"A server for finding information about Puppeteer (headless browser automation tool)" matching MCP tools:

• score_deviceA

  LayerCallA

  Judge a browser fingerprint from /fp.js: headless detection, automation frameworks (Selenium, Puppeteer, Playwright), timezone-versus-IP mismatch and repeat-device history. Note the ceiling honestly — the declared signals it relies on are the first thing stealth tooling patches, so a clean result is weaker evidence than a dirty one.

  ConnectorNo auth

• emit_chaingraph_artifactA

  AINumbers Fintech Intelligence SuiteC

  Makes ChainGraph tools agent-callable (ChainGraph Standard v0.1 §3.1). Mode 1 — supply pre_computed_artifact (exported from the browser tool): validates §4 schema fields, recomputes execution_hash via SHA-256 over canonical {policy_parameters, output_payload}, returns verified structuredContent. Mode 2 — supply tool_id + policy_parameters: returns an artifact template envelope and browser prefill URL so an agent can hand the user a pre-filled link; GPU sims always delegate to the browser per §9.2. Mode 3 — supply tool_id only: returns node metadata and artifact schema scaffold. Mode 4 (Compute Binding, v0.4) — supply tool_id + policy_parameters + compute:"server" (or compute:"auto" for gpu:false nodes): runs the registered kernel server-side and returns a verified v0.4 artifact with execution_hash + output_payload in one round-trip. No browser required. gpu:true nodes always delegate to browser. Hashed input must be I-JSON (RFC 7493): integers beyond 2^53 must be passed as JSON strings, and NaN/Infinity are rejected — values outside I-JSON have no stable canonical form, so a structured -32602 error (error.data.reason "ijson_violation") is returned instead of an execution_hash. readOnlyHint: true. Zero PII, zero payload logging. Pair with verify_execution_hash (independent hash verification) and build_chaingraph (DAG wiring).

  ConnectorNo auth

• check_endpointA

  cerberus-indexA

  Endpoint & tool trust — one call before an agent connects to a third-party MCP server or HTTP tool. Pass the endpoint `url` (and, to unlock the strongest check, its `tools`: the name/description/inputSchema the agent is about to trust). Returns three signals behind one verdict: (1) transport & TLS identity — encrypted, valid chain, not expired or self-signed; (2) domain age via RDAP — freshly-registered hosts are a scam tell; (3) a TOOL-POISONING scan of the tool definitions for the hidden directives that hijack agents — instruction overrides, 'don't tell the user', data exfiltration, secret harvesting, tool-shadowing, and invisible-unicode / homoglyph steganography that a human reviewer can't see. Nobody else screens tool descriptions for injection. Verdict: trusted | caution | untrusted | unknown, with per-finding evidence. Price: $0.008 USDC. Missing something? Call `submit_feedback` (free) to request it. Pass `attest=true` to also get an Ed25519-SIGNED attestation of this verdict — portable proof you can log, hand to a counterparty, or verify later with `verify_attestation` (free) or the published key.

  ConnectorNo auth

• get_tier1_recommendationsA

  Tier1 IT AssessmentA

  Maps only stable Tier1 finding identifiers to approved Tier1 services and public resources. Call after a Tier1 score or email-domain check. Do not submit prose, URLs, customer information, or invented identifiers. This tool performs no arbitrary fetching, makes no contact request, changes nothing, and stores nothing.

  ConnectorNo auth

• get_corpus_coverageA

  SRI — MCP Server InspectorA

  No arguments. Returns how many MCP servers have been read at source level, and the share of them with each category of finding (credential access, network egress, install-time execution, prompt-injection surface). Use this to judge whether checking a specific server is worth it before you look one up. It reports aggregate counts only - no per-server findings, and no verdict about any individual server.

  ConnectorNo auth

• findagent_connect_githubA

  FindAgentA

  Start connecting GitHub for the CALLER'S OWN FindAgent account so findagent_import_repo / findagent_list_repos can pull their repos. Returns whether GitHub is already connected plus a browser connect URL — the caller opens it, authorizes GitHub, and the token is stored server-side (this tool grants nothing itself; the actual connect happens in the browser). Call this first if import_repo or list_repos reports github not connected. The connection is scoped to THIS FindAgent account, so authorize on the same browser account. To switch GitHub accounts, use findagent_disconnect_github first.

  ConnectorOAuth

• add_screenshotA

  cobaltA

  Append a screenshot (with an optional note) to a review created by create_review. The image is stored durably in Cobalt — this is the way to persist screenshots that would otherwise be lost when they only pass through a browser tool. Call once per screen as you go. NO BROWSER? Pass `page_url` and Cobalt renders the page for you (Cloudflare headless Chrome): `viewport` 'desktop' (1280px) or 'mobile' (390px phone, 2x), `full_page` true for the whole scroll. Use it for every screen you would otherwise only describe in text — a review without screenshots is a reduced deliverable, and the mobile viewport is how you test the phone fold without a device. The result includes the rendered image: LOOK AT IT before moving on. Cookie walls and modal veils are stripped automatically, but if what came back is still not the shot (an overlay, a blank, the wrong page), retake it in place with `replace_item` = that item's number, adding `hide_selectors` for anything you can name — never leave a useless capture in the review and never append a second copy after it. Otherwise the input is `image_url`: POST the image to https://cobaltcapture.com/api/upload (multipart field `file`, no auth, returns {url, key}) and pass back the url. If a browser-automation script took the screenshot, do that POST inside the same script (Python `requests.post(...)`, or Playwright's request context) rather than shelling out to curl afterwards — same result, one less permission prompt. The `image` base64 parameter exists for small images only: tool-call arguments are model-generated text, so a real screenshot means emitting tens of thousands of base64 tokens perfectly, and an image you received as an image cannot be transcribed at all.

  ConnectorNo auth

• get_current_workflowA

  NoClickA

  Get the workflow currently OPEN in the user's browser (nodes, edges, selected node). WARNING: with no browser session (the normal headless case) it does NOT error — it falls back to the user's most-recently-updated workflow (a GUESS) flagged with _fallback/_warning. If you have a specific workflow in mind, use get_workflow(workflow_id) instead; list_workflows to choose. Use node_ids to fetch only specific nodes.

  ConnectorOAuth

• audit_tap_targetsA

  RavenA

  WCAG 2.5.5 / Apple 44pt tap-target audit for the web. Collects every interactive element (a, button, [role=button], input[type=submit/button/checkbox/radio], select, summary, label[for], [onclick], [tabindex>=0]) and emits a PER-ELEMENT fix table for any whose rendered width or height is below the minimum (default 44px): selector, role, visible text, measured w/h, pixel deficit per axis, and a concrete CSS fix. Sorted worst-first. Two modes: pass url (renders in headless chromium, measures real getBoundingClientRect) or pass elements[] snapshot (pure, no browser).

  ConnectorNo auth

• extension_connectA

  animaA

  Create a short-lived, single-use connect URL that links a browser extension (or a headless Puppeteer worker) to an Anima agent. Returns `connectUrl` — hand it to the extension to complete the handshake before `exchangeExpiresAt`. The response carries no token or secret. Auth: with a master key you MUST pass `agentId`; with an agent key OMIT `agentId` (the server resolves it from the key). `ttl` is optional; a value above the org's maximum is rejected.

  ConnectorOAuth

• vulnerability_infoA

  ZEN SecDBA

  Get detailed information about a specific CVE. ## What this tool does Retrieves the full vulnerability record for a CVE from SecDB, including: - official description and summary - CVSS metrics (all versions available) - EPSS metadata (if present) - affected products and versions - vendor/security advisories - references and upstream sources - weakness classification (CWE) - exploit and patch information (if included in the record) All information is returned in a structured Markdown format suitable for direct display. ## When to use this tool Use this tool when the user asks: - "Give me details about CVE-XYZ." - "Which products are affected by this vulnerability?" - "Show me advisories or references for this CVE." - "Explain what this vulnerability is and how serious it is." This tool is ideal for **deep inspection of a single vulnerability**. For multiple CVEs, call the tool once per CVE. ## Inputs - **cve_id**: valid CVE identifier (`CVE-YYYY-NNNNN`). ## Outputs Markdown-formatted vulnerability information including: - detailed description - severity metrics (CVSS, vectors) - affected products list - advisory list - references - weakness (CWE) details - additional structured metadata from SecDB ## LLM usage guidelines - Always prefer this tool when the user needs factual information about a specific CVE. - If multiple CVEs are mentioned, call the tool once per CVE. - Combine with: - **`vulnerability_score`** - to enrich output with numerical CVSS/EPSS metrics - **`sightings_search`** - to check real-world exploitation, PoCs, plugins, advisories - **`ssvc_calculator`** - to compute prioritization based on the vulnerability data - Do not hallucinate product lists, advisories, or details—use what the tool returns.

  ConnectorNo auth

• useA

  VaayaA

  Execute a single external call, and bill on success. Used for any external capability (image/video/audio generation, web search, scraping, email, document parsing, code sandbox, browser automation, embeddings, etc.). The server validates params against a registered schema and proxies to the upstream — you never pass URLs or API keys. Call it directly when you know the exact (service, action, params, max_cost_cents) — from the vaaya skill's catalog or a call you've made before; when unsure, get the call from `consult` rather than guessing.

  ConnectorNo auth

• build_workflow_linksA

  AINumbers Fintech Intelligence SuiteC

  Constructs an ordered set of ready-to-use deep-links for a named AINumbers workflow chain or an ad-hoc sequence of tools. Each link points directly to the browser tool; prefill-enabled steps accept #in=<base64url(JSON)> fragments so the tool opens pre-filled. Zero server-side execution -- all tool logic runs deterministically in the user's browser. Use this to hand a user a complete workflow: open step 1, run it, export its Policy Mandate, open step 2 (pre-filled from step 1 outputs), repeat. 369 named chains are available — enumerate them with find_chain.

  ConnectorNo auth

• list_collectionsA

  Skill of SkillsA

  The curated buyer-intent collections (e.g. mcp-servers, testing-qa, browser-automation). Use get_collection for the ranked tools inside one.

  ConnectorNo auth

• tools.getA

  Revuo.ai MCPA

  Get detailed information about a specific MCP tool, scoped to one product. Pass both the productSlug and the tool name — same-named tools across products are distinct. Response: { tool: { normalizedName, displayName, description, inputSchema, productSlug, productName, serverQualifiedName, isRemoteCapable, accessModel, healthScore, readOnly, destructive, tier, unverified, verifiedAt, position (always 1), rank (always 1.0) } }. Errors: { error: { code: 'not_found', ... } }.

  ConnectorNo auth

• oxylabs_scrapeA

  OxylabsA

  Scrape any URL via the Oxylabs Web Scraper API (rotating proxies, anti-bot handling) and return the page HTML with its upstream status code. Set render_js:true to load the page in a headless browser first — use for JS-heavy sites. Calls are synchronous proxying and can take 10-30 seconds. BYOK: _apiKey is "username:password" from the Oxylabs dashboard. Example: oxylabs_scrape({ url: "https://example.com", _apiKey: "myuser:mypass" })

  ConnectorNo auth

• crawlbase_screenshotA

  CrawlbaseA

  Capture a screenshot of a rendered web page via Crawlbase (headless browser + rotating proxies, anti-bot bypass). Returns a stored screenshot_url (JPEG, link expires after about one hour) plus crawl metadata. Requires your Crawlbase JavaScript token as _apiKey — screenshots always render in a real browser. Captures the full page by default; pass mode:"viewport" with width/height to constrain. Example: crawlbase_screenshot({ url: "https://example.com", _apiKey: "your-js-token" })

  ConnectorNo auth

• scrapingdog_scrapeA

  ScrapingdogA

  Scrape any website through Scrapingdog's rotating proxies and return its content. Returns HTML by default, or clean markdown with format:"markdown" (ideal for feeding an LLM). Set dynamic:true to render JavaScript in a headless browser for SPAs and dynamic pages (costs 5 credits instead of 1), premium:true for hard-to-scrape sites (residential proxies, 10 credits), and country to geotarget the proxy. Example: scrapingdog_scrape({ url: "https://example.com", format: "markdown", dynamic: true, _apiKey: "your-key" })

  ConnectorNo auth

• wdf_data_templates_listA

  Web Data FormsA

  Lists all automation-enabled Data Templates (Forms) available for the current group. Use this tool first when you need to determine which Data Template (Form) should be used for a user's request, before retrieving its schema or working with submissions.

  ConnectorNo auth

• capture_full_page_screenshotA

  Superflow Free ToolsA

  Capture a full-height PNG of a page in a real headless browser, scrolling first so lazy-loaded content renders. Returns a signed link to the image that expires in about 24 hours; download the bytes if you need to keep them. No watermark and no height cap. Cannot capture anything behind a login. Returns { imageUrl, expiresAt, bytes, width, height, deviceType }. Limit: 10 runs per hour per IP. Allow up to 90s for a response. Free, no account, no API key. Pass `url` to start a run. A slow run answers with `{ status: "pending", runId }` instead of a result: call this same tool again with just that `runId` to collect it, as many times as it takes. Collecting costs no rate-limit slot.

  ConnectorNo auth

• get_api_infoA

  govbid-mcp-serverA

  Get metadata about the GovBid Global API including version, data source, license information, and usage guidelines. Call this first to understand the service before making other tool calls.

  ConnectorNo auth