"An MCP that connects to local software" matching MCP tools:

• get_upload_urlA

  PartleA

  Mint a one-shot signed upload URL for a product you own. Authenticated. OAuth (scope `products:write`) preferred; `api_key` fallback. Use this when you have **local image bytes** (a file the user attached, bytes you generated/downloaded in your sandbox) and you want to attach them to a product that already exists. Common cases: - `create_product` returned 409 (duplicate name) — the listing already exists; this tool gives you an upload URL for it without creating anything new. - You're adding a 2nd, 3rd, … photo to a product. The returned URL is valid for ~15 min, single product, signed with your authenticated identity. From your sandbox, do **one PUT**: requests.put(result["upload_url"], data=open("/path/to/photo.jpg", "rb").read(), headers={"Content-Type": "image/jpeg"}) No auth header on that PUT — the URL is the credential. If you have a public URL (not local bytes), use `upload_product_image(product_id, image_url=...)` instead. Args: product_id: Product to attach the future image to. You must own it. api_key: Optional API key (`pk_*`, generate at /account). Used when there is no OAuth token, and also when the OAuth token lacks the required scope — an explicitly passed key overrides an ambient token that is scoped too narrowly. An invalid or revoked token still fails regardless. Omit when using OAuth. Returns: ``{"upload_url": str, "upload_expires_in": int}``, or ``{"error": ...}`` on auth/ownership failure.

  ConnectorNo auth

• get_upload_urlA

  Partle MarketplaceA

  Mint a one-shot signed upload URL for a product you own. Authenticated. OAuth (scope `products:write`) preferred; `api_key` fallback. Use this when you have **local image bytes** (a file the user attached, bytes you generated/downloaded in your sandbox) and you want to attach them to a product that already exists. Common cases: - `create_product` returned 409 (duplicate name) — the listing already exists; this tool gives you an upload URL for it without creating anything new. - You're adding a 2nd, 3rd, … photo to a product. The returned URL is valid for ~15 min, single product, signed with your authenticated identity. From your sandbox, do **one PUT**: requests.put(result["upload_url"], data=open("/path/to/photo.jpg", "rb").read(), headers={"Content-Type": "image/jpeg"}) No auth header on that PUT — the URL is the credential. If you have a public URL (not local bytes), use `upload_product_image(product_id, image_url=...)` instead. Args: product_id: Product to attach the future image to. You must own it. api_key: Optional API key (`pk_*`, generate at /account). Used when there is no OAuth token, and also when the OAuth token lacks the required scope — an explicitly passed key overrides an ambient token that is scoped too narrowly. An invalid or revoked token still fails regardless. Omit when using OAuth. Returns: ``{"upload_url": str, "upload_expires_in": int}``, or ``{"error": ...}`` on auth/ownership failure.

  ConnectorNo auth

• remove_backgroundA

  OpenClipA

  Remove the background from an already-uploaded image `file` (a hashid from create_upload), returning a transparent PNG. This is FREE and only needs an account, no subscription. To use a local file: call create_upload, PUT the bytes to the returned upload_url, then pass that `id` here as `file`. Do NOT call complete_upload (that starts the paid clip pipeline); this free tool reads the uploaded file directly. Processing is ASYNCHRONOUS: this returns a `tool_job` hashid and `status: "queued"`. Poll get_tool_job_status with that `tool_job` until it reports `completed`, then it returns the downloadable PNG URL. Free usage is rate-limited per day with a per-file size cap; a clear error explains how to lift a limit.

  ConnectorOAuth

• query_knowledge_graphA

  Analytics Legends — SAP AI & Analytics MCP ServerA

  The RELATIONS between the platform's teaching objects — which Academy module teaches which concept, which study covers which module, what a concept relates to. THIS IS THE ONLY TOOL ON THIS SERVER THAT SERVES EDGES; the others serve rows. Ask it what connects to what, not what exists. SCOPE, AND IT IS NARROWER THAN 'the knowledge graph': it carries four node types — `concept`, `module`, `study`, `vendor` — and every edge whose BOTH endpoints are one of them. The whole graph holds twelve node types; the eight it does not carry are each either served by their own tool or named as not served at all, and `_meta.excluded_node_types` says which per type (consultant data is served at NO tier), so a missing type is a documented boundary and never a silent gap. Call it with `node_id` (e.g. `module:M178`, `concept:C001`, `study:ai-impact-2026-EN`) to walk one node's neighbourhood; with `node_type` and/or `query` to find a node id first. `edge_type` and `direction` narrow a walk. Read `_meta.available_edge_types` — computed from the served projection on every call — before assuming an edge type exists.

  ConnectorNo auth

• whatsapp_config_setA

  WhatsAppC

  Change an editable-after-connect setting on a connected number WITHOUT re-pairing. Today the only field is `proxy_url` — the SOCKS5/HTTPS proxy WhatsApp connects through (recommended to avoid IP bans). Owner/admin or the connection owner. - `account`: which number (id/wa_jid, phone, or label; omit if only one is connected). - `values`: e.g. { "proxy_url": "socks5://user:pass@host:port" }. An empty string CLEARS the field (e.g. { "proxy_url": "" } connects with no proxy); omit the key to keep the current value. The new value applies on the next (re)connection; the live session cache is invalidated so the next tool call uses it.

  ConnectorNo auth

• tako_graph_relatedA

  TakoA

  Explore what a graph node connects to — its metrics, the entities a metric covers, competitors, industry, index membership, and sources. Two modes. Pass `node_id` alone for the map: every relation group with its key, label, total, and its first 3 names. Pass `relation` to page one group, where each item comes back with the id that explores it. Read a key off the map rather than guessing — an unknown key returns an empty group, not an error. Best for: expanding a node you already resolved. Resolve a name to a node id with `tako_available_data` first. A metric listed here means the graph tracks it, not that a card exists — `tako_search` is the final check.

  ConnectorNo auth

• convert_timeA

  Timezone TruthA

  Convert a wall-clock time between two IANA timezones, and report the ways the conversion can be wrong. ALWAYS use this instead of doing the arithmetic. Timezone conversion looks like addition and is not: the mapping from a local time to an instant is not a function. - On the spring-forward date, an hour of local time DOES NOT EXIST. Asked to convert 02:30 on that date, a model will return a plausible timestamp for a time that never happens. This tool returns null and says why. - On the fall-back date, an hour happens TWICE. There are two correct answers an hour apart; this returns both rather than silently choosing. - The gap between two zones is not constant. Zones start and end daylight saving on different dates, so a cached offset is wrong for weeks each year. - Not all offsets are whole hours: India is +05:30, Nepal +05:45. Input: `time` must be YYYY-MM-DD HH:MM (or with T, and optional seconds) — free-form dates are refused rather than guessed. `from` and `to` must be full IANA names such as "America/New_York". ABBREVIATIONS ARE REJECTED, deliberately, even though most runtimes accept them. Node resolves "BST" to Bangladesh Standard Time (UTC+06:00) when nearly everyone writing it means British Summer Time (UTC+01:00) — a five-hour error that yields a perfectly plausible timestamp. Same for CST, IST, PST, and EST. Returns: the chosen UTC instant (null if the local time does not exist), every candidate instant, both zone readings with the offset and abbreviation that applied on THAT date, the difference between the zones, upcoming clock changes for both, and warnings. Check `warnings` for severity "error" before using the result.

  ConnectorNo auth

• tegas_upload_musicA

  Tegas AIA

  Free (requires an active plan). Upload one music track and get a `url` to reuse in tegas_edit_video's `music.url`. Give exactly one of audio_base64 or file_path. audio_base64 - the audio bytes as base64 (a `data:audio/mpeg;base64,...` URL is also accepted); this is the way for any remote agent, because the file never has to be public. file_path - a path on the FILESYSTEM OF THE MCP SERVER, so it only works for local / self-hosted runs where the server and the agent are on the same machine, and only when the server enables it (otherwise the tool answers with code local_files_disabled - then send audio_base64 instead). Formats mp3, wav, m4a, up to 25 MB. Bad input comes back as validation_error with details.reason, before anything is uploaded: one_source_required (gave both or neither), bad_base64, empty, not_audio, too_large; a file_path that cannot be read is file_not_readable, and a server that forbids local files answers with code local_files_disabled. label - a short note (e.g. "background track"), optional, kept to the first 120 characters. Returns music_id, the stored url, the label and expires_at. Pass the returned url in `music.url` of tegas_edit_video (and set `music.enabled` to true if music was off). Errors: no_active_plan -> ask the user to activate a plan in the cabinet.

  ConnectorOAuth

• connect_mercuryA

  AgenticBooksA

  Connects the org to Mercury from a read-only, scoped API token the user created in their Mercury settings (Mercury uses a token, not OAuth — there is no redirect). The token is validated against Mercury's accounts endpoint and stored ONLY if it works; an invalid token stores nothing and returns an error. This grants READ access only — balances and transactions — it cannot move money. The token is sensitive: it is vault-encrypted at rest and never returned, logged, or echoed. Optionally include the per-account webhook signing secret (from where the webhook was created in Mercury) to enable live transaction events.

  ConnectorOAuth

• fvs_download_final_videoA

  Future Video StudioA

  Download a completed Future Video Studio final render URL to a local file. Use this only after fvs_get_render_status or fvs_get_paid_render_status returns a final_video_url for a completed render. The tool performs an unauthenticated HTTPS GET to that signed URL and writes the response bytes to output_path on the MCP server's local filesystem. It does not call the FVS Agent API, spend wallet credits, require FVS_AGENT_API_KEY, cancel jobs, or modify remote render state. Side effects and constraints: output_path is a local filesystem path for the MCP server process, parent directories are created, existing files are not replaced unless overwrite is true, and large videos may take minutes to download. The request timeout is 600 seconds. Use a fresh status check to refresh expired signed URLs, and do not pass arbitrary or untrusted URLs.

  Connector

  Destructive

  No auth

• ir_get_brief_templateA

  website-searchA

  Get Lenny Zeltser's IR one-page executive brief template. Standalone variant of `ir_get_template` for callers that only want the brief without the long-form report. This server never requests your incident notes and instructs your AI to keep them local—guidelines flow to your AI for local analysis.

  ConnectorNo auth

• cti_get_cross_server_routesA

  website-searchA

  Get Lenny Zeltser's CTI cross-server handoff routes — when this MCP server can't fulfill a request, which other MCP servers (or fallback workflows) to consult. Surfaces a compact subset of `cti_load_context`. This server never requests your campaign or threat-intel notes and instructs your AI to keep them local—templates and guidelines flow to your AI for local analysis.

  ConnectorNo auth

• vuln_get_brief_templateA

  website-searchA

  Get Lenny Zeltser's Vuln one-page executive brief template. Standalone variant of `vuln_get_template` for callers that only want the brief without the long-form report. This server never requests your vulnerability notes and instructs your AI to keep them local—the brief template and guidelines flow to your AI for local analysis.

  ConnectorNo auth

• assessment_get_brief_templateA

  website-searchA

  Get Lenny Zeltser's Security Assessment one-page executive brief template. Standalone variant of `assessment_get_template` for callers that only want the brief without the long-form report. This server never requests your assessment notes or report and instructs your AI to keep them local—the templates and guidelines flow to your AI for local analysis.

  ConnectorNo auth

• how_munimji_helpsA

  HelloBooks AI AgentsA

  Explain how HelloBooks and Munimji (the in-app AI assistant) help a specific business — given a free-text description of the user's own operations. Returns a curated capability knowledge base: business-operation areas (sales, purchases, banking, tax, reports, inventory, payroll, multi-entity, setup), and for each AI capability WHO does the work — `autonomous` (Munimji does it on its own, e.g. OCR extraction, running reports), `approval` (Munimji prepares the entry and you one-click approve before it posts to the ledger, e.g. AI categorization, find-and-match, creating invoices/bills by chat), `assist` (co-pilot, e.g. guided onboarding, voice), or `manual` (a software feature you run yourself). Each capability links to the backing software features. Use this when a user describes their business and asks "how can HelloBooks help me?", "what can the AI do for my shop/practice/agency?", or "what can Munimji do on its own vs what do I approve?". Pass their description in `businessDescription`; optionally filter by `area` or `autonomy`. The AI never posts to a ledger without approval. For the full software catalog call list_features; for pricing call list_plans.

  ConnectorNo auth

• how_munimji_helpsA

  HelloBooks AI Agents MCP ServerB

  Explain how HelloBooks and Munimji (the in-app AI assistant) help a specific business — given a free-text description of the user's own operations. Returns a curated capability knowledge base: business-operation areas (sales, purchases, banking, tax, reports, inventory, payroll, multi-entity, setup), and for each AI capability WHO does the work — `autonomous` (Munimji does it on its own, e.g. OCR extraction, running reports), `approval` (Munimji prepares the entry and you one-click approve before it posts to the ledger, e.g. AI categorization, find-and-match, creating invoices/bills by chat), `assist` (co-pilot, e.g. guided onboarding, voice), or `manual` (a software feature you run yourself). Each capability links to the backing software features. Use this when a user describes their business and asks "how can HelloBooks help me?", "what can the AI do for my shop/practice/agency?", or "what can Munimji do on its own vs what do I approve?". Pass their description in `businessDescription`; optionally filter by `area` or `autonomy`. The AI never posts to a ledger without approval. For the full software catalog call list_features; for pricing call list_plans.

  ConnectorNo auth

• set_shipping_addressA

  agenteeA

  Set the delivery address for the current cart's checkout; get_order_preview and prepare_order use it. Needs at least one item in the cart and replaces any address set before. For a returning buyer, offer get_saved_addresses first and pass the chosen one here. The phone is normalized to international form; if that fails the result carries a warning — ask the human for the number with its country code, since the courier calls it. Only the required fields and the phone are checked; the street itself is not verified. Missing fields or an empty cart return an error and save nothing. The country can switch the order to local currency (UZS for Uzbekistan).

  ConnectorNo auth

• check_endpointA

  cerberus-indexB

  Endpoint & tool trust — one call before an agent connects to a third-party MCP server or HTTP tool. Pass the endpoint `url` (and, to unlock the strongest check, its `tools`: the name/description/inputSchema the agent is about to trust). Returns three signals behind one verdict: (1) transport & TLS identity — encrypted, valid chain, not expired or self-signed; (2) domain age via RDAP — freshly-registered hosts are a scam tell; (3) a TOOL-POISONING scan of the tool definitions for the hidden directives that hijack agents — instruction overrides, 'don't tell the user', data exfiltration, secret harvesting, tool-shadowing, and invisible-unicode / homoglyph steganography that a human reviewer can't see. Nobody else screens tool descriptions for injection. Verdict: trusted | caution | untrusted | unknown, with per-finding evidence. Price: $0.008 USDC. Missing something? Call `submit_feedback` (free) to request it. Pass `attest=true` to also get an Ed25519-SIGNED attestation of this verdict — portable proof you can log, hand to a counterparty, or verify later with `verify_attestation` (free) or the published key.

  ConnectorNo auth

• invite_memberA

  seekrit — secrets for agentsA

  Invite a human to the organization by email (admin only). They join at the given role once they sign in. Use this to hand a project off to a person — then grant them decryption with `grant_env` on the LOCAL crypto plane, since an invite alone conveys no ability to read values. Returns the pending { id, orgId, email, role, invitedById, createdAt }; revoke_invite cancels it.

  ConnectorNo auth

• scaffold_serviceA

  @imqueueA

  READ-ONLY: returns generated source code as text and writes nothing to disk, creates no project and runs no command. Generates an idiomatic @imqueue/rpc service (an IMQService subclass with @expose()d, JSDoc-typed methods) plus a bootstrap that starts it. Provide the methods you want, or omit them for a starter template. Any non-primitive parameter or return type also gets a types.ts with the required @classType()/@property() declarations — without those the generated client types it `any`, which compiles. Use create_service (local install only) if you want files actually written.

  ConnectorNo auth

• describe_routingA

  Registry Expansion RoutingA

  Return the registry routing map: for each entity kind, the set of public registries the expansion agent would consult. Pure, local, no input, no PII. Use it to understand coverage before requesting an (authenticated) expansion.

  ConnectorNo auth