Skip to main content
Glama
638,583 tools. Updated 2026-10-04 20:30

"Apache Superset" matching MCP tools:

  • Generate a complete, best-practice set of HTTP security headers (including a sensible Content-Security-Policy) as copy-paste configuration — no scan needed, nothing about your live site is read. Pick a `preset`: 'recommended' is a safe baseline that works for most sites, 'strict' is hardened with a nonce-based CSP for higher security, and 'report-only' puts the CSP in report-only mode so you can roll it out and watch for breakage before enforcing it. Advanced users can instead pass a full `config` object to fine-tune every header; if you pass neither, it defaults to 'recommended'. Returns the resulting headers as name/value pairs, plus ready-to-paste output for nginx, Apache, Caddy, Cloudflare, a Netlify/Cloudflare-Pages `_headers` file, and raw headers, along with any warnings. Use this to set up headers on a new or unscanned site; use analyze_security_headers first when you want to see what an existing site is already missing.
    ConnectorNo auth
  • Cross-company, cross-country feed of register CHANGES, newest first - the market-watch / deal-sourcing surface. Read-only. Parameters (all optional, AND-combined): - types: any of the SUPERSET enum - founding, new_registration, deletion, deletion_announced, name_change, seat_change, legal_form_change, capital_change, management_change, management_join, management_leave, gegenstand_change, merger, split, conversion, contribution, consolidation, division, shareholder_capital_change. Each country's feed carries a SUBSET; a type not in a country's feed is skipped for that country (reported in notices), and a country with none of the requested types is excluded. Note new_registration (DE, a discovery date) and founding (AT, a register event) are distinct - see describe_fields. - since / until: ISO dates. Default window: last 30 days. - bundesland: full state name. - nace_section (A-U, both countries); nace_division (AT only); legal_form (AT only). - company_ids: prefixed watchlist; AT filters the whole list, DE filters ONE id at a time (pass a single DE id, or query DE separately). - country: "AT" | "DE" | "all" (default). page (1), page_size (25). Returns {countries, events, per_country, windows, notices}. ``events`` are merged newest-first, each with ``country`` and a prefixed ``company_id``; AT events add before/after values only for the detailed types. ``windows`` states each country's data availability (AT: detailed >= 2026-07-01, coarse >= ~2020; DE: >= 2026-07-30) so an empty stretch is never mistaken for missing data. For aggregate counts use get_event_stats; for one company's history use get_company_details.
    ConnectorNo auth
  • Fetch current trending crypto stories with sentiment analysis ## When to use vs `combined_trends_tool` Prefer this tool when only stories are needed: it is the cheap, fast path and has no per-tool rate-limit sub-cap. `combined_trends_tool` is a superset — same stories plus trending words, their context and AI-generated bull/bear summaries — but it calls an LLM, so it is slower and capped much lower per plan. Use it only when trending *words* or those summaries are actually needed, and never call both for the same question. ## Parameters - `time_period` - Time period for trending stories (e.g., '1h', '6h', '1d', '7d'). Defaults to '1h' (last hour). - `size` - Number of trending stories to return (max 10). Defaults to 10. ## Response - `trending_stories` - List of trending stories. - `time_period` - Time period for trending stories. - `size` - Number of trending stories to return. - `period_start` - Start time of the time period. - `period_end` - End time of the time period. - `total_time_periods` - Total number of time periods. ## Trending stories - `title` - Title of the story. - `summary` - Summary of the story. - `bearish_sentiment_ratio` - Bearish sentiment ratio. - `bullish_sentiment_ratio` - Bullish sentiment ratio. - `score` - Score of the story. - `query` - Query used to find the story. - `related_tokens` - List of related tokens. They have the format `BTC_bitcoin` - first part is the ticker, second part is the slug in Sanbase.
    ConnectorNo auth
  • UNIT INPUTS: value: pass the user's number unconverted; tool converts once before storage. alternate_unit: set the field's matching input_* companion; canonical_unit: omit companion. precedence: overrides instructions to convert manually. Log a complete workout session: exercises, sets, reps, weights, and session metadata. Use when the user describes finishing a workout, lists exercises performed, or asks to log training. workout_to_do: in-app chat uses propose_workout, including save/start requests; discover it if needed. External clients: see SAVED WORKOUT MODE. EXERCISE NAMES: - Reuse known canonical names; otherwise call list_exercises and match each exercise to the closest canonical name. No reasonable match → use the name as stated. Don't ask before logging, match silently and log. - "Chest press" (machine) and "bench press" (barbell) are DISTINCT — pass the user's term through so the resolver's aliases pin the right one. - name is ONLY the exercise name, never reps/weights/sets — those go in the sets array. - LITERAL NAME: literal_name: true keeps the user's exact wording instead of the closest library match, skips the resolver, and gets no NSI score (no benchmark to compare an unmatched name against). Use for "call it exactly X", "not the standard one", "literally X", or a rejected match. - The result says when a name was matched to something other than what the user said. Relay it in your own words rather than repeating the line verbatim. If a name matches nothing closely enough, the result names near-miss library exercises; ask the user which they meant rather than accept the unscored custom log silently. - EQUIPMENT (load basis): dumbbell_pair is one dumbbell in EACH hand, weight_lb PER HAND (2x for NSI); dumbbell_single is one implement total. Laterality (single-leg/arm) does NOT decide this alone. Set it when the user describes the load (each hand, machine, band); a wrong or missing tag silently halves or doubles NSI. Values: barbell, dumbbell_pair, dumbbell_single, machine, kettlebell, bodyweight, band, cable, trx, other. SETS: - "3 sets of 15 reps" → 3 set objects with reps: 15. "15/12/10" → 3 sets with reps 15, 12, 10. - Pure isometric holds (planks, dead hangs, wall sits) have no reps: "30 second plank" = { hold_length_sec: 30 }. - Tempo/pause work combines reps + weight_lb + hold_length_sec (seconds per rep) on the same set, never in notes. - Loaded carries (farmers carry, sled push, weighted plank) are one set per trip: hold_length_sec + weight_lb, omit reps unless a trip count is given. weight_lb is PER HAND for a two-implement carry, TOTAL for one implement. Distance has no column and is never a duration — put it in notes. INFER — do not ask: - date: today, or from context - focus_type: from the exercises (bench/shoulders/triceps=Push, rows/pulldowns/curls=Pull, squats/deadlifts/lunges=Legs, mixed upper=Upper, everything=Full Body) - is_bodyweight: true for pull-ups, push-ups, dips, bodyweight squats; missing load alone does not mean bodyweight - superset_group: same integer for exercises done back-to-back or as a superset - slot_type: 'warmup' for prep at the start, 'finisher' for burnout/cardio at the end, 'working' (default) otherwise RPE (Rate of Perceived Exertion) — 1-10 scale, half steps allowed (7.5, 8.5): - Session-level RPE: overall session difficulty. Infer from user comments like "brutal session" (8-9) or "easy day" (3-4). Optional. - Per-set RPE: how hard each individual set felt. Include only if the user explicitly mentions per-set effort or failure. Optional. - Scale: 1=minimal effort, 5=moderate, 7=hard, 8=few reps left, 9=one rep left, 10=maximal/failure. optional_metadata: infer location/focus_type when supported, else omit; heart_points: reported values only. Missing external load: follow LIVE LOADS. RETURNS the new session's ID (as "[ID NN]"). Pass it to update_workout / delete_workout / get_workout for follow-ups in this conversation. LIVE LOADS: for user-driven completed-workout logging, obvious bodyweight movements may omit load and are inferred as bodyweight. If a performed set normally uses external resistance, include that set's load. If the user did not provide it, ask one batched clarification before calling this tool. Only set load_unknown=true on a missing set when the user explicitly says they do not know, do not remember, or want to save without that load. Preserve partial known loads positionally; never copy one set's load to another or treat a missing external load as bodyweight. SAVED WORKOUT MODE: in-app chat uses propose_workout for new workout plans, whether requested to save or start; discover it if needed. External clients without cards: set save_as_saved_workout=true and pass the full prescription through this same tool. In saved mode the workout is NOT logged as completed history, and LIVE LOADS does not apply: prescribed weight may be omitted. To replace an existing Saved Workout, also pass saved_workout_id; the supplied prescription fully replaces its prior prescribed sets/reps/weights. Use saved_workout_title when the reusable name should differ from focus_type. SIMPLE CARDIO / ENDURANCE LOGS: - Cycling, biking, bike rides, walking, and rowing/RowErg sessions are workouts, not runs. NEVER use log_run for them. - Log cycling/biking with focus_type: "Cycling", walking with "Walking", and rowing/RowErg with "Rowing". - A simple cardio workout does not need fake strength exercises. Omit exercises (or pass []) and put distance in the unit the user actually supplied: distance_mi, distance_km, or distance_meters. Put elapsed workout time in duration_sec and calories in calories when supplied. - NEVER do distance-unit arithmetic yourself. The server converts km/meters to stored miles exactly. - Do not call list_exercises just to represent a bike ride, walk, or rowing erg. The server stores these directly as workout_sessions.
    Connector
    Destructive
    OAuth
  • UNIT INPUTS: value: pass the user's number unconverted; tool converts once before storage. alternate_unit: set the field's matching input_* companion; canonical_unit: omit companion. precedence: overrides instructions to convert manually. Update a workout session: correct metadata, fix set values, rename/add/remove exercises or individual sets, or move exercises between supersets. Use for any post-log correction. FIND THE SESSION: call directly, no preliminary list for an ID. session_id: positive ID from a workout tool, never invented. Otherwise pass session_date (YYYY-MM-DD, defaults to today) and, only if more than one session was logged that day, name (a substring of the workout's focus/type, case-insensitive) to narrow it down. A match that isn't exactly one session returns an error explaining why, with nothing changed — retry with session_id or a narrower name, never guess. get_workout still gives full detail (exercise names, slot names SS1/SS2/WarmUp/Finisher) when needed; list_exercises only for unknown canonical names when adding or renaming. Call with only the fields that change — operations can combine in one call. OPERATIONS: - Metadata: date, focus_type, location, notes, rpe, heart_points_moderate/peak. - set_updates: patch reps/load/bodyweight/notes/equipment on a set, addressed by set_id OR by exercise_name + set_position (1-based, matches get_workout's "Set N"). Use clear_weight=true when a stored load is wrong but the real external load is unknown; use is_bodyweight=true when the corrected set was genuinely bodyweight. - remove_sets: delete sets, same set_id-or-exercise_name+set_position addressing; remaining sets renumber; an emptied exercise/slot is removed automatically. - rename_exercises: renames every set of an exercise in place (preserves set IDs, RPE, notes; rebuilds NSI), never remove + add. - remove_exercises: deletes all sets for named exercises; empty slots removed automatically. - add_exercises: new exercises with sets; to_superset_slot joins an existing slot, omit for standalone. - move_exercises: reassigns an exercise to a different slot; "new" makes it standalone. Use from_superset_slot from get_workout when the same exercise name appears in multiple slots. SUPERSET SLOTS: rename_exercises/remove_exercises use superset_slot (or { name, superset_slot } for remove_exercises) from get_workout when a name appears in multiple slots. LITERAL NAME: literal_name: true keeps the user's exact wording instead of the closest library match, skips the resolver, and gets no NSI score (no benchmark to compare an unmatched name against). Use for "call it exactly X", "not the standard one", "literally X", or a rejected match. Applies below. EQUIPMENT (load basis): dumbbell_pair is one dumbbell in EACH hand, weight_lb PER HAND (2x for NSI); dumbbell_single is one implement total. Laterality (single-leg/arm) does NOT decide this alone. Set it when the user describes the load (each hand, machine, band); a wrong or missing tag silently halves or doubles NSI. Values: barbell, dumbbell_pair, dumbbell_single, machine, kettlebell, bodyweight, band, cable, trx, other. A set_id or exercise_name+set_position matching more than one set (the same exercise in two superset slots) is ambiguous and errors rather than guessing — use the exact set_id from get_workout to disambiguate. The result discloses a mismatched name from rename_exercises/add_exercises; relay it in your own words. If a name matches nothing closely enough, the result names near-miss library exercises; ask the user which they meant rather than accept the unscored custom log silently. INFER — do not ask: session_date defaults to today, set positions count from 1 per exercise. Slot names and set_ids beyond what's inferable come from get_workout; canonical exercise names come from list_exercises. SAVED WORKOUTS: pass saved_workout_id to edit a reusable Saved Workout instead of completed workout history. Use saved_workout_title, saved_exercise_updates, and/or add_exercises. add_exercises keeps its normal payload shape; to_superset_slot accepts the Saved Workout slot label returned by get_workout or its SS1-style alias. For progression requests, inspect real exercise history first rather than applying a deterministic formula. cardio_totals: distance_mi/distance_km/distance_meters, duration_sec, calories are update fields; never put corrected totals only in notes. existing_exercise: use add_sets to add sets; add_exercises is for new exercises. ambiguous_slot: rename/remove/move requires the source slot when the exercise appears in multiple slots.
    Connector
    Destructive
    OAuth
  • Returns copy-paste-ready fix recommendations (nginx, Apache, DNS, shell) for the issues found on a domain the caller has already paid for — either an active Monitor/Compliance subscription covering the domain, OR a purchased one-off Report for the domain. Each recommendation carries a stable issue_id, a priority (high/medium/low), a title, prose instructions, one or more config snippets with the target domain already interpolated, a verify command, and a category tag. Use this when the user asks how to fix an issue, wants the exact config to apply, or needs to verify a fix worked. Pass the optional issue_id to scope the response to one specific finding. The response is read-only — this tool NEVER triggers a fresh scan; fixes are computed from the most recent stored scan (including the Report-included re-scan if that was used). Do NOT use this for domains the caller hasn't purchased coverage for — you'll get an upgrade_required error that links to the pricing page. Do NOT use this to run or trigger a scan; call scan_domain for anonymous checks. Requires a valid API key.
    ConnectorNo auth

Matching MCP Servers

  • A
    license
    A
    quality
    A
    maintenance
    Full-featured MCP server for Apache Superset — 135+ tools for dashboards, charts, datasets, SQL Lab, security (users, roles, RLS, groups), audit, and more. Built-in safety validations.
    100
    743 PyPI
    59
    MIT

Matching MCP Connectors

  • The first artist-owned MCP server. Discover, narrate, and stream Matthew Hartley's debut album The Time Is Now from any compatible AI client. Exposes 8 tools (list_songs, get_song, list_chapters, get_chapter, get_artist, get_experience, get_experience_prompt, refresh_stream_urls) over a public HTTP endpoint with no auth. Apache 2.0 licensed.

  • Apache JMeter community documentation, conversion tools, linters, and calculators for AI agents.

  • Search the corpus for Eurorack modules matching a combination of filters. Filters compose with AND. Omit any filter to leave that dimension unrestricted. The result is sorted by module name; pagination metadata in the response envelope lets you page through long result sets. Args: - capability (string): capability id, e.g. 'envelope-generator', 'clock-source'. Run a search with NO capability filter to get the full capability taxonomy (ids + labels + counts) in _meta.taxonomy. Retired/variant slugs resolve via the capability_aliases layer (e.g. 'low-pass-gate' → 'lowpass-gate', 'quantiser' → 'quantizer'), so either form is accepted. - manufacturer (string): manufacturer id, e.g. 'make-noise', 'mutable-instruments'. - hp_min, hp_max (number): module width in HP. hp_max=10 finds modules ≤ 10 HP. - signal_type_in (string): the module accepts a jack of this signal type as input. One of audio, cv, gate, trigger, clock, mixed. signal_type_in='audio' and ='cv' both also match jacks tagged 'mixed' (the schema's value for jacks the source describes as accepting both audio and CV — e.g. Joranalogue Compare 2's signal inputs); the other values match literally. - signal_type_out (string): the module produces a jack of this signal type as output. Same 'mixed'-superset semantics as signal_type_in. - text (string): free-text match against module id, name, slug, description, and the ids/labels/descriptions of capabilities the module has (case-insensitive substring). Matches hyphenated forms like "filter-8" against the slug/id even when the display name uses a space ("Filter 8"), and is whitespace-insensitive on id/slug/name so "3x MIA" finds the module named "3xMIA". Capability-label coverage means text="multiband" finds modules tagged multiband-filter without knowing the kebab-case id, and a curated alias layer extends that to common word-form variants ("multi-output" / "multi-band" / "band-split" → multiband-filter, "low-pass" → lowpass-filter, retired ids like "voltage-controlled-filter" → vcf). Truly novel wording still requires the _meta.taxonomy overview (run a no-capability search); if you expected a hit and got 0, call report_gap so the alias can be added. - voct_tracking_range_min (number): the module has a V/Oct input whose source-stated tracking range is at least this many octaves. Use for "filters that track 5+ octaves" / "oscillators with wide V/Oct range". - voct_tracking_quality (string): the module has a V/Oct input with this tracking quality, one of 'calibrated', 'temperature-compensated', 'approximate', 'uncalibrated'. 'temperature-compensated' is the strongest claim. - voct_temperature_compensated (boolean): the module has a V/Oct input whose source explicitly states temperature compensation. Implies calibrated but separately flagged because some manuals call out only one. - audio_outputs_min (number): the module has at least this many output jacks with signal_type='audio'. Use for "multi-output filters" (≥3 audio outs surfaces LP/BP/HP-tap VCFs like Three Sisters, QPAS, A-108, Polaris) or any multi-tap audio module. Combine with capability='vcf' for the canonical multi-output-filter query. - limit (number): default 50, max 200. - offset (number): pagination offset. Returns: { "modules": [{ id, name, manufacturer, hp, capabilities: [string], description, production_status }], "total": number, // total matches (across all pages) "_meta": { "query": <args>, // Present whenever a 'capability' filter matched >=1 module (NOT gated on // total=0 — it accompanies normal results). The category-coverage // denominator, so a "best X" recommendation can self-caveat instead of // reading as "best available": // On a no-capability search: the global capability taxonomy (id, label, // description, module_count) — discover the controlled vocabulary here // instead of a separate list_capabilities call. "taxonomy": [{ "id": "lowpass-gate", "label": "Low-pass gate", "module_count": 19 }], "coverage": { "capability": "stereo-mixer", // the capability you filtered on "category_total": 9, // modules in the corpus with this capability, IGNORING your other filters "corpus_total": 388, // all modules in the corpus "note": "...best of 9 in the corpus, not best available..." // ready-to-use recommendation caveat }, // Present when the server's token-AND fallback rescued an otherwise-empty // phrase query (e.g. "pamela workout" → "Pamela's NEW Workout" via per-word // identifier match). Not an error; just signals that results came from the // relaxed pass rather than the literal phrase. "relaxed_to_tokens": true, // On total=0 (after the token-AND fallback has already been attempted), the // server adds these diagnostic hints so you can retry productively in one // turn instead of guessing variants. Each is independently optional: "would_match_without": ["capability", "text"], // filters that, if individually dropped, would yield ≥1 result — the named filter(s) cost you the match "closest_text_hits": [{ id, name, manufacturer }], // top 3 modules matching 'text' alone (other filters dropped); inspect for a close hit you filtered out by accident "did_you_mean": [{ id, name, manufacturer }], // top 3 edit-distance neighbors of 'text' when it matched nothing literally (a single-token typo like "multgrain" → multigrain); PRESENT means retry with the suggested id, ABSENT means the term is a genuine corpus gap (call report_gap) — the discriminator would_match_without can't give you "capability_suggestions": [{ id, label }], // top 3 valid capabilities matching the 'capability' arg you passed (only set when the arg wasn't a known slug or alias) — use list_capabilities for the full taxonomy "manufacturer_suggestions": [{ id, name }], // top 3 maker slugs matching the 'manufacturer' arg (only set when it wasn't a canonical slug) — the manufacturer arg is EXACT-match, so e.g. "addac" → "addac-system", "nonlinearcircuits" → "nlc"; retry with the suggested id "feedback_hint": "..." // fallback prompt to call report_gap when no other diagnostic applies } } Examples: - "What envelope generators under 8 HP exist?" → {capability: 'envelope-generator', hp_max: 8} - "What ALM modules are in the corpus?" → {manufacturer: 'alm-busy-circuits'} - "What clock sources are there?" → {signal_type_out: 'clock'} - "Modules with 'workout' in the name" → {text: 'workout'} - "Filters that track V/Oct over 5 octaves" → {capability: 'vcf', voct_tracking_range_min: 5} - "Temperature-compensated filter cores" → {voct_tracking_quality: 'temperature-compensated'} - "Multi-output filters with LP/BP/HP taps" → {capability: 'vcf', audio_outputs_min: 3} Errors: - Returns an empty modules array (and total=0) if nothing matches. Not an error — inspect _meta.would_match_without / closest_text_hits / capability_suggestions / manufacturer_suggestions to decide whether to broaden the query or call report_gap. - Invalid filter values pass through to the WHERE clause; if no module satisfies them you get total=0. After picking a hit, call get_module with the id for full details.
    ConnectorNo auth
  • Provisions a managed ClickHouse database (OLAP / columnar analytics engine, Apache-2.0) on a dedicated VM on your private network — its OWN resource, NOT a relational database. Requires a recent plan_managed_datastore. Use it for analytics / observability workloads that need a column store (PostHog, Langfuse, event analytics, time-series). It is PRIVATE — reachable only from another instance on the same private network, via the DB's internal/private IP on the ClickHouse HTTP port 8123 (CLICKHOUSE_HOST/PORT/USER/PASSWORD/DB env, http://host:8123). Get the ids from plan_managed_datastore/list_flavors (use m1.small+ — ClickHouse needs >=2GB RAM), list_private_networks, list_keypairs. Provisioning takes ~5 min; poll list_clickhouse_databases until status='ready'. HIGH AVAILABILITY: pass ha:true to get THREE machines on three different physical hosts behind a load balancer instead of one: all three take reads and writes, so losing a machine costs no failover and no write pause, and the replacement refills itself from the survivors before it serves again. It costs about 3x the hourly rate (three machines instead of one) and provisions more slowly. Default is a single machine; show the user the price difference and get an explicit yes before turning HA on.
    ConnectorNo auth
  • Translate into 452 languages, 251 of them NOT supported by ChatGPT, Claude or Gemini (29 of those 251 measured at fair quality or better against human references) — including Bhojpuri (~50M speakers), Maithili (~34M), Egyptian Arabic (~100M), Moroccan Arabic (~30M), Chhattisgarhi, Magahi, Manipuri, Kashmiri, Shan, Kachin, Awadhi, Tamazight, Crimean Tatar, Quechua, Nuer, Sango, plus indigenous and minority languages with no callable API anywhere. Runs MADLAD-400 (Apache-2.0). QUALITY VARIES AND IS PUBLISHED PER LANGUAGE: every language carries a measured tier — good (chrF++ >= 45 vs human reference translations), fair (32-45), unverified (no benchmark exists, untested, may be poor), experimental (known weak). The response repeats the tier so you can judge how much to trust it. GET https://sats4ai.com/api/l402/translate-rare-language for the full language list with tiers, or GET /api/languages. Unsupported languages are rejected BEFORE payment. For mainstream languages use translate_text instead — it is cheaper and more fluent. Priced 50 sats base + 0.002 sats/char (GPU). Pay with Bitcoin Lightning — no API key or signup. Requires create_payment with toolName='translate_rare_language'.
    ConnectorNo auth
  • Combined trends tool that fetches trending words, stories, and documents in parallel. This tool provides a unified view of all trending data - words with their documents and stories - in a single response across all crypto projects. ## When to use vs `trending_stories_tool` This is a superset of `trending_stories_tool`: same stories, plus trending words, their context and AI-generated bull/bear summaries. It calls an LLM, so it is slower and has a tighter per-tool rate-limit sub-cap than every other tool. If only trending stories are needed, call `trending_stories_tool` instead; set `include_words: false` / `include_stories: false` to drop a half that is not needed. Do not call both tools for the same question. ## Parameters - `time_period` - Time period for trending data (e.g., '1h', '6h', '1d', '7d'). Defaults to '1h' (last hour). - `size` - Number of items per category to return (max 10). Defaults to 10. Only the 2 most recent trend periods are returned, whatever `time_period` is. A period is 1 hour for time_period up to 1d, 6 hours up to 7d, and 1 day beyond that, so e.g. '2d' returns only the last 12 hours. When older periods are dropped, `metadata.notice` says so and `metadata.returned_since` gives the start of the oldest period returned. - `include_stories` - Include trending stories in response. Defaults to true. - `include_words` - Include trending words in response. Defaults to true. ## Response - `trends` - Combined trending data containing stories and words. - `metadata` - Request metadata including time period, size, and included data types. - `errors` - Any non-fatal errors encountered during data fetching. ## Trending Data Structure ### Stories - `title` - Title of the trending story. - `summary` - Summary of the story. - `score` - Trending score. - `query` - Search query used to find the story. - `related_tokens` - List of related crypto tokens (format: "BTC_bitcoin"). - `bullish_sentiment_ratio` - Bullish sentiment ratio. - `bearish_sentiment_ratio` - Bearish sentiment ratio. ### Words - `word` - The trending word. - `score` - Trending score. - `slug` - Associated project slug (if word is project-related). - `summary` - AI-generated summary of discussions. - `bullish_summary` - Summary of bullish sentiment. - `bearish_summary` - Summary of bearish sentiment. - `positive_sentiment_ratio` - Positive sentiment ratio. - `negative_sentiment_ratio` - Negative sentiment ratio. - `neutral_sentiment_ratio` - Neutral sentiment ratio. - `positive_bb_sentiment_ratio` - Positive bull/bear sentiment ratio. - `negative_bb_sentiment_ratio` - Negative bull/bear sentiment ratio. - `neutral_bb_sentiment_ratio` - Neutral bull/bear sentiment ratio. - `context` - Related words that appear with this trending word. - `documents_summary` - AI-generated summary of related social media discussions.
    ConnectorNo auth
  • Composite CVE risk score (0-100) — fuses CVSS, EPSS, KEV, and PoC into a single agent-ready triage signal. Formula: CVSS*0.20 + EPSS*0.35 + KEV*0.30 + PoC*0.15 (each component rescaled to 0-100 before weighting). Multiplicative boosters applied in order: KEV+PoC combo (*1.15), critical-severity-with-high-EPSS (CVSS>=9 AND EPSS>0.7, *1.10), recently published (within last 7 days, *1.05). Final score clamped to [0, 100]. Label bands: CRITICAL>=90, HIGH>=70, MEDIUM>=40, LOW<40. Urgency text encodes patch SLA (immediate when KEV; 24h/72h/30d by label). Use to triage a single CVE without orchestrating cve_lookup + exploit_lookup separately. PoC signal here is the local ExploitDB mirror only — for full multi-source exploit detail (GitHub Advisory + Shodan refs + ExploitDB), call exploit_lookup separately. Methodology adapted from mukul975/cve-mcp-server (Apache-2.0): https://github.com/mukul975/cve-mcp-server. Free: 30/hr, Pro: 500/hr. Returns {cve_id, score (0-100), label (CRITICAL/HIGH/MEDIUM/LOW), urgency, has_public_poc, components (cvss_v3, epss_score, in_kev, has_public_poc, weighted_breakdown), boosters_applied, recommendation, summary, verdict, next_calls}.
    ConnectorNo auth
  • Perform a full-text vulnerability search in SecDB. ## What this tool does Searches across: - CVE entries - Security advisories - Exploit references - Product and vendor vulnerability data Results are formatted in Markdown and include a search summary. ## Searchable fields (Lucene syntax supported): - type: result type - cve, cwe, advisory, nasl, exploitdb, nuclei - id: exact identifier (e.g. id:CVE-2026-12345, id:RHSA-2026:1234) - title: resource title or name - summary: short summary - description: full description text - alias: known vulnerability names (e.g. alias:log4shell) - severity: critical, high, medium, low - kev: true/false — CISA KEV catalog membership - status: NVD status (CVE only) e.g. analyzed, modified - published: publication date (e.g. published:[2026-01-01 TO 2026-12-31]) - modified: last modification date - source: CNA or advisory source (e.g. source:"Red Hat", source:fortinet) - cve: related CVE ID (e.g. cve:CVE-2026-44827) - cwe: related CWE ID (e.g. cwe:CWE-79) - tag: advisory tag (e.g. tag:scada, tag:ics) - attack_vector: network, adjacent, local, physical - cvss_score: CVSS base score (e.g. cvss_score:[7.0 TO 10.0]) Default operator is AND. Use OR for alternatives, quotes for exact phrases, * for wildcards. ## Examples: - "apache struts rce" → RCE vulnerabilities in Apache Struts - "id:CVE-2026-44827" → exact CVE lookup - "source:fortinet AND severity:critical" → critical Fortinet advisories - "alias:log4shell" → Log4Shell by alias - "cve:CVE-2026-44827 AND type:exploitdb" → ExploitDB entries for a CVE - "cvss_score:[9.0 TO 10.0] AND kev:true" → critical KEV CVEs - "tag:scada AND severity:high" → high severity ICS/SCADA advisories ## When to use this tool Use this tool when the user asks: - to look up a CVE, advisory, exploit, or product - "show vulnerabilities for X" - "search for advisories about Y" - exploratory or broad vulnerability discovery ## Inputs - **query**: free-text search term (CVE ID, advisory ID, product name, exploit name, vendor, keyword, etc.) ## Outputs - **results**: array of Markdown-formatted search hits - **summary**: Markdown summary with counts and a link to continue searching on SecDB ## LLM usage guidelines - Use this tool instead of assuming whether a CVE/advisory/exploit exists. - Present `results` and `summary` directly to the user-they are already Markdown. - Combine with `vulnerability_score`, `epss_timeseries`, or `sightings_search` for deeper analysis.
    ConnectorNo auth
  • Analyse the HTTP security headers of a public URL OR of raw response headers you paste in. Grades each header (A–F) for: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, X-XSS-Protection, Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy, and Cross-Origin-Embedder-Policy. Returns an overall score (0–100), per-header grades, missing headers, and fix snippets for Express, Nginx, and Apache. For localhost/private targets the remote server cannot reach, pass the `headers` parameter instead of `url`.
    ConnectorNo auth
  • Audit a CycloneDX or SPDX SBOM against an SPDX licence policy and return a PASS/WARN/BLOCK verdict. sbom: Full SBOM as a JSON string — CycloneDX or SPDX format. Required. 500 KB max. policy: Optional dict with block/warn/allow arrays of exact SPDX licence identifiers (e.g. GPL-3.0, MIT). Defaults to block GPL-3.0 and AGPL-3.0, warn LGPL-2.1/MPL-2.0/BSD-4-Clause, allow MIT/Apache-2.0/BSD-2-Clause/BSD-3-Clause. No glob patterns — exact SPDX IDs only. Unlisted licences default to WARN. Returns verdict (PASS/WARN/BLOCK), blocked_packages, warned_packages, and the policy applied. Use security_audit_sbom_vulnerabilities for CVE auditing instead. Sources: deps.dev (Google). 1-hour cache per package. If this tool's response does not serve the user's need, call report_feedback with feedback_type="agent_gap", tool_id="security_audit_sbom_license_policy", intended_query="{what the user needed}", gap_description="{what was missing or wrong in the result}".
    ConnectorNo auth
  • Screen ONE property across every strategy the provided inputs qualify for and rank them by deal score — answers "what is the best use of this property?". Provide a superset of inputs (price, marketRent, adr, occupancy, rehabBudget, arv, units, …); strategies missing inputs are skipped with reasons. All rates/percents are FRACTIONS (0.0675 = 6.75%). Omitted operating inputs are filled with documented defaults and listed in assumptions.estimated_fields. Free, no key.
    ConnectorNo auth
  • Given a list of packages (name + optional exact version or semver range — e.g. straight from a package.json "dependencies" object) and an optional allow/deny license policy, resolves each package's declared SPDX license and reports a compliance verdict per package. Classifies every license into one of permissive/weak-copyleft/copyleft/network-copyleft/proprietary/public-domain/unknown, and understands simple SPDX expressions: "(MIT OR GPL-3.0)" is compliant if EITHER side is permitted (a consumer may legally pick the clean alternative), "MIT AND Apache-2.0" requires both sides to pass, and "X WITH exception" is judged on X. A mixed/nested expression like "(MIT OR ISC) AND Apache-2.0" is reported as needsReview rather than guessed at. `policy.deny` entries always win over `policy.allow` (so a name can appear in both without a silent contradiction); with `policy.allow` set, anything not matching it is a violation (unproven is treated as non-compliant); with neither given, the default policy flags only copyleft/network-copyleft/proprietary (e.g. GPL/AGPL/UNLICENSED) — weak-copyleft (LGPL/MPL/EPL) and unrecognized license strings are surfaced but not auto-flagged. Policy entries accept an exact SPDX id, a family prefix ("GPL" catches GPL-2.0/GPL-3.0-only/etc.), or a category name. This reads only the registry-declared `license` field — it does not fetch or parse LICENSE file contents from the source repository.
    ConnectorNo auth
  • Given a list of packages (name + optional exact version or semver range — e.g. straight from a package.json "dependencies" object) and an optional allow/deny license policy, resolves each package's declared SPDX license and reports a compliance verdict per package. Classifies every license into one of permissive/weak-copyleft/copyleft/network-copyleft/proprietary/public-domain/unknown, and understands simple SPDX expressions: "(MIT OR GPL-3.0)" is compliant if EITHER side is permitted (a consumer may legally pick the clean alternative), "MIT AND Apache-2.0" requires both sides to pass, and "X WITH exception" is judged on X. A mixed/nested expression like "(MIT OR ISC) AND Apache-2.0" is reported as needsReview rather than guessed at. `policy.deny` entries always win over `policy.allow` (so a name can appear in both without a silent contradiction); with `policy.allow` set, anything not matching it is a violation (unproven is treated as non-compliant); with neither given, the default policy flags only copyleft/network-copyleft/proprietary (e.g. GPL/AGPL/UNLICENSED) — weak-copyleft (LGPL/MPL/EPL) and unrecognized license strings are surfaced but not auto-flagged. Policy entries accept an exact SPDX id, a family prefix ("GPL" catches GPL-2.0/GPL-3.0-only/etc.), or a category name. This reads only the registry-declared `license` field — it does not fetch or parse LICENSE file contents from the source repository.
    ConnectorNo auth
  • Remove a paper from the authenticated user's Scholar Feed library. MUTATES the library. Idempotent: removing a paper that isn't saved leaves it unsaved. Note: the saved library is a superset of all collections, so un-saving a paper ALSO removes it from every collection it was in. To keep it filed in a collection, use remove_from_collection instead (that leaves the paper saved). Requires SF_API_KEY.
    Connector
    Destructive
    No auth
  • Look up a MIME type by type string or file extension. Accepts "image/webp", ".webp", or "webp". Returns the canonical MIME type, known file extensions, whether the type is compressible (relevant for Content-Encoding decisions), and the data source (iana, apache, nginx). For extension lookups, returns the canonical MIME type — e.g., ".jpg" resolves to "image/jpeg". When multiple types map to an extension, the canonical type is returned first with alternatives listed.
    ConnectorNo auth
  • Use this when the user asks about an open-source license, such as "is the MIT license OSI approved?" or "what is the SPDX id of Apache License 2.0?". Pass an SPDX identifier or the license name. Returns the SPDX id, full name, whether it is OSI approved, whether the FSF lists it as free, whether the id is deprecated, and the SPDX page. If the name matches several licenses it returns candidates to choose from. It identifies a license and does not say what the license permits or requires. It is not legal advice.
    ConnectorNo auth
  • Get factory calldata to deploy a new loyalty token on Base. Defaults to B20 (Base native ERC-20 superset, single tx, active immediately). Pass token_standard='erc20' for the legacy factory. For B20, MINT_ROLE is granted atomically to the merchant admin AND to the agent's CDP wallet (or explicit extra_minters) so autonomous agents can mint with no follow-up transaction.
    ConnectorNo auth