"A tool or system to control 3D modelers" matching MCP tools:

• linux_auditA

  ZEN SecDBA

  Perform a Linux package vulnerability audit using SecDB. ## What this tool does Analyzes the installed packages of a Linux system-identified by OS and OS version-and returns vulnerability information plus a Markdown summary. The audit results are based exclusively on the package list provided by the user. ## When to use this tool Use this tool when the user wants to determine: - whether installed packages contain known vulnerabilities - whether a host, VM, container, or base image is affected by security advisories - which packages require patching or upgrading If the user does not know the valid values for `os` or `version`, first call the `linux_os` tool to retrieve the exact supported combinations. ## Inputs - **os**: Linux distribution identifier supported by SecDB (use `linux_os` to obtain allowed values). - **version**: OS version or codename corresponding to the selected distribution. - **packages**: list of installed packages, **one per line**, generated using the appropriate system command: ### For RPM-based distributions (RHEL, CentOS, Rocky, Alma, SUSE) rpm -qa --qf '%{NAME}-%{VERSION}-%{RELEASE}.%{ARCH}\n' ### For DEB-based distributions (Ubuntu, Debian) dpkg-query -W -f='${Package} ${Version} ${Architecture}\n' ### For Alpine Linux apk list -I The raw output of these commands can be passed directly as the `packages` input (one package per line). ... python3 3.12.3-0ubuntu2.1 amd64 systemd 255.4-1ubuntu8.10 amd64 tmux 3.4-1ubuntu0.1 amd64 ... ## Outputs - **report**: structured objects describing the advisories affecting the audited packages. - **summary**: Markdown summary including total vulnerabilities, severity breakdown, and key findings. ## LLM usage guidelines - Never guess whether a package is vulnerable-always call this tool for Linux audits. - If `os` or `version` is unclear or missing, call `linux_os` and ask the user to choose a valid combination. - Normalize the package list to “one entry per line” if the user provides unstructured output. - The `summary` is already Markdown and can be shown directly. - Use `report` when deeper technical analysis is required.

  ConnectorNo auth

• scan_injectionA

  TunnelMind Data APIB

  Runs a curated signature corpus over a piece of untrusted text — content an agent is about to consume, a retrieved document, a tool result, an email body — and returns the matched injection patterns plus a bounded 0..1 risk score. This is a signal, never a policy decision: the caller decides what to do with a flagged input. Detected classes: instruction_override (ignore/override previous rules), role_reassignment (you are now DAN / developer mode), exfiltration (leak the system prompt or a secret to a URL), tool_smuggling (covertly invoke a tool, delete/destroy data), boundary_spoof (fake system/assistant turn delimiters). Input is normalized first to blunt cheap evasions (zero-width characters, smart quotes, whitespace padding). Use this tool when: - You are an agent about to feed retrieved or third-party text into a model and want to check it for embedded instructions first. - You are triaging why a tool description or web page looks suspicious. Do NOT use this tool when: - You want a trust verdict on a domain or entity — use `cross_lens_verify`. - You want to scan a whole MCP server's tools — use `scan_mcp`. Inputs: - `text` (body, required): the untrusted text to scan. Max 200,000 chars. Returns: - `flagged`: true if any signature matched. - `score`: bounded 0..1 risk score (saturating — one high-severity hit is already strongly flagged; many hits approach but never exceed 1). - `severity_max`: highest severity among matches (`high`/`medium`/`low`) or null. - `classes`: distinct injection classes matched. - `matches`: each matched signature `{ id, class, severity, excerpt }`. Cost: - Free. No API key required. Pure edge computation, no external calls. Latency: - Typical <20ms.

  ConnectorNo auth

• foura_autoA

  mcpA

  Give it a public URL and get the content back. This is the default when you don't want to choose between HTTP, proxy rotation, and a full browser. On protected targets, or whenever HTTP 200 may still be a challenge or incomplete page, pass validate.data.accept with text unique to the real content. Auto makes bounded attempts and returns either validated content or a failure; it cannot guarantee a match. The response includes completion details and, by default, reusable session values for follow-up calls. Use a lower-level tool when you need direct control over HTTP, proxy selection, or browser navigation, or to choose which browser is presented to the target: that lives on foura_single and foura_proxy.

  ConnectorNo auth

• explain_reason_codeA

  Export ControlA

  Expand a reason-for-control code such as NS, AT or CB into its full name. Use this when reading a Control List entry or a chart column and the two-letter code is not obvious. Returns the code and the name it stands for, or the whole glossary when called with no argument. This is a glossary lookup only: it reports what a code means, never whether that control applies to anything you are shipping, and it cannot tell you whether a licence is required.

  ConnectorNo auth

• ethora-agents-create-v2A

  ethora-mcp-serverA

  Create a reusable AI agent (POST /v2/apps/:appId/agents). Works in user auth mode (the normal hosted mode) or B2B mode; app-token mode is not accepted by the backend. Each agent is a persona — name, avatar, system prompt, LLM config, plus response-gate settings (responseMode, cooldownSec) that control when it speaks in a room. For multi-agent scenarios (two or more personas conversing in one chat) create each one separately, then `ethora-agent-invite-to-chat` them into the same room. See the `ethora-agents-quickstart` prompt for the end-to-end recipe.

  ConnectorNo auth

• set_user_preferencesA

  NewzAI News MCP serverA

  Adds one or more news preferences for the authenticated user. Each preference is defined by news category(or search parameter), region, output language. Optional values include last_n_hours for recency filter, search_type, and enable_decay. Leave search_type as auto (default) — the system will classify the best type from the category. Existing preferences are not removed — new ones are appended. Login is required to access this tool.

  ConnectorOAuth

• create3DModelA

  Ludo AI Game AssetsA

  Convert a single source image into a textured 3D model (image-to-3D). The job result is a downloadable GLB model_url plus an array of snapshot image URLs rendered from different angles (handy for previews). Accepts optional mesh controls: target_num_faces (max triangle count, 1000-200000, default 50000), texture_size (1024 or 2048, default 2048), and texture_type ("pbr", "simple", or "none", default "pbr"). Credits are charged only on success. Pass an optional request_id to tag the result so you can locate it later via `GET /assets/3d-models/results`. Requires an API key (user scope). Returns 202 with a job id immediately; poll `getApiJob` (pass `wait: 30`) until status is succeeded, then read its `result` field, which is exactly the response documented for this operation. Each account may have up to 50 generations queued or running at once; beyond that submissions return 429 (PENDING_JOBS_LIMIT) - wait for jobs to finish. Credits: This endpoint consumes 3 credits per call.

  ConnectorNo auth

• designesy_skill_mdA

  DesignesyA

  Get the Designesy SKILL.md — the agent-skill-format export of the design-system contract, written as behavioral rules an AI coding agent can drop into .agents/skills/ or a system prompt. Use this when you want the contract in a form that steers how an agent *builds* UI (tokens, anti-patterns, behavioral rules, verification). When NOT to use: for the raw contract JSON, use designesy_contract; for scoring, use designesy_score. Read-only — no side effects. Returns markdown text (SKILL.md format) — drop into .agents/skills/ or paste into a system prompt. No parameters.

  ConnectorNo auth

• huntA

  SpaceMoltB

  Hunt a wildlife creature to start a battle (target_id is a creature ID from get_nearby (the 'creatures' list). Starts a system-scale battle with that single creature — wildlife never dogpile, so attacking one grazer does not pull in the rest of the herd. Grazers are low-threat targets good for practicing combat and harvesting molt goods (carapace, biogas); predators like the Molt Leviathan hunt ships and fight to the death. Killing a creature drops a carcass wreck you can loot. Equivalent to 'attack' on a creature ID. Use the 'battle' command for tactical control once engaged.)

  ConnectorNo auth

• validate_artifactA

  Verificate MCPA

  Deterministic production-readiness gate for AI-built systems. Verifies the invariants that stop a system silently shipping broken: every critical component is PRESENT and LOADS, the import closure resolves (nothing assumed 'already on the box'), all runtime dependencies are declared, and health is a REAL fail-closed check. Returns approve/reject with a fix plan and ISO 27001 / ISO 5055 control evidence. Facts are gathered by the Verificate collector in your CI; the gate is the authority. Non-bypassable, fails closed. This is the control-plane sibling of validate_ai_output — code quality is one invariant; this gates the whole deployable.

  ConnectorNo auth

• get_image_generatorA

  GoodeyeA

  Inspect one image generator you own (its model and full config) at head or a pinned version. ``generator_id`` accepts a UUID string. Platform ``system:...`` tier aliases and system generator UUIDs are not returned here (NotFound): system generators are run-only and their internal config never surfaces through list, get, deploy, or revoke. Defaults to the current version; pass ``version`` to pin. Returns the full deploy-time payload (``provider``, ``model``, ``generation_contract``, ``default_params``) plus ``config_hash`` (SHA-256 over the config) so callers can detect drift across versions. Requires ownership; a cross-user or revoked generator surfaces as NotFound.

  ConnectorOAuth

• dossier_corsA

  drwho.meA

  Core dossier check: Send a CORS preflight OPTIONS request to https://<domain>/ and return the access-control-* response headers. Use to verify CORS policy for a specific origin-method pair, or to check whether a domain allows cross-origin requests; provide origin and method to simulate a precise preflight, or omit to use defaults (origin: https://domainposture.com, method: GET). Single OPTIONS request via fetch, 5 s timeout. Returns a CheckResult: on success, {status:"ok", headers:{access-control-allow-origin,...}}; on failure, {status:"error", reason}.

  ConnectorNo auth

• get_term_infoA

  VirtualFlyBrainA

  Get term info for a VFB or anatomy ontology entity (VFB_*, FBbt_*, etc.). THIS IS THE QUERY DISCOVERY TOOL: the response's "Queries" array lists the valid query_type values that run_query accepts for this entity. ALWAYS call get_term_info before run_query unless you already obtained the query_type from a previous get_term_info call in this conversation. Returns: SuperTypes (classification), Tags (data flags like has_image, has_neuron_connectivity), Queries (valid query_types for run_query), RelatedTools (other MCP tools applicable to this entity, with default_args ready to copy — e.g. get_hierarchy with subclass_of for cell types or part_of for nervous-system regions), Images (keyed by template brain ID), Publications, Synonyms. Supports batch — pass an array of IDs to fetch in parallel; batch results are returned as a JSON object keyed by ID. To build VFB browser URLs from the Images field: https://v2.virtualflybrain.org/org.geppetto.frontend/geppetto?id=<VFB_ID>&i=<TEMPLATE_ID>,<IMAGE_ID1>,<IMAGE_ID2> — id= sets the focus term and i= lists images for the 3D viewer (template ID must be first in i= to set the coordinate space).

  ConnectorNo auth

• linux_osA

  ZEN SecDBA

  List supported Linux operating systems and their corresponding versions for use with the `linux_audit` tool. ## What this tool does Returns an array of supported OS/version pairs, each in the form: {"os":"name", "versions":["version or codename"]} This allows the LLM and the user to know exactly which inputs are valid for the `linux_audit` tool. ## When to use this tool Use this tool when: - the user does not know which OS names or versions are supported - the user provides unclear or ambiguous OS information - you need to validate `os`/`version` before performing a Linux audit This tool should typically be called **before `linux_audit`** whenever parameters are uncertain. ## Inputs This tool does not require any input. ## Outputs Returns an array of objects: - **os**: supported Linux distribution identifier - **versions**: corresponding list of supported release or codename Example: [ {"os": "ubuntu", "versions": ["noble","focal"]}, {"os": "debian", "versions": ["bookworm","sid"]}, {"os": "redhat", "version": ["redhat-9.0"]} ] ## LLM usage guidelines - Use this tool to validate or suggest correct OS/version combinations before calling `linux_audit`. - If the user provides invalid or misspelled OS names, retrieve the official list here and ask them to select one. - Do not guess operating system identifiers-always rely on this tool to confirm correctness.

  ConnectorNo auth

• medcode_check_codeA

  medical-codes-mcp-serverA

  Validate whether a US medical code exists, is current, and is billable in the active bundled release. Returns a discriminated status — valid_billable, valid_not_billable, valid_header, or terminated — with a `whyNot` explaining non-billable and terminated cases (e.g. "valid ICD-10-CM category but not billable — submit a more specific child code"). This is the detail a coder needs before submitting a claim. Auto-detects the system from the code's shape; pass an explicit `system` to disambiguate. A non-billable or terminated code is a successful result with a whyNot, not an error — only a code that exists in no bundled system raises unknown_code. A code string that also exists in another bundled system carries `alsoInSystems` naming it, since the verdict applies only to the system that answered.

  ConnectorNo auth

• estimate_productionA

  energyaiC

  Honest-range annual solar production estimate (kWh/year ± band, with assumptions) for a ZIP code, from either a proposed system size (kW) or a monthly bill. Use to sanity-check installer quotes or size a system before talking to anyone. [20 anonymous calls/caller/24h; then 100 free calls/key/30d; active Builder required for sustained informational use]

  ConnectorNo auth

• estimate_productionA

  solar-home-incentivesA

  Honest-range annual solar production estimate (kWh/year ± band, with assumptions) for a ZIP code, from either a proposed system size (kW) or a monthly bill. Use to sanity-check installer quotes or size a system before talking to anyone. [20 anonymous calls/caller/24h; then 100 free calls/key/30d; active Builder required for sustained informational use]

  ConnectorNo auth

• dossier_corsA

  drwho.me developer toolsA

  Core dossier check: Send a CORS preflight OPTIONS request to https://<domain>/ and return the access-control-* response headers. Use to verify CORS policy for a specific origin-method pair, or to check whether a domain allows cross-origin requests; provide origin and method to simulate a precise preflight, or omit to use defaults (origin: https://domainposture.com, method: GET). Single OPTIONS request via fetch, 5 s timeout. Returns a CheckResult: on success, {status:"ok", headers:{access-control-allow-origin,...}}; on failure, {status:"error", reason}.

  ConnectorNo auth

• tm_list_scenesA

  Twinmotion MCPA

  Enumerate every 2D/3D view ('scene') baked into the translated model, plus a shallow dump of the model object tree (first 50 top-level nodes across all 3D views), plus the list of completed derivatives (svf2, thumbnail, obj, etc.) available via APS. The canonical discovery tool for anything downstream that needs a view name or GUID. When to use: before tm_render_image (to pick a valid camera_preset), before tm_export_video (to plan a camera path across named views), to audit what was translated ('did the 3D coordination view survive translation?'), or to expose the top-level model hierarchy for UI display. Also a useful health check — if scene_count=0, the translation is incomplete or failed. When NOT to use: not for full property queries on individual objects (this tool returns names + GUIDs + child counts only — use a dedicated property-query tool for full attribute dumps), not for geometry data (use tm_export_video for OBJ export), not on a URN that has not yet started translating. APS scopes required: viewables:read data:read. Read-only across Model Derivative manifest + metadata + object-tree endpoints. Rate limits: APS default ~50 req/min. This tool fans out across every 3D view to fetch object trees — for models with many 3D views (10+) it can burn a chunk of the budget in one call. Prefer caching the result on the caller side rather than re-invoking. Errors: 401/403 = token/scope; 404 = URN not found; 422 = n/a; 429 = back off 60s (this tool makes multiple APS calls per invocation, so 429 is more likely than on single-call tools); 5xx = APS upstream. A 202 on object-tree means APS is still building the tree — the tool retries once internally. Side effects: NONE on APS (read-only). Writes a usage_log row. Idempotent.

  ConnectorNo auth

• hs_code_lookupA

  banking-intelligenceA

  Reverse-lookup an HS code → mapped export-control classifications (ECCNs). For customs brokers / shippers who have an HS (Harmonized System) code and need to know which export-control classifications may apply. Returns the mapped ECCNs with confidence levels, control reasons, sensitivity, and the governing international regime (Wassenaar, MTCR, NSG, etc.). A 4-digit HS heading is accepted, but mappings are richest at the 6-digit subheading level (e.g. "854231" rather than "8542"). An empty mapping list means no export-control mapping is on file for that code — it is NOT a guarantee the goods are uncontrolled; confirm with goods_classify or a formal classification. Args: hs_code: 4-6 digit HS code (e.g. "854231", "8411"). Dots/spaces are ok. jurisdiction: Optional filter — "US", "EU", "UK", or "JP". Examples: hs_code_lookup("854231") # semiconductors → 3A001 / 3A090 ... hs_code_lookup("841112") # turbojet engines → 9A001 ... hs_code_lookup("854231", "US") # US mappings only Use case: 'What export controls might apply to HS code 854231?'

  ConnectorNo auth

• dossier_corsA

  mcpA

  Core dossier check: Send a CORS preflight OPTIONS request to https://<domain>/ and return the access-control-* response headers. Use to verify CORS policy for a specific origin-method pair, or to check whether a domain allows cross-origin requests; provide origin and method to simulate a precise preflight, or omit to use defaults (origin: https://domainposture.com, method: GET). Single OPTIONS request via fetch, 5 s timeout. Returns a CheckResult: on success, {status:"ok", headers:{access-control-allow-origin,...}}; on failure, {status:"error", reason}.

  ConnectorNo auth