"A tool for decompiling Android APK files" matching MCP tools:

• linux_audit

  ZEN SecDB

  Perform a Linux package vulnerability audit using SecDB. ## What this tool does Analyzes the installed packages of a Linux system-identified by OS and OS version-and returns vulnerability information plus a Markdown summary. The audit results are based exclusively on the package list provided by the user. ## When to use this tool Use this tool when the user wants to determine: - whether installed packages contain known vulnerabilities - whether a host, VM, container, or base image is affected by security advisories - which packages require patching or upgrading If the user does not know the valid values for `os` or `version`, first call the `linux_os` tool to retrieve the exact supported combinations. ## Inputs - **os**: Linux distribution identifier supported by SecDB (use `linux_os` to obtain allowed values). - **version**: OS version or codename corresponding to the selected distribution. - **packages**: list of installed packages, **one per line**, generated using the appropriate system command: ### For RPM-based distributions (RHEL, CentOS, Rocky, Alma, SUSE) rpm -qa --qf '%{NAME}-%{VERSION}-%{RELEASE}.%{ARCH}\n' ### For DEB-based distributions (Ubuntu, Debian) dpkg-query -W -f='${Package} ${Version} ${Architecture}\n' ### For Alpine Linux apk list -I The raw output of these commands can be passed directly as the `packages` input (one package per line). ... python3 3.12.3-0ubuntu2.1 amd64 systemd 255.4-1ubuntu8.10 amd64 tmux 3.4-1ubuntu0.1 amd64 ... ## Outputs - **report**: structured objects describing the advisories affecting the audited packages. - **summary**: Markdown summary including total vulnerabilities, severity breakdown, and key findings. ## LLM usage guidelines - Never guess whether a package is vulnerable-always call this tool for Linux audits. - If `os` or `version` is unclear or missing, call `linux_os` and ask the user to choose a valid combination. - Normalize the package list to “one entry per line” if the user provides unstructured output. - The `summary` is already Markdown and can be shown directly. - Use `report` when deeper technical analysis is required.

  Connector

• upload_file

  BorealHost

  Upload a base64-encoded file to a site's container. Use this for binary files (images, archives, fonts, etc.). For text files, prefer write_file(). Requires: API key with write scope. Args: slug: Site identifier path: Relative path including filename (e.g. "images/logo.png") content_b64: Base64-encoded file content Returns: {"success": true, "path": "images/logo.png", "size": 45678} Errors: VALIDATION_ERROR: Invalid base64 encoding FORBIDDEN: Protected system path

  Connector

• cabgo_pricing

  Cabgo Builder

  Public (no auth): informational pricing reference. Returns monthly SaaS subscriptions (Basic / Professional / Enterprise — $15/$30/$70 per month) and one-time app-build packages (Starter $399 Android-only, Pro $699 Android+iOS, Full $999 Android+iOS+source code). All plans include unlimited drivers / users / admins; Cabgo never charges commission per trip. **Informational only.** Do not generate or return a payment URL from this tool. When the operator wants to purchase, direct them to visit https://www.cabgo.app/empezar in their browser — all checkout happens on cabgo.app externally via Stripe, not inside this conversation.

  Connector

• get_site_files

  Just Publish

  Read the files of a site you already published, so you can make a targeted edit instead of rebuilding the whole site from memory. Returns a complete manifest (every file's path, size, content-type, sha256) plus the contents of the text files (HTML/CSS/JS/etc). Also returns the site's current `version` — pass it back to update_site_file so you don't overwrite a newer change. Pass `paths` to fetch only specific files; omit it to get all text files. Requires site_id + edit_token.

  Connector

• start_build

  PRD to Flutter APK

  Buy a build. Call once without `x_payment` to get the x402 payment requirements, sign an EIP-3009 authorization over them, then call again passing the signed authorization as `x_payment`. Returns a job id; poll it with build_status until apk_available is true, then download the APK from apk_url. A build takes about 5-8 minutes, so poll rather than blocking. Payment settles on-chain before the build starts, and a failed build still returns its diagnostics.

  Connector

• read_kit_files

  gamedev.pl

  Read up to 12 small Creator Kit files in one call (≤128 KiB aggregate). Prefer this over repeated read_kit_file to stay within per-turn tool-call limits. Pass engineRef from get_kit. Per-path failures stay in files[]; oversized files need read_kit_file_fragment.

  Connector

• patch_source_file

  gamedev.pl

  Edit existing path(s) in the staging buffer without re-uploading whole files. Prefer this over stage_source_file whenever the file already exists (from get_sources, a prior stage, or the seed) — especially for large game/render.ts or game/model.ts files. PREFERRED: pass old + new (exact unique substring replace), or patches: [{ old, new }, ...] for multiple replacements in one file, or files: [{ path, old, new } | { path, patches: [{ old, new }] }, ...] to edit several files in one call — no @@ line numbers, no diff format. With patches[] / files[], replacements apply sequentially per file; ensure earlier replacements do not make a later old snippet ambiguous. Edits that apply are kept even if later ones miss — retry only failed[] (path + index), do not resend the ones that landed. Honour warnings.code=patch_incomplete. ALTERNATE: pass path + patch as a unified diff for that single file ("--- a/game/render.ts\n+++ b/game/render.ts\n@@\n context\n-old\n+new\n context\n"; bare @@ ok). old must match exactly once; widen the snippet if it is ambiguous. Do not mix files[] with top-level path/old/new/patches/patch. Then submit_sources({ fromStaged: true, mode, kitEngineRef }); fromStaged overlays onto the latest delivery/seed so you only need the patched paths staged.

  Connector

• webpage_tabs

  Robot Actions — Remote Device Control

  List, open, switch and close browser tabs on the device — one tool for what would otherwise be several. `list` works on BOTH iOS Safari and Android Chrome and returns a pageId per tab; pass that pageId to any other webpage_* tool to act on that specific tab, on either platform. `new`, `select` and `close` are ANDROID ONLY and error on iOS rather than pretending — Safari can list and drive tabs remotely but cannot open or close them, and needs no switching since pageId already targets one directly. Stale tabs accumulate across sessions and clutter the list: close what you are done with.

  Connector

• deploy_app

  AppDeploy

  Deploy or update a website or web app to get a public URL. Text files only in files[]. files[] must be a JSON array, even for one file. Example: files: [{"filename":"src/App.tsx","content":"..."}]. Never pass a bare string or a single file object. Use files[] for inline text edits and diffs, not for copying large existing local file contents into tool params. Never inline or base64-encode binary assets/resources in files[]; use upload_assets first for images, fonts, media, PDFs, archives, and other client-supplied file assets, then pass upload_id. Inline deploy_app text payloads MUST be compact. For JavaScript/TypeScript/JSX/TSX string literals, use single quotes wherever valid. Keep inline HTML/CSS/JS/TS diff from/to values single-line wherever valid; do not include newline characters unless required for valid syntax. Template files from get_app_template are auto-included as the baseline — use diffs[] to modify them; content is otherwise only for entirely new files. New apps: tests/tests.txt is the intentional template-file exception and must be sent as a complete content replacement. New apps: set app_id to null, provide app_name, description, app_type, frontend_template, and features. Updates: provide existing app_id, features, and either changed files/deletePaths or upload_id. If upload_id is provided, do not also send files[] or deletePaths[]; the upload manifest owns all text changes, diffs, and delete operations. Rules: do not add @appdeploy/client or @appdeploy/sdk to package.json (platform-injected). SPAs must use HashRouter. Frontend must never import @appdeploy/sdk; backend must never import @appdeploy/client. Frontend must use api from @appdeploy/client for backend calls, never fetch() or axios. If frontend realtime is used, @appdeploy/client websocket usage is ws.connect() only; do not call ws.subscribe/ws.publish/ws.send directly on ws. After deploy, poll get_app_status every 5s until status is 'ready' or 'failed'. If get_app_status returns QA/e2e/runtime errors, attempt automatic fixes and redeploy up to 3 times before asking the user for guidance.

  Connector

• publish_site

  mcp

  Deploy files to a live URL. No slug → create a NEW site (works without auth; anonymous sites expire in 24h — always show the user the claimUrl). With slug → UPDATE that site (complete snapshot: send ALL files). A Dockerfile in the files makes it a server-side app (auth required; listen on process.env.PORT; persist under /data; poll app_status). Total payload ≤ 8 MB — for bigger sites use the dataecho skill scripts.

  Connector

• how-to

  Fast.io

  Built-in product help — ask a natural-language "how do I…" question about Fastio and get a grounded, product-aware answer (or a short clarifying question) back in one call. EXPLAIN-ONLY / ADVISORY: it returns GUIDANCE TEXT and performs NO platform action (it will not create shares, move files, or change anything) — read the guidance, then act with the other tools. Answers are grounded in Fastio's own how-to knowledge AND phrased in terms of these MCP tools — they name the concrete `<tool> action="…"` calls to make — so prefer this over guessing endpoints or burning exploratory calls. For Q&A over YOUR uploaded files (RAG) use the `ai` tool instead — `how-to` answers questions about Fastio ITSELF. FREE and requires only an authenticated user (no org, no plan gate, no billing). Call action='describe' for the full action/param reference.

  Connector

• hires_upload_candidate_file

  100Hires - AI ATS & Recruitment Software

  Upload a file for a candidate using a base64 payload. Used for portfolio uploads and document attachment. WARNING: host function-call serializers (both OpenAI and Anthropic) truncate tool arguments above ~20KB, so binary files larger than that will arrive corrupted. For resumes specifically, prefer hires_create_candidate / hires_update_candidate with resume_text — the model parses the file from chat context and passes extracted text, avoiding the size limit entirely.

  Connector

• cabgo_create_my_app

  Cabgo Builder

  Materializes a free Cabgo workspace for the operator and queues an Android build of their branded app. No payment, no card, no checkout — the workspace is free to create and operate. Call ONLY when the user explicitly wants to create / launch / spin up / set up a new app for their business — verbs like 'create', 'launch', 'build me', 'set up an app for'. Do NOT call this for setup / installation / connector questions (use cabgo_install_instructions). Ask the user 2 things: (1) what type of business — taxi / food delivery / gas distribution? (2) what brand name for their app? Optionally city + brand color. **The connected OAuth user becomes the owner automatically** — no email or name is needed in the body. **A single user can own multiple tenants** — calling this again creates a NEW workspace rather than erroring. Branding tweaks happen via other Cabgo tools after creation. Any plan / billing / subscription management is done by the operator on https://www.cabgo.app — never through this tool.

  Connector

• publish_site

  shiply

  Publish files to the web → live URL at <slug>.shiply.now. UPDATING: never create a new site for changes — re-call with claimToken (anonymous sites) or slug (sites you own with a Bearer key) and the SAME URL gets the new version. Unchanged files are hash-skipped server-side, so re-publishing (including retrying a failed publish) is cheap — always update the same site rather than creating a new one. Works WITHOUT auth (anonymous: 24h lifetime, returns claimToken/claimUrl — SAVE THEM). With a Bearer shp_ key sites are permanent. ≤50 files / 2 MB inline; bigger: REST flow per https://shiply.now/llms.txt. index.html serves at /. spaMode for client-side routing.

  Connector

• submit_brief

  IBO Studio MCP

  Submit the creative brief for a PAID order: pass order_token (from get_order; session ids are not accepted here) plus project fields (product, goal, audience, channels, resolution, launch, links, constraints) and files[] from create_upload_url. Delivery resolution must be selected before creative kickoff. Customer identity comes from the verified payment. NOTE: unpaid/anonymous submissions are rejected here; for Custom Production inquiries without payment use the submit_custom_inquiry tool instead.

  Connector

• batch_upload_pdf

  KDAN PDF

  Upload multiple PDF files from ChatGPT file attachments. Use this when the user provides multiple file attachments in ChatGPT. Downloads each PDF from its signed URL and stores it. Returns session_id and a list of job_ids. Like upload_pdf, this ONLY works on hosts that resolve chat attachments for you (ChatGPT). On Claude and other MCP clients, call create_upload_page instead. Never invent or guess a download_url or file_id. MANDATORY WORKFLOW before calling this tool: 1. ALWAYS call check_upload_status FIRST — even if you think the files are new. 2. Only include files confirmed absent from check_upload_status. If ALL files are already uploaded, skip batch_upload_pdf entirely and reuse the existing job_ids. 3. Reuse job_ids from already_uploaded — do NOT re-upload those files. Skipping step 1 and calling batch_upload_pdf directly is FORBIDDEN. After batch_upload_pdf completes: if the user requested a comparison, call 'compare_pdfs' with the returned job_ids immediately.

  Connector

• check_upload_status

  KDAN PDF

  Check existing uploads and determine which files still need uploading. Call this BEFORE upload_pdf or create_upload_page to avoid duplicate uploads. Also call it after the user uploads via the widget to discover the new file and its job_id. Returns 'session_id' (always — store it!), plus: - 'already_uploaded': files from pending_filenames that are already in this session, with reusable job_ids (empty when pending_filenames is omitted) - 'needs_upload': files not yet in this session (must be uploaded) - 'jobs' / 'count': every file currently stored in this session You MUST call this tool before any upload, and you MUST act on its result immediately. When you passed pending_filenames: - 'needs_upload' is non-empty → call upload_pdf (single) or batch_upload_pdf (multiple) with ONLY the files listed in 'needs_upload'. Pass the same session_id. Do NOT upload files in 'already_uploaded'. - 'needs_upload' is empty → skip uploading entirely; use the job_ids from 'already_uploaded'. When pending_filenames is omitted, 'already_uploaded' and 'needs_upload' are always empty and carry NO meaning — read 'jobs' instead. A non-empty 'jobs' means the files are already here: use those job_ids and do NOT ask the user to upload again.

  Connector

• webpage_click

  Robot Actions — Remote Device Control

  Click an element in the device browser, by CSS selector or by a `ref` from a page-elements listing — works on BOTH iOS Safari and Android Chrome, auto-detected from the udid. Scrolls the element into view, waits for it to stop moving, and checks it is actually clickable — visible, non-zero-size, enabled, and not covered by anything — retrying until timeoutMs before it gives up. Then taps its center. On iOS the DEVICE taps its own screen at that position, so the page receives a real, fully trusted touch — pointerdown, touchstart, mousedown and click, exactly as from a finger — which also satisfies sites that gate on trusted input. On Android the tap is delivered as a TOUCH through the browser, so elements listening for pointer events respond as well as those listening for click. Falls back to mouse events, then a plain `.click()`, if a step is unsupported, and the response reports which was used via `via`. ERRORS rather than reporting success when the element never becomes clickable; pass force:true to skip the checks and dispatch at its coordinates anyway — which works for anything that still occupies a box, but NOT for a display:none or zero-size element, where there is no point to aim at and force fails too. When a selector matches several elements the first VISIBLE one wins, not the first in document order. This is COORDINATE-based. Android events are synthesized by the browser (isTrusted:false); iOS taps are real device input (isTrusted:true) whenever `via` comes back as "nativeTap".

  Connector

• remediate_findings

  quantakrypto pqc-tools (hosted)

  Produce a deterministic remediation REQUEST bundle (rubric + fix schema + per-finding metadata + fingerprints) for YOU (the host agent) to fix. This tool calls no model and needs no key. For each finding, propose the corrected FULL file content, then VERIFY with verify_fix and keep only fixes that clear the finding. Never touch files with secrets; never auto-merge. Pass 'findings' from scan_path --format json.

  Connector

• resolve_topic

  Pine Script

  USE WHEN looking up an exact Pine Script API term or known concept keyword. Returns the best-matching doc paths with matched keywords and a retrieval suggestion (get_doc or list_sections + get_section). AFTER calling this tool, follow the suggestion: call get_doc() for small files or list_sections() + get_section() for large files. For natural language questions use search_docs() instead. Data sourced from bundled TOPIC_MAP and doc file content scan.

  Connector