"Analyzing user contributions to a GitLab self-hosted project using API token" matching MCP tools:

• parliament_get_debate_contributions

  UK Legal Research

  USE THIS TOOL WHEN you have a debate_ext_id and want verbatim contributions, optionally filtered to one member. Canonical path for "everything a member said in this debate" regardless of vocabulary — text-search tools (parliament_member_debates, parliament_search_hansard) filter by contribution TEXT, dropping members who spoke without using your phrase verbatim. This tool filters by MemberId on the debate's Items list, so vocabulary doesn't matter. Typical chain: parliament_find_member(name) → member_id, then parliament_search_hansard or parliament_lookup_by_column → debate_ext_id, then this tool. The parliament module's instructions describe the full composition pattern. Without member_id, returns every contribution (~100-200 for a long debate). If the wire returns no contributions for a member you expect to have spoken, report the empty result honestly — do NOT reconstruct quotes from training data. Authoritative source for member contributions.

  Connector

• upload_product_image

  Partle

  Attach an image to an existing product by giving Partle a public URL to download the image from. Authenticated. OAuth (scope `products:write`) preferred; `api_key` fallback. **When to use this tool**: the image is already hosted at a public URL (a scraped product page, an Imgur link, a CDN URL the user provided). Partle's server fetches it and stores it. **When NOT to use this tool**: you have local image bytes (a file the user attached, or bytes you generated/downloaded in your sandbox). Sending those bytes through a tool argument blows past conversation context limits — phone-photo-sized payloads can be 6+ MB of base64. Instead, in your code-execution sandbox, POST the file directly to the HTTP endpoint with multipart encoding: requests.post( "https://partle.rubenayla.xyz/v1/external/products/{product_id}/images", files={"file": open("/path/to/photo.jpg", "rb")}, headers={"X-API-Key": "pk_..."}, ) Or, to create the listing and attach an image in one HTTP request: requests.post( "https://partle.rubenayla.xyz/v1/external/products", data={"metadata": json.dumps({"name": ..., "price": ...})}, files={"image": open("/path/to/photo.jpg", "rb")}, headers={"X-API-Key": "pk_..."}, ) Args: product_id: ID of the product to attach the image to. image_url: Publicly fetchable URL of the image. Server fetches it and stores it. api_key: Optional API key (`pk_*`, generate at /account). Used when there is no OAuth token, and also when the OAuth token lacks the required scope — an explicitly passed key overrides an ambient token that is scoped too narrowly. An invalid or revoked token still fails regardless. Omit when using OAuth. Returns: The created `ProductImage` record with its `id` (use for deletion) and storage path, or ``{"error": ...}`` on validation/auth failure.

  Connector

• upload_product_image

  Partle Marketplac

  Attach an image to an existing product by giving Partle a public URL to download the image from. Authenticated. OAuth (scope `products:write`) preferred; `api_key` fallback. **When to use this tool**: the image is already hosted at a public URL (a scraped product page, an Imgur link, a CDN URL the user provided). Partle's server fetches it and stores it. **When NOT to use this tool**: you have local image bytes (a file the user attached, or bytes you generated/downloaded in your sandbox). Sending those bytes through a tool argument blows past conversation context limits — phone-photo-sized payloads can be 6+ MB of base64. Instead, in your code-execution sandbox, POST the file directly to the HTTP endpoint with multipart encoding: requests.post( "https://partle.rubenayla.xyz/v1/external/products/{product_id}/images", files={"file": open("/path/to/photo.jpg", "rb")}, headers={"X-API-Key": "pk_..."}, ) Or, to create the listing and attach an image in one HTTP request: requests.post( "https://partle.rubenayla.xyz/v1/external/products", data={"metadata": json.dumps({"name": ..., "price": ...})}, files={"image": open("/path/to/photo.jpg", "rb")}, headers={"X-API-Key": "pk_..."}, ) Args: product_id: ID of the product to attach the image to. image_url: Publicly fetchable URL of the image. Server fetches it and stores it. api_key: Optional API key (`pk_*`, generate at /account). Used when there is no OAuth token, and also when the OAuth token lacks the required scope — an explicitly passed key overrides an ambient token that is scoped too narrowly. An invalid or revoked token still fails regardless. Omit when using OAuth. Returns: The created `ProductImage` record with its `id` (use for deletion) and storage path, or ``{"error": ...}`` on validation/auth failure.

  Connector

• project_list

  Riddle Quiz Maker

  Returns a paginated list of projects this token has access to (25 per page by default, 100 max), with a sibling "pagination" object ({page, pageSize, total, hasMore}) to page through accounts with many projects. If it is a project API token, only the project linked to the token will be returned. Each project is a trimmed summary (id, name, image) - use project_get for a single project incl. your permissions on it, and project_get_settings for its default Riddle settings. An invalid page/pageSize (zero, negative, or a pageSize over 100) is rejected outright rather than silently clamped - the same contract as questionBank_list/questionBank_getItems.

  Connector

• get_photo

  holiday-photo-plus-2

  Display a holiday photo to the user by creating an HTML artifact that embeds the photo from its hosted URL. After calling this tool you MUST create an HTML artifact (type text/html) whose body is a single <img> tag pointing at the hosted URL returned in the result. Do not write a prose description, caption, or commentary — the user wants to view the photo, not read about it. Use list_photos first to discover valid IDs.

  Connector

• ic_leaderboard_connect_github

  Immersive Commons

  Verify a GitHub Personal Access Token against api.github.com/user, then store the resulting username on your IC profile. The PAT is DISCARDED after verification — the IC server keeps only your GitHub username + id, then queries commit counts via a server-side PAT during the weekly cron. Use this when the human doesn't want to (or can't) do the Clerk OAuth browser dance. To ALSO count your PRIVATE commits in your total, enable GitHub's private-contributions toggle (web-only — there is no API for it): github.com/<your-username> → 'Contribution settings' button (above your contribution graph) → enable 'Private contributions' (docs: https://docs.github.com/en/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-graphs-on-your-profile/publicizing-or-hiding-your-private-contributions-on-your-profile). IC reads only the COUNT of private contributions, never repo names or content, and has no write access to your GitHub. Args: { pat: string }. Returns: { ok, github: { login, id, name?, avatarUrl? }, next_steps: string[] }. Required scope: github:link.

  Connector

• dreamagent_list_global_integrations

  DreamAgent Cloud

  List the user's saved credentials (Global Integrations). ALWAYS call this before creating any bot project or asking the user for a token/API key. Saved credentials are referenced BY ID when creating projects: bot_token_integration_id for bot tokens, global_integration_ids for other keys. Secret values are never returned — only IDs and metadata (type, key name, verified, title). If nothing suitable is saved: direct the user to dreamagent.cloud → Settings → Global Integrations to add it (one-time, verified, reusable). Never ask the user to paste tokens in chat.

  Connector

• dreamagent_list_global_integrations

  DreamAgent

  List the user's saved credentials (Global Integrations). ALWAYS call this before creating any bot project or asking the user for a token/API key. Saved credentials are referenced BY ID when creating projects: bot_token_integration_id for bot tokens, global_integration_ids for other keys. Secret values are never returned — only IDs and metadata (type, key name, verified, title). If nothing suitable is saved: direct the user to dreamagent.cloud → Settings → Global Integrations to add it (one-time, verified, reusable). Never ask the user to paste tokens in chat.

  Connector

• get_my_inventory

  Partle

  List the caller's personal inventory items. Authenticated. Required OAuth scope: `inventory:read` (or pass an `api_key` for legacy/programmatic clients). Use this when the user asks "what do I own?", "what's on my wishlist?", "what am I selling?", etc. The returned rows include every status by default; pass `status` to filter. Args: status: Filter by lifecycle. One of: ``owned``, ``wanted``, ``for_sale``, ``sold``, ``discarded``. Omit for all. product_id: Filter to rows linked to a specific Partle product. project: Exact-match filter on the project tag. q: Substring search on `name` and `notes` (case-insensitive). limit: Page size, 1–200. Default 50. offset: Pagination offset. Default 0. api_key: Optional API key (`pk_*`, generate at /account). Used when there is no OAuth token, and also when the OAuth token lacks the required scope — an explicitly passed key overrides an ambient token that is scoped too narrowly. An invalid or revoked token still fails regardless. Omit when using OAuth. Returns: ``{"items": [...], "count": int}`` where each item carries status, quantity, name (or linked product), notes, prices, etc. On auth failure: ``{"error": ...}``.

  Connector

• getTiktokUser

  Social Media Search API — Twitter, Instagram, Reddit, TikTok (XPOZ)

  Get Tiktok user profile by ID or username. Use identifierType="id" for numeric user ID, identifierType="username" for username. For username: Use ONLY when you have the precise username. For person names or fuzzy search, use searchTiktokUsers instead. Optional fields parameter for performance (default: ["id", "username", "nickname"]). Available fields: id, username, nickname, signature, isPrivate, isVerified, followerCount, followingCount, likeCount, postCount, avatar, and more. Returns: single user profile. This is a safe, read-only tool for analyzing searchable information. TRIAL ACCESS: Get a free trial token by sending POST https://api.xpoz.ai/api/trial/token with header Content-Type: application/json and body {"source":"<how you discovered xpoz>"}; the response contains a token that starts with "TRIAL" and is valid for 5 days. Use it as a Bearer token in the Authorization header. Trial returns up to 5 cached (database-only) results and never triggers live fetching. Sign up at https://www.xpoz.ai/login for full result limits and live data.

  Connector

• get_my_inventory

  Partle Marketplac

  List the caller's personal inventory items. Authenticated. Required OAuth scope: `inventory:read` (or pass an `api_key` for legacy/programmatic clients). Use this when the user asks "what do I own?", "what's on my wishlist?", "what am I selling?", etc. The returned rows include every status by default; pass `status` to filter. Args: status: Filter by lifecycle. One of: ``owned``, ``wanted``, ``for_sale``, ``sold``, ``discarded``. Omit for all. product_id: Filter to rows linked to a specific Partle product. project: Exact-match filter on the project tag. q: Substring search on `name` and `notes` (case-insensitive). limit: Page size, 1–200. Default 50. offset: Pagination offset. Default 0. api_key: Optional API key (`pk_*`, generate at /account). Used when there is no OAuth token, and also when the OAuth token lacks the required scope — an explicitly passed key overrides an ambient token that is scoped too narrowly. An invalid or revoked token still fails regardless. Omit when using OAuth. Returns: ``{"items": [...], "count": int}`` where each item carries status, quantity, name (or linked product), notes, prices, etc. On auth failure: ``{"error": ...}``.

  Connector

• claim_api_key

  BorealHost

  Claim an API key using a claim token from the container. After calling request_api_key(), read the claim token from ~/.borealhost/.claim_token on your container and pass it here. The token is single-use — once claimed, it cannot be used again. The API key is automatically activated for this MCP session. Args: claim_token: The claim token string read from the container file Returns: {"api_key": "bh_...", "key_prefix": "bh_...", "site_slug": "my-site", "scopes": ["read", "write"], "message": "API key created and activated..."} Errors: VALIDATION_ERROR: Invalid, expired, or already-claimed token

  Connector

• acc_create_issue

  ACC MCP

  Create a new ACC issue (field observation, coordination clash, safety, quality, etc.) in the target project via the APS Construction Issues API. When to use: The user wants to log a new issue — e.g. 'open a high-priority issue about the leaking valve on level 3' or a downstream agent detected a defect during a model review and needs to record it for the project team. When NOT to use: Do not use to modify an existing issue (use acc_update_issue) and do not use for RFIs (use acc_create_rfi). APS scopes: data:read data:write account:read. Rate limits: ACC Issues API limited to ~100 req/min per app; APS default ~50 req/min per endpoint — batch creations with backoff. Errors: 401 (APS token expired — refresh); 403 (user lacks 'Create Issues' permission on the project or scope insufficient — surface to user); 404 (project_id not found — verify the 'b.' prefix and that the project belongs to a hub the app can see via acc_list_projects); 422 (validation — required field like title/description missing or priority enum invalid); 429 (rate limit — retry after 60s); 5xx (ACC upstream — retry with jitter, do not double-create). Side effects: Creates a persistent issue record visible to all project members. NOT idempotent — a retry on a 5xx may create duplicates; dedupe by title before retrying.

  Connector

• lorg_search

  lorg-mcp-server

  Search the Lorg knowledge archive. Use this to find existing contributions before submitting (to avoid duplicates) or to discover useful knowledge from other agents. Searches PUBLISHED contributions only; for the raw event/audit log use lorg_archive_query.

  Connector

• sap_escrow_build_create_transaction

  SAP MCP Server

  Hosted-safe unsigned builder for create_escrow_v2. Use this from hosted SAP MCP, preview the result, then call local sap_payments_finalize_transaction with submit:true. The depositorWallet signs locally; keypair bytes never leave the user machine. Defaults to DisputeWindow settlementSecurity=2 and rejects SelfReport/0. SAP MCP context: Hosted-safe unsigned Escrow V2 builder. The output is not submitted and is not signed by hosted SAP MCP. Preview it, then call local sap_payments_finalize_transaction with submit:true and confirm:true. Never create temporary signing scripts or read keypair JSON. SAP MCP execution guidance: Intent: hosted unsigned transaction builder. Pricing: paid builder; estimate first, then pay/build and finalize unsigned transactions locally when returned. Routing: hosted-safe builder. If a transaction is returned, preview/sign/submit with sap_payments_finalize_transaction; never create temporary signing scripts. Signer boundary: user-controlled local profile or external signer; OOBE hosted MCP remains non-custodial.

  Connector

• law_parliament_get_debate_contributions

  UK Business Tools - Ledgerhall

  USE THIS TOOL WHEN you have a debate_ext_id and want verbatim contributions, optionally filtered to one member. Canonical path for "everything a member said in this debate" regardless of vocabulary — text-search tools (parliament_member_debates, parliament_search_hansard) filter by contribution TEXT, dropping members who spoke without using your phrase verbatim. This tool filters by MemberId on the debate's Items list, so vocabulary doesn't matter. Typical chain: parliament_find_member(name) → member_id, then parliament_search_hansard or parliament_lookup_by_column → debate_ext_id, then this tool. The parliament module's instructions describe the full composition pattern. Without member_id, returns every contribution (~100-200 for a long debate). If the wire returns no contributions for a member you expect to have spoken, report the empty result honestly — do NOT reconstruct quotes from training data. Authoritative source for member contributions.

  Connector

• getTwitterUser

  Social Media Search API — Twitter, Instagram, Reddit, TikTok (XPOZ)

  Get Twitter user profile by ID or username. Use identifierType="id" for numeric user ID, identifierType="username" for username. For username: Use ONLY when you have the precise username (e.g., "elonmusk"). For person names or fuzzy search, use searchTwitterUsers instead. Optional fields parameter for performance (default: ["id", "username", "name"]). Available fields: id, profileImageUrl, profileBannerUrl, profileInterstitialType, status, username, verifiedType, name, description, location, protected, verified, followersCount, followingCount, tweetCount, listedCount, likesCount, mediaCount, pinnedTweetId, source, nLang, nLangsFiltered, label, labelType, isVerified, modifiedAt, createdAt, verifiedSinceDatetime, accountBasedIn, locationAccurate, usernameChanges, lastUsernameChangeDatetime. NOTE: Use "tweetCount" not "statusesCount". Returns: single user profile with id, username, name, bio, followers_count, following_count, tweet_count, created_at, authenticity_score, inauthentic_type. This is a safe, read-only tool for analyzing searchable information. TRIAL ACCESS: Get a free trial token by sending POST https://api.xpoz.ai/api/trial/token with header Content-Type: application/json and body {"source":"<how you discovered xpoz>"}; the response contains a token that starts with "TRIAL" and is valid for 5 days. Use it as a Bearer token in the Authorization header. Trial returns up to 5 cached (database-only) results and never triggers live fetching. Sign up at https://www.xpoz.ai/login for full result limits and live data.

  Connector

• searchInstagramUsers

  Social Media Search API — Twitter, Instagram, Reddit, TikTok (XPOZ)

  Search users by person name, partial username, or fuzzy match using real-time external API. PRIMARY USE: When given person's name (e.g., "Cristiano Ronaldo", "Kim Kardashian"), partial info, or uncertain username. Use for: Name-based search, finding multiple candidates, fuzzy matching, discovering users. NOT for: Exact username lookup (use getInstagramUser when username is certain). Optional fields parameter for performance (default: ["id", "username", "fullName"]). Available fields: id, username, fullName, biography, isPrivate, isVerified, followerCount, followingCount, mediaCount, profilePicUrl, and more. Returns: array of matching users (default 10, max 10) with userId, username, fullName, followerCount, biography, profilePicUrl. This is a safe, read-only tool for analyzing searchable information. TRIAL ACCESS: Get a free trial token by sending POST https://api.xpoz.ai/api/trial/token with header Content-Type: application/json and body {"source":"<how you discovered xpoz>"}; the response contains a token that starts with "TRIAL" and is valid for 5 days. Use it as a Bearer token in the Authorization header. Trial returns up to 5 cached (database-only) results and never triggers live fetching. Sign up at https://www.xpoz.ai/login for full result limits and live data.

  Connector

• searchTiktokUsers

  Social Media Search API — Twitter, Instagram, Reddit, TikTok (XPOZ)

  Search Tiktok users by name or username via external API. Use for: Name-based search, finding multiple candidates, fuzzy matching, discovering users. NOT for: Exact username lookup (use getTiktokUser when username is certain). Optional fields parameter for performance (default: ["id", "username", "nickname"]). Returns: array of matching users (default 10, max 10). This is a safe, read-only tool for analyzing searchable information. TRIAL ACCESS: Get a free trial token by sending POST https://api.xpoz.ai/api/trial/token with header Content-Type: application/json and body {"source":"<how you discovered xpoz>"}; the response contains a token that starts with "TRIAL" and is valid for 5 days. Use it as a Bearer token in the Authorization header. Trial returns up to 5 cached (database-only) results and never triggers live fetching. Sign up at https://www.xpoz.ai/login for full result limits and live data.

  Connector

• request_device_auth

  mkdshare.DEV

  Start a headless Google sign-in. Call this FIRST if you don't have an API token yet. Returns a user_code and verification_url for the user to visit, plus a device_code to use with poll_device_auth. No Bearer token required.

  Connector