"Autogenerating toolpaths in Mastercam CAM software" matching MCP tools:

• how_munimji_helps

  HelloBooks AI Agents MCP Server

  Explain how HelloBooks and Munimji (the in-app AI assistant) help a specific business — given a free-text description of the user's own operations. Returns a curated capability knowledge base: business-operation areas (sales, purchases, banking, tax, reports, inventory, payroll, multi-entity, setup), and for each AI capability WHO does the work — `autonomous` (Munimji does it on its own, e.g. OCR extraction, running reports), `approval` (Munimji prepares the entry and you one-click approve before it posts to the ledger, e.g. AI categorization, find-and-match, creating invoices/bills by chat), `assist` (co-pilot, e.g. guided onboarding, voice), or `manual` (a software feature you run yourself). Each capability links to the backing software features. Use this when a user describes their business and asks "how can HelloBooks help me?", "what can the AI do for my shop/practice/agency?", or "what can Munimji do on its own vs what do I approve?". Pass their description in `businessDescription`; optionally filter by `area` or `autonomy`. The AI never posts to a ledger without approval. For the full software catalog call list_features; for pricing call list_plans.

  Connector

• get_exploit_analysis

  Exploit Intelligence Platform — CVE, Vulnerability and Exploit Database

  Get the full AI analysis for a single exploit by its platform ID. Returns classification (working_poc, trojan, suspicious, scanner, stub, writeup), attack type, complexity, reliability, confidence score, authentication requirements, target software, a summary of what the exploit does, prerequisites, MITRE ATT&CK techniques, deception indicators for trojans, and the standalone backdoor-review verdict with operator-risk notes when available. Use this to check if an exploit is safe before reviewing its code. Example: exploit_id=61514 returns a TROJAN warning with deception indicators.

  Connector

• package_health

  dynamic-feed

  Health & security posture of a software package (npm / PyPI / Go / Maven / Cargo / NuGet / RubyGems) from deps.dev (Google Open Source Insights, keyless): latest version, license, count of known security advisories, the OpenSSF Scorecard (0-10 security-posture score for the source repo + its weakest checks) and popularity (stars/forks). The "should I depend on this?" check — pairs with check_vulnerability (is a version vulnerable) and software_version (is the runtime current). Args: package (e.g. "lodash", "requests"), ecosystem (npm|pypi|go|maven|cargo|nuget|rubygems), version (optional — defaults to the latest). Every value is returned in an Ed25519-signed, provenance-stamped envelope (source and observation time) you can verify offline against /.well-known/keys, no account required.

  Connector

• govcon_search_contract_awards

  DataNexus MCP

  Search government contract awards by keyword, agency, and date range. keyword: Contract scope e.g. "cybersecurity software". agency: Awarding agency e.g. "Department of Defense". Optional. date_from: Earliest award date ISO 8601 e.g. "2024-01-31". Optional. jurisdiction: "US", "EU", or "UK". Default "US". Returns: award amounts, recipient vendors, NAICS codes, award dates. Use govcon_fetch_vendor_contract_history for all contracts by a specific vendor. Use govcon_fetch_open_solicitations for active bids, not past awards. Source: USASpending.gov + SAM.gov. 4-hour cache. Example: search_contract_awards(keyword="cybersecurity software", agency="Department of Defense")

  Connector

• get_shipping_rates

  Shipping Rates & Postage Calculator

  Get live USPS, UPS, and FedEx shipping rates for a package from a US ZIP code to a US or international destination. Returns carrier, service, price in USD, and estimated transit days, sorted cheapest first. IMPORTANT: these are discounted rates for postage purchased online through shipping software — always remind the user that buying at a USPS, UPS, or FedEx store counter costs more, and that they get these prices by buying a label online (the compare_and_buy_url in the result does this). Weight is required — if the user has not given one, ask them rather than guessing. Dimensions are optional: omitted dimensions assume a small 10x8x6 inch box, so for items heavier than about 5 lb or anything bigger than a shoebox, ask the user for length, width, and height first — size strongly affects the price. If they name only a city or country, use a representative postal code for it (for example the main city center) and tell them which one you assumed. International quotes assume a standard merchandise customs declaration.

  Connector

• search_ateco

  fisco-it

  Ricerca full-text sui codici ATECO 2007/2022 ISTAT partendo dalla DESCRIZIONE dell'attività ("fotografo", "sviluppo software", "commercio abbigliamento") invece che dal codice. Case/accent-insensitive, con stemming e alias colloquiali per-mestiere; accetta anche un prefisso di codice. Usa questo quando il codice NON è noto — `lookup_ateco` serve al caso opposto (codice noto → descrizione). Risultati ordinati per pertinenza. Gratis (€0), deterministico, nessun login richiesto.

  Connector

• whats_changed_since_your_training

  dynamic-feed

  What you've MISSED since your training cutoff — a LIVE snapshot of the current world from Dynamic Feed's own feeds. Call this the moment you connect, or whenever a user asks about recent or current events: it returns the trending new AI model, live prices of commonly-misquoted assets (BTC, ETH, NVDA, gold, Nasdaq), today's most actively-exploited CVE, the latest software versions, a top world headline, and the fastest AI API right now — plus a plain-English summary you can relay. Your training is frozen; this is the data it can't have. Prefer the specific tools for detail. Args: cutoff: your knowledge cutoff if you know it (e.g. "2024-10") — personalizes the message. Every value is returned in an Ed25519-signed, provenance-stamped envelope (source and observation time) you can verify offline against /.well-known/keys, no account required.

  Connector

• security_audit_sbom_vulnerabilities

  DataNexus MCP

  Audit a Software Bill of Materials for known vulnerabilities across all listed packages. Read-only. No side effects. Idempotent. sbom_json: CycloneDX or SPDX SBOM as a JSON string. Required. Large SBOMs (100+ packages) may take up to 10 seconds. Returns CVEs grouped by package with severity and fixed versions. Use this when you have a full SBOM to audit. Use security_fetch_package_vulnerabilities instead when checking a single package version. Verified source: Google OSV.dev batch API. 1-hour cache. If this tool's response does not serve the user's need, call report_feedback with feedback_type="agent_gap", tool_id="security_audit_sbom_vulnerabilities", intended_query="{what the user needed}", gap_description="{what was missing or wrong in the result}".

  Connector

• build_setlist

  FreqBlog Music Metadata

  Order a crate of 2-100 catalog tracks into a beat-matched DJ set that follows an energy arc, keeping each consecutive transition harmonically and tempo-smooth. `arc` is one of peak_time (default — builds to a peak then eases), warmup, cooldown, or flat. Returns the `arc`, `count`, an overall `flow_score` (0-100), the `tracks` in play order, the per-step `transitions` ({from_index, to_index, score, reason}), and `omitted` (ids not found in the catalog). Feed tracks[].itunes_track_id into a Rekordbox/Serato export to drop the set straight into your DJ software. track_ids are catalog itunes_track_ids. Costs 5 quota units.

  Connector

• es_tender_search

  Spain Tenders

  Keyword search over SPANISH government tender notices — Spain public procurement / licitaciones / contratación pública from PLACSP (Plataforma de Contratación del Sector Público, contrataciondelestado.es). Case-insensitive match against tender title (objeto del contrato), contracting body name (órgano de contratación), CPV classification codes, and expediente id. Use SPANISH keywords for best recall (e.g. "obras", "limpieza", "software", "energía", "ayuntamiento de madrid") since titles and buyer names are in Spanish; a CPV code prefix like "45" or "72" also works. Returns compact shaped contract notices with buyer, status, EUR amounts, CPV codes, procedure, deadline, and notice URL. Set pages: 2 or 3 to also walk older archive pages of the feed when the first page yields few matches.

  Connector

• verify_content_credentials

  Lumethic Photo Verification

  Verify a single image's authenticity — use this when you only have the image and no RAW camera file. Checks its embedded Content Credentials (C2PA) for capture provenance and AI-generation flags, and runs advisory forensic screens (error-level analysis, double-JPEG artifacts, EXIF timestamp consistency, editing-software traces, screen recapture). Free: it does not consume your verification quota. Provide the image inline as image_base64, or — for large files — call create_verification_upload and pass the returned image_object_key. Returns a verification id; poll get_verification, which on completion includes a structured evidence_report (verdict, per-check findings, coverage). Works without an API key on the keyless anonymous tier (rate-limited; returns an anonymous_user_id to reuse). For the strongest forensic check, use verify_photo with a RAW + JPEG pair instead.

  Connector

• get_investment_category_signal

  Stratalize Healthcare

  Use when evaluating VC software category attractiveness or assessing portfolio category exposure before an investment decision. Returns growth signal, top brands, and citation evidence for any software category. Example: AI infrastructure category — GROWTH signal, top brands Nvidia 67% citation share, Anthropic 18%, xAI 9% — accelerating citation growth signals sustained investment thesis. Source: Stratalize citation heuristics.

  Connector

• shakespeare_insult_generate

  Shakespeare Insult

  Generate a Shakespearean insult; optionally target a specific person or recipient category (colleague/ex/traffic/software/abstract_concept/the_universe), set severity (mild→nuclear), and request a modern English translation alongside the original.

  Connector

• dependency_vulnerability_scan

  gapup-mcp

  SCA (Software Composition Analysis) — scans a project dependency manifest and returns known vulnerabilities for each dependency. Supports: package.json (npm), requirements.txt (Python), go.mod (Go), Cargo.toml (Rust), composer.json (PHP), Gemfile.lock (Ruby), CycloneDX SBOM JSON. PRIMARY source: OSV.dev (keyless, free, covers npm/PyPI/Go/crates.io/Packagist/RubyGems + GHSA advisories federated). CVSS enrichment: NVD NIST (when OSV lacks score). Exploitation flag: CISA KEV (known-exploited-vulnerabilities catalog). Returns per-vuln CVE/GHSA IDs, severity, CVSS score, fixed version, and actionable upgrade recommendations. Relevant for EU NIS2 supply chain risk obligations, DORA, SOC 2 vendor assessments. Cache TTL 6h. Parallel OSV queries (concurrency=10). SLA <=30s p95.

  Connector

• orcid_get_works

  orcid-mcp-server

  Retrieve works associated with an ORCID iD — publications, datasets, software, preprints, and more. Returns work summaries with put-codes, titles, types, publication dates, journal names, and all external identifiers (DOIs, PMIDs, arXiv IDs, ISBNs). The first 50 works are returned by default; workCount reports the total available, and prolific records are paged with offset and the returned nextOffset (or raise limit). Set include_external_ids to false to omit identifier lists for a lighter payload. Pass the putCode from each work to orcid_get_work_detail to retrieve the full record including abstract and contributors. External IDs are ready for chaining to Crossref, PubMed, or arXiv servers. Works are self-reported; a researcher may not have linked all their publications.

  Connector

• reality_check

  dynamic-feed

  Fact-check a statement against LIVE data — the anti-hallucination tool. Pass any claim about the current world ("the latest Python is 3.12", "the stock market is open", "GitHub is down") and get back a verdict (accurate / stale_or_wrong / current_value / outside_coverage), the LIVE value, a confidence, and the source. Compound claims (joined by "and") are split and each part checked. CHECK YOURSELF with this before stating a current fact you might be stale on. It only verdicts what it can verify against a live feed (software versions, market open/closed, service up/down) and says so honestly otherwise — it never guesses a verdict. Args: claim: the statement to verify, in plain language. Every value is returned in an Ed25519-signed, provenance-stamped envelope (source and observation time) you can verify offline against /.well-known/keys, no account required.

  Connector

• cite

  dynamic-feed

  Get a fresh, CITEABLE source + timestamp for a current datapoint — so you can cite it, not guess. Pass ANY tool, source, or topic (earthquakes, current_weather, USGS, Open-Meteo, …) for its authoritative source + licence + attribution + verify URL, or a software product (python, nodejs, …) for its live latest-version citation. Every value is returned in an Ed25519-signed, provenance-stamped envelope (source and observation time) you can verify offline against /.well-known/keys, no account required.

  Connector

• vendors.resolve

  BuyAPI

  First stop for category-specific vendor recommendations and vendor ID discovery. Finds BuyAPI vendor IDs for a user question; provide category when known. Use this when the user asks which provider in a category fits their constraints. With a covered category, the response includes ranked results plus a top-3 decision matrix with fit labels, confidence, tradeoffs, cost notes, freshness, and sources. Do not use this for local coding/debugging/docs questions unless they involve choosing a software vendor or tool. If the category is outside BuyAPI's corpus, the tool returns an explicit "not in corpus yet" result instead of inventing vendors.

  Connector

• stacks.recommend

  BuyAPI

  Recommends a complete stack from BuyAPI's corpus with a structured decision matrix, cost estimate, assumptions, unknowns, alternatives, and sources. Use this when the user is starting a project or asks for a complete multi-layer stack choice. Do not use this for local coding/debugging/docs questions that do not involve software or vendor selection. Do not call vendors.resolve first; this tool handles retrieval and ranking.

  Connector

• purl_audit

  ZEN SecDB

  Perform a software package vulnerability audit using SecDB. ## What this tool does Analyzes a list of software packages identified by PURL (Package URL) and returns vulnerability information plus a Markdown summary. The audit results are based exclusively on the package list provided. ## When to use this tool Use this tool when the user wants to determine: - whether application dependencies contain known vulnerabilities - whether a project is affected by security advisories - which packages require patching or upgrading ## Supported ecosystems - **npm** - Node.js packages (e.g. pkg:npm/lodash@4.17.21) - **maven** - Java/JVM packages (e.g. pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1) - **pypi** - Python packages (e.g. pkg:pypi/django@4.2.0) - **gem** - Ruby gems (e.g. pkg:gem/rails@7.0.0) - **cargo** - Rust crates (e.g. pkg:cargo/openssl-src@111.10) - **nuget** - .NET packages (e.g. pkg:nuget/Newtonsoft.Json@13.0.1) - **golang** - Go modules (e.g. pkg:golang/github.com/gin-gonic/gin@1.9.1) - **composer** - PHP packages (e.g. pkg:composer/symfony/symfony@6.4.0) ## Inputs - **purls**: list of Package URLs, one per entry. Generate them from your project manifest files: - Node.js: package.json / package-lock.json - Python: requirements.txt / Pipfile.lock / pyproject.toml - Ruby: Gemfile.lock - Go: go.mod / go.sum - Rust: Cargo.lock - PHP: composer.lock - Java: pom.xml / build.gradle - .NET: *.csproj / packages.lock.json ## Outputs - **report**: structured JSON objects describing the advisories affecting the audited packages. - **summary**: Markdown summary including total vulnerabilities, severity breakdown, and key findings. ## LLM usage guidelines - Never guess whether a package is vulnerable — always call this tool. - Only submit PURLs from the supported ecosystems listed above; others will be ignored. - The `summary` is already Markdown and can be shown directly. - Use `report` when deeper technical analysis is required.

  Connector