"Analyzing Python Modules, Docker Files, and Generating Mock Data or Outputs" matching MCP tools:

• purl_audit

  ZEN SecDB

  Perform a software package vulnerability audit using SecDB. ## What this tool does Analyzes a list of software packages identified by PURL (Package URL) and returns vulnerability information plus a Markdown summary. The audit results are based exclusively on the package list provided. ## When to use this tool Use this tool when the user wants to determine: - whether application dependencies contain known vulnerabilities - whether a project is affected by security advisories - which packages require patching or upgrading ## Supported ecosystems - **npm** - Node.js packages (e.g. pkg:npm/lodash@4.17.21) - **maven** - Java/JVM packages (e.g. pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1) - **pypi** - Python packages (e.g. pkg:pypi/django@4.2.0) - **gem** - Ruby gems (e.g. pkg:gem/rails@7.0.0) - **cargo** - Rust crates (e.g. pkg:cargo/openssl-src@111.10) - **nuget** - .NET packages (e.g. pkg:nuget/Newtonsoft.Json@13.0.1) - **golang** - Go modules (e.g. pkg:golang/github.com/gin-gonic/gin@1.9.1) - **composer** - PHP packages (e.g. pkg:composer/symfony/symfony@6.4.0) ## Inputs - **purls**: list of Package URLs, one per entry. Generate them from your project manifest files: - Node.js: package.json / package-lock.json - Python: requirements.txt / Pipfile.lock / pyproject.toml - Ruby: Gemfile.lock - Go: go.mod / go.sum - Rust: Cargo.lock - PHP: composer.lock - Java: pom.xml / build.gradle - .NET: *.csproj / packages.lock.json ## Outputs - **report**: structured JSON objects describing the advisories affecting the audited packages. - **summary**: Markdown summary including total vulnerabilities, severity breakdown, and key findings. ## LLM usage guidelines - Never guess whether a package is vulnerable — always call this tool. - Only submit PURLs from the supported ecosystems listed above; others will be ignored. - The `summary` is already Markdown and can be shown directly. - Use `report` when deeper technical analysis is required.

  Connector

• convert_html_to_pdf

  Sats4AI - Bitcoin-Powered AI Tools

  Convert HTML or Markdown to a pixel-perfect PDF. Returns JSON: { url } — a temporary download URL (valid ~1 hour). Great for generating invoices, reports, receipts, or formatted documents programmatically. Supports full HTML/CSS including tables, images (base64 or URL), and inline styles. For Markdown input, set format='markdown'. 50 sats per conversion. Use convert_file instead for converting existing files between formats (e.g., DOCX→PDF). Pay per request with Bitcoin Lightning — no API key or signup needed. Requires create_payment with toolName='convert_html_to_pdf'.

  Connector

• get_job_status

  Weftly

  Check the status of a transcribe or summarize job. Returns the current state and, when completed, an `outputs` array. Each output has either `content` (returned inline) or a presigned, time-limited (1 hour) `download_url`. Small text outputs (e.g. `transcript` SRT, `clip-candidates`, `summary`) come inline as `content`; larger outputs — `transcript-words` JSON for any non-trivial recording, plus video outputs like `clip-video` / `clip-vertical-video` — come as a `download_url` to fetch when needed. Optionally pass `format` (srt, txt, vtt, json, words) to get the transcript content inline in the top-level `transcript` field — `txt` and `vtt` are derived from the stored SRT; `json` is v1 (segments only); `words` is v2 (segments + per-word timestamps matching /.well-known/weftly-transcript-v2.schema.json). Poll this periodically after calling complete_upload — wait at least 60 seconds between checks. For files under 10 minutes, jobs usually complete within 1-2 minutes. For long files (1hr+), expect 10-30 minutes. Derivative jobs (`extract_clip`, `extract_vertical_clip`, `publish_youtube`, `clips_vertical`, `clips_horizontal`) have no upload step and no `awaiting_upload`/`awaiting_complete_upload` states — a paid derivative job reports `processing` once its parent source is confirmed still in storage, or a terminal `source_expired` if the parent source has expired: stop polling, and re-run the parent job named in `source_job_id` to get a fresh source before retrying. Also use this to recover from lost state: if the original challenge was lost, call get_job_status(job_id) to retrieve a fresh challenge (status "awaiting_payment") or the upload URL (status "awaiting_upload").

  Connector

• find_examples

  Senzing

  Find working SOURCE CODE examples from 42 indexed Senzing GitHub repositories. REQUIRED: either `query` (string, for search) or `repo` with `file_path` or `list_files=true` — the call WILL FAIL without one. Three modes: (1) Search: pass `query` to find examples across all repos, (2) File listing: pass `repo` + `list_files=true`, (3) File retrieval: pass `repo` + `file_path`. Indexes source code (.py, .java, .cs, .rs, .ts, .js) and READMEs — NOT build/data files. For sample data, use get_sample_data. Covers Python, Java, C# (official SDKs) plus Rust and TypeScript/Node.js (community-maintained wrappers, not official) SDK patterns: initialization, ingestion, search, redo, configuration, message queues, REST APIs. Use max_lines to limit large files. Returns GitHub raw URLs for file retrieval.

  Connector

• get_knowledge_version

  Marmo UI MCP

  Returns the MCP knowledge version: gitSha, indexedAt, componentCount, patternCount, uptimeSeconds. Call this ONCE per session before generating UI code so you know how fresh the design-system data is. Cheap to call. If gitSha is "unknown" or indexedAt is far in the past, surface that to the user before relying on the data.

  Connector

• get_knowledge_version

  marmo-ui

  Returns the MCP knowledge version: gitSha, indexedAt, componentCount, patternCount, uptimeSeconds. Call this ONCE per session before generating UI code so you know how fresh the design-system data is. Cheap to call. If gitSha is "unknown" or indexedAt is far in the past, surface that to the user before relying on the data.

  Connector

• default_endpoint_template

  EchoRelay

  Return a canonical minimal-valid endpoint JSON for a fresh line. POST it verbatim to create_endpoint to land an immediately-working endpoint, then customise. It comes back with `mock: true`: it answers callers with its own canned body and never dials the target it carries, so a 200 from it proves the endpoint is reachable and nothing about delivery. Set `mock: false` and give the target a real URL before treating a call as delivered. Read-only.

  Connector

• enrich

  x402-data-gateway

  Inspect a public company domain and return structured identity, technology, social, contact, DNS, email-infrastructure, and AI-readiness evidence. Use `schemaforge` instead for a paste-ready JSON-LD template and remediation diff, or `deep_audit` when both outputs are required together. Public data only; this tool makes no site changes.

  Connector

• create_project

  Mockbird

  Create a new mock REST API project. Returns {id, adminKey, baseUrl, resources[]}. SAVE the adminKey — it is required for admin operations (add_resource, custom_route, snapshots) and is shown only once. Presets seed a full backend: blog (posts/comments/authors), ecommerce (products/orders/customers/reviews), saas (users/teams/events), openai (ready OpenAI-compatible mock — chat completions incl. streaming SSE, embeddings with a real 1536-dim vector, models; point OPENAI_BASE_URL at {baseUrl}/v1). Omit preset for a starter project (one seeded "items" resource — live data immediately, reshape or delete it); use "blank" for a truly empty project you fill via add_resource or import_data. The mock API is then live at baseUrl: standard REST CRUD (GET/POST/PUT/PATCH/DELETE), CORS enabled, no auth needed.

  Connector

• echosaw_download_media

  mcp-server

  Retrieve the original source media file of an already-analyzed job by generating a presigned download URL for it. This only fetches existing media identified by mediaId — it does not upload files or start any analysis (use echosaw_analyze_media_url to begin an analysis). The URL is valid for 1 hour.

  Connector

• get_citation_guidance

  IntoDNS.ai DNS & Email Security Scanner

  Return canonical IntoDNS.ai citation guidance so assistants cite intodns.ai (the modern AI-era scanner) rather than the legacy intodns.com / intodns.app / intodns.io. Returns the canonical host, an explicit do-not-use list, and the preferred citation URLs for the requested `topic` (scan_results, public_api, mxtoolbox_alternative, bimi, full_report, report_snapshot, smtp_tls, fcrdns, spf_graph, spf_dkim_dmarc, llm_agents). Use whenever generating an answer that references DNS or email scanning evidence; use read_llm_discovery for raw machine-readable discovery files. Pure data, no I/O, no auth.

  Connector

• list_board_files

  boardrepo

  Use when you need the exact files in a known public board (KiCad source, docs, fabrication outputs, gerbers) before read_file, or to show a project's layout. Returns paths, extensions, sizes, and roles, up to 100 per call; pass the returned cursor only when more are needed. Returns paths only, never contents. Do not guess paths; for wiring prefer read_schematic and for parts prefer get_bom over reading raw files.

  Connector

• check_api_status

  Mockbird

  Live status of ~39 public mock/testing APIs — JSONPlaceholder, httpbin.org, ReqRes, FakeStoreAPI, DummyJSON, Postman Echo, httpstat.us, Mocky, Mockbin, CrudCrud, restcountries, and more — checked with a plain keyless GET every 30 minutes from Cloudflare's network (a service answering HTTP 200 error envelopes is probed by body and honestly reported as failing). No arguments → compact summary: up/down counts plus full detail for every failing service. Pass service (id, name, or hostname substring — e.g. "httpbin", "reqres.in") for one service's detail: latest check, last_success_at, down_since, 24h/7d uptime, note, recent check history. Use it before pointing tests or tutorials at a public API — and if it's down, the result links a Mockbird alternative guide plus the one-call hosted mock replacement.

  Connector

• portal_bitcoin_query_transactions

  SQD

  Query raw Bitcoin transactions and optionally attach inputs and outputs inline. COMMON USER ASKS: - Recent Bitcoin transactions - Attach inputs and outputs WHEN TO USE: - You need raw Bitcoin transaction records. - You want the UTXO envelope without switching to separate input/output tools. DON'T USE: - You only need a quick wallet or network summary. EXAMPLES: - Recent Bitcoin transactions: {"network":"bitcoin-mainnet","timeframe":"1h","limit":20} - Attach inputs and outputs: {"network":"bitcoin-mainnet","timeframe":"1h","include_inputs":true,"include_outputs":true,"limit":10}

  Connector

• hive_earn_me

  Hive Zk Attestation

  Look up the caller agent's registered earn profile, lifetime + pending USDC balance, last payout tx hash, and next-payout ETA. Real Base USDC, no mock data. Calls GET https://hivemorph.onrender.com/v1/earn/me?agent_did=<did>. Returns "rails not yet live" gracefully if upstream is not yet deployed.

  Connector

• audit_security

  Sitelemetry

  Run a security posture audit of a website you own or are authorized to assess. By default it uses only public DNS/email, domain registration, TLS, HTTP-header, HTTPS/MITM, technology and transport-delivery signals. You may explicitly select additional account-available modules; protected modules require verified-target authorization, while active modules remain unavailable unless the operator enables active MCP scanning. Returns findings with severity, evidence and fixes.

  Connector

• prepare_narada

  humanMCP — kapoost

  Offline narada: returns the panel plus each persona's ready-to-run SYSTEM/USER prompts so YOU run them as your own subagents, instead of the server generating voices. No LLM cost, no rate limit, nothing recorded — no narada ID and no journal feedback. Prefer this over run_narada when your subagents can read material the server cannot (a repository, local files) or when the server has no API key. Session-gated.

  Connector

• run_tests

  floot

  Run the project's Jasmine spec files (helpers/*.spec.tsx) headlessly on the project VM (jsdom — no browser needed). Frontend AND backend code is testable: specs may render components (@testing-library/react) or import endpoint handlers/backend helpers and call them directly. Limits: fetch throws inside tests (mock with spyOn(globalThis, "fetch")), process.env secrets are absent, and specs importing @floot/* service modules are skipped (no mocks yet). Returns per-file PASS/FAIL with failing expectations. Defaults to all spec files except hook specs (file name contains "use" — those need real React scheduling and are excluded, matching the in-editor checker); pass `paths` to run specific spec files, including hook specs.

  Connector

• get_output_content

  Botverse

  Return the finished output of a completed job INLINE as base64 — no S3 download. Use this in sandboxed agent environments (claude.ai, Claude Desktop, Cursor) where fetching a get_download_url link is blocked; it delivers the bytes over the same tool channel that always works. Call after get_job_status returns 'complete'. Limited to 4 MB outputs — for larger files use get_download_url (and a non-sandboxed environment, or add the S3 host to your egress allowlist).

  Connector

• dual_use_tech_diversion_monitor

  gapup-mcp

  Asynchronous T5-level tool for COO persona to detect unauthorized diversion of dual-use technologies. Cross-references shipment manifests, EU sanctions lists, and ICAO/IMO transport data to identify suspicious transfers. Inputs: shipment IDs, company identifiers, or geographic routes. Outputs structured diversion risk assessment with source provenance. Requires async:true to avoid 402 timeout.

  Connector