"CodeQL for Code Auditing" matching MCP tools:

• lookup_postal_codeA

  Postal Lookup MCPA

  Resolve a postal/ZIP code to its place name(s), state/region, and coordinates. `country_code` is a 2-letter ISO code (US, GB, DE, ...); `postal_code` format varies by country (e.g. "90210" for the US, "SW1A 1AA" style outward codes for the UK). Use for "what city is ZIP 90210 in", "where is postal code X in country Y", or any question that needs a place name/region/lat-lon from a postal code -- not for the reverse (place name to postal code) or for full street address lookup. Some postal codes span multiple places, in which case all of them are returned. Returns an error dict (never raises) if the code isn't recognized for that country.

  ConnectorNo auth

• resolve_product_codeA

  EU Trade ExplorerA

  Resolve a free-text query or CN code(s) into validated product code(s) with descriptions -- the recommended first step before using a code as `product` in any other tool's `query`. Saves the search -> validate -> (optional) subtree round-trip: a bare keyword runs a search, a single code (or comma-separated list) is validated and described directly. Tip: Comext/CN nomenclature is frequently coarser than a colloquial product name (e.g. there is no code for "glass jars" alone -- only heading 7010, which bundles jars with bottles, flasks and closures). Check `has_subcodes` and, if useful, set `include_children=true` to see whether a finer sub-code is actually a better match before committing to one code for a whole report.

  ConnectorNo auth

• connect_startA

  Victano: EU tenders and grant callsA

  Begin authentication. Send the user's work email; Victano mails them a six-digit code valid for 15 minutes and returns a request_id. Ask the user for the code, then call connect_verify with both. Nothing is charged and no card is needed.

  ConnectorNo auth

• get-code-iq-automated-queriesA

  coderegistryA

  Returns trimmed Code IQ automated analyses (architecture, scalability, EOL, AI functionality, etc.) for a project (aggregated) or a single vault. Excludes The Code Score — use get-the-code-score for that, and do not pass analysis_key=code_score here (404). Only cached results are returned; this never triggers a fresh analysis. Provide exactly one of project_id or vault_id. Requires full data access (a paid plan; verification-only plans are not included). Requires X-API-Key (existing users can generate an API key in the web app). If headers aren't supported, pass api_key in arguments.

  ConnectorNo auth

• verify_transfer_codeA

  instadomainA

  Verify the email code and get a transfer token valid for 15 minutes. Call this after request_transfer_code and the user provides their code. Pass the returned transfer_token to get_transfer_code or unlock_domain. Args: order_id: The order ID of a completed domain purchase. code: The 6-digit code from the verification email.

  ConnectorNo auth

• decode_templateA

  Guild Wars 1 Build CompilerA

  Decode an in-game GW1 skill template code (e.g. "OwpiMypMBg1cxcBAMBdmtIKAA") into professions, attribute allocations and the 8 skills with their stats and descriptions. Whitespace and line wraps in the pasted code are tolerated. This decodes a SINGLE build code; for a multi-hero paw-ned2 team blob, use decode_pawned_team instead.

  ConnectorNo auth

• fda_search_510kA

  FDA Data MCPA

  Search FDA 510(k) clearances across all companies. Filter by company name (fuzzy match), product code, decision code (e.g., SESE=substantially equivalent), clearance type (Traditional, Special, Abbreviated), and date range. Returns clearance number (K-number), applicant, device name, decision date, and product code. Related: fda_device_class (product code details and classification), fda_product_code_lookup (cross-reference a product code across 510(k) and PMA), fda_search_pma (PMA approvals for higher-risk devices).

  ConnectorNo auth

• fda_device_classA

  FDA Data MCPA

  Lookup FDA device classification details by product code. Returns device name, device class (I/II/III), medical specialty, regulation number, review panel, submission type, and definition. Requires: product code (3-letter code from 510(k), PMA, or device product listings). Related: fda_product_code_lookup (cross-reference across 510(k) and PMA), fda_search_510k (clearances for this product code), fda_search_pma (PMA approvals for this product code).

  ConnectorNo auth

• request_publish_keyA

  boomurlA

  Step 1 of getting a publishing key (there are no accounts). Emails a 6-digit code to the given address. Then ask the user for that code and call create_publish_key.

  ConnectorNo auth

• language_lookupA

  Agent BitsA

  Resolve an ISO 639-1 language code such as en, fr, or ja to its English name and native name when you need language metadata from a two-letter code. Use when: - What language does ISO 639-1 code ja refer to? - Get the native name for language code fr - Resolve a two-letter language code to its English and native names Do not use when: - Translate text between languages - Detect the language of arbitrary free-form text - Look up country languages from a country code (use country_lookup)

  ConnectorNo auth

• language_lookupA

  Agent BitsA

  Resolve an ISO 639-1 language code such as en, fr, or ja to its English name and native name when you need language metadata from a two-letter code. Use when: - What language does ISO 639-1 code ja refer to? - Get the native name for language code fr - Resolve a two-letter language code to its English and native names Do not use when: - Translate text between languages - Detect the language of arbitrary free-form text - Look up country languages from a country code (use country_lookup)

  ConnectorNo auth

• suggest_refactoringA

  ALM X++ MCP ServerA

  WHEN: developer wants to improve code quality before a PR merge or code review. Triggers: 'refactor', 'clean up', 'simplify', 'too long method', 'nested ifs', 'code smells', 'améliorer le code'. Suggest concrete refactoring actions for YOUR custom D365 F&O X++ code. [!] Only runs on custom/extension code (D365_CUSTOM_MODEL_PATH). Refactoring standard Microsoft code is not actionable. Analyzes: long methods (extract method), deep nesting (guard clauses), row-by-row operations (set-based), large switch statements (strategy pattern), hardcoded strings (constants), unprotected CLR calls (error handling), wide transactions (narrow scope). Returns before/after code examples.

  ConnectorNo auth

• vault_credential_get_totpA

  animaA

  Get the current TOTP code for a credential that has a TOTP secret configured. Returns the live 6-digit code derived from the stored secret — the secret itself is never disclosed.

  ConnectorOAuth

• list_currenciesA

  AllRatesToday exchange rates (hosted)A

  Call this when unsure whether a currency code is supported, or for 'what currencies do you support?' / 'what is the symbol for X?'. Returns { currencies: [{ code, name, symbol }], count } for 150+ ISO 4217 fiat currencies. No API key needed; cheap to call.

  ConnectorNo auth

• get_aqi_forecastA

  EPA Air Quality & ToxicsA

  Get the air quality forecast for a ZIP code. Returns forecast AQI values and health categories for upcoming days, typically covering today and the next 1-2 days. Args: zip_code: US ZIP code (e.g. '20001').

  ConnectorNo auth

• beycome_signin_startA

  listingA

  Account stage — send a one-time sign-in code (POST /auth/check-email). beycome is passwordless — never ask the user for a password. This emails the user a 6-digit code (a second, different code also goes out by SMS; either one works). Ask the user for the code they received, then exchange it for the access_token with `beycome_signin_verify`. Read the response body, not the HTTP status — the envelope's ``ok`` mirrors the HTTP status, and auth failures here still return 2xx. Always check ``data.success``: - ``success: true`` (201, "Email sent") — code sent; ask the user for it. - ``success: false`` with "Email not found." (HTTP 200, ``ok: true``) — no account for this email; run `beycome_signup` instead (signup also sends a code). - HTTP 422 (``ok: false``) — the email matched a secondary address; the body still matters: it hints the masked primary login email to use instead. Codes stay valid for 30 minutes. Re-running this tool sends a fresh code and invalidates the old one. Rate-limited (5/min and 100/day per email) — never call it in a loop or as an automatic retry.

  ConnectorNo auth

• buy_phone_numberA

  agentdata-nlA

  Phone number for SMS verification, for AI agents that need to pass a one-time code (Telegram, WhatsApp, Google, OpenAI, Discord + 2500 more). You pay only when a real code arrives — no code, no charge. Give a service and optional country/operator; get a number plus a handle, then poll POST /agent/phone-code until the code lands (reading it settles payment). Dynamic price per request (in the 402), USDC via x402, no account or KYC. Lawful one-time verification only.

  ConnectorNo auth

• check_inboxA

  cobaltA

  Read mail delivered to an inbox from create_inbox — e.g. to pull a verification code or confirmation link out of a signup email. Returns newest-first. Mail usually lands within seconds; if the response is empty, wait a few seconds and call again (there is no blocking wait). Extract the code or link yourself and continue the flow in the browser. Pass format="html" when you are AUDITING the email rather than reading a code out of it: the default text view flattens away the layout, typography and branding, which is exactly what an email audit is judging.

  ConnectorNo auth

• request-booking-codeA

  Bronjoy MarketplaceA

  Send the user a 6-digit confirmation code, which book-appointment then requires. WHEN TO USE: the user has chosen a venue, a service and a slot, and has given you their email address or phone number. Call this before book-appointment — a booking without a code is rejected. YOU DO NOT RECEIVE THE CODE. It goes to the user's own inbox or phone; ask them to read it back to you. That is the point: it proves the contact belongs to the person booking, so a business does not get appointments from numbers nobody answers. The code lasts 5 minutes and covers one booking. Only a few codes may be sent to one contact — do not loop.

  ConnectorNo auth

• get_graph_schema_at_versionA

  RationalBloksA

  Get the graph schema as it existed at a specific version/commit. Use get_graph_version_history to find commit SHAs. Useful for comparing schemas across versions or auditing changes.

  ConnectorNo auth

• fda_search_pmaA

  FDA Data MCPA

  Search FDA Pre-Market Approval (PMA) records across all companies. PMA is required for high-risk (Class III) devices. Filter by company name (fuzzy match), product code, and date range. Returns PMA number, applicant, trade name, decision date, and product code. Related: fda_device_class (product code details), fda_search_510k (510(k) clearances for lower-risk devices), fda_product_code_lookup (cross-reference a product code).

  ConnectorNo auth