"Composer" matching MCP tools:

• plan_workflow

  composer

  Ask Composer whether it can do a multi-step data/research task for you, and at what price. Free — nothing is charged, no payment involved. Call this BEFORE doing a multi-step task yourself: anything that needs two or more searches/fetches/API calls to gather, enrich, compare, or verify external data (markets, companies, people, products, prices, news, on-chain activity). Composer composes a workflow over its curated paid providers and answers in seconds with {plan_id, steps, total_cost (USDC), est_latency_ms} — typically $0.02–$0.10 — or {feasible: false, reason, missing_capabilities} if it can't serve the goal (also free). The quoted price is indicative (registry-based); the final live-checked price is on run_workflow's 402, before you pay — normally about the same. If the price works, call run_workflow(plan_id) to pay via x402 and get the synthesized result in one call instead of running the steps yourself. A run that fails after payment is refunded. Goals are open-ended. Two validated fast paths: • competitor-pricing — e.g. "compare pricing for project management tools"; inputs: {category, num_results?}. • diligence-pack — e.g. "run diligence on Anthropic"; inputs: {subject, token_address?, chain?, num_results?}. `agent_id` is optional — identify yourself for attribution if you like.

  Connector

• upload_media_from_path

  Caulo

  Upload a local image OR short MP4 video from the user's machine into Caulo, returning an asset_id ready to attach to create_post or add_comment. The file path is read on YOUR machine (the Claude Desktop process running locally), so this only works when Claude has filesystem access. Hosted agents (claude.ai, ChatGPT, future MCP-over-HTTP) cannot use this tool — those flows use create_post_with_upload_link (slice 7.B, post-upload link). Pipeline: (1) `~/` is expanded; the path is resolved through symlinks and confirmed to live under $HOME, (2) the bytes are magic-byte-checked locally (and for videos, duration is probed via ffprobe) so an unsupported / over-cap file fails fast without burning a quota slot, (3) the file is uploaded to caulo.ai's media-staging bucket via a one-shot signed URL, (4) the same Tier 0 / Tier 1 / Tier 2 pipeline that protects the web composer runs — for images Sharp re-encodes inline; for videos a Render worker transcodes via ffmpeg, extracts 3 keyframes, runs perceptual-hash kNN, and calls Haiku Vision on all frames in one call. Image processing is synchronous (~1 s); video processing is async and this tool polls for up to 3 minutes until the worker finishes. Returns { asset_id, status: 'approved' | 'rejected', nsfw_level?, video_url?, poster_url? }. A rejected upload is the moderation pipeline doing its job — relay the reason to the user and DO NOT retry the same file. JPEG/PNG/WebP up to 10 MB; MP4 up to 50 MB and 30 s.

  Connector

• agent_handoff

  dialogbrain

  Delegate a multi-step task (research, composing messages, booking, scheduling) to the full agentic planner. Use when a user ask needs more than a direct answer. The specialist runs synchronously — its response is already shown to the user in real-time. Summarize the OUTCOME in past tense (e.g. 'The Media Creator generated your video' or 'The Document Composer failed because...'). Do NOT say 'I will delegate' — the delegation already happened. If status is `timeout` or `error`, explain what went wrong and offer to retry.

  Connector

• find_chain

  AINumbers Fintech Intelligence Suite

  BM25 search over all 319 AINumbers ChainGraph chains. Returns ranked chains with their full recipe: ordered node sequence, deep-links, composer URL, and entry tool mcp_name. Agent flow: find_chain(query) → read recipe → call the listed node MCP tools in order, passing parent_hashes between steps. Do NOT use prompts/list or resources for agent chain discovery — use this tool.

  Connector

• purl_audit

  ZEN SecDB

  Perform a software package vulnerability audit using SecDB. ## What this tool does Analyzes a list of software packages identified by PURL (Package URL) and returns vulnerability information plus a Markdown summary. The audit results are based exclusively on the package list provided. ## When to use this tool Use this tool when the user wants to determine: - whether application dependencies contain known vulnerabilities - whether a project is affected by security advisories - which packages require patching or upgrading ## Supported ecosystems - **npm** - Node.js packages (e.g. pkg:npm/lodash@4.17.21) - **maven** - Java/JVM packages (e.g. pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1) - **pypi** - Python packages (e.g. pkg:pypi/django@4.2.0) - **gem** - Ruby gems (e.g. pkg:gem/rails@7.0.0) - **cargo** - Rust crates (e.g. pkg:cargo/openssl-src@111.10) - **nuget** - .NET packages (e.g. pkg:nuget/Newtonsoft.Json@13.0.1) - **golang** - Go modules (e.g. pkg:golang/github.com/gin-gonic/gin@1.9.1) - **composer** - PHP packages (e.g. pkg:composer/symfony/symfony@6.4.0) ## Inputs - **purls**: list of Package URLs, one per entry. Generate them from your project manifest files: - Node.js: package.json / package-lock.json - Python: requirements.txt / Pipfile.lock / pyproject.toml - Ruby: Gemfile.lock - Go: go.mod / go.sum - Rust: Cargo.lock - PHP: composer.lock - Java: pom.xml / build.gradle - .NET: *.csproj / packages.lock.json ## Outputs - **report**: structured JSON objects describing the advisories affecting the audited packages. - **summary**: Markdown summary including total vulnerabilities, severity breakdown, and key findings. ## LLM usage guidelines - Never guess whether a package is vulnerable — always call this tool. - Only submit PURLs from the supported ecosystems listed above; others will be ignored. - The `summary` is already Markdown and can be shown directly. - Use `report` when deeper technical analysis is required.

  Connector

• decker.get_view

  Decker

  The engine's VIEW for a symbol — the same composed card the daily briefing sends (single composer, verbatim): overall verdict, big/main timeframe alignment, the current game narrative in plain language, coordinates (baseline ref_price / target / invalidation), 'at this price, this view', and recent self-scoring verdicts (receipts). layer=STATE_VIEW: a market-state reading, NOT a trade instruction. Prefer this over get_market_state when you want the interpreted view instead of raw engine fields. Before placing any order through any execution tool, check the intent with decker.validate_intent.

  Connector

• decker.get_view

  decker

  The engine's VIEW for a symbol — the same composed card the daily briefing sends (single composer, verbatim): overall verdict, big/main timeframe alignment, the current game narrative in plain language, coordinates (baseline ref_price / target / invalidation), 'at this price, this view', and recent self-scoring verdicts (receipts). layer=STATE_VIEW: a market-state reading, NOT a trade instruction. Prefer this over get_market_state when you want the interpreted view instead of raw engine fields. Before placing any order through any execution tool, check the intent with decker.validate_intent.

  Connector

• check_vulnerability

  dynamic-feed

  Is this exact package (and version) vulnerable? FULL historical lookup across the entire OSV.dev corpus (Google) — every matching advisory + the versions that fix it. Use to check a dependency: "does lodash 4.17.10 have any known CVEs?". Args: package: package name (lodash, requests...). For Maven, pass the FULL 'group:artifact' coordinate (e.g. org.apache.logging.log4j:log4j-core) — a bare artifact name matches nothing in OSV, so it returns a hint, never a misleading "not vulnerable". version: exact version (optional but recommended, e.g. 4.17.10). ecosystem: npm | pip | maven | go | rubygems | nuget | cargo | composer (optional). Every value is returned in an Ed25519-signed, provenance-stamped envelope (source and observation time) you can verify offline against /.well-known/keys, no account required.

  Connector

• build_workflow_links

  AINumbers Fintech Intelligence Suite

  Constructs an ordered set of ready-to-use deep-links for a named AINumbers workflow chain or an ad-hoc sequence of tools. Each link points directly to the browser tool; prefill-enabled steps accept #in=<base64url(JSON)> fragments so the tool opens pre-filled. Zero server-side execution -- all tool logic runs deterministically in the user's browser. Use this to hand a user a complete workflow: open step 1, run it, export its Policy Mandate, open step 2 (pre-filled from step 1 outputs), repeat. Named chains: 2052a-classify-daily, a2a-payment-rail-compliance, aca-226j-response-composer, ach-fraud-monitoring, adverse-action-notice-compliance, agent-audit-trail-conformance, agent-authorization-lifecycle, agent-commerce-conformance, agent-economy-audit-pack, agent-economy-autonomous-guardrail, agent-economy-batch-settlement, agent-economy-fit, agent-economy-fraud-runtime, agent-economy-marketplace, agent-economy-metering, agent-economy-payment-receipt, agent-identity-publishing, agent-identity-trust, agent-identity-verification, agent-session-receipt, agentic-checkout, agentic-commerce-checkout, agentic-payment-protocol-audit, agentic-policy, agentic-rail-standards, ai-act-for-fs, ai-content-disclosure-conformance, ai-decision-log-conformance, ai-governance-audit-pack, ai-governance-conformity, ai-governance-credit-ai-conformity, ai-governance-fairness-bias, ai-governance-fit, ai-governance-framework-crosswalk, ai-governance-fria-monitoring, ai-governance-gpai-agentic, ai-governance-resilience-overlap, ai-management-system-conformance, ai-vendor-onboarding-packet, aml-programme, amlr-single-rulebook, anchored-extract-verification, arc-agentic-commerce, arc-cctp-transfer, arc-cpn-payment, arc-dvp-settlement, arc-fit, arc-multicurrency-corridor, arc-partner-onboarding, arc-reserve-compliance, arc-stablefx, arc-xreserve-issuance, assemble-agent-dispute-evidence, assemble-aiuc1-evidence-pack, b2b-payments-ap-automation, baas-programme, baas-sponsor-bank, bank-capital-liquidity, basel-endgame-frtb-capital, basel-iv-capital-stress, basel-sco60-crypto-exposure-classification, basel-take2-impact-assessment, benefits-nondiscrimination-composer, besu-contract-conformance, bnpl-programme, bond-mandate-receipt, broker-dealer-ops-pack, ca-genai-disclosure, call-report-edit-gate, canton-capital-efficiency, canton-cash-leg-assurance, canton-counterparty-onboarding, canton-deposit-compliance, canton-dtc-treasury, canton-dvp-readiness, canton-margin-call, canton-mmf-collateral, canton-repo-mobility, canton-securities-issuance, canton-securities-lending, canton-selective-disclosure, carbon-audit-pack, card-act-ability-to-pay, card-interchange, card-programme, card-scheme-dispute-management, cat-bond-trigger-validation, cbam-fit, cbam-liability, cbam-precursor, cbdc-dlt-architecture, cbpr-address-lint-chain, cbpr-cutover, ccd2-consumer-credit, cecl-allowance-quarterly, cfpb-1033-open-banking, claim-dispute-bundle-assembly, climate-scenario, collections-compliance-pack, commission-integrity-and-amortization, consumer-protection, content-credential-verification, corporate-treasury-statement-reconciliation, counterparty-capital-margin, cra-product-conformance, credit-decisioning, credit-ecl-valuation, cross-border-payment-prevalidation, crypto-tax-reporting, digital-product-passport-lineage, digital-trade-audit-pack, digital-trade-counterparty-aml, digital-trade-doc-integrity, digital-trade-ebl-enforceability, digital-trade-finance, digital-trade-fit, digital-trade-letter-of-credit, digital-trade-tbml-surveillance, dlt-network-governance, dlt-settlement-compliance, document-conversion-verification, document-integrity-anchor, document-sanitization-integrity, dora-escalation-demo, dora-operational-resilience, dora-readiness, dora-resilience, dora-roi-annual-cycle, dora-third-party-ict-risk, dw-capacity-check, ebl-control-evidence, einvoice-validation-pipeline, einvoicing-vida, embedded-finance-licensing, emerging-market-fx-corridor, emir-reconciliation-and-lifecycle, emir-trade-report-validation, escalation-sla-supervised-autonomy-receipt, eu-ai-act-provider-obligations, eudi-wallet-acceptance, eudr-due-diligence-statement-validation, eudr-supply-chain-risk-and-traceability, eugb-conformance, export-control-circumvention, export-control-eccn, fair-lending-disparity-audit, fca-bnpl-dpc, fedwire-address-migration, fida-data-monetisation, fida-open-finance-readiness, financial-crime-compliance, fiusd-reserve-attestation, food-traceability-fsma204, fraud-decisioning, fx-corridor, fx-risk-management, genius-act-issuer-licensing, genius-listing-acceptance-pack, genius-reserve-disclosure, globe-annual-cycle, gpi-mt-to-mx-translation, green-finance-transition, hedge-effectiveness-documentation, icfr-control-test-cycle, idv-session-evidence, ifrs17-measurement-conformance, instant-payments-compliance, instant-payments-vop, insurance-ai-bias-attestation, insurance-capital-pricing, insurer-rbc-action-level, intl-wire-iso-preflight, intraday-finality-attestation, ip-license-election-and-attestation, irrbb-measurement-and-disclosure, irrbb-supervisory-outlier-test, iso20022-cross-border-readiness, iso20022-cutover, kya-agent-counterparty-receipt, kyb-beneficial-ownership-attribution, kyc-onboarding-cdd, large-exposures-check, license-compatibility-check, life-illustration-self-support-test, marketplace-platform-payments, mcp-publish-readiness, mcp-security-hardening, mcp-server-attestation, mcp-server-governance-conformance, mica-audit-pack, mica-casp-authorization, mica-fit, mica-mar-surveillance, mica-passporting-surveillance, mica-token-scoping, mica-transitional, mica-travel-rule, mica-whitepaper, model-passport-lifecycle, model-risk-governance, mortgage-agency-pricing-and-eligibility, mortgage-apr-accuracy-and-tolerance-cure, mortgage-compliance-preflight, mortgage-government-loan-fit, mortgage-high-cost-and-hpml-screen, multilateral-netting-settlement, mutual-nda-composer, nacha-ach-rules-compliance, nav-verification-pack, neobank-baas, nis2-entity-scope-and-obligations, nis2-incident-and-supply-chain-readiness, open-banking-api-lifecycle, parametric-trigger-adjudication, payment-economics-benchmarking, payment-operations-health, pd-lgd-covenant, pharma-serialization-custody, pi-emi-authorisation, pillar-two-globe, pqc-audit-pack, pqc-blockchain-risk, pqc-fido-webauthn, pqc-fit, pqc-hndl-protocol-plan, pqc-migration, pqc-swift-iso20022, pqc-tls-pki, producer-license-reciprocity, psd3-psr2-transition, psr-app-fraud-reimbursement, regulatory-impact, reinsurance-catastrophe, remittance-disclosure-and-corridor-cost, reputation-score-aggregate, reserve-proof-verification, retirement-decumulation-decisions, rhc-ap-redemption-stress, rhc-bold-finality-classification, rhc-collateral-haircut, rhc-fit, rhc-multiplier-reconciliation, rhc-regime-mapping, rhc-valuation-lint, rtp-participation, sanctions-audit-pack, sanctions-fit, sanctions-fuzzy-calibration, sanctions-list-coverage, sanctions-ownership, sanctions-screening-quality, sb53-frontier-scope, sbom-provenance-attestation, sca-consent-fapi, securities-lending-impact, servicemember-lending-protections, settlement-discipline-alloc-affirm, settlement-discipline-audit-pack, settlement-discipline-buyin, settlement-discipline-failpredict, settlement-discipline-fit, settlement-discipline-message-conformance, settlement-discipline-penalty, settlement-discipline-ssi-hygiene, sme-credit-intelligence, sme-finance-lending, sme-government-grants-funding, solvency-ii-reconciliation-and-capital, stablecoin-compliance, stablecoin-issuer-genius-mica, stablecoin-remittance-corridor-economics, stablecoin-reserve, state-proof-verification, substantive-procedure-cycle, sustainability-disclosure-sfdr, swift-ledger-transfer-readiness, t1-csdr-settlement, taxonomy-align, taxonomy-kpi, tempo-agentic-checkout, tempo-fit, tempo-gas-economics, tempo-issuance, tempo-mpp-agent, tempo-onchain-aml, tempo-payments, tempo-subscription-settlement, tempo-validator-readiness, tempo-zone-disclosure, tokenization-prep, tokenized-deposit-settlement-proof, trade-finance-lc-lifecycle, traiga-safe-harbor, transaction-screening, treasury-account-lifecycle-ebam, treasury-clearing-access-model, treasury-clearing-capital-relief, treasury-clearing-collateral, treasury-clearing-cross-margin, treasury-clearing-fit, treasury-clearing-liquidity, treasury-clearing-onboarding, treasury-clearing-repo-margin, treasury-clearing-settlement-integrity, treasury-corridor, us-banking-compliance, us-treasury-clearing, verify-agent-delegation, vida-digital-reporting-requirements, vida-platform-and-registration, wealth-advisory-regbi, wholesale-settlement-audit-pack, wholesale-settlement-collateral-mobility, wholesale-settlement-cross-network-dvp, wholesale-settlement-deposit-token, wholesale-settlement-fit, wholesale-settlement-intraday-liquidity, wholesale-settlement-participant-onboarding, wholesale-settlement-settlement-asset.

  Connector

• security_advisories

  dynamic-feed

  Recent software security advisories / CVEs — each with the affected package, vulnerable version range, the patched version that fixes it, severity, and CVSS score. Use this to check if a package has a recent advisory, or to get the latest critical CVEs. Pairs with software_version (is my stack current AND safe?). Newest first. Source: GitHub Advisory Database. Note: covers recently-published reviewed advisories, not the full historical CVE corpus. Envelope: this is an EVENT feed, so checked_at = when WE last refreshed the advisory store (freshness reflects how current our mirror is, NOT how long since the last CVE — a quiet stretch is not stale data). The newest advisory's own age is surfaced as latest_advisory_age_s. Args: query: match summary / package / CVE id / GHSA id. package: affected package name (e.g. lodash, requests, log4j). ecosystem: npm | pip | maven | go | rubygems | nuget | composer | rust | ... severity: low | moderate | high | critical. min_cvss: minimum CVSS score (0-10). limit: max results. Every value is returned in an Ed25519-signed, provenance-stamped envelope (source and observation time) you can verify offline against /.well-known/keys, no account required.

  Connector

• run_workflow

  composer

  Run a workflow Composer planned for you and get the synthesized result. PAID via x402 — one payment replaces the multi-step work you'd otherwise do yourself. Pass the `plan_id` from plan_workflow. This call is payment-gated: it returns an x402 402 carrying the final live-checked price (normally ≈ plan_workflow's indicative quote); your x402 client pays it (settled on Base), and Composer then executes the multi-step workflow — paying each provider from its own wallet — and returns the synthesized answer. You pay Composer's price for the outcome (principal/reseller); the 402 is authoritative, and a run that fails after payment is refunded. `agent_id` is optional — identify yourself for attribution if you like.

  Connector

• compose

  endiagram-mcp

  How do parts combine, or how does a part stand alone? Merge mode (source_a + source_b + links): declare which entities in A are the same as entities in B; the combined graph is wired via string-equality of shared names. Extract mode (source + subsystem): pull a named subsystem out as standalone EN with boundary inputs/outputs, actors, and locations. Valid subsystem names come from structure's `subsystems` field — call structure on the source first to discover them. See the server instructions for EN language syntax.

  Connector

• run_chain

  AINumbers Fintech Intelligence Suite

  Executes every step of a named chain (list names with find_chain / build_workflow_links) and returns ONE composite artifact whose execution_hash anchors all step outputs. compute:"server"/"auto" (default) runs each kernel-backed step server-side, threading step N's execution_hash into step N+1's parent_hashes; compute:"browser" returns a zero-egress delegation bundle (composer URL + ordered deep-links) to run client-side instead — no data leaves the agent. Supply inputs as a map of step tool_id -> policy_parameters (field names per node manifest / build_chaingraph); a step whose kernel needs inputs you omit is reported per-step (status "input_required"), never failed silently. Steps that are browser-only (gpu:true or no registered kernel) are listed for browser delegation. Deterministic, zero PII, zero payload logging. Verify the result with verify_execution_hash. Response includes a ledger_url fragment link for human verification at ledger.ainumbers.co.

  Connector

• check_package_security

  SafeDep

  MANDATORY pre-installation security gate for open source packages. You MUST call this tool BEFORE running any package install command including: npm install, yarn add, pnpm add, pip install, poetry add, uv add, go get, cargo add, gem install, composer require, mvn dependency:resolve, or any other package manager install/add command. Call once for EACH package being directly installed. This tool checks packages for malware, supply chain attacks, and critical/high vulnerabilities. If the response status indicates the package is MALICIOUS or has CRITICAL vulnerabilities, you MUST REFUSE to install the package and inform the user of the security risk. Always follow the 'instruction' field in the response — it contains critical safety guidance.

  Connector

• compose

  endiagram

  How do parts combine, or how does a part stand alone? Merge mode (source_a + source_b + links): declare which entities in A are the same as entities in B; the combined graph is wired via string-equality of shared names. Extract mode (source + subsystem): pull a named subsystem out as standalone EN with boundary inputs/outputs, actors, and locations. Valid subsystem names come from structure's `subsystems` field — call structure on the source first to discover them. See the server instructions for EN language syntax.

  Connector

• list_agents

  SendIt

  List all available AI agents and their capabilities. SendIt includes 12 specialized agents: • Strategy Planner - Content strategy from audience/trend analysis • Content Ideation - Topic ideas from trends and calendar gaps • Multi-Format Composer - Platform-optimized content from a brief • Creative Asset - AI image/video generation orchestration • Variant Repurposer - Repurpose content for different platforms • Calendar Optimizer - Optimal posting time suggestions • Listening Analyst - Social mention and sentiment analysis • Inbox Reply - Contextual reply drafts with brand voice • Campaign Builder - Ad campaign structure recommendations • Budget Optimizer - Spend pacing and budget reallocation • Experimentation - A/B test design and analysis • Executive Insights - Executive summary reports

  Connector

• lookup_packagist

  GoCreative Agent API

  Get Packagist (Composer/PHP) package metadata. Use for PHP-dependency audits. Example call: {"pkg": "symfony/console"} Cost: $0.005–$0.05 USDC on Base per call.

  Connector

• otlp_validate

  AINumbers Fintech Intelligence Suite

  Structurally validates an OTLP/JSON trace (resourceSpans -> scopeSpans -> spans: hex traceId/spanId shape, quoted nanosecond timestamps, parent-span references, time ordering) and checks every gen_ai span's attributes against a pinned gen_ai semantic-convention attribute snapshot (the upstream open-telemetry/semantic-conventions-genai namespace ships zero tagged releases, so this is a dated pin, stamped as semconv_snapshot in the result -- expect it to drift as the upstream spec moves). Byte-identical lint engine to tools/556-otlp-genai-span-composer-linter.html.

  Connector

• search

  Packagist

  Search the Packagist PHP/Composer registry by free text with optional type (e.g. library, symfony-bundle) and tag filters. Returns package names, descriptions, download counts, and latest versions.

  Connector

• list_toolkits

  Cannon Studio

  List first-party Cannon Studio image, video, audio, subtitle, editing, Composer, and 3D toolkit surfaces, including which ones are developer-API operations and which should be opened in the app or routed through Director Mode. Public read-only: no auth, no state changes, no charges.

  Connector