"AWS instance metadata service endpoint URL" matching MCP tools:

• registerA

  agent-tools (x402 + MCP + A2A directory)A

  Self-register an x402 / MCP service in the agent-tools directory. Service owners and agents may submit new services here. Submissions are auto-reviewed instantly by x402 verification (no human gate): if the URL proves x402 payment support it is listed immediately and shows up in `search`; otherwise it is rejected or retried automatically. Listing is FREE. Dedup: if a service with the same canonical origin (scheme://host) already exists in the directory we return its slug instead of creating a duplicate submission. Same goes for a still-pending submission with the same origin. Rate limit: at most 5 pending submissions per client IP per 24h. Hits beyond that get `{error: rate_limited}` — try again later or email contact@agent-tools.cloud for bulk imports. Args: url: Public HTTPS URL of the service (the x402-payable endpoint or its homepage). Required. name: Human-friendly name. Defaults to the URL hostname. description: One-paragraph description (max ~2000 chars). mcp_url: If the service speaks MCP, its streamable-http endpoint. category: Free-form (e.g. "defi", "search", "social"). Use `list_categories` to align with existing taxonomy. chains: Networks the service accepts payment on (e.g. ["base", "solana"]). price_min_usdc: Lower bound of per-call price in USDC. price_max_usdc: Upper bound of per-call price in USDC. contact: Optional email / handle the directory team can reach you on for clarifications.

  ConnectorNo auth

• awsinspect_batchA

  InsideOut (Riley)A

  BATCH INSPECTION: run up to 32 AWS inspect probes in one call. ⚠️ **PREREQUISITE**: Same as awsinspect — deploy attempt required. Check convostatus for hasDeployAttempt=true before calling. Use this when you need to check more than ~3 resources. The backend fetches Oracle credentials ONCE per batch and fans out probes against a single AWS config — for a 12-resource health check this is ~5–8× faster and 12× fewer Oracle round-trips than calling awsinspect 12 times. BUDGETS: - Up to 32 sub-probes per call (subs array length). - 30s per-sub timeout; 60s total batch wall-clock. - Concurrency cap 8 — sub-probes run in parallel but never saturate AWS. - 512 KB response cap: subs past the cap keep their envelope (index/service/action/ok) but have result replaced with truncated=true. PARTIAL FAILURE IS EXPECTED. The response is an ordered results array; each entry has {index, service, action, ok, result, error}. Inspect each result — do NOT abort on the first error. A credential fetch failure leaves cred-less probes (list-actions, list-metrics) succeeding anyway. REQUIRES: session_id from convoopen response (format: sess_v2_...). Supported services: account, acm, alb, apigateway, apprunner, backup, bedrock, cloudfront, cloudwatchlogs, cognito, cost-explorer, dynamodb, ebs, ec2, ecs, eks, elasticache, kms, lambda, msk, opensearch, rds, route53, s3, sagemaker, secretsmanager, sqs, vpc, waf For a specific service's actions, use awsinspect (singular) with action="list-actions" — batch is not the place for discovery. Batch responses are always summarized (no detail/raw per-sub); use singular awsinspect when you need full metadata or raw API output for one resource. EXAMPLES: - awsinspect_batch(session_id=..., subs=[ {"service":"ec2","action":"describe-instances"}, {"service":"rds","action":"describe-db-instances"}, {"service":"vpc","action":"describe-vpcs"}, {"service":"s3","action":"list-buckets"}]) - awsinspect_batch(session_id=..., subs=[ {"service":"ec2","action":"get-metrics","filters":"{\"hours\":6}"}, {"service":"rds","action":"get-metrics","filters":"{\"hours\":6}"}])

  ConnectorNo auth

• awsinspect_batchA

  InsideOut (Riley)A

  BATCH INSPECTION: run up to 32 AWS inspect probes in one call. ⚠️ **PREREQUISITE**: Same as awsinspect — deploy attempt required. Check convostatus for hasDeployAttempt=true before calling. Use this when you need to check more than ~3 resources. The backend fetches Oracle credentials ONCE per batch and fans out probes against a single AWS config — for a 12-resource health check this is ~5–8× faster and 12× fewer Oracle round-trips than calling awsinspect 12 times. BUDGETS: - Up to 32 sub-probes per call (subs array length). - 30s per-sub timeout; 60s total batch wall-clock. - Concurrency cap 8 — sub-probes run in parallel but never saturate AWS. - 512 KB response cap: subs past the cap keep their envelope (index/service/action/ok) but have result replaced with truncated=true. PARTIAL FAILURE IS EXPECTED. The response is an ordered results array; each entry has {index, service, action, ok, result, error}. Inspect each result — do NOT abort on the first error. A credential fetch failure leaves cred-less probes (list-actions, list-metrics) succeeding anyway. REQUIRES: session_id from convoopen response (format: sess_v2_...). Supported services: account, acm, alb, apigateway, apprunner, backup, bedrock, cloudfront, cloudwatchlogs, cognito, cost-explorer, dynamodb, ebs, ec2, ecs, eks, elasticache, kms, lambda, msk, opensearch, rds, route53, s3, sagemaker, secretsmanager, sqs, vpc, waf For a specific service's actions, use awsinspect (singular) with action="list-actions" — batch is not the place for discovery. Batch responses are always summarized (no detail/raw per-sub); use singular awsinspect when you need full metadata or raw API output for one resource. EXAMPLES: - awsinspect_batch(session_id=..., subs=[ {"service":"ec2","action":"describe-instances"}, {"service":"rds","action":"describe-db-instances"}, {"service":"vpc","action":"describe-vpcs"}, {"service":"s3","action":"list-buckets"}]) - awsinspect_batch(session_id=..., subs=[ {"service":"ec2","action":"get-metrics","filters":"{\"hours\":6}"}, {"service":"rds","action":"get-metrics","filters":"{\"hours\":6}"}])

  ConnectorNo auth

• connections_accountsA

  ConnectionsA

  THE answer to 'is <service> connected?' - every connected account/instance this company has (service, instance, accountId, region), filterable with `service` and narrowed with `match` (looking for one plane's instance? pass `match` - the full list is ~50 rows). Pass an instance as connections_execute's `instance` to target one. Two kinds: a normal row holds a credential in this vault; a kind:'brokered' row is owned by ANOTHER first-party plane (named in `via`) that holds the credential - notably every Stripe account linked through Pay, which you reach with Pay endpoints per the row's `callWith`, NOT with service:'stripe'. Stripe can appear BOTH ways at once and they are different accounts: a brokered row is Pay's Connect link, while a normal stripe row is a secret key this workspace pasted directly and IS called with service:'stripe' as its own instance - so read the row's `kind` before choosing how to call it. A `brokeredUnavailable` field means that plane could not be reached, so the list is INCOMPLETE - never read it as 'not connected'.

  ConnectorOAuth

• thestarmy_articleA

  Crawlora MCPB

  Fetch public The Star (Malaysia) story metadata and body paragraphs from a canonical `url`. Metered or premium stories return only the public teaser with `paywalled` set to true; if no teaser is available, the endpoint returns a permission error. Use thestarmy_headlines to find stories, thestarmy_news for the general feed, or thestarmy_author for a byline page.

  ConnectorNo auth

• thestarmy_articleA

  Crawlora MCPB

  Fetch public The Star (Malaysia) story metadata and body paragraphs from a canonical `url`. Metered or premium stories return only the public teaser with `paywalled` set to true; if no teaser is available, the endpoint returns a permission error. Use thestarmy_headlines to find stories, thestarmy_news for the general feed, or thestarmy_author for a byline page.

  ConnectorNo auth

• fetchA

  Penfield MemoryA

  [ChatGPT Connector compat] Fetch memory by ID. Exists to satisfy ChatGPT Deep Research's required `search`/`fetch` tool contract. Native MCP clients should fetch via `recall` + memory_id, or use the API's GET /memories/{id} endpoint directly. Returns a single memory with citation support (id, title, url, text fields). Args: id: Memory UUID to fetch ctx: MCP context Returns: Dict with id, title, url, text, metadata fields

  ConnectorOAuth

• awsinspectA

  InsideOut (Riley)A

  INSPECTION: Inspect AWS infrastructure for a deployed project ⚠️ **PREREQUISITE**: This tool requires a prior deployment ATTEMPT (successful or failed). Check convostatus for hasDeployAttempt=true before calling. Works even after failed deploys to inspect orphaned resources. Inspect deployed AWS resources after a deployment attempt. Use this tool when the user asks about the status or details of their deployed infrastructure. It fetches temporary read-only credentials securely and queries the AWS API directly. RESPONSE TIERS (default is summary for token efficiency): - Summary (default): Key fields only (~500 tokens). Set detail=false, raw=false or omit both. - Detail: Full metadata for a specific resource. Set detail=true + resource filter. - Raw: Complete unprocessed API response. Set raw=true. REQUIRES: session_id from convoopen response (format: sess_v2_...). Supported services: account, acm, alb, apigateway, apprunner, backup, bedrock, cloudfront, cloudwatchlogs, cognito, cost-explorer, dynamodb, ebs, ec2, ecs, eks, elasticache, kms, lambda, msk, opensearch, rds, route53, s3, sagemaker, secretsmanager, sqs, vpc, waf For a specific service's actions, call with action="list-actions". METRICS: Use list-metrics to discover available metrics for a service (no credentials needed). Then use get-metrics to retrieve data (auto-discovers resources). Most services return CloudWatch time-series. KMS returns key health (rotation, state). SecretsManager returns secret health (rotation, last accessed/rotated). Optional filters JSON: {"hours":6,"period":300}. BILLING: Use service=cost-explorer to inspect AWS costs. Actions: get-cost-summary (last 30 days by service, filters: {"days":7,"granularity":"DAILY"}), get-cost-forecast (projected spend through end of month), get-cost-by-tag (costs grouped by tag, filters: {"tag_key":"Environment","days":30}). Requires ce:GetCostAndUsage and ce:GetCostForecast IAM permissions. EXAMPLES: - awsinspect(session_id=..., service="ec2", action="describe-instances") - awsinspect(session_id=..., service="cost-explorer", action="get-cost-summary") - awsinspect(session_id=..., service="ec2", action="get-metrics", filters="{\"hours\":6}") - awsinspect(session_id=..., service="rds", action="describe-db-instances", detail=true)

  ConnectorNo auth

• awsinspectA

  InsideOut (Riley)A

  INSPECTION: Inspect AWS infrastructure for a deployed project ⚠️ **PREREQUISITE**: This tool requires a prior deployment ATTEMPT (successful or failed). Check convostatus for hasDeployAttempt=true before calling. Works even after failed deploys to inspect orphaned resources. Inspect deployed AWS resources after a deployment attempt. Use this tool when the user asks about the status or details of their deployed infrastructure. It fetches temporary read-only credentials securely and queries the AWS API directly. RESPONSE TIERS (default is summary for token efficiency): - Summary (default): Key fields only (~500 tokens). Set detail=false, raw=false or omit both. - Detail: Full metadata for a specific resource. Set detail=true + resource filter. - Raw: Complete unprocessed API response. Set raw=true. REQUIRES: session_id from convoopen response (format: sess_v2_...). Supported services: account, acm, alb, apigateway, apprunner, backup, bedrock, cloudfront, cloudwatchlogs, cognito, cost-explorer, dynamodb, ebs, ec2, ecs, eks, elasticache, kms, lambda, msk, opensearch, rds, route53, s3, sagemaker, secretsmanager, sqs, vpc, waf For a specific service's actions, call with action="list-actions". METRICS: Use list-metrics to discover available metrics for a service (no credentials needed). Then use get-metrics to retrieve data (auto-discovers resources). Most services return CloudWatch time-series. KMS returns key health (rotation, state). SecretsManager returns secret health (rotation, last accessed/rotated). Optional filters JSON: {"hours":6,"period":300}. BILLING: Use service=cost-explorer to inspect AWS costs. Actions: get-cost-summary (last 30 days by service, filters: {"days":7,"granularity":"DAILY"}), get-cost-forecast (projected spend through end of month), get-cost-by-tag (costs grouped by tag, filters: {"tag_key":"Environment","days":30}). Requires ce:GetCostAndUsage and ce:GetCostForecast IAM permissions. EXAMPLES: - awsinspect(session_id=..., service="ec2", action="describe-instances") - awsinspect(session_id=..., service="cost-explorer", action="get-cost-summary") - awsinspect(session_id=..., service="ec2", action="get-metrics", filters="{\"hours\":6}") - awsinspect(session_id=..., service="rds", action="describe-db-instances", detail=true)

  ConnectorNo auth

• aw_check_endpointA

  Agent WatchA

  Probe an MCP or HTTP-402 endpoint now and get its trust verdict. Performs a real MCP initialize handshake (not a ping), measures p50/p95 latency, counts tools, hashes the tool schema (for drift detection), and checks RFC 9728 auth metadata. Returns: alive (bool), name, tool_count, latency_p50_ms, tool_schema_hash, auth_metadata_present, and error detail when dead. Use before wiring any new MCP server into your client. Args: url: the MCP or HTTP-402 endpoint URL to probe (e.g. https://host/mcp/) timeout: probe timeout in seconds (default 30)

  ConnectorNo auth

• connections_copy_connectionA

  ConnectionsA

  Copy one connected service (Cloudflare, GitHub, AWS, ...) from one of the member's workspaces into another, so the receiving workspace uses the same account without a new sign-in. The copy SHARES the source's credential - nothing secret is duplicated, read into this conversation or returned. Allowed only while the member's cross-workspace access is ON (connections_cross_workspace_access) and BOTH workspaces are solely theirs; otherwise the reply is cross_workspace_refused with a reason and the settings link - say that and do not retry; when the member asked you to do it, mint a one-tap link with connections_copy_connection_link and send them that instead. Name the source EXACTLY ONE way: `connectionId` (the source row's id, from GET /v1/connected-services in the source workspace), or `service` (the connector slug, e.g. "ssh") + `instance` (that connection's instance name) - naming both forms together returns conflicting_source, and naming neither returns missing_source. `fromProject` defaults to whichever of the member's own workspaces holds that connection, the one this assistant is bound to included; pass it when service + instance matches in more than one workspace (the reply is ambiguous_source, listing each candidate's project_id) or to search only one. A not_found names the workspace searched - pass fromProject, or switch to service + instance, rather than guessing. Pass `overwrite` with a connection id in the TARGET workspace to replace a dead or duplicate connection in one act: the copy lands first, the old row is disconnected, and the copy takes its name. Returns {connectionId, projectId, instanceName, sharesCredential}.

  Connector

  Destructive

  OAuth

• manage_webhookA

  BriefGateA

  Register, list, or remove a webhook endpoint: a public HTTPS URL on the user's own service that BriefGate POSTs intake events to, as an alternative to polling get_intake_status. Webhook reference: https://briefgate.dev/docs/webhooks The endpoint must be reachable from the internet over HTTPS. A URL that cannot receive (for example a process that runs only in a local terminal) produces failing deliveries while the intake looks watched, so without such a service polling get_intake_status is the working option. action="create" returns a signing "secret" exactly once. The receiving service needs it to verify the signature on every delivery (verifyWebhookSignature from @briefgate/mcp/webhook), and it cannot be shown again. If it is ever exposed, there is no rotation in place — delete the endpoint and create a new one, which issues a fresh secret. Events: intake.completed (all required items in — the one to act on), item.submitted (a single item arrived), client.viewed (the client opened the portal), chase.bounced (a reminder failed to deliver), intake.overdue (the due date passed with required items outstanding — the one to act on when work is blocked), intake.stalled (fires only when the intake sets max_reminders; without it this event never arrives).

  Connector

  Destructive

  API key

• nodeset_compatibility_statusA

  OPC UA NodeSet GateA

  Return bounded service metadata for OPC UA NodeSet Compatibility Gate. Use this only to discover deployment stage, deterministic static-analysis scope, production availability and payment status; do not use it to compare NodeSets. The result includes the shared MCP endpoint and explicitly lists which tool calls are free and which require x402 payment.

  ConnectorNo auth

• create_userA

  mcpA

  Create a database user for a Cloud SQL instance. * This tool returns a long-running operation. Use the `get_operation` tool to poll its status until the operation completes. * When you use the `create_user` tool, specify the type of user: `CLOUD_IAM_USER`, `CLOUD_IAM_SERVICE_ACCOUNT`, or `BUILT_IN`. * By default the newly created user is assigned the `cloudsqlsuperuser` role, unless you specify other database roles explicitly in the request. * You can use a newly created user with the `execute_sql` tool if the user is a currently logged in IAM user. The `execute_sql` tool executes the SQL statements using the privileges of the database user logged in using IAM database authentication. The `create_user` tool has the following limitations: * To create a built-in user with password, use the `password_secret_version` field to provide password using the Google Cloud Secret Manager. The value of `password_secret_version` should be the resource name of the secret version, like `projects/12345/locations/us-central1/secrets/my-password-secret/versions/1` or `projects/12345/locations/us-central1/secrets/my-password-secret/versions/latest`. The caller needs to have `secretmanager.secretVersions.access` permission on the secret version. * The `create_user` tool doesn't support creating a user for SQL Server. To create an IAM user in PostgreSQL: * The database username must be the IAM user's email address and all lowercase. For example, to create user for PostgreSQL IAM user `example-user@example.com`, you can use the following request: ``` { "name": "example-user@example.com", "type": "CLOUD_IAM_USER", "instance":"test-instance", "project": "test-project" } ``` The created database username for the IAM user is `example-user@example.com`. To create an IAM service account in PostgreSQL: * The database username must be created without the `.gserviceaccount.com` suffix even though the full email address for the account is`service-account-name@project-id.iam.gserviceaccount.com`. For example, to create an IAM service account for PostgreSQL you can use the following request format: ``` { "name": "test@test-project.iam", "type": "CLOUD_IAM_SERVICE_ACCOUNT", "instance": "test-instance", "project": "test-project" } ``` The created database username for the IAM service account is `test@test-project.iam`. To create an IAM user or IAM service account in MySQL: * When Cloud SQL for MySQL stores a username, it truncates the @ and the domain name from the user or service account's email address. For example, `example-user@example.com` becomes `example-user`. * For this reason, you can't add two IAM users or service accounts with the same username but different domain names to the same Cloud SQL instance. * For example, to create user for the MySQL IAM user `example-user@example.com`, use the following request: ``` { "name": "example-user@example.com", "type": "CLOUD_IAM_USER", "instance": "test-instance", "project": "test-project" } ``` The created database username for the IAM user is `example-user`. * For example, to create the MySQL IAM service account `service-account-name@project-id.iam.gserviceaccount.com`, use the following request: ``` { "name": "service-account-name@project-id.iam.gserviceaccount.com", "type": "CLOUD_IAM_SERVICE_ACCOUNT", "instance": "test-instance", "project": "test-project" } ``` The created database username for the IAM service account is `service-account-name`.

  ConnectorNo auth

• create_webhookA

  DockA

  Register a new webhook endpoint on an org. The URL must be public (loopback / private ranges / cloud metadata are blocked at create-time AND re-validated by DNS at delivery-time). Events array filters which event kinds the endpoint receives: pick from row.* / comment.* / member.* / workspace.* / doc.*; an empty array means "none" so always pass at least one. Returns the signing `secret` exactly once (whsec_… prefixed); store it on the receiver to verify HMAC signatures on incoming requests.

  ConnectorNo auth

• timer_verify_originA

  zermA

  One-time consent handshake before timers can deliver to an origin. Prerequisite: an HTTPS endpoint you control that can read a request body and echo part of it back - if you have no endpoint of your own, timers are not usable yet. zerm POSTs {type:"zerm.origin_verification", token, service, instructions} to the URL; the endpoint must answer 2xx with the token echoed anywhere in the response body. The URL must be https on the default port, publicly reachable, with no credentials and no private/reserved IP. Verification covers the whole origin (scheme+host) and persists, so this is once per origin, not once per timer.

  ConnectorNo auth

• oracle.discovery_bundleA

  InterAI Risk OracleA

  Read-only bootstrap or handoff bundle with service identity, interfaces, runtime mode, contracts, schemas, and sample payloads in one response. Use it for complete integration context; use oracle.service_descriptor for focused service metadata, oracle.agent_card for A2A capabilities, or oracle.get_pricing for costs.

  ConnectorNo auth

• oracle.service_descriptorA

  InterAI Risk OracleA

  Read-only general service descriptor with identity, endpoints, billing, trust, and supported agent protocols. Use it to inspect service-level integration metadata; use oracle.agent_card for A2A skills or oracle.discovery_bundle for the complete bootstrap package.

  ConnectorNo auth

• find_playbooksA

  Cloud FinOps Skill & MCPA

  Finds the runbook for a specific cloud waste pattern, filtered by provider, service, waste category or detection confidence. Useful before answering a specific waste or cost-fix question: each runbook includes a tested detection query the user can run in their own account, so it also serves questions about the user's own resources. Use this for questions like "which VMs are running for nothing", "why is our NAT bill so high", "my NAT gateway processes 10TB to S3", "should I delete these old snapshots", "which of our RIs are about to expire", "what waste can we clean up safely without review" - anything that names a provider, a waste category, or how confident the detection needs to be before acting. Patterns covered include NAT gateways and VPC endpoints, expiring Savings Plans / RIs / reservations, snapshot sprawl, S3 lifecycle gaps, idle or stopped VMs, orphaned disks / public IPs / EBS volumes, GPU and SageMaker sizing, Kubernetes idle capacity, and schedule blindness. All filters are optional and combine with AND semantics. String matching is case-insensitive and exact. Examples: - ``find_playbooks(scope="aws")`` - all AWS-specific playbooks - ``find_playbooks(waste_category="idle")`` - every idle-resource pattern - ``find_playbooks(scope="cross-cloud", confidence="obvious")`` Args: scope: ``"aws"``, ``"azure"``, ``"gcp"``, or ``"cross-cloud"``. service: Provider service exact-match (e.g. ``"AWS NAT Gateway"``). waste_category: ``"orphaned"``, ``"idle"``, ``"overprovisioned"``, ``"commitment-mismatch"``, ``"schedule-blindness"``, ``"modernization"``, ``"ai-ml-inefficiency"``, or ``"egress"``. confidence: ``"obvious"`` (single signal is enough), ``"likely"`` (two signals required), or ``"possible"`` (needs human review). From the OptimNow three-tier confidence model in `finops-waste-detection-playbooks`. Returns ``{"filters": {...}, "playbooks": [...], "total": N}``. A query that matches nothing also returns `hint` and `valid_values`, so a typo is distinguishable from a genuine gap in coverage.

  ConnectorNo auth

• create_aws_clusterA

  AnkraB

  Create and provision a new self-managed Kubernetes cluster on AWS EC2: k3s or kubeadm on Ubuntu instances reached through a bastion host, with the AWS cloud controller manager, the EBS CSI driver and an NLB-fronted ingress installed. By default Ankra creates the network: a VPC from network_ip_range (default 10.0.0.0/16) with a public /24 and a private /20 per availability zone, an internet gateway and NAT gateways (egress_mode nat_gateway), all torn down with the cluster; omit vpc_id for this and, unless the user names availability_zones, the preflight picks one zone (three when control_plane_count is 3 or more). To adopt an existing VPC instead, pass vpc_id with at least one private node subnet (node_subnet_ids) and a public bastion subnet (bastion_subnet_id); Ankra never modifies an adopted VPC's network. Requires an AWS credential, an SSH key credential, a region and the IPv4 CIDRs allowed to SSH to the bastion. Use list_provider_credentials with provider='aws' and provider='ssh-key' to find the credential ids. There is no chat-side VPC or subnet listing: when adopting, take the vpc_id, node_subnet_ids and bastion_subnet_id from the user (or the AWS console) and confirm with them, before proposing, that every subnet belongs to that VPC and region, the node subnets are private, and the bastion subnet routes to an internet gateway - the same checks the create's preflight enforces. The create runs that preflight first (credential scope; for a created network the CIDR plan, the zones and the VPC / NAT-gateway / elastic-IP quotas, for an adopted VPC the VPC and subnet facts and egress routes; instance-type availability, service quotas) and refuses with every failing item when it cannot proceed; nothing is written on refusal. Instance types are EC2 names (e.g. 't3.medium', 'm6i.large'). Managed EKS creation is create_managed_cluster, not this tool. Only available to organisations with AWS self-managed provisioning enabled.

  Connector

  Destructive

  OAuth

• get_page_dataA

  Codemate websiteA

  Read the full text of a codemate.com article or client case study, given the URL that search_site, list_articles or list_references returned. Returns the title, date, metadata and the page's prose. Use this after a search to actually read a result — search only returns a summary. For Codemate's main service and product pages, use get_topic instead.

  ConnectorNo auth