Skip to main content
Glama
741,519 tools. Updated 2026-11-04 05:16

"A server that scans projects for security vulnerabilities and recommends fixes" matching MCP tools:

  • Scans an MCP server manifest or endpoint for security vulnerabilities — prompt injection in tool descriptions, exfiltration vectors, unbounded resource access, privilege escalation, schema mismatches, transport security issues, and over-permissive scopes. Returns a structured risk report with severity levels and remediation guidance.
    ConnectorNo auth
  • Scans for security vulnerabilities - hardcoded passwords in HTML, exposed API keys, missing TLS, missing rate limiting, exposed bot tokens, and insecure file permissions.
    ConnectorNo auth
  • Auto-created from research: A tool that scans autonomous AI agents for critical vulnerabilities and provides real-time alerts and fixes. [x402: 0.01 USDC on Base, pay-per-use]
    ConnectorNo auth
  • Check Python source without running it: parse, lint (ruff), type-check (mypy), AST security policy, credential scan. Safe on code you do not trust. Use it on every Python file you generated or edited, before writing it to disk. Alternatives: repair_python to get the corrected source instead of the diagnosis; execute_python to prove the code runs. Auth: a key is required. A free key covers this call, 25 per day, then HTTP 429; get one with POST /v1/keys. Credits are bought without an account, 1 per call: GET /v1/pricing says where to send the xDAI. Or pay for this one call with no key at all: call it without one and the result carries x402 payment requirements ($0.01 in USD Coin on eip155:8453); sign them and repeat the call with the payment in _meta['x402/payment']. Arguments: code: the whole file, 1..200000 bytes of UTF-8 measured after encoding (empty is refused with 400, larger with 413); a fragment is fine, but line and column numbers in the answer count from 1 in what you sent. language: must be 'python'; anything else is 400, and the field may be omitted. Of options only transpile_to (e.g. 'javascript', which returns a translated copy in transpiled) acts here; timeout_s, max_iterations, optimize, examples and expected_output need a pass that rewrites or runs the code, so send code alone. Ignored options are not refused, so a call that sets them looks like it worked; and code that does not parse is answered rather than refused: valid=false with the syntax error located, which is the point. Returns valid, score 0..1, diagnostics (rule, message, line, column), security findings, fixes, fixed_code and runtime; see outputSchema. The code and its verdict are retained to improve the service.
    ConnectorNo auth
  • Rename a folder, or move it under a different parent - in IMAP these are the same operation, because a folder's name is its path. Pass `parent` to reparent it while keeping its name. THE MESSAGES INSIDE COME WITH IT, and so do any sub-folders: renaming "Projects" also moves "Projects/Q1", and the result lists every child that moved. REFUSES to rename INBOX (on IMAP that empties your inbox into a new folder rather than renaming anything) and refuses to rename Sent, Drafts, Trash, Junk or Archive (mail clients find those by a flag, not by name, and renaming one can leave your sent mail split across two folders). It also refuses a name that is already taken rather than risk merging two folders. Read the refusal and tell the user what it says - each one is protecting something.
    Connector
    Destructive
    OAuth
  • Use when the user wants an existing project changed without opening the studio: its title, whether it is public (a public project has a share page and, for meshes, a public GLB URL), and on logo and coin projects the style: material, lighting room, background, motion, depth, font, the wordmark on text projects; on coins also the look, coin and mark colours, and the blank edge. Only the fields given change. Making a project public needs a saved render. Style changes render the next time the project is opened and saved. Do not use for a share link that keeps the project private (create_share_link) or to make something new (create_text_logo_project, duplicate_project).
    ConnectorOAuth

Matching MCP Servers

  • F
    license
    Not graded
    quality
    C
    maintenance
    This MCP server provides secure access to databases for AI agents, enforcing authentication, authorization, human approval, logging, and notifications to prevent dangerous actions.
    -
  • A
    license
    Not graded
    quality
    A
    maintenance
    Project management CLI + MCP server for AI agents. Register projects once, open them anywhere, sync to S3, auto-init git, and wire into the hasna ecosystem.
    4,335 npm
    Apache 2.0

Matching MCP Connectors

  • Get current usage against the plan limits, one entry per category (projects, specs, members, …) with the current count, the maximum and whether the category is unlimited. This is the tool that answers 'why can I not create another one'. Use this for usage against plan limits; for the AI credit balance use get_credit_balance. Requires organization context. Read-only: plan, seat and top-up changes are not available through MCP by design — a human does those in the web app.
    ConnectorAPI key
  • Before security-sensitive tooling or agent operations: find recent threads relevant to a task, with source links, provenance and matching keywords. Keyword overlap on title, tags and excerpt over the last 200 active threads; not semantic search and not the full archive (use search for that). Seeds excluded by default.
    ConnectorNo auth
  • Move one of your projects to the trash (all its pages, translations and device variants go with it). It is restorable for 30 days with restore_project (see list_trash); after that it is purged for good. Two steps: call it with just projectId to PREVIEW (name and page count, nothing changes), then again with confirm:true. Only confirm when the user has clearly asked to delete that project. Owner-only. Find ids with list_projects.
    Connector
    Destructive
    OAuth
  • Perform a Linux package vulnerability audit using SecDB. ## What this tool does Analyzes the installed packages of a Linux system-identified by OS and OS version-and returns vulnerability information plus a Markdown summary. The audit results are based exclusively on the package list provided by the user. ## When to use this tool Use this tool when the user wants to determine: - whether installed packages contain known vulnerabilities - whether a host, VM, container, or base image is affected by security advisories - which packages require patching or upgrading If the user does not know the valid values for `os` or `version`, first call the `linux_os` tool to retrieve the exact supported combinations. ## Inputs - **os**: Linux distribution identifier supported by SecDB (use `linux_os` to obtain allowed values). - **version**: OS version or codename corresponding to the selected distribution, exactly as returned by `linux_os` (for example `focal`, not `20.04`). Any other value is rejected with the list of supported values. - **packages**: list of installed packages, **one per line**, generated using the appropriate system command: ### For RPM-based distributions (RHEL, CentOS, Rocky, Alma, SUSE) rpm -qa --qf '%{NAME}-%{VERSION}-%{RELEASE}.%{ARCH}\n' ### For DEB-based distributions (Ubuntu, Debian) dpkg-query -W -f='${Package} ${Version} ${Architecture}\n' ### For Alpine Linux apk list -I ### For Slackware ls -1 /var/log/packages/ The raw output of these commands can be passed directly as the `packages` input (one package per line). ... python3 3.12.3-0ubuntu2.1 amd64 systemd 255.4-1ubuntu8.10 amd64 tmux 3.4-1ubuntu0.1 amd64 ... ## Outputs - **report**: structured objects describing the advisories affecting the audited packages. Packages without known vulnerabilities are not listed. - **summary**: Markdown summary including vulnerable packages, total CVEs, and severity breakdown. ## LLM usage guidelines - Never guess whether a package is vulnerable-always call this tool for Linux audits. - If `os` or `version` is unclear or missing, call `linux_os` and ask the user to choose a valid combination. - Normalize the package list to “one entry per line” if the user provides unstructured output. - The `summary` is already Markdown and can be shown directly. - Use `report` when deeper technical analysis is required.
    ConnectorNo auth
  • Returns the latest public web-security scan results for turva.dev's own domain (Hardenize, Internet.nl site and mail), each with its scan date. Use this when a user asks about turva.dev's own security posture or wants evidence beyond agent-readiness scores. For the agent-readiness score itself, which is a separate measurement, use get_agent_readiness instead. Read-only: returns static JSON that is compiled into the Worker, so it changes nothing and updates only on deploy.
    ConnectorNo auth
  • Get the wiring instructions for connecting an MCP client to ~alter. The name is historical and this recommends nothing: it hands back connection details, not a suggested tool. Use it when adding ~alter to a new MCP client, or when passing the endpoint to another agent so it can connect for itself. Returns the MCP endpoint URL, a ready-to-paste JSON configuration snippet, and how many tools are callable at each tier. Takes no parameters and reads no member data. Free L0, no authentication required.
    ConnectorNo auth
  • Runs a free one-off security scan of the given domain and returns its grade (A–F), scan timestamp, and up to three top-priority issues with a permalink to the full report on siteguardian.io. Use this when the user asks for a quick security check of a domain that is NOT yet under SiteGuardian monitoring, or when they want a fresh assessment before subscribing. Results are cached for two hours, so repeated calls about the same domain return the same snapshot and mark it with cached=True. Do NOT use this for domains already under monitoring by the user — call get_domain_status instead for the account-scoped view with framework tags. Do NOT use this to batch-scan many domains as a competitive-intelligence tool; per-source-IP and per-target rate limits bound usage. This tool does not require authentication.
    ConnectorNo auth
  • Get Lenny Zeltser's Security Assessment one-page executive brief template. Standalone variant of `assessment_get_template` for callers that only want the brief without the long-form report. This server never requests your assessment notes or report and instructs your AI to keep them local—the templates and guidelines flow to your AI for local analysis.
    ConnectorNo auth
  • List this account's company memory, one line per entry (name + description), newest first. Traverse index-first: scan this, then memory_recall(name) for full bodies. Memory accrues automatically from your competitor scans (exhaust) and from your own memory_note writes.
    ConnectorNo auth
  • Search Epinu real-asset projects. Returns bounded summaries only; call projects_get_deep_dive for detailed packets. Results include public projects plus the token owner's own archived, draft, or unpublished projects for duplicate checks; another owner's unpublished projects are never returned. Available without a token for public results only.
    ConnectorNo auth
  • Select bypass and bulk decoupling capacitors for IC power supply pins. Computes the target PDN (Power Distribution Network) impedance from supply current, voltage, and allowable ripple using Z_target = V_ripple / I_total. Recommends a ceramic bypass capacitor (high-frequency decoupling, placed closest to IC pins) and a bulk capacitor (low-frequency decoupling, near the regulator). Calculates the ceramic cap's self-resonant frequency assuming typical lead inductance, and checks whether ESR-induced ripple stays within limits. Essential for digital, analog, and mixed-signal PCB design. Chain with lc_resonance to verify the decoupling capacitor's resonant behavior, or with trace_width to size the power trace.
    ConnectorNo auth
  • A table of contents for this user's memory: which sources are connected (email, calendar, docs, …), how many items each holds, and the top people, topics and projects. It is an index rather than an answer — it contains no message bodies, no dates and no content, so it establishes that a source exists without saying anything about what is in it. The content behind any entry it lists is retrievable with cortex_ask.
    ConnectorNo auth
  • Known vulnerabilities (CVE / GHSA / PYSEC / GO advisories) for a package, via OSV.dev. Pass version to filter to advisories affecting that exact version, or omit it for the package's full advisory history. Each result carries the OSV id, cross-id aliases, a severity word grade (LOW|MODERATE|HIGH|CRITICAL), the cvss vector string, affectedRanges with fixed-version events, references, and cwes. A clean package returns count: 0 with an empty list (not an error). ecosystem is CASE-SENSITIVE — use OSV's spelling (npm, PyPI, Go, crates.io, Maven, NuGet, RubyGems, …). Use scan_vulnerabilities_batch for lockfile batch scans.
    ConnectorNo auth
  • A powerful metrics-based project filtering and sorting tool that works with cryptocurrency assets based on their metrics and allows for ordered, paginated results. The tool allows for filtering assets by a metric and sorting them according to that same metric in ascending or descending metric, or just to sort the assets by a metric without filtering. This tool allows you to discover projects that meet specific criteria by analyzing their metrics over time periods. You can filter projects by absolute values (greater_than/less_than thresholds) or by percentage changes, or just sort projects by some metric. ## When to use vs other metric tools This tool scans the whole asset universe and returns one aggregated value per matching asset — use it for "which assets satisfy X" and "top N by X". It never returns a timeseries: for the values of a metric over time for already-known slugs use `fetch_metric_data_tool`. To check that a metric exists (or fix a mistyped metric/slug) use `metrics_and_assets_discovery_tool`. ## Use Cases - Get top 10 assets by marketcap, sorted in descending order - Get top 50 assets with highest dev_activity_1d - Find assets with price more than $10 - Discover tokens whose price increased by more than 50% in the last 30 days - Screen for projects with market cap less than $100M - Identify assets that have dev_activity_1d decline by more than 20% in the past month ## Examples - Get projects that have a price_usd in the last 24 hours and it's greater_than $500. Get the first 20 ordered by price_usd in descending order `{metric: "price_usd", operator: :greater_than, threshold: 500.0, from: "utc_now-24h", to: "utc_now", sort: "desc, page: 1, page_size: 20}` - Find projects whose price_usd today is 25% higher than 7 days ago, sorted by the highest percent increase in descending order. Get the first 100. `{metric: "price_usd", operator: :percent_up, threshold: 25.0, from: "utc_now-7d", to: "utc_now", sort: "desc", page: 1, page_size: 100}` - Projects with current market cap less_than $50M. Get 100 such projects, ordered by marketcap in descending order. `{metric: "marketcap_usd", operator: :less_than, threshold: 50000000.0, from: "utc_now-1d", to: "utc_now", sort: "desc", page: 1, page_size: 100}` Here is how the filtering works: - For absolute value operators - `greater_than` and `less_than` - fetch the `metric` for each asset in the interval `from`-`to`, aggregting it using the specified `aggregation` method (defaulting to the metric's default). - For percent change operators - `percent_up` and `percent_down` - fetch the `metric` for each asset in the interval `from-`to`, as well as in the same length interval immediately before `from`. The two resulting values are compared to calculate the percentage change. Some metrics like price_usd and marketcap_usd are aggregated with `LAST` aggregation by default, meaning that the last known value in the queried interval is used. For percent change, this means that the tool compares the last known price immediately before `from` and the last known price before `to`. Other metrics like transaction_volume_usd and social_volume_total (and most other volume metrics) are aggregated by default with SUM aggregation, meaning that the total combined sum in the queried interval is used. For these metrics length of the time window is vital. A common mistake is to try to check if the social_total_total for the last 5 minutes is greater_than some threshold. Five minutes is not enough for social volume to accumulate enough. In such scenarios use a longer time window like 1 day or more.
    ConnectorNo auth
  • Get a security advisory (vulnerability) by its key. Returns a security advisory by key, for example a GHSA id taken from a version's advisoryKeys, including the title, CVE aliases, CVSS v3 score and vector, and a link to the full record on osv.dev. Use this only when you already have an advisory ID from get_package_version's advisoryKeys. There is no search here. To find out whether a version has vulnerabilities at all, call get_package_version first; this tool explains one advisory in depth.
    ConnectorNo auth