot (by udid).

  Connector

• export_terraform

  Control Plane

  Generate Terraform (HCL) for EXISTING Control Plane resources from a self link. Single resource (`/org/acme/gvc/prod/workload/api`) or bulk by path depth — `/org/acme` exports the whole org, `/org/acme/gvc/prod/workload` exports every workload in a GVC. Set `generateImports` to get ready-to-run `terraform import` commands for adopting the resources into Terraform state, and `includeDependencies` to pull in referenced resources. Secrets are never exported — a ref that targets secrets is refused, and an export that would pull secrets in is refused wholesale. An unsupported kind is rejected with the supported list (list_terraform_kinds, full profile, enumerates them up front). For an in-memory manifest, use convert_to_terraform. Recommended reading: get_cpln_skill("iac-terraform-pulumi").

  Connector

• get_shop_services

  Timeplex K-Beauty Booking

  Get the available services, prices, durations, and bookable staff or resources for a specific Korean beauty or wellness shop. Use this after finding a shop when service details, prices, durations, staff, or resources are needed before checking appointment availability. Pass lang to receive the content translated into the customer's language.

  Connector

• list_resources

  floot

  List the env vars a project's code can use and the resources behind them: (1) resources CONNECTED to the project — usable as process.env.<NAME> in endpoint code now; (2) the owner's other account-level credentials — reusable, but not usable in code until connected; (3) everything Floot can add. Call it to learn what env vars exist before writing backend code, and BEFORE provisioning or requesting any credential (the owner may already have the one you need). Pass query (case-insensitive substring over names, descriptions, types, and env var names) to filter when the account has many resources. Read-only. Details: get_guides('resources').

  Connector

• http_security

  Dechonet-MCP

  Follow a URL's HTTP redirect chain and audit response security headers (CSP, HSTS, X-Frame-Options, COOP, CORP, COEP, Permissions-Policy), grading A+ to F and flagging information leaks such as server-version disclosure. Use this for HTTP-layer/header posture. Use ssl_check instead for certificate or TLS-handshake issues, or security_scan for a full domain report. Read-only (an HTTP GET-style probe that sends no payload); requires no API key; rate-limited. Returns a text report: grade, header findings, redirect trace, issues, and actions.

  Connector