Skip to main content
Glama
723,720 tools. Updated 2026-10-30 02:00

"Apache Solr" matching MCP tools:

  • Search VFB terms. This is the search virtualflybrain.org itself runs — the same Solr query, the same ranking — so what comes back first here is what a user would see first on the site. USE filter_types BY DEFAULT. Unfiltered searches mix scRNAseq artifacts and developmental stages in with the entity the user wants. Common filter_types recipes: - Neuron classes: ["neuron", "class"] - Individual neurons with images: ["neuron", "has_image"] - Neurons with connectome data: ["neuron", "has_neuron_connectivity"] - Brain regions / neuropils: ["anatomy"] - Genes: ["gene"] - Driver lines / expression patterns: ["expression_pattern"] - Datasets: ["dataset"] There are over 200 type names and they change as data is added, so do NOT guess them: call list_search_facets to see the current vocabulary (optionally filtered, e.g. contains="lineage"). Names are matched case- and separator-insensitively, and a name that does not exist is an error with suggestions rather than a silently empty result. Deprecated terms are excluded by the search itself — you do not need exclude_types: ["deprecated"], and adding it is harmless but pointless. Stage filtering: VFB covers adult, larval, and embryonic data, and many anatomical FBbt classes are stage-agnostic. Do NOT add "adult" or "larva" to filter_types by default — only add them when the user is explicit about a stage (e.g. "adult Kenyon cells", "larval mushroom body"). Default searches should leave stage out so stage-agnostic classes and all life stages are visible. Useful flags: - unique=true (the default) → one row per term. Turn it OFF only when you need to see WHICH synonym matched; with unique=false a term appears once per matching synonym, so "Kenyon cell" can return the same ID several times. - minimize_results=true → top 10, essential fields only, for exploratory searches. - auto_fetch_term_info=true → if an exact label match is found, returns get_term_info in the same response. - boost_types=["has_image", "has_neuron_connectivity"] → float data-rich entities to the top of the list without excluding anything else. - demote_types=["expression_pattern_fragment"] → sink noisy types to the bottom of the list instead of removing them. If the search returns no good matches, do NOT fall back to training-data answers — try alternative spellings, synonyms, broader terms, or different filter_types. Multiple filter_types are ANDed (results must match ALL). Multiple exclude_types are ORed (any match excludes). boost_types and demote_types re-order without excluding; boost wins if a term matches both.
    ConnectorNo auth
  • 在 Kindle Music 正版曲库里检索曲目或专辑,支持关键词、facet 筛选、BPM 与时长区间。 Searches the Kindle Music production-music catalog: keyword + facet filters + bpm/duration ranges. searchField 怎么选 / Choosing searchField: - keywords:关键词匹配,默认值。多个词之间是 OR、按命中词数排序,所以加不同维度的词(用途 + 情绪 + 乐器)比堆近义词有用;英文加双引号是短语匹配("epic trailer")。不要写 AND/OR/NOT;开头的 -term 按字面匹配,不表示排除。 剧情词和抽象词(逆袭、对峙、回忆、高级感)曲库标签里很少出现,会把排序带偏:先翻译成情绪 / 乐器 / 速度这类音乐描述再检索。 expand="fast":中文按词翻译 + 同义扩展(结果稳定,同一个词每次扩成一样);expand="deep":映射到曲库标准词,召回更窄、最慢约 1 分钟。不带 expand 时 keyword 必须是英文。 带 expand 时中文否定从句(不要X / 去掉X / 避免X)会从 keyword 里剥离并映射成 exclude(「不要太X」这类程度否定映射成降权),一次最多 3 条,结果见 derivedNegations。 - ai:一句自然语言描述(可中文),后端整句理解改写后检索,结果看前排而不是总数。一两个词的需求用 keywords 更好。 - semantic:text→audio 语义检索(英文效果最好),适合"听感"类描述;不可用或 0 结果时自动降级 ai。 - track:按英文原曲名查(去掉前导序号与扩展名,中文译名搜不到)。album:按专辑编号/名查,编号不区分大小写、连字符、空格与前导零。 - lyrics:按歌词查(可中文)。composer:按作曲者查(只能英文)。 - 手里是下载文件名、UPM 链接、本站链接或 PUC-045 这类编号时,先用 km_resolve 定位,不要拿它当关键词。 ⚠️ 硬约束 / Hard constraint: searchField=keywords(未带 expand)或 composer 时 keyword 只能是英文。 Passing Chinese with searchField=composer, or with keywords and no expand, is rejected up front (Solr matches literally → zero hits). 否定 / Negation: - keywords:英文的 no / without X 不会被识别(反而把 X 当正向词召回),用 exclude*;中文否定需带 expand(见上)。客户的硬性排除任何模式都用 exclude* 兜底。 - ai:直接写进句子(不要/无/别/去掉/避免 X,no/not/without X),一次最多 4 项;「不要太X」只让 X 往后排不去掉;排除后 0 结果会自动放宽。 响应里的 derivedNegations 说明每条否定被映射成了哪个 facet 值、是否被放宽——交付前核对它。 include*/exclude* 的取值必须先用 km_vocabulary 取,并原样回填。同一维度多个值是 AND(includeLabels / includeAlbums 例外,是 OR);exclude* 命中任一即排除。 关键词不匹配厂牌名,按厂牌收窄用 includeLabels。 partition:independent = 网站「独立精选」分区,universal = 「环球UPM」分区;不传 = 两个分区合并检索(网站精选站默认只显示独立精选)。 bpmMin/bpmMax 与 durationMin/durationMax(秒)必须成对给出。 fields 怎么选 / Choosing fields: - slim(默认):每首 25 个字段(含 track_number、四维标签 + 中英文描述 + 可播放的 url),够直接做精排与交付。pageSize 上限 50。 - compact:每首只回 10 个字段(id / album_code / track_number / track_title / track_version / track_bpm / track_duration / library_name / library_type / web_url),pageSize 上限放宽到 200。 没有"按 id 批量取全字段"的端点:compact 结果需要中文描述与四维标签时,只能对收窄后的条件重跑一次 fields=slim。 ⚠️ BPM 半速口径 / Half-time BPM: 本曲库 55/60 与 110/120 常常是同一个脉冲的两种记法(标注方按半速还是双速记没有统一)。 在架主曲落在 60–90 BPM 的有 12.6 万首,一刀切 bpmMin=95,bpmMax=125 会静默漏掉一大片听感完全对的曲子。 按 BPM 收窄时要把半速区间也检索一遍再合并,否则会漏召回。 返回 / Returns: { total, appliedSearchField, searchId, fields, tracks[](字段集见 fields,含可直接打开的 web_url), search_url(C 端复现本次检索的链接)}。 有扩展时另带 ai_keyword / expanded(实际检索用的英文词);有否定时带 derivedNegations。 translation_failed:true 表示中文扩展失败、按空结果返回,不代表曲库里没有:换英文或改 searchField=ai 重试。 ai / lyrics / expand 受后端每日 LLM 配额;超额时返回 llmQuotaExceeded:true 且 appliedSearchField 降级为 keywords。 返回的 track_url 仅供试听/临时分析,见 audioNotice。 Returned track_url values are for audition / temporary analysis only; see audioNotice.
    ConnectorNo auth
  • utilpeek: parse and format a phone number. For a prefix's country and network use lookup_phone_prefix. A string that is not a phone number, or a national form without region, is a 422 (not charged). Offline numbering-plan check (phonenumbers, Apache-2.0): `valid` means the number fits its country's numbering plan, not that it is assigned, in service or reachable; `carrier` is the original range holder (ported numbers are not detected). The submitted value is processed in memory only, never logged or stored. Typically under 0.1 s. Price: USD 0.001. Free: 10 utilpeek calls per IP per UTC day. Docs: https://tanod.dev/learn/phone-number-validation-api.html
    ConnectorNo auth
  • utilpeek: parse and format a phone number. For a prefix's country and network use lookup_phone_prefix. A string that is not a phone number, or a national form without region, is a 422 (not charged). Offline numbering-plan check (phonenumbers, Apache-2.0): `valid` means the number fits its country's numbering plan, not that it is assigned, in service or reachable; `carrier` is the original range holder (ported numbers are not detected). The submitted value is processed in memory only, never logged or stored. Typically under 0.1 s. Price: USD 0.001. Free: 10 utilpeek calls per IP per UTC day. Docs: https://tanod.dev/learn/phone-number-validation-api.html
    ConnectorNo auth
  • utilpeek: parse and format a phone number. For a prefix's country and network use lookup_phone_prefix. A string that is not a phone number, or a national form without region, is a 422 (not charged). Offline numbering-plan check (phonenumbers, Apache-2.0): `valid` means the number fits its country's numbering plan, not that it is assigned, in service or reachable; `carrier` is the original range holder (ported numbers are not detected). The submitted value is processed in memory only, never logged or stored. Typically under 0.1 s. Price: USD 0.001. Free: 10 utilpeek calls per IP per UTC day. Docs: https://tanod.dev/learn/phone-number-validation-api.html
    ConnectorNo auth
  • Returns copy-paste-ready fix recommendations (nginx, Apache, DNS, shell) for the issues found on a domain the caller has already paid for — either an active Monitor/Compliance subscription covering the domain, OR a purchased one-off Report for the domain. Each recommendation carries a stable issue_id, a priority (high/medium/low), a title, prose instructions, one or more config snippets with the target domain already interpolated, a verify command, and a category tag. Use this when the user asks how to fix an issue, wants the exact config to apply, or needs to verify a fix worked. Pass the optional issue_id to scope the response to one specific finding. The response is read-only — this tool NEVER triggers a fresh scan; fixes are computed from the most recent stored scan (including the Report-included re-scan if that was used). Do NOT use this for domains the caller hasn't purchased coverage for — you'll get an upgrade_required error that links to the pricing page. Do NOT use this to run or trigger a scan; call scan_domain for anonymous checks. Requires a valid API key.
    ConnectorNo auth

Matching MCP Servers

  • A
    license
    A
    quality
    B
    maintenance
    Lets AI assistants connect to Apache Solr deployments to enumerate collections and schemas, run full-text and filtered queries, apply faceting and sorting, and issue SQL or vector-semantic searches without building custom API glue. Communicates over stdio or SSE and requires minimal environment configuration instead of app-specific credentials or mandatory ZooKeeper wiring.
    7
    MIT
  • A
    license
    Not graded
    quality
    D
    maintenance
    A Python server that enables AI assistants to perform hybrid search queries against Apache Solr indexes through the Model Context Protocol, combining keyword precision with vector-based semantic understanding.
    20
    MIT

Matching MCP Connectors

  • PLOS Search MCP — Solr-backed search over all PLOS journals.

  • Serverless hybrid search: full-text, vector and faceted search, in SQL, ES DSL, Solr and more.

  • Search the ORCID registry using structured field parameters or raw Solr syntax. Provide at least one non-blank search field; all provided structured params are ANDed together. The `query` field adds raw Solr syntax, ANDed with the structured params as one group. Returns ORCID iDs with inline name and institution data — no follow-up profile fetches needed for basic disambiguation. For ranked disambiguation of an ambiguous author name, use orcid_resolve_researcher instead. Continue a page from nextStart; the ORCID Public API pages only the first 10,000 matches, so narrow the query to reach the rest.
    ConnectorNo auth
  • Provisions a managed ClickHouse database (OLAP / columnar analytics engine, Apache-2.0) on a dedicated VM on your private network - its OWN resource, NOT a relational database. Requires a recent plan_managed_datastore. Use it for analytics / observability workloads that need a column store (PostHog, Langfuse, event analytics, time-series). It is PRIVATE - reachable only from another instance on the same private network, via the DB's internal/private IP on the ClickHouse HTTP port 8123 (CLICKHOUSE_HOST/PORT/USER/PASSWORD/DB env, http://host:8123). Get the ids from plan_managed_datastore/list_flavors (use m1.small+ - ClickHouse needs >=2GB RAM), list_private_networks, list_keypairs. Provisioning takes ~5 min; poll list_clickhouse_databases until status='ready'. HIGH AVAILABILITY: pass ha:true to get THREE machines on three different physical hosts behind a load balancer instead of one: all three take reads and writes, so losing a machine costs no failover and no write pause, and the replacement refills itself from the survivors before it serves again. It costs about 3x the hourly rate (three machines instead of one) and provisions more slowly. Default is a single machine; show the user the price difference and get an explicit yes before turning HA on.
    ConnectorNo auth
  • Translate into 452 languages, 251 of them NOT supported by ChatGPT, Claude or Gemini (29 of those 251 measured at fair quality or better against human references) — including Bhojpuri (~50M speakers), Maithili (~34M), Egyptian Arabic (~100M), Moroccan Arabic (~30M), Chhattisgarhi, Magahi, Manipuri, Kashmiri, Shan, Kachin, Awadhi, Tamazight, Crimean Tatar, Quechua, Nuer, Sango, plus indigenous and minority languages with no callable API anywhere. Runs MADLAD-400 (Apache-2.0). QUALITY VARIES AND IS PUBLISHED PER LANGUAGE: every language carries a measured tier — good (chrF++ >= 45 vs human reference translations), fair (32-45), unverified (no benchmark exists, untested, may be poor), experimental (known weak). The response repeats the tier so you can judge how much to trust it. GET https://sats4ai.com/api/l402/translate-rare-language for the full language list with tiers, or GET /api/languages. Unsupported languages are rejected BEFORE payment. For mainstream languages use translate_text instead — it is cheaper and more fluent. Priced 50 sats base + 0.002 sats/char (GPU). Pay with Bitcoin Lightning — no API key or signup. Requires create_payment with toolName='translate_rare_language'.
    ConnectorNo auth
  • Create an EnergyAI production API key in-band with no browser or card after the human operator has authorized the Terms and Privacy Policy. Returns a live key plus three commercial trial calls. Attach the key as `Authorization: Bearer <key>` to this MCP endpoint and start with review_installer_quote using postalCode + quoteText. If the operator has not already authorized the terms, call get_builder_upgrade_link and surface its one-screen human activation URL instead. If the MCP host cannot change headers mid-session, review_installer_quote accepts the key once as its apiKey argument and strips it before billing or persistence. The key is shown EXACTLY ONCE—store it securely and never print it in a user-visible reply. [always free — no API key required]
    ConnectorNo auth
  • utilpeek: parse a User-Agent string. For known x402 monitors and indexers with call rates use identify_x402_client. A User-Agent is self-reported and easy to fake; `is_bot` is a heuristic (declared crawlers, HTTP libraries, headless browsers). Parsed with ua-parser and the uap-core regexes (Apache-2.0). Typically under 0.1 s (first call up to 0.5 s). Price: USD 0.001. Free: 10 utilpeek calls per IP per UTC day. Docs: https://tanod.dev/learn/user-agent-parser-api.html
    ConnectorNo auth
  • mlpeek: Rerank up to 100 documents against a query. For pair scores use text_similarity. Returns 1-100 documents scored against a query by the ms-marco-MiniLM-L6-v2 cross-encoder (Apache-2.0) and sorted best first: index, rank, score (sigmoid of the logit, a relevance in 0-1) and logit; `top_k` keeps the best k. English model. Each text is cut at the model's 512-token window and the answer says so (longest side first). Over 32,768 tokens per request is a 422 too_many_tokens (not charged). Runs an open model pinned by hash on Tanod's own CPU (no LLM, no third-party API); an unavailable model is a 503 (not charged). Typically 0.1-2 s, up to about 10 s at the token budget. Price: USD 0.002. Free: 5 mlpeek calls per IP per UTC day. The submitted text is never logged or stored. Docs: https://tanod.dev/learn/embeddings-rerank-ner-mcp-server.html
    ConnectorNo auth
  • utilpeek: parse a User-Agent string. For known x402 monitors and indexers with call rates use identify_x402_client. A User-Agent is self-reported and easy to fake; `is_bot` is a heuristic (declared crawlers, HTTP libraries, headless browsers). Parsed with ua-parser and the uap-core regexes (Apache-2.0). Typically under 0.1 s (first call up to 0.5 s). Price: USD 0.001. Free: 10 utilpeek calls per IP per UTC day. Docs: https://tanod.dev/learn/user-agent-parser-api.html
    ConnectorNo auth
  • mlpeek: Rerank up to 100 documents against a query. For pair scores use text_similarity. Returns 1-100 documents scored against a query by the ms-marco-MiniLM-L6-v2 cross-encoder (Apache-2.0) and sorted best first: index, rank, score (sigmoid of the logit, a relevance in 0-1) and logit; `top_k` keeps the best k. English model. Each text is cut at the model's 512-token window and the answer says so (longest side first). Over 32,768 tokens per request is a 422 too_many_tokens (not charged). Runs an open model pinned by hash on Tanod's own CPU (no LLM, no third-party API); an unavailable model is a 503 (not charged). Typically 0.1-2 s, up to about 10 s at the token budget. Price: USD 0.002. Free: 5 mlpeek calls per IP per UTC day. The submitted text is never logged or stored. Docs: https://tanod.dev/learn/embeddings-rerank-ner-mcp-server.html
    ConnectorNo auth
  • utilpeek: parse a User-Agent string. For known x402 monitors and indexers with call rates use identify_x402_client. A User-Agent is self-reported and easy to fake; `is_bot` is a heuristic (declared crawlers, HTTP libraries, headless browsers). Parsed with ua-parser and the uap-core regexes (Apache-2.0). Typically under 0.1 s (first call up to 0.5 s). Price: USD 0.001. Free: 10 utilpeek calls per IP per UTC day. Docs: https://tanod.dev/learn/user-agent-parser-api.html
    ConnectorNo auth
  • mlpeek: Rerank up to 100 documents against a query. For pair scores use text_similarity. Returns 1-100 documents scored against a query by the ms-marco-MiniLM-L6-v2 cross-encoder (Apache-2.0) and sorted best first: index, rank, score (sigmoid of the logit, a relevance in 0-1) and logit; `top_k` keeps the best k. English model. Each text is cut at the model's 512-token window and the answer says so (longest side first). Over 32,768 tokens per request is a 422 too_many_tokens (not charged). Runs an open model pinned by hash on Tanod's own CPU (no LLM, no third-party API); an unavailable model is a 503 (not charged). Typically 0.1-2 s, up to about 10 s at the token budget. Price: USD 0.002. Free: 5 mlpeek calls per IP per UTC day. The submitted text is never logged or stored. Docs: https://tanod.dev/learn/embeddings-rerank-ner-mcp-server.html
    ConnectorNo auth
  • Composite CVE risk score (0-100) — fuses CVSS, EPSS, KEV, and PoC into a single agent-ready triage signal. Formula: CVSS*0.20 + EPSS*0.35 + KEV*0.30 + PoC*0.15 (each component rescaled to 0-100 before weighting). Multiplicative boosters applied in order: KEV+PoC combo (*1.15), critical-severity-with-high-EPSS (CVSS>=9 AND EPSS>0.7, *1.10), recently published (within last 7 days, *1.05). Final score clamped to [0, 100]. Label bands: CRITICAL>=90, HIGH>=70, MEDIUM>=40, LOW<40. Urgency text encodes patch SLA (immediate when KEV; 24h/72h/30d by label). Use to triage a single CVE without orchestrating cve_lookup + exploit_lookup separately. PoC signal here is the local ExploitDB mirror only — for full multi-source exploit detail (GitHub Advisory + Shodan refs + ExploitDB), call exploit_lookup separately. Methodology adapted from mukul975/cve-mcp-server (Apache-2.0): https://github.com/mukul975/cve-mcp-server. Free: 30/hr, Pro: 500/hr. Returns {cve_id, score (0-100), label (CRITICAL/HIGH/MEDIUM/LOW), urgency, has_public_poc, components (cvss_v3, epss_score, in_kev, has_public_poc, weighted_breakdown), boosters_applied, recommendation, summary, verdict, next_calls}.
    ConnectorNo auth
  • Perform a full-text vulnerability search in SecDB. ## What this tool does Searches across: - CVE entries - Security advisories - Exploit references - Product and vendor vulnerability data Results are formatted in Markdown and include a search summary. ## Searchable fields (Lucene syntax supported): - type: result type - cve, cwe, advisory, nasl, exploitdb, nuclei - id: exact identifier (e.g. id:CVE-2026-12345, id:RHSA-2026:1234) - title: resource title or name - summary: short summary - description: full description text - alias: known vulnerability names (e.g. alias:log4shell) - severity: critical, high, medium, low - kev: true/false — CISA KEV catalog membership - status: NVD status (CVE only) e.g. analyzed, modified - published: publication date (e.g. published:[2026-01-01 TO 2026-12-31]) - modified: last modification date - source: CNA or advisory source (e.g. source:"Red Hat", source:fortinet) - cve: related CVE ID (e.g. cve:CVE-2026-44827) - cwe: related CWE ID (e.g. cwe:CWE-79) - tag: advisory tag (e.g. tag:scada, tag:ics) - attack_vector: network, adjacent, local, physical - cvss_score: CVSS base score (e.g. cvss_score:[7.0 TO 10.0]) Default operator is AND. Use OR for alternatives, quotes for exact phrases, * for wildcards. ## Examples: - "apache struts rce" → RCE vulnerabilities in Apache Struts - "id:CVE-2026-44827" → exact CVE lookup - "source:fortinet AND severity:critical" → critical Fortinet advisories - "alias:log4shell" → Log4Shell by alias - "cve:CVE-2026-44827 AND type:exploitdb" → ExploitDB entries for a CVE - "cvss_score:[9.0 TO 10.0] AND kev:true" → critical KEV CVEs - "tag:scada AND severity:high" → high severity ICS/SCADA advisories ## When to use this tool Use this tool when the user asks: - to look up a CVE, advisory, exploit, or product - "show vulnerabilities for X" - "search for advisories about Y" - exploratory or broad vulnerability discovery ## Inputs - **query**: free-text search term (CVE ID, advisory ID, product name, exploit name, vendor, keyword, etc.) ## Outputs - **results**: array of Markdown-formatted search hits - **summary**: Markdown summary with counts and a link to continue searching on SecDB ## LLM usage guidelines - Use this tool instead of assuming whether a CVE/advisory/exploit exists. - Present `results` and `summary` directly to the user-they are already Markdown. - Combine with `vulnerability_score`, `epss_timeseries`, or `sightings_search` for deeper analysis.
    ConnectorNo auth
  • Analyse the HTTP security headers of a public URL OR of raw response headers you paste in. Grades each header (A–F) for: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, X-XSS-Protection, Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy, and Cross-Origin-Embedder-Policy. Returns an overall score (0–100), per-header grades, missing headers, and fix snippets for Express, Nginx, and Apache. For localhost/private targets the remote server cannot reach, pass the `headers` parameter instead of `url`.
    ConnectorNo auth
  • Audit a CycloneDX or SPDX SBOM against an SPDX licence policy and return a PASS/WARN/BLOCK verdict. sbom: Full SBOM as a JSON string — CycloneDX or SPDX format. Required. 500 KB max. policy: Optional dict with block/warn/allow arrays of exact SPDX licence identifiers (e.g. GPL-3.0, MIT). Defaults to block GPL-3.0 and AGPL-3.0, warn LGPL-2.1/MPL-2.0/BSD-4-Clause, allow MIT/Apache-2.0/BSD-2-Clause/BSD-3-Clause. No glob patterns — exact SPDX IDs only. Unlisted licences default to WARN. Returns verdict (PASS/WARN/BLOCK), blocked_packages, warned_packages, and the policy applied. Use security_audit_sbom_vulnerabilities for CVE auditing instead. Sources: deps.dev (Google). 1-hour cache per package. If this tool's response does not serve the user's need, call report_feedback with feedback_type="agent_gap", tool_id="security_audit_sbom_license_policy", intended_query="{what the user needed}", gap_description="{what was missing or wrong in the result}".
    ConnectorNo auth
  • Given a list of packages (name + optional exact version or semver range — e.g. straight from a package.json "dependencies" object) and an optional allow/deny license policy, resolves each package's declared SPDX license and reports a compliance verdict per package. Classifies every license into one of permissive/weak-copyleft/copyleft/network-copyleft/proprietary/public-domain/unknown, and understands simple SPDX expressions: "(MIT OR GPL-3.0)" is compliant if EITHER side is permitted (a consumer may legally pick the clean alternative), "MIT AND Apache-2.0" requires both sides to pass, and "X WITH exception" is judged on X. A mixed/nested expression like "(MIT OR ISC) AND Apache-2.0" is reported as needsReview rather than guessed at. `policy.deny` entries always win over `policy.allow` (so a name can appear in both without a silent contradiction); with `policy.allow` set, anything not matching it is a violation (unproven is treated as non-compliant); with neither given, the default policy flags only copyleft/network-copyleft/proprietary (e.g. GPL/AGPL/UNLICENSED) — weak-copyleft (LGPL/MPL/EPL) and unrecognized license strings are surfaced but not auto-flagged. Policy entries accept an exact SPDX id, a family prefix ("GPL" catches GPL-2.0/GPL-3.0-only/etc.), or a category name. This reads only the registry-declared `license` field — it does not fetch or parse LICENSE file contents from the source repository.
    ConnectorNo auth