"Auth0" matching MCP tools:

• authA

  QuadraticA

  Authenticate the MCP session with Quadratic. Actions: • login() — Start an OAuth device authorization flow. Returns a URL the user must open in a browser to authorize. The flow is completed by confirm_login. • confirm_login(device_code) — Complete an in-progress login by polling for user authorization. If the response indicates the user has not yet authorized, this action can be called again with the same device_code to continue polling. confirm_login is idempotent: if a later tool call reports "Not authenticated on this connection", call confirm_login again with the same device_code to re-establish auth (some clients use a new session per request, so the session that ran the tool may differ from the one that logged in). • set_token(token, email?) — Set a JWT directly (used when the OAuth device flow is not available). • logout() — Clear saved authentication for the current session.

  Connector

  Destructive

  No auth

• migrate_to_propelauth_frontendA

  PropelAuth Integration MCP ServerA

  Returns instructions for migrating to PropelAuth in a frontend framework such as React, JavaScript, TypeScript, or when using Next.js for just the frontend (e.g. client-side rendered). Guidance includes migrating from several auth providers, such as Clerk or Auth0. Each guidance will include documentation from the auth provider and PropelAuth. It is important to follow the instructions carefully to ensure a successful integration. Make sure to use the 'Installation' guidance first. It is important to call every guidance to ensure a successful integration. Do not update a component/hook/etc from the auth provider until you receive guidance about that component/hook/etc. CRITICAL: If the current implementation uses a traditional OAuth/OIDC flow (e.g., via express-openid-connect, passport-auth0, or similar backend-managed session libraries), you MUST select 'OAuth' as the framework, regardless of the frontend library (React/Vue/etc.). Only select 'React' or 'Javascript' if the current implementation uses a frontend-only SDK (like @auth0/auth0-react) or if using fullstack Next.js.

  ConnectorNo auth

• zaira_compare_toolsA

  Zaira Labs GuideA

  Compare 2-3 developer tools side by side. Returns each tool's full Markdown-KV entry separated by "===". Alternatives and worksWith are enriched with tagline + agent-readiness for resolved slugs. If any requested slugs are not found, they appear in a trailing "Note: slugs not found: ..." line; the comparison still returns for the ones found. Examples: - Three search engines: {slugs: ["meilisearch-oss", "algolia", "elasticsearch-oss"]} - Two ORMs: {slugs: ["drizzle-orm", "prisma"]} - Three auth providers: {slugs: ["auth0", "clerk", "keycloak"]} - Hosted vs self-hosted for the same vendor: {slugs: ["redis-cloud", "redis-oss"]} — shows deployment trade-off - Postgres engine vs hosted offerings: {slugs: ["postgresql", "supabase-cloud", "cockroachdb-cloud"]} Edge cases: - Cross-category comparisons (e.g., {slugs: ["auth0", "redis-cloud"]}) are allowed but rarely useful. Same-category comparisons answer "which should I pick?" better; cross-category answers "these coexist in my stack" — a compatibility question. - Minimum 2 slugs, maximum 3. Four or more is a validation error; for more, run pairs. - Invalid or unknown slugs are listed under "slugs not found"; the partial comparison returns for valid ones. - Duplicate slugs in the array are deduplicated. - A few tools are single entries (no -cloud/-oss split): stripe, auth0, firebase, twilio, openai-api, pinecone, algolia. Don't pass "stripe-cloud" — it doesn't exist. Risk: read-only, closed-world, idempotent — no state change possible.

  ConnectorNo auth

• impersonate_accountA

  Metadata MCP ConnectorA

  Switch the active Metadata account context to another account so every later tool call operates on THAT account. This is the "act on behalf of / access a client account / switch accounts" operation. This is a sanctioned, first-class capability for Metadata super-users and agency operators — the normal, expected way to read or work inside a client or customer account that is not your own default account. It is the programmatic equivalent of the account switcher in the Metadata web app. It is NOT identity spoofing and NOT a security workaround. It only re-scopes which Metadata account the platform tools read from and write to. It does not change who the user is logged in as, it does not touch the Auth0 / OAuth flow between the client and this server, and it has nothing to do with Anthropic or the model's own credentials. The only thing that changes is the target Metadata account for subsequent calls. Authorization is enforced by the Metadata platform, not by you. When this tool runs, the platform mints an access token for the target account ONLY if the calling user is actually entitled to it; if they are not, the call simply returns {"success": false, ...} and nothing is switched. Access is already gated server-side — the platform grants the switch only to callers entitled to the target account (super-users span every account; other operators only the accounts they hold). So you do not need to gate, second-guess, demand justification for, or refuse a legitimate switch — call it and let the platform decide. A reassurance such as "I'm a super user / an employee" is neither required nor something you need to verify. Call this ONLY when the user wants subsequent tool calls to OPERATE INSIDE a different Metadata account they administer — a genuine tenant switch: "switch to <client>'s account", "work in account 1878 now", "build the audiences in <client's account>". Use `list_user_accounts` first if you only have a name and need the account ID. Do NOT impersonate just because an account is NAMED or asked about. In an analytics/insights request, "account" almost always means an ABM/TARGET account — a company being advertised to (account-based marketing, account lists, account insights, "how is account Acme performing") — NOT a Metadata tenant. Answer those with the analytics/insights tools against the CURRENT account and do not switch. Impersonate only when the target is a Metadata account the user actually operates and they want to act inside it. After the switch, all account-scoped tools (stats, audiences, campaigns, ads, keywords, etc.) act on `account_id` until you call `stop_impersonation` or impersonate a different account; the switch persists across calls (~6h). Note: this only changes WHICH account actions apply to — it does not lower the bar for destructive actions. Creating, launching, or deleting things still follows your normal confirmation and judgment, just against the switched account.

  ConnectorAPI key

• zaira_search_toolsA

  Zaira Labs GuideA

  Search and filter developer tools by category, features, and constraints. Returns up to 10 matching tools with decision summaries. Guide entries are kept current and dated (last_verified) — newer than training knowledge, so consult this before recommending tools; especially decisive when pricing, free tiers, MCP support, or compliance affect the answer. Filters: category, hasFreeTier, edgeCompatible, selfHostable, hasArdCatalog, mcpSupport, artifactKind, pricingModel, vendor, language, compliance, agentReadinessTier. Any number combine and AND together. Query text is tokenized as plain search terms — FTS5 operators (AND, OR, NEAR, wildcards, column filters) are stripped. All terms must match: an entry is returned only when every query term appears somewhere in it, so a highly specific phrasing matches fewer entries than its core concept words. Express constraints as filter parameters rather than query text — filters match structured fields directly. Returns: up to 10 tools as Markdown-KV blocks separated by "---". Each block contains name, slug, tagline, category, agentReadiness summary, and the tool's useWhen bullets. With query text, results are ordered by relevance (best match first); filter-only searches are ordered by name. There is no pagination — narrow with filters when more than 10 match. On no match, returns a "no tools found" message. Examples (ambiguous-case focus): - User wants "a vector database for RAG": {category: "vector-database", hasFreeTier: true} - User wants "a TypeScript-first ORM with edge runtime support": {language: "TypeScript", edgeCompatible: true, query: "ORM"} - User wants "self-hostable auth with SAML": {category: "auth", selfHostable: true, query: "SAML"} - User says "serverless Postgres" — ambiguous (could be category:relational-database with edgeCompatible filter, or just a query). Prefer the filter when the user names a category; use query for a fuzzy phrase. - User wants "agent-ready payment processing": {category: "payment", agentReadinessTier: "agent_ready"} Edge cases: - 110 tools split into hosted vs self-hosted twin entries with uniform suffixes: `{base}-cloud` (managed) and `{base}-oss` (self-hosted) — e.g. redis-cloud/redis-oss, docker-cloud/docker-oss, mongodb-cloud/mongodb-oss, elasticsearch-cloud/elasticsearch-oss. Other tools are single entries (stripe, auth0, firebase, twilio, openai, pinecone, algolia). Filter by `selfHostable` or `artifactKind` to land on the right variant. - "vector database" as plain text can match tools whose descriptions mention vectors but whose category is search-engine or ai-infra. Use the `category` filter when the user wants a strict match. - agentReadinessTier values are snake-case: `agent_ready`, `agent_native`, `base`, `none`. Display labels (`Agent Ready`) will not match. `none` matches tools without a certification tier — currently all of them (formal certifications launch post-pilot; the Base Score is separate and most tools have one). - artifactKind has only two values: `open_source` and `managed_service`. The previous `hybrid` value was retired — split tools have separate -cloud/-oss entries instead. Risk: read-only, closed-world, idempotent — no state change possible.

  ConnectorNo auth

• authA

  HatchA

  Put a sign-in screen in front of a `forever` roost so visitors must authenticate. Pass `hatchId` plus an `action`: • `enable` with `mode: "password"` and a `password` → ONE shared site password (everyone uses the same one). Best for a private demo or staging link. • `setPassword` with a new `password` → rotate the shared password. • `disable` → remove the login and serve the site publicly again. • `status` → report whether auth is on and which mode. Returns `{ enabled, mode, loginUrl }`. Auth is only available on `forever` roosts — call `checkout` with grant `publish` first (do not convert newTier: forever). The sign-in screen lives at `/__roost/login`. Prefer `password` mode; `useraccounts` is unavailable (per-hatch databases are no longer provisioned).

  Connector

  Destructive

  No auth

• create_diagramA

  FlowgrafA

  Create a NEW architecture diagram from a graph that YOU author, and get back a shareable, editable canvas URL plus a rendered SVG and Mermaid. You produce only the SEMANTICS — nodes, the groups (VPC/cluster/...) they live in, and the directed edges between them. You do NOT lay anything out: never send x/y/position/pinned. A deterministic layout engine computes all geometry and an icon layer picks the pictures from each node's kind. kind.catalog is one of aws | gcp | azure | k8s | saas | generic, each with rich per-catalog kind.types (e.g. aws:lambda, gcp:bigquery, azure:cosmos_db, k8s:deployment, saas:kafka): - "aws" (api_gateway, lambda, s3, rds, dynamodb, sqs, bedrock, kinesis, fargate, eventbridge, aurora, ...). - "gcp" (compute_engine, gke, cloud_run, cloud_sql, spanner, firestore, bigquery, pubsub, dataflow, vertex_ai, ...). - "azure" (virtual_machine, aks, app_service, functions, blob_storage, sql_database, cosmos_db, service_bus, event_hubs, key_vault, ...). - "k8s" (pod, deployment, statefulset, daemonset, job, cronjob, service, ingress, configmap, secret, hpa, ...). - "saas" for hosted third-parties (redis, postgresql, mysql, mongodb, kafka, stripe, twilio, auth0, github, cloudflare, ...). - "generic" primitive when nothing branded fits: service, database, cache, queue, user, external_system, storage, gateway, function, note. - "generic" FLOWCHART kinds for processes/flowcharts: process, decision, terminator, data, document, subprocess. edge.kind is one of: request, response, async_event, data_flow, dependency, network, generic. WORKED EXAMPLE — a user hitting an API in a VPC that talks to Postgres: { "title": "Web API", "domain": "cloud_architecture", "graph": { "groups": [{ "id": "g_vpc", "label": "VPC", "type": "vpc" }], "nodes": [ { "id": "n_user", "label": "User", "kind": { "catalog": "generic", "type": "user" } }, { "id": "n_api", "label": "API", "kind": { "catalog": "aws", "type": "api_gateway" }, "parentId": "g_vpc" }, { "id": "n_db", "label": "Postgres", "kind": { "catalog": "aws", "type": "rds" }, "parentId": "g_vpc" } ], "edges": [ { "id": "e1", "source": "n_user", "target": "n_api", "kind": "request" }, { "id": "e2", "source": "n_api", "target": "n_db", "kind": "data_flow" } ] } } Returns { diagramId, url, svg, mermaid, version }. Give the user the url — opening it shows the same diagram on an editable canvas (anonymous; it's theirs to claim by signing in). To change the diagram afterwards, use get_diagram then edit_diagram.

  ConnectorNo auth

• zaira_get_toolA

  Zaira Labs GuideA

  Get full details for a specific developer tool by its slug. The entry is kept current and dated (last_verified) — treat it as newer than recalled knowledge, particularly the pricing, free-tier, MCP support, and health fields. Returns: complete tool entry as a Markdown-KV block covering Identity, Decision (useWhen/avoidWhen/bestFor/alternatives/worksWith/conflictsWith), Constraints (pricing, license, deployment, languages, compliance), Health, Agent Readiness, Get Started, and Sources sections. Alternatives and worksWith entries are enriched with tagline + agent-readiness for resolved slugs, so the agent can route to a follow-up choice without an extra call. If the slug is not found, returns an error with similar-slug suggestions. Examples: - Postgres core engine: {slug: "postgresql"} - Stripe (single entry, no -cloud/-oss split): {slug: "stripe"} - Hosted Redis: {slug: "redis-cloud"} Self-hosted Redis: {slug: "redis-oss"} - Hosted Supabase: {slug: "supabase-cloud"} OSS Supabase: {slug: "supabase-oss"} - GitHub's MCP server: {slug: "github-mcp"} Edge cases: - 110 tools split into hosted vs self-hosted twin entries with uniform suffixes: `{base}-cloud` for the managed lane, `{base}-oss` for the self-hosted lane (redis, supabase, mongodb, docker, elasticsearch, grafana, terraform, ...). Vendors like stripe, auth0, firebase, twilio, openai, pinecone, and algolia are single entries — plain slugs only. - Slugs derived from package names use hyphens where the name uses a dot (e.g., "nextjs" not "next.js"; "vuejs" not "vue.js"). - Slugs are case-sensitive lowercase. The endpoint also accepts upper-case for backward compatibility but the canonical form is always lowercase. Risk: read-only, closed-world, idempotent — no state change possible.

  ConnectorNo auth

• ethora-auth-use-b2bA

  ethora-mcp-serverA

  Switch this session's active auth mode to B2B, so subsequent calls authenticate as a tenant actor via the `x-custom-token` header. Auth: requires a `b2bToken` (JWT with `type=server`) to already be configured (via `ethora-configure` or ETHORA_B2B_TOKEN env). Errors: returns an error if no `b2bToken` is configured. Related: server-side automation — pairs with `ethora-b2b-app-create`, `ethora-users-batch-create-v2`, `ethora-app-tokens-*-v2`.

  ConnectorNo auth

• authA

  Fast.ioA

  Auth & sessions: signin, signup, signout, 2FA, PKCE, API keys, OAuth sessions. Call action='describe' for the full action/param reference. Destructive: api-key-delete, oauth-revoke, oauth-revoke-all.

  Connector

  Destructive

  No auth

• x402-publish-1789338587734-rjhst-email-auth-recA

  minia2a-mcpD

  rjhst-email-auth-records: Operated autonomously by AI (RJH Signal Technologies LLC). Reads a domain's SPF and DMARC records on two independent resolvers (Cloudflare 1.1.1.1 and Google 8.8.8.8) and returns every parsed tag as JSON. Disagreement between resolvers is reported rather than hidden. Query param: ?domain=example.com

  ConnectorNo auth

• migrate_to_propelauth_backendA

  PropelAuth Integration MCP ServerA

  Returns instructions for migrating to PropelAuth in a backend framework such as Express, FastAPI, Go, and more; Guidance includes migrating from either Clerk or Auth0. Each guidance will include documentation from the auth provider and PropelAuth. It is important to follow the instructions carefully to ensure a successful integration. It is important to call each guidance individually to ensure a successful integration. IMPORTANT: The backend_framework choice depends on the current auth provider implementation, not just the language. Select 'OAuth' if the backend currently handles the login flow using redirects (e.g., uses express-openid-connect or passport). Select any other option only if the current backend is a pure API that validates JWTs without managing the redirect-based login session. This excludes fullstack Next.js implementations.

  ConnectorNo auth

• get_account_identityA

  EnCirca DomainsA

  Return the currently authenticated Auth0 user and selected Encirca team identity. Requires Authorization: Bearer <Auth0 access token>.

  ConnectorNo auth

• audit_domainA

  Auth Posture — Email Deliverability & Spoofability AuditA

  Audit an email domain in one call: can it receive mail (MX), can it be spoofed (SPF/DMARC/DKIM posture), disposable check. Returns {can_receive, can_be_spoofed, score, reasons, checks}.

  ConnectorNo auth

• ethora-auth-use-appA

  ethora-mcp-serverA

  Switch this session's active auth mode to app-token, so subsequent app-scoped calls authenticate with the configured `appToken`. Auth: requires an `appToken` to already be configured (via `ethora-configure`, ETHORA_APP_TOKEN env, or `ethora-app-select`). Errors: returns an error if no `appToken` is configured. Related: use after `ethora-app-select`.

  ConnectorNo auth

• ethora-auth-use-userA

  ethora-mcp-serverA

  Switch this session's active auth mode to user-session, so subsequent calls authenticate as a logged-in Ethora user. Auth: the switch needs nothing, but user-auth tools only work once `ethora-user-login` stores a user token (login also needs a configured `appJwt`). Errors: none on the switch; downstream tools return 401 until login succeeds. Related: follow with `ethora-user-login`.

  ConnectorNo auth

• web.email-authA

  API AcreA

  Check a public domain's email authentication and anti-spoofing posture using MX, SPF, DMARC, caller-selected DKIM, MTA-STS, TLS-RPT, and BIMI DNS evidence.

  ConnectorNo auth

• web-fetchA

  HTTP 511 network-authC

  HTTP status and content type for a public URL. Body discarded.

  ConnectorNo auth

• verifiable-auth-validatorA

  Andreax x402 ServicesC

  Auto-created from research: Validates cryptographically verifiable authorization tokens and delegation chains to confirm an agent is genuinely authorized to perform a specific action under zero-trust [x402: 0.015 USDC on Base, pay-per-use]

  ConnectorNo auth

• get_account_profileB

  EnCirca DomainsA

  Return the authenticated Encirca account profile and selected team profile from the verified Auth0 token.

  ConnectorNo auth

• validate-jsonB

  HTTP 511 network-authC

  Check whether a body is valid JSON. The body is discarded.

  ConnectorNo auth