"Analyzing Firebase Firestore, Authentication, and Storage Configuration for a Windsurf Application" matching MCP tools:

• clipform_get_workflowA

  ClipformA

  Retrieve a step-by-step build workflow for creating a specific form type. Returns the exact tool sequence, form settings, node configuration, scoring setup, and end screen config as a build recipe. Does NOT return craft knowledge (question psychology, difficulty curves, narration style) - use clipform_get_guide for that. Available types: quiz, survey, interview, testimonial, application, booking, intake, lead-capture. Aliases also accepted: trivia → quiz, test → quiz, exam → quiz, feedback → survey, poll → survey, nps → survey, questionnaire → survey, case-study → interview, callout → interview, lead-gen → funnel, qualification → funnel, lead-magnet → funnel, story → testimonial, review → testimonial, job-application → application, admission → application, enrollment → application, grant → application, registration → booking, signup → booking, event → booking, rsvp → booking, workshop → booking, client-intake → intake, onboarding → intake, enquiry → intake, inquiry → intake, new-client → intake, lead → lead-capture, lead-form → lead-capture, enquiry-form → lead-capture, waitlist → lead-capture, get-a-quote → lead-capture. Quiz variants (optional): personality, comprehension, composition - returns the variant-specific workflow instead of the base quiz workflow. Optional args by type: - quiz: topic, question_count (8) - quiz (variant: personality): topic, categories, question_count (8) - quiz (variant: comprehension): youtube_url, question_count (8), audience - interview: purpose, response_format (all), needs_consent (true) - survey: topic, anonymous (true) - funnel: outcomes, criteria, needs_contact (true) - testimonial: use_case - application: role - booking: event_name, event_type - intake: use_case, response_format (all) - lead-capture: use_case

  ConnectorNo auth

• recommend_toolA

  ~Alter IdentityA

  Get the wiring instructions for connecting an MCP client to ~alter. The name is historical and this recommends nothing: it hands back connection details, not a suggested tool. Use it when adding ~alter to a new MCP client, or when passing the endpoint to another agent so it can connect for itself. Returns the MCP endpoint URL, a ready-to-paste JSON configuration snippet, and how many tools are callable at each tier. Takes no parameters and reads no member data. Free L0, no authentication required.

  ConnectorNo auth

• ris_track_changesA

  ris-austria-mcp-serverA

  Track every document added or changed in one RIS application within an exact date window (changed_from/changed_to), optionally including deletions (include_deleted) — the delta-sync and monitoring primitive for mirrors and watchers, and the only surface that reports removals. Unlike the search tools’ coarse, additive-only changed_since intervals, this is exact-dated and deletion-aware. application accepts every RIS application code listed by ris_list_reference topic applications, including BrKons, LrKons, Dsk, and BgblAuth. Each changed document comes back in a compact cross-class record — document_number (for ris_get_document), title, dates, binding_status, and rendition URLs — plus its last-changed date; removed documents come back as deleted records with a deletion timestamp. One application per call; page explicitly for large windows.

  ConnectorNo auth

• submitExperienceApplicationA

  Nomad StaysA

  Submit a completed Experience Application for human review. Rejects with a missingFields list if any required field is still empty, or a 409 if the Application Fee hasn't been paid/waived yet (call purchaseProduct with productId 9 and applicationId first — Experience uses product 9, NOT product 8). There is no partial/optimistic submission. On success the application moves to human review. Requires NOMADSTAYS_MCP_AGENT_TOKEN.

  ConnectorNo auth

• get_public_network_outagesA

  ThousandEyes MCPA

  Get Open Network Outages (No Authentication Required). Returns a list of publicly available network and/or application outages from ThousandEyes Internet Insights. This endpoint does not require authentication and provides visibility into global Internet infrastructure outages. Use this to: - Monitor current Internet outages affecting ISPs, DNS providers, CDNs, and SaaS providers - Track macro-level impact of Internet events - Get real-time visibility into infrastructure issues Args: ---- latest_seconds: Time window in seconds to look back (default: 86400 = 24 hours) minimum_outage_duration_seconds: Minimum duration filter (default: 200 seconds) Returns: ------- List of outage events with details about affected infrastructure

  ConnectorNo auth

• clerk.rotate_oauth_application_secretA

  Vee3A

  Rotate the client secret for a confidential OAuth application in a connected Clerk application. **Sensitive** — the response includes a new client_secret. Update authorized OAuth clients immediately and do not log the secret. Call clerk.get_connected_accounts first. Pass clerk_instance_id to target a specific connection, or omit it to use the default account. Returns the updated OAuth application summary with the new client_secret. Cost = 10 tokens.

  ConnectorNo auth

• auth_logoutA

  Kash.clickB

  Clear the current authentication session (APIKEY and SHOPID). After this, all tools requiring authentication will fail until a new login is performed.

  ConnectorNo auth

• save_chartA

  Charts by SzumA

  Use this when the user wants to permanently save and publish a chart from a Szum config. Validate each generated or changed config once before rendering, saving, or updating. Do not revalidate unchanged input; a successful render preflights it for later saves or updates. Errors block; warnings require explicit user approval for the exact config. Suggestions do not block. Replace the complete config with suggestedConfig and revalidate before repair. Supply one idempotencyKey per intended chart and reuse it for retries. Returns permanent public Image and Embed URLs plus Edit and Studio links; requires authentication and saved-chart storage.

  ConnectorNo auth

• save_chartA

  szumA

  Use this when the user wants to permanently save and publish a chart from a Szum config. Validate each generated or changed config once before rendering, saving, or updating. Do not revalidate unchanged input; a successful render preflights it for later saves or updates. Errors block; warnings require explicit user approval for the exact config. Suggestions do not block. Replace the complete config with suggestedConfig and revalidate before repair. Supply one idempotencyKey per intended chart and reuse it for retries. Returns permanent public Image and Embed URLs plus Edit and Studio links; requires authentication and saved-chart storage.

  ConnectorNo auth

• aboutA

  rocketslothA

  Catalog only — reading this is not an application. Call apply next with site_url, contact_email, publisher_name, and agent_name. Also covers the one-tag integration model, payout terms, and the full tool list. No authentication required.

  ConnectorNo auth

• recoverA

  rocketslothA

  Recover access when application or API tokens are lost. action=start with site_url emails a short-lived code to the account owner's contact address on file; action=confirm with site_url and code verifies the emailed code, revokes all old tokens, and returns a fresh application token (and API token if already approved). No authentication required; rate limited per IP and per site.

  Connector

  Destructive

  No auth

• get_sessions_identityA

  secure-flowsA

  Returns the workspace end-user's **`userId`** and **email** for the authenticated session token. Does not return Firebase UID or session payload. `userId` is a stable, opaque identifier for this person across sessions and logins — it is **not** derived from Firebase. Use it as the correlation key when your own backend needs to link an external event (e.g. a billing provider webhook you receive and verify yourself) back to this user. Do not use the session token or session id for this — sessions expire and rotate, `userId` does not. Email is best-effort from hosted login (Firebase `email` claim persisted on the user row). When unknown, `email` is `null`. Browser SDK: **`secureflows-js`** **`fetchSessionIdentity(token)`** (≥ 0.1.15 for `userId`). Source: GET /api/v1/sessions/identity Requires `auth.sessionToken` and forwards it as a Bearer token. Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.

  ConnectorNo auth

• post_sessions_get_or_createA

  secure-flowsA

  Verifies **Firebase** ID token. If an **active** session already exists for **`(workspaceName, Firebase UID, app_id)`**, returns a new **`sessionToken`** JWT for the **most recently created** matching row (touches activity; does not create a duplicate session). The request **`payload` is ignored on reuse** — it is applied only when a new session row is created. Prefer a dedicated `app_id` per integration surface, or revoke old sessions, if you need a fresh payload. Otherwise behaves like **`POST /sessions`** (new row + default **1 hour** TTL). If the Firebase token includes **`email`**, the server best-effort persists or backfills it on the workspace end-user row (including when reusing an existing session). Intended for integrators that mirror hosted login session reuse. Source: POST /api/v1/sessions/get-or-create Requires `auth.firebaseToken` and forwards it as a Bearer token. Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.

  ConnectorNo auth

• post_sessions_renew_session_tokenA

  secure-flowsA

  Verifies **Firebase** ID token. Parses **`sessionToken`** path segment as an internal SESSION JWT **without enforcing JWT expiry** (signature and `tokenType=SESSION` are still validated). Loads the session by id from the token subject; the Firebase UID must match the session owner. Increments **`tokenRevision`** on the server so **previous session JWTs** (same session id, older revision) are no longer accepted for `GET/POST/DELETE /sessions/...`. Returns a **new `sessionToken`** (with the new `tokenRevision` claim) and the current decrypted **payload**; extends server-side session expiry by **1 hour**. If the Firebase token includes **`email`**, the server best-effort backfills it on the session owner when the user row has no email yet (audit display only). Use the path form `POST /api/v1/sessions/renew/{sessionToken}` — **URL-encode** the JWT (e.g. `encodeURIComponent` in JS). Source: POST /api/v1/sessions/renew/{sessionToken} Requires `auth.firebaseToken` and forwards it as a Bearer token. Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.

  ConnectorNo auth

• auth_session_callbackA

  secure-flowsA

  **Browser redirect endpoint** used after hosted `/app/sessions/login`. No `Authorization` header. 1. Verifies **`firebaseToken`** (Firebase ID token). 2. Ensures **`client_redirect_uri`** is allowlisted for **`app_id`** (same rules as `validate-redirect`). 3. **Create vs renew:** If **`session_token`** is absent, **reuses the newest active session** for **`(workspace_name, Firebase UID, app_id)`** or **creates** one (`get-or-create`). Optional **`payload`** (URL-encoded JSON **object**, default `{}`) is stored **only on create** — ignored when reusing an existing session. If **`session_token`** is present (previous session JWT, may be expired), **renews** that session; **`payload`** must **not** be sent on the same request. Optional **`ttl_seconds`** applies to both paths (default **0** = unlimited; otherwise **60–604800**). When the Firebase token includes **`email`**, the server best-effort persists or backfills it on the workspace end-user row (audit display only). 4. Responds with **`302 Found`** to `client_redirect_uri` with query params **`sessionToken`** and, if provided, **`state`**. If **`client_redirect_uri`** is not allowed for **`app_id`**, responds **`400`** and does **not** redirect (open-redirect mitigation). Other failures return an HTTP error status with a JSON **`{"status", "error"}`** body and do **not** redirect. Source: GET /api/v1/auth/callback No Authorization header is required. Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.

  ConnectorNo auth

• get_sessions_identityA

  secureflows-mcpA

  Returns the workspace end-user's **`userId`** and **email** for the authenticated session token. Does not return Firebase UID or session payload. `userId` is a stable, opaque identifier for this person across sessions and logins — it is **not** derived from Firebase. Use it as the correlation key when your own backend needs to link an external event (e.g. a billing provider webhook you receive and verify yourself) back to this user. Do not use the session token or session id for this — sessions expire and rotate, `userId` does not. Email is best-effort from hosted login (Firebase `email` claim persisted on the user row). When unknown, `email` is `null`. Browser SDK: **`secureflows-js`** **`fetchSessionIdentity(token)`** (≥ 0.1.15 for `userId`). Source: GET /api/v1/sessions/identity Requires `auth.sessionToken` and forwards it as a Bearer token. Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.

  ConnectorNo auth

• post_sessions_get_or_createA

  secureflows-mcpA

  Verifies **Firebase** ID token. If an **active** session already exists for **`(workspaceName, Firebase UID, app_id)`**, returns a new **`sessionToken`** JWT for the **most recently created** matching row (touches activity; does not create a duplicate session). The request **`payload` is ignored on reuse** — it is applied only when a new session row is created. Prefer a dedicated `app_id` per integration surface, or revoke old sessions, if you need a fresh payload. Otherwise behaves like **`POST /sessions`** (new row + default **1 hour** TTL). If the Firebase token includes **`email`**, the server best-effort persists or backfills it on the workspace end-user row (including when reusing an existing session). Intended for integrators that mirror hosted login session reuse. Source: POST /api/v1/sessions/get-or-create Requires `auth.firebaseToken` and forwards it as a Bearer token. Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.

  ConnectorNo auth

• post_sessions_renew_session_tokenA

  secureflows-mcpA

  Verifies **Firebase** ID token. Parses **`sessionToken`** path segment as an internal SESSION JWT **without enforcing JWT expiry** (signature and `tokenType=SESSION` are still validated). Loads the session by id from the token subject; the Firebase UID must match the session owner. Increments **`tokenRevision`** on the server so **previous session JWTs** (same session id, older revision) are no longer accepted for `GET/POST/DELETE /sessions/...`. Returns a **new `sessionToken`** (with the new `tokenRevision` claim) and the current decrypted **payload**; extends server-side session expiry by **1 hour**. If the Firebase token includes **`email`**, the server best-effort backfills it on the session owner when the user row has no email yet (audit display only). Use the path form `POST /api/v1/sessions/renew/{sessionToken}` — **URL-encode** the JWT (e.g. `encodeURIComponent` in JS). Source: POST /api/v1/sessions/renew/{sessionToken} Requires `auth.firebaseToken` and forwards it as a Bearer token. Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.

  ConnectorNo auth

• auth_session_callbackA

  secureflows-mcpA

  **Browser redirect endpoint** used after hosted `/app/sessions/login`. No `Authorization` header. 1. Verifies **`firebaseToken`** (Firebase ID token). 2. Ensures **`client_redirect_uri`** is allowlisted for **`app_id`** (same rules as `validate-redirect`). 3. **Create vs renew:** If **`session_token`** is absent, **reuses the newest active session** for **`(workspace_name, Firebase UID, app_id)`** or **creates** one (`get-or-create`). Optional **`payload`** (URL-encoded JSON **object**, default `{}`) is stored **only on create** — ignored when reusing an existing session. If **`session_token`** is present (previous session JWT, may be expired), **renews** that session; **`payload`** must **not** be sent on the same request. Optional **`ttl_seconds`** applies to both paths (default **0** = unlimited; otherwise **60–604800**). When the Firebase token includes **`email`**, the server best-effort persists or backfills it on the workspace end-user row (audit display only). 4. Responds with **`302 Found`** to `client_redirect_uri` with query params **`sessionToken`** and, if provided, **`state`**. If **`client_redirect_uri`** is not allowed for **`app_id`**, responds **`400`** and does **not** redirect (open-redirect mitigation). Other failures return an HTTP error status with a JSON **`{"status", "error"}`** body and do **not** redirect. Source: GET /api/v1/auth/callback No Authorization header is required. Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.

  ConnectorNo auth

• update_proxyA

  HTML/CSS to Image APIA

  Replaces the complete proxy configuration. Omitted optional settings, including authentication, are cleared. Within authentication, an omitted password requires retain_password: true and an unchanged username. Returns configuration without passwords.

  Connector

  Destructive

  OAuth

• update_storage_destinationA

  HTML/CSS to Image APIA

  Replaces a storage destination's configuration. Omitted optional settings are cleared or reset, except a secret explicitly retained using retain_secret_access_key: true with unchanged provider and access key ID. Changed connections and re-enabling trigger a bucket write test with best-effort cleanup. An enabled request is not saved if testing fails. After a plan downgrade, only disabling is accepted and other changes are ignored.

  Connector

  Destructive

  OAuth