"A simple MCP server to serve images from a filesystem path with appropriate MIME type" matching MCP tools:

• Compoid_upload_file

  Compoid MCP

  Upload a file to the Compoid MCP server. Accepts a data URI (data:<mime>;base64,<data>). Returns the server-side path to use as file_upload in Compoid_create_record or Compoid_update_record.

  Connector

• hf_fs

  Hugging Face

  Use hf_fs for Hugging Face Hub filesystem operations. Call it with operations, an array of {cmd, args} items; multiple operations may be submitted together. Usage: {"operations":[{"cmd":"ls","args":["hf://models/org/repo"]}]} Grammar; each string below is one args array item: ls URI [--recursive] [--glob GLOB] [--type TYPE] [--sort SORT] [--limit N] cat URI [--offset N] [--max-bytes N] attach URI [--max-bytes N] stat URI find URI [--name GLOB] [--path GLOB] [--type TYPE] [--limit N] search URI [QUERY] [--type TYPE] [--sort SORT] [--tag TAG] [--kind mcp] [--limit N] COMMAND = ls|cat|attach|stat|find|search. TYPE = file|dir|repo|bucket|collection|paper|link. SORT = createdAt|downloads|likes|lastModified|likes30d|trendingScore|mainSize|id|trending|upvotes. URI is a canonical hf:// URI. QUERY and GLOB are each one string. Use search for discovery, ls for a known directory, find for recursive matching within a known scope, stat for filesystem metadata or an uncertain target type, cat for text contents, and attach for a complete JPEG, PNG, or WebP image. When the request gives an exact text-file URI, use cat directly; do not add ls or stat first. stat does not read the contents of JSON, Markdown, or other text files. Search scopes: hf://models|datasets|spaces[/OWNER], hf://collections[/OWNER], hf://papers, and hf://docs[/...]. Paper and documentation search require QUERY. Repeat --tag only for search hf://spaces; --kind mcp selects MCP Spaces. Use ls hf://models/trending, hf://datasets/trending, hf://spaces/trending, or hf://papers/trending for trending listings. For a named paper.md or metadata.json, use cat directly. Use ls on a paper only to discover an unnamed related resource. Omit --limit, --sort, and --type unless the request requires them. Limits and path-specific behavior are documented at hf://README.md. Issue one hf_fs call.

  Connector

• upload_file

  BorealHost

  Upload a base64-encoded file to a site's container. Use this for binary files (images, archives, fonts, etc.). For text files, prefer write_file(). Requires: API key with write scope. Args: slug: Site identifier path: Relative path including filename (e.g. "images/logo.png") content_b64: Base64-encoded file content Returns: {"success": true, "path": "images/logo.png", "size": 45678} Errors: VALIDATION_ERROR: Invalid base64 encoding FORBIDDEN: Protected system path

  Connector

• tronsave_login

  TronSave MCP Server

  Authenticate with TronSave and create a server session. Returns `{ sessionId, walletAddress?, expiresAt }` — pass `sessionId` as the `mcp-session-id` header on every subsequent MCP request. `walletAddress` is set only for signature-mode logins. Two modes: (1) wallet signature (preferred for platform tools) — call this tool with `signature_timestamp` formatted as `<signature>_<timestamp>`, where `<signature>` must be produced client-side by signing the timestamp message; you may optionally call `tronsave_get_sign_message` to obtain a helper message/timestamp pair; (2) API key (internal tools) — pass `apiKey` (raw key, no prefix). Side effect: creates a new session on the server. Wallet signing must happen client-side; never send private keys to the server.

  Connector

• order_vps

  eqvps

  Order a VPS. `product` = plan slug from list_plans; `os_id` = an OS id from that plan's images. Optional `hostname` and `ssh_key` (public key — strongly recommended so you get key-based root login). Branching on the response: • `paid_from_balance: true` → the prepaid balance covered it; the server is provisioning. Poll `get_vps_status` until status is `active` and the VM is reachable. • `paid_from_balance: false` → balance was insufficient; an unpaid `invoice` is returned. Call `pay_invoice` with `invoice.id` to get a crypto `checkout_url`, OR `topup_balance` then re-order.

  Connector

• check_upload_link

  Orivox AI Website Builder

  Return the EXACT images the user chose on their upload link. Pass the token_id that request_image_upload_link returned. Call this after the user says they uploaded or picked their images: it returns files[], each with a hosted url and a source ("upload", "gallery", or "shared"), so you place PRECISELY the images they selected instead of guessing from the whole gallery. An empty files list means they have not chosen anything yet -- ask them to open the link and add images, or wait and check again. Read-only; changes nothing.

  Connector

• query_knowledge_graph

  Analytics Legends — SAP Analytics Intelligence

  The RELATIONS between the platform's teaching objects — which Academy module teaches which concept, which study covers which module, what a concept relates to. THIS IS THE ONLY TOOL ON THIS SERVER THAT SERVES EDGES; the others serve rows. Ask it what connects to what, not what exists. SCOPE, AND IT IS NARROWER THAN 'the knowledge graph': it carries four node types — `concept`, `module`, `study`, `vendor` — and every edge whose BOTH endpoints are one of them. The whole graph holds eleven node types; the seven it does not carry are each either served by their own tool or named as not served at all, and `_meta.excluded_node_types` says which per type (consultant data is served at NO tier), so a missing type is a documented boundary and never a silent gap. Call it with `node_id` (e.g. `module:M178`, `concept:C001`, `study:ai-impact-2026-EN`) to walk one node's neighbourhood; with `node_type` and/or `query` to find a node id first. `edge_type` and `direction` narrow a walk. Read `_meta.available_edge_types` — computed from the served projection on every call — before assuming an edge type exists.

  Connector

• create_volumeset

  Control Plane

  Create a new volumeset in a GVC with explicit performance class, filesystem type, initial capacity, snapshot policy, and (optional) autoscaling. Performance class and filesystem type are IMMUTABLE — choose carefully. xfs/ext4 support snapshots; shared is read-write-many but cannot be snapshotted. Snapshot defaults injected when omitted: createFinalSnapshot=true, retentionDuration "7d". customEncryption (customer-managed KMS keys) cannot be set here — apply a full manifest with the CLI (`cpln apply`), calling get_resource_schema (kind=volumeset) first. Mount separately via mount_volumeset_to_workload (ext4/xfs need a stateful or vm workload; shared mounts on any workload type). Recommended reading before first use: get_cpln_skill("stateful-storage") — the runbook for this tool family (read once per session).

  Connector

• get_product_details

  SendaMeal Storefront

  Get product details (variants, options and images) by product ID(s). Arguments: productIds - array of product IDs to get details for (from 'search_products'). [IMPORTANT] Request only the products the user needs. A server-configured limit applies (default 20); requests over the limit are rejected with an error (retry with fewer IDs). option_values - resolve a specific variant by option/value IDs. Only valid with a SINGLE productId, and applied on the B2C storefront catalog. B2B buyers instead receive every variant (each with its option/value IDs) and pick the desired one from the returned list. channelId - optional; scopes the B2B catalog. Defaults to the channel resolved from the request. Returns: - products: array of products, each with: - variants: each carrying entityId, SKU, and options (optionId, optionLabel, valueId, valueLabel). - For B2B buyers, variants also include price, inventoryLevel, purchaseable, and bulkPricing. - Products not found are omitted from the array. Flow: - Call 'search_products' to get product IDs. - Call this tool with the product IDs to get variants, options and images. - Call 'add_item_to_cart' with results of 'search_products' and 'get_product_details' (variant) tools. - [IMPORTANT] If a product has variants you must specify which variant to add.

  Connector

• dcma14_health_check

  cpp-cpm-engine

  Full Schedule Health Dashboard HTML report — DCMA-14 + CPLI + BEI + variance/slip register against the baseline. Wraps the CPP Schedule Health Review skill, which produces a self-contained ~1.3 MB HTML dashboard. The dashboard renders DCMA metrics, charts, baseline-vs-current variance, slip register, GAO/AACE compliance bands, and a reproducibility manifest. Baseline XER is OPTIONAL as of Round 7 (Fix MCP-8). When omitted, the tool runs in "degraded mode": the current XER is used as its own baseline for a synthetic 0-variance run. The result carries ``degraded_mode: true`` and ``degraded_mode_reason`` explaining that BEI / variance / slip register KPIs are NOT meaningful in this mode. Supply baseline_xer_path or baseline_xer_content to get the real two-XER variance dashboard. REQUIRES Node + Playwright on the server (the dashboard renders via headless Chromium). The tool returns a clear error if either prerequisite is missing. Use this tool when you need the formal HTML deliverable. For the JSON / dict shape only (no HTML), use ``critical_path_validator`` which exposes the same DCMA-14 block. === HOW TO PASS THE XER FILES === For each XER (current, baseline) you supply EXACTLY ONE of: - ``*_xer_path`` — filesystem path on the server. Use this when the MCP server runs locally and the file is already accessible to it. - ``*_xer_content`` — full text of the XER file as a string. Use this when calling a HOSTED MCP server from your local Claude — the server has no access to your local filesystem, so you must send the content over the wire. The server writes it to a tempfile, runs the pipeline, and cleans up afterward. If both are supplied for the same XER, content wins (the path is ignored). If neither is supplied, the call returns an error. Args: current_xer_path: server-side path to the current XER. baseline_xer_path: server-side path to the baseline XER. current_xer_content: full text of the current XER (alternative). baseline_xer_content: full text of the baseline XER (alternative). output_path: optional output HTML path. Ignored when content is supplied (output goes to a tempdir alongside). timeout_seconds: per-step Playwright timeout (default 120s). debug: pipe Playwright stderr / browser console to stderr. return_html_inline: when True (default), the generated HTML is read off disk and returned as ``html_content`` in the response. Required for hosted/remote use; set False to save bandwidth when calling a local server where you can open ``html_path`` directly. Returns: { "ok": True, "html_path": "absolute path on the server", "html_content": "<!DOCTYPE html>..." (when return_html_inline), "current_xer": "...", "baseline_xer": "...", # ── Deliverable headline — the SAME figures the HTML # renders in its header / gauge / DCMA footer # ("GRADE C · 69% · YELLOW"). Extracted verbatim from the # dashboard's embedded payload; NOT recomputed here. These # are the authoritative grade for citing the deliverable. "grade": "C", # letter grade A-F (or None) "health_score": 69, # gauge percent = round(PASS/SCORED*100) "status_band": "YELLOW", # GREEN | YELLOW | RED "headline": { # full block (None if absent) "grade": "C", "grade_label": "Acceptable", "health_score": 69, "health_score_exact": 68.75, "status_band": "YELLOW", "passed": int, "failed": int, "scored": int, "not_scored": int, "basis": "health_score = round(passed / scored * 100); " "scored excludes not-scored criteria", }, # NOTE: result["health_score"] (the gauge percent) and # dcma_14.summary.pass_rate are now the SAME ratio on the # SAME basis — PASS / SCORED, where SCORED excludes the # unscored (status "NONE" / pass:null) criteria. So # round(dcma_14.summary.pass_rate * 100) == health_score # (e.g. 0.692 → 69), matching the HTML "69% compliance". # (Before 2026-06-28 pass_rate divided by total-criteria — # 9/14 = 0.643 — and silently contradicted the 9/13 = 69% # dashboard; that is the report-safety bug this fixed.) Cite # `health_score` / `grade` / `status_band` for the headline; # use dcma_14.summary for the raw criterion tallies. "dcma_14": { # ← sibling of html_content; # matches critical_path_validator shape "criteria": {1: {...}, 2: {...}, ...}, # Each criterion carries `scored` (bool) and a TRI-STATE # `pass`: # "scored": True/False — did the dashboard reach a # PASS/FAIL/WARN verdict? False means the criterion # was NOT evaluated (e.g. C10 Resources when the # TASKRSRC section is absent; status "NONE"). # "pass": True — scored and PASSED # "pass": False — scored and FAILED/WARNED # "pass": null — NOT scored (no verdict). null is # distinct from false: to count failed criteria, # filter pass == False (or scored == True and not # pass), NOT pass != True — an unscored criterion is # not a failure. `summary.fail` already excludes it. # `scored` = pass + fail + warn (the dashboard's # denominator); `pass_rate` = pass / scored, NOT # pass / total. `unscored` (status NONE) is excluded from # `scored`. In degraded mode `not_applicable` counts the # baseline-dependent criteria excluded from the score and # `degraded: true` + `degraded_note` are stamped inline. "summary": {"total": int, "scored": int, "pass": int, "fail": int, "warn": int, "unscored": int, "pass_rate": float | None}, }, "metrics": { # ← DEPRECATED — alias for dcma_14 # DEPRECATED. Identical payload to `dcma_14`. Retained # for backward-compat with clients written against the # pre-Round-4 schema. New code should read `dcma_14`. # The `deprecated_alias_for` key is set on every # response to make migration explicit. This key may be # removed in a future major version. "deprecated_alias_for": "dcma_14", "criteria": {1: {...}, 2: {...}, ...}, "summary": { # identical payload to dcma_14.summary "total": int, "scored": int, "pass": int, "fail": int, "warn": int, "unscored": int, "pass_rate": float | None, }, } } On error: {"error": "..."} Note: the inline HTML payload can be ~1.3 MB. Some MCP transport stacks have request/response size limits (typically 5-20 MB). For very large XERs / very long dashboards, this may fail at the transport layer; in that case set ``return_html_inline=False`` and arrange to fetch the file from ``html_path`` separately.

  Connector

• xer_parser

  cpp-cpm-engine

  Parse a Primavera P6 XER file and return a TABLE SUMMARY (not the full row-level data — XER row dumps explode the MCP context window). For each table in the XER, returns the table name, field list, and record count. Per-row data is intentionally omitted — for forensic / DCMA / windows analysis use the dedicated tools (``forensic_windows_analysis``, ``critical_path_validator``, etc.) which consume the parsed XER internally and return analytical summaries, not raw rows. Use this tool to confirm an XER is parseable, list its tables, see the data date / project name from PROJECT, or count activities in TASK before deciding which deeper tool to run. Args: xer_path: server-side filesystem path to the XER file. xer_content: full text of the XER file (alternative for hosted/remote use). Supply EXACTLY ONE of path/content. Returns: { "filepath": absolute path, "encoding_used": "utf-8" | "cp1252" | ..., "ermhdr": file header dict (P6 version, export user, etc.), "tables": [{"name", "fields", "record_count"}, ...], "table_count": int, "total_records": int, "project_summary": { "proj_id", "proj_short_name", "proj_long_name", "data_date", "plan_end_date" } (from first PROJECT row, if any) }

  Connector

• fvs_download_final_video

  Future Video Studio

  Download a completed Future Video Studio final render URL to a local file. Use this only after fvs_get_render_status or fvs_get_paid_render_status returns a final_video_url for a completed render. The tool performs an unauthenticated HTTPS GET to that signed URL and writes the response bytes to output_path on the MCP server's local filesystem. It does not call the FVS Agent API, spend wallet credits, require FVS_AGENT_API_KEY, cancel jobs, or modify remote render state. Side effects and constraints: output_path is a local filesystem path for the MCP server process, parent directories are created, existing files are not replaced unless overwrite is true, and large videos may take minutes to download. The request timeout is 600 seconds. Use a fresh status check to refresh expired signed URLs, and do not pass arbitrary or untrusted URLs.

  Connector

• check_text

  WSC - Writing Style Checker

  Analyze text for writing style issues: weasel words, passive voice, duplicate words, long sentences, nominalizations, hedging, filler adverbs, and research-cited AI tells. Read-only and stateless — text is analyzed in memory on the hosted server and never stored. Returns a plain-text report with each issue's line and column, the matched text, surrounding context, and the reason for AI tells; texts over 100,000 characters return an error message. This hosted server has no filesystem access — the wsc-mcp npm package adds a check_file tool for local files. It only reports issues — to auto-remove duplicate words, follow up with fix_duplicates.

  Connector

• cti_get_cross_server_routes

  website-search

  Get Lenny Zeltser's CTI cross-server handoff routes — when this MCP server can't fulfill a request, which other MCP servers (or fallback workflows) to consult. Surfaces a compact subset of `cti_load_context`. This server never requests your campaign or threat-intel notes and instructs your AI to keep them local—templates and guidelines flow to your AI for local analysis.

  Connector

• ping

  nara-tour

  Connectivity check — returns server version and current timestamp. Use to verify MCP server is reachable before calling other tools.

  Connector

• scan_mcp_server

  Compuute MCP Security Scanner

  Scan a public GitHub MCP-server repository for security issues. Clones the repo (shallow, <60s, <200 MB), runs compuute-scan v0.6.2 in static analysis mode (no code execution from the target), and returns a structured report with severity counts, a 0-100 score, and the 10 most severe findings. WHEN TO USE: - Before connecting to an unknown MCP server discovered via Anthropic Registry, Smithery, mcp.so, or a Discord recommendation. - Before installing a third-party MCP-server package into a production pipeline. - As part of an agent's pre-commit / pre-deploy due-diligence step when adding new dependencies. - As one input to a multi-source trust evaluation (combine with publisher reputation, package install count, last-update recency). WHEN NOT TO USE: - For private repos. Use the on-prem CLI instead: `npx compuute-scan ./path-to-private-repo` - For deep exploitability assessment of a specific code path. This is pattern matching, not dataflow analysis. Book a manual L2-L4 audit at https://compuute.se/audit for that depth. - For non-GitHub hosts (GitLab, Bitbucket, self-hosted). v1 supports github.com only. - For repos > 200 MB or clone time > 60s. The endpoint returns a 413 or 504 in those cases — fall back to local CLI. EXPECTED RESPONSE TIME: - Median: ~1-2 seconds for small repos (<100 files). - p99: ~10 seconds for medium repos. - Hard timeout at clone=60s, scan=120s combined. EXPECTED COST: - Free tier in MVP. Future Pro tier may charge per-scan or per-month. DATA FRESHNESS: - Scanner version is reported in response.scanner.version. - L1 rule set freshness reflects compuute-scan releases — see github.com/Compuute/compuute-scan/CHANGELOG.md for the latest CVE and threat-intel response timeline. EXAMPLES: Example 1 — scan an MCP server you're evaluating: github_url = "https://github.com/modelcontextprotocol/servers" → score: 0, summary: {critical: 1, high: 94, medium: 22} → top_findings include SSRF, eval, etc. → recommendation: "AVOID — 1 critical and 94 high finding(s)..." Example 2 — scan a clean reference implementation: github_url = "https://github.com/microsoft/azure-devops-mcp" → score: 90+, summary: {critical: 0, high: 1} → recommendation: "REVIEW — 1 high finding(s)..." Example 3 — scan your own dev MCP-server before publishing: github_url = "https://github.com/yourorg/your-mcp" → audit your own surface before others install it OUTPUT FIELDS (stable schema): - repo_url (str): canonical URL of the scanned repo. - score (int): 0-100, higher safer. Coarse summary, not a precision claim. - summary (object): {critical, high, medium, low, info, files_scanned}. - recommendation (str): action guidance derived from severity counts. - findings_count (int): total raw findings (may include false positives). - top_findings (list): up to 10 most severe, each with {id, title, severity, file, line, owasp, cwe}. - l0_discovery (object): MCP transport, tool count, dependency pinning. - performance (object): clone_seconds, scan_seconds, repo_size_bytes. - scanner (object): {name, version, layers_covered}. - _disclaimer (str): MANDATORY triage disclaimer. Read it. Args: github_url: Public GitHub HTTPS URL (e.g. https://github.com/org/repo). Must be public and < 200 MB. v1 is github.com only. Returns: Structured scan result. On error, returns {"error": code, "message": ...} with HTTP-style code (invalid_url, clone_failed, scan_timeout, etc.).

  Connector

• tronsave_login

  Tronsave MCP Testnet

  Authenticate with TronSave and create a server session. Returns `{ sessionId, walletAddress?, expiresAt }` — pass `sessionId` as the `mcp-session-id` header on every subsequent MCP request. `walletAddress` is set only for signature-mode logins. Two modes: (1) wallet signature (preferred for platform tools) — call this tool with `signature_timestamp` formatted as `<signature>_<timestamp>`, where `<signature>` must be produced client-side by signing the timestamp message; you may optionally call `tronsave_get_sign_message` to obtain a helper message/timestamp pair; (2) API key (internal tools) — pass `apiKey` (raw key, no prefix). Side effect: creates a new session on the server. Wallet signing must happen client-side; never send private keys to the server.

  Connector

• ping

  Nordic Financial MCP

  Connectivity check that confirms the Nordic MCP server process is responding. Use this at the start of a session to verify the server is reachable before making other calls. Do not use as a proxy for database health — the server can respond while the Qdrant vector database is temporarily unavailable. To confirm data availability, call search_filings directly. Returns: A greeting string: "Hello {name}! Nordic MCP server is running."

  Connector

• check_configuration

  vivideo

  Check whether a Vivideo API key is present on this request. Call this FIRST. Returns { configured: boolean }. If false, ask the user to add an Authorization: Bearer vv_live_... header to the MCP server config (a key from https://app.vivideo.ai/account/api-keys). Never asks for or exposes the key.

  Connector

• web.url.content_type

  1cent Web Intelligence for AI Agents

  Classify MIME type, charset and bounded content length. Use only for public HTTP(S) resources; it does not execute JavaScript or bypass access controls. Pass url as an absolute public HTTP(S) URL. Keep fresh=false to allow cache reuse; set fresh=true only when a new upstream fetch is required.

  Connector