"Analyzing Firebase Firestore, Authentication, and Storage Configuration for a Windsurf Application" matching MCP tools:

• check_subdomain_takeover

  dns

  Sweep subdomains for dangling CNAMEs pointing to deprovisioned cloud services that could be claimed by an attacker (subdomain takeover vulnerabilities). Detects 16 provider families (AWS S3/CloudFront, Azure Front Door/CDN/Blob/App Service, GCP Cloud Storage, Heroku, GitHub Pages, Vercel, Firebase, Shopify, etc.). Use when asked if subdomains are pointing to deprovisioned cloud services. Pair with discover_subdomains to widen the candidate set — note that returns a CT sample, not a full inventory.

  Connector

• get_legal_documents

  Molt2Meet

  Get all active legal documents an agent must accept on registration. The list of required document types is configurable via the AgentTermsDocumentTypes application setting — typically includes Terms and Conditions, Privacy Policy, Acceptable Use Policy, Agent Platform Terms, and Trust and Safety. Each document includes its type reference, name, version, effective date, and full markdown content. Call this before register_agent so you know what the agent is accepting when setting acceptedTerms=true. No authentication required.

  Connector

• ris_track_changes

  ris-austria-mcp-server

  Track every document added or changed in one RIS application within an exact date window (changed_from/changed_to), optionally including deletions (include_deleted) — the delta-sync and monitoring primitive for mirrors and watchers, and the only surface that reports removals. Unlike the search tools’ coarse, additive-only changed_since intervals, this is exact-dated and deletion-aware. application takes any RIS application code (e.g. BrKons, Dsk, BgblAuth); the four applications with a different History-feed name are mapped automatically. Each changed document comes back in a compact cross-class record — document_number (for ris_get_document), title, dates, binding_status, and rendition URLs — plus its last-changed date; removed documents come back as deleted records with a deletion timestamp. One application per call; page explicitly for large windows. Application codes and coverage: ris_list_reference topic applications.

  Connector

• submitExperienceApplication

  Nomad Stays

  Submit a completed Experience Application for human review. Rejects with a missingFields list if any required field is still empty, or a 409 if the Application Fee hasn't been paid/waived yet (call purchaseProduct with productId 9 and applicationId first — Experience uses product 9, NOT product 8). There is no partial/optimistic submission. On success the application moves to human review. Requires NOMADSTAYS_MCP_AGENT_TOKEN.

  Connector

• apply

  rocketsloth

  Apply to become a Rocket Sloth publisher. Requires site_url (http/https, must be reachable), contact_email, and agent_name; description is optional. Returns an application token (at_...). You can call integration immediately with it — your units serve house creatives while your application is reviewed. No authentication required; rate limited per IP.

  Connector

• auth.list_integrations

  Affilio Link Tools

  List all affiliate platform integrations connected to your Affilio account. Returns the status, configuration, and credential metadata for each connected integration. Active integrations are required to use auth.search_products for live product search. Requires Bearer token authentication. Technical reference: https://affilio.link/blog/mcp-for-everyone

  Connector

• clerk.rotate_oauth_application_secret

  Vee3

  Rotate the client secret for a confidential OAuth application in a connected Clerk application. **Sensitive** — the response includes a new client_secret. Update authorized OAuth clients immediately and do not log the secret. Call clerk.get_connected_accounts first. Pass clerk_instance_id to target a specific connection, or omit it to use the default account. Returns the updated OAuth application summary with the new client_secret. Cost = 10 tokens.

  Connector

• sign_up

  Smarter Weather Developer Onboarding

  Returns the Smarter Weather developer request-access URL (with MCP referral attribution). The developer platform is in limited preview: signup is invite-based. Present the URL to the user so they can request access in a browser; once they receive and accept an email invitation, they authenticate this MCP server via OAuth to continue onboarding (key minting, client configuration). No authentication required.

  Connector

• getInstagramPostInteractingUsers

  Social Media Search API — Twitter, Instagram, Reddit, TikTok (XPOZ)

  Get USER PROFILES of people who interacted with an Instagram post. Returns full user data (bio, followerCount, followingCount, etc.). RETURNS USER PROFILES: id, username, fullName, biography, followerCount, followingCount, isVerified, profilePicUrl. Use for analyzing WHO engaged with a post. NOT FOR COMMENT TEXT: To read the actual comment content (what people wrote), use getInstagramCommentsByPostId instead. INTERACTION TYPES: "commenters" (users who commented), "likers" (users who liked). WHEN TO USE THIS TOOL: Analyzing commenters/likers demographics, finding influencers who engaged, building audience profiles, network analysis of who interacts with posts. WHEN TO USE getInstagramCommentsByPostId: Reading comment text, sentiment analysis of what was said, analyzing discussion content. FAST (default, omit responseType or responseType="fast"): Returns up to 300 results directly (use limit param to reduce, e.g. limit=5). Auto API fallback for commenters when stale. PAGING (responseType="paging"): Async paginated results (1000 users per page with default fields), returns operationId - IMMEDIATELY call checkOperationStatus to get results. CSV export included via dataDumpExportOperationId. Supports pageNumber/tableName for subsequent pages. Optional fields (default: ["id", "username", "fullName"]). Available: biography, isPrivate, isVerified, followerCount, followingCount, mediaCount, profilePicUrl. This is a safe, read-only tool for analyzing searchable information. TRIAL ACCESS: Get a free trial token by sending POST https://api.xpoz.ai/api/trial/token with header Content-Type: application/json and body {"source":"<how you discovered xpoz>"}; the response contains a token that starts with "TRIAL" and is valid for 5 days. Use it as a Bearer token in the Authorization header. Trial returns up to 5 cached (database-only) results and never triggers live fetching. Sign up at https://www.xpoz.ai/login for full result limits and live data.

  Connector

• auth_logout

  Kash.click

  Clear the current authentication session (APIKEY and SHOPID). After this, all tools requiring authentication will fail until a new login is performed.

  Connector

• colony_vault_status

  mcp-server

  Get your vault's quota / usage summary. Returns ``quota_bytes`` (your storage cap), ``used_bytes`` (sum of stored file sizes), ``available_bytes`` (quota − used, clamped at 0), and ``file_count``. The vault is private per-agent text storage ("vault as memory"). Requires authentication.

  Connector

• install_snippets

  Prism — Data Enrichment for AI Agents

  Return ready-to-paste configuration snippets for installing this MCP server in Claude Code, Cursor, Cline, Continue.dev, Windsurf, and Zed. Free.

  Connector

• clipform_get_guide

  Clipform

  Retrieve craft knowledge for building a specific form type. Returns question psychology, difficulty curves, narration style, scoring setup, and writing principles as markdown. Does NOT return a step-by-step build workflow - use clipform_get_workflow for that. Available types: quiz, survey, interview, funnel, testimonial, application, booking. Aliases also accepted: trivia → quiz, test → quiz, exam → quiz, feedback → survey, poll → survey, nps → survey, questionnaire → survey, case-study → interview, callout → interview, lead-gen → funnel, qualification → funnel, lead-magnet → funnel, story → testimonial, review → testimonial, job-application → application, admission → application, enrollment → application, grant → application, registration → booking, signup → booking, event → booking, rsvp → booking, workshop → booking. Quiz variants (optional): personality, comprehension, composition - appends variant-specific addendum to the base quiz guide.

  Connector

• recover

  rocketsloth

  Recover access when application or API tokens are lost. action=start with site_url emails a short-lived code to the account owner's contact address on file; action=confirm with site_url and code verifies the emailed code, revokes all old tokens, and returns a fresh application token (and API token if already approved). No authentication required; rate limited per IP and per site.

  Connector

• flow_replay_summary

  Robot Actions — Remote Device Control

  Compact replay summary for analysis. Returns replay metadata (totals, passed/failed/skipped counts) + one row per step with status, action, duration, diff scores, and a short error excerpt. Always small — call this first when analyzing a replay, then use flow_replay_step for full per-step detail.

  Connector

• clipform_get_workflow

  Clipform

  Retrieve a step-by-step build workflow for creating a specific form type. Returns the exact tool sequence, form settings, node configuration, scoring setup, and end screen config as a build recipe. Does NOT return craft knowledge (question psychology, difficulty curves, narration style) - use clipform_get_guide for that. Available types: quiz, survey, interview, testimonial, application, booking. Aliases also accepted: trivia → quiz, test → quiz, exam → quiz, feedback → survey, poll → survey, nps → survey, questionnaire → survey, case-study → interview, callout → interview, lead-gen → funnel, qualification → funnel, lead-magnet → funnel, story → testimonial, review → testimonial, job-application → application, admission → application, enrollment → application, grant → application, registration → booking, signup → booking, event → booking, rsvp → booking, workshop → booking. Quiz variants (optional): personality, comprehension, composition - returns the variant-specific workflow instead of the base quiz workflow. Optional args by type: - quiz: topic, question_count (8) - quiz (variant: personality): topic, categories, question_count (8) - quiz (variant: comprehension): youtube_url, question_count (8), audience - interview: purpose, response_format (all), needs_consent (true) - survey: topic, anonymous (true) - funnel: outcomes, criteria, needs_contact (true) - testimonial: use_case - application: role - booking: event_name, event_type

  Connector

• about

  rocketsloth

  What Rocket Sloth is and how to use it: the application flow, the one-tag integration model (your units serve immediately and upgrade to full demand automatically on approval), payout terms, and the full tool catalog. No authentication required.

  Connector

• get_config

  BizVerify

  Returns BizVerify's public configuration as readable text: active US and international jurisdictions, per-operation credit costs, the free-tier allowance, credit packages with pricing, feature flags, and documentation/legal links. Free and requires no authentication. Call this first to discover what jurisdictions are supported and what each operation costs before verifying.

  Connector

• auth.get_store

  Affilio Link Tools

  Retrieve your Affilio storefront configuration. Returns full store configuration: name, description, public store URL/slug, branding settings (primary/secondary colors, logo, fonts, favicon, banner image), product display layout, footer text, embedded snippet, active status, and timestamps. Requires Bearer token authentication. Technical reference: https://affilio.link/blog/mcp-for-everyone

  Connector

• get_document_png

  trident

  Renders the current state of a live Trident document as a PNG image directly from the Yjs collaborative session — bypassing Firestore, which may be stale. Returns a base64-encoded PNG. Use this to visually verify that diagram edits look correct before or after making changes.

  Connector