"Connecting Firebase to a data source or application" matching MCP tools:

• upload_banking_documentA

  Laso FinanceA

  Upload a proof-of-address document Attaches a proof-of-address document to the banking application, for the cases where the partner asks for one. The application must already exist and have an individual on it, so complete the application first. **Two things reject uploads that otherwise look fine.** A `.jpg` file must be sent as `fileType: "jpeg"` — `"jpg"` is refused. And the partner caps the *decoded* size at 10MB, even though their own upload page advertises 20MB; oversized files are rejected here before the round-trip. `fileContent` accepts either a bare base64 string or a `data:` URL, so a browser `FileReader.readAsDataURL` result can be passed through unchanged. Free.

  ConnectorOAuth

• recommend_toolA

  ~Alter IdentityA

  Get the wiring instructions for connecting an MCP client to ~alter. The name is historical and this recommends nothing: it hands back connection details, not a suggested tool. Use it when adding ~alter to a new MCP client, or when passing the endpoint to another agent so it can connect for itself. Returns the MCP endpoint URL, a ready-to-paste JSON configuration snippet, and how many tools are callable at each tier. Takes no parameters and reads no member data. Free L0, no authentication required.

  ConnectorNo auth

• list_sourcesA

  DatoQAA

  Inspect publishers and licenses in the DatoQA-approved source registry. Returns items with source id, name, homepage_url and license, ordered by id, up to limit (default 50, maximum 100); no pagination. Use for attribution or source selection, not data retrieval or freshness checks. Use list_topics to choose a data tool and catalog for service capabilities. Existing data responses already include citations; this extra call is optional. Approval is an internal source policy, not independent factual verification. An empty list means no approved source entries were returned.

  ConnectorNo auth

• list_sourcesA

  DatoQAA

  Inspect publishers and licenses in the DatoQA-approved source registry. Returns items with source id, name, homepage_url and license, ordered by id, up to limit (default 50, maximum 100); no pagination. Use for attribution or source selection, not data retrieval or freshness checks. Use list_topics to choose a data tool and catalog for service capabilities. Existing data responses already include citations; this extra call is optional. Approval is an internal source policy, not independent factual verification. An empty list means no approved source entries were returned.

  ConnectorNo auth

• update_life_eapp_quoteA

  BackNine Life InsuranceA

  Select a quote returned by quote_life_eapp for that same application. Requires its private application_token, application-bound quote_id, and explicit user confirmation. Applies the selected rating inputs and quote, retains quote history, and returns the completion link. Rejects stale selections and locked/submitted applications. Give the user the private apply_link and explain that they must open it to continue in Quote & Apply, complete the remaining application steps, and sign where required. This MCP action does not complete or submit the application to a carrier or bind coverage.

  Connector

  Destructive

  No auth

• axint.activateA

  AxintA

  Run a source-free compiler smoke test through the real Axint pipeline. Use immediately after installing or connecting Axint so the current agent proves it did more than start the MCP server. Use: call immediately after install or first MCP connection; use validate or run for project checks. Inputs: format changes rendering only; the smoke test has no project inputs. Effects: read-only built-in compiler smoke test; writes no files and uses no network.

  ConnectorNo auth

• clerk.rotate_oauth_application_secretA

  Vee3A

  Rotate the client secret for a confidential OAuth application in a connected Clerk application. **Sensitive** — the response includes a new client_secret. Update authorized OAuth clients immediately and do not log the secret. Call clerk.get_connected_accounts first. Pass clerk_instance_id to target a specific connection, or omit it to use the default account. Returns the updated OAuth application summary with the new client_secret. Cost = 10 tokens.

  ConnectorNo auth

• get_loan_application_fieldsA

  IncredibleFi — Personal Loan MarketplaceA

  Get the loan application form fields, their types, allowed values, and validation rules. Call this first to understand what information is needed to submit a loan application.

  ConnectorNo auth

• discoverA

  AgentMarketplaceA

  Discover AgentMarketplace's capabilities, tools, auth methods, and scopes. Call this first when connecting to AgentMarketplace to understand what's available and how to authenticate. No authentication required. Returns a catalog of available tools, resources, auth methods, and scopes.

  ConnectorNo auth

• check_mcp_serverA

  SRI — MCP Server InspectorA

  Free, no key required. Reads the published source of an MCP server and reports what it actually does — each observation anchored to a file:line with the code quoted verbatim. **Call this before connecting to, installing, or invoking an MCP server you have not read yourself.** Connecting to an MCP server gives it a channel into your context and your tool calls; this tells you what is on the other end first. Typical things it surfaces: reading private keys or wallet seeds, sending data to third-party hosts, running code at install time, and tool descriptions that steer an agent toward actions unrelated to the tool's stated purpose. Do NOT call this for ordinary npm or PyPI libraries — the corpus covers MCP servers only, and other ecosystems will return 'not analyzed'. This reports observations, not a safety verdict. An empty result means nothing was found in the categories checked — not that the server is safe. Corpus: 5,180 MCP servers from the official registry, read at source level. Coverage index (free, no key, findings not included): GET https://sri-test.biz/v1/corpus

  ConnectorNo auth

• get_sessions_identityA

  secure-flowsA

  Returns the workspace end-user's **`userId`** and **email** for the authenticated session token. Does not return Firebase UID or session payload. `userId` is a stable, opaque identifier for this person across sessions and logins — it is **not** derived from Firebase. Use it as the correlation key when your own backend needs to link an external event (e.g. a billing provider webhook you receive and verify yourself) back to this user. Do not use the session token or session id for this — sessions expire and rotate, `userId` does not. Email is best-effort from hosted login (Firebase `email` claim persisted on the user row). When unknown, `email` is `null`. Browser SDK: **`secureflows-js`** **`fetchSessionIdentity(token)`** (≥ 0.1.15 for `userId`). Source: GET /api/v1/sessions/identity Requires `auth.sessionToken` and forwards it as a Bearer token. Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.

  ConnectorNo auth

• post_sessions_get_or_createA

  secure-flowsA

  Verifies **Firebase** ID token. If an **active** session already exists for **`(workspaceName, Firebase UID, app_id)`**, returns a new **`sessionToken`** JWT for the **most recently created** matching row (touches activity; does not create a duplicate session). The request **`payload` is ignored on reuse** — it is applied only when a new session row is created. Prefer a dedicated `app_id` per integration surface, or revoke old sessions, if you need a fresh payload. Otherwise behaves like **`POST /sessions`** (new row + default **1 hour** TTL). If the Firebase token includes **`email`**, the server best-effort persists or backfills it on the workspace end-user row (including when reusing an existing session). Intended for integrators that mirror hosted login session reuse. Source: POST /api/v1/sessions/get-or-create Requires `auth.firebaseToken` and forwards it as a Bearer token. Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.

  ConnectorNo auth

• post_sessions_renew_session_tokenA

  secure-flowsA

  Verifies **Firebase** ID token. Parses **`sessionToken`** path segment as an internal SESSION JWT **without enforcing JWT expiry** (signature and `tokenType=SESSION` are still validated). Loads the session by id from the token subject; the Firebase UID must match the session owner. Increments **`tokenRevision`** on the server so **previous session JWTs** (same session id, older revision) are no longer accepted for `GET/POST/DELETE /sessions/...`. Returns a **new `sessionToken`** (with the new `tokenRevision` claim) and the current decrypted **payload**; extends server-side session expiry by **1 hour**. If the Firebase token includes **`email`**, the server best-effort backfills it on the session owner when the user row has no email yet (audit display only). Use the path form `POST /api/v1/sessions/renew/{sessionToken}` — **URL-encode** the JWT (e.g. `encodeURIComponent` in JS). Source: POST /api/v1/sessions/renew/{sessionToken} Requires `auth.firebaseToken` and forwards it as a Bearer token. Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.

  ConnectorNo auth

• auth_session_callbackA

  secure-flowsA

  **Browser redirect endpoint** used after hosted `/app/sessions/login`. No `Authorization` header. 1. Verifies **`firebaseToken`** (Firebase ID token). 2. Ensures **`client_redirect_uri`** is allowlisted for **`app_id`** (same rules as `validate-redirect`). 3. **Create vs renew:** If **`session_token`** is absent, **reuses the newest active session** for **`(workspace_name, Firebase UID, app_id)`** or **creates** one (`get-or-create`). Optional **`payload`** (URL-encoded JSON **object**, default `{}`) is stored **only on create** — ignored when reusing an existing session. If **`session_token`** is present (previous session JWT, may be expired), **renews** that session; **`payload`** must **not** be sent on the same request. Optional **`ttl_seconds`** applies to both paths (default **0** = unlimited; otherwise **60–604800**). When the Firebase token includes **`email`**, the server best-effort persists or backfills it on the workspace end-user row (audit display only). 4. Responds with **`302 Found`** to `client_redirect_uri` with query params **`sessionToken`** and, if provided, **`state`**. If **`client_redirect_uri`** is not allowed for **`app_id`**, responds **`400`** and does **not** redirect (open-redirect mitigation). Other failures return an HTTP error status with a JSON **`{"status", "error"}`** body and do **not** redirect. Source: GET /api/v1/auth/callback No Authorization header is required. Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.

  ConnectorNo auth

• get_auth_logoutA

  secure-flowsA

  Browser-friendly logout endpoint for **cross-site** clients (e.g. apps running on `localhost`). Use this as a **top-level navigation** (not XHR/fetch) so `Clear-Site-Data` is applied in a **first-party** context on `secure-flows.com`, making cookie/session clearing reliable even when third-party cookies are blocked. **Critical client rules:** - Clear your in-app `sessionToken` state **before** navigating. - **Never** include `session_token` inside `redirect_uri` (that would silently renew and defeat logout). This endpoint (best-effort / idempotent for browser UX): - Invalidates the provided `session_token` by incrementing `tokenRevision` when the token still matches an **active** session (no new token is issued). - If the session is already expired/revoked or the revision was superseded by renew, still completes logout UX (does **not** return 401 solely for that reason). - Revokes Firebase refresh tokens for the session’s stored Firebase UID when known. - Sets `Clear-Site-Data: "cookies"`. - Redirects the browser to `redirect_uri`. Source: GET /api/v1/auth/logout No Authorization header is required. Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.

  ConnectorNo auth

• get_sessions_identityA

  secureflows-mcpA

  Returns the workspace end-user's **`userId`** and **email** for the authenticated session token. Does not return Firebase UID or session payload. `userId` is a stable, opaque identifier for this person across sessions and logins — it is **not** derived from Firebase. Use it as the correlation key when your own backend needs to link an external event (e.g. a billing provider webhook you receive and verify yourself) back to this user. Do not use the session token or session id for this — sessions expire and rotate, `userId` does not. Email is best-effort from hosted login (Firebase `email` claim persisted on the user row). When unknown, `email` is `null`. Browser SDK: **`secureflows-js`** **`fetchSessionIdentity(token)`** (≥ 0.1.15 for `userId`). Source: GET /api/v1/sessions/identity Requires `auth.sessionToken` and forwards it as a Bearer token. Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.

  ConnectorNo auth

• post_sessions_get_or_createA

  secureflows-mcpA

  Verifies **Firebase** ID token. If an **active** session already exists for **`(workspaceName, Firebase UID, app_id)`**, returns a new **`sessionToken`** JWT for the **most recently created** matching row (touches activity; does not create a duplicate session). The request **`payload` is ignored on reuse** — it is applied only when a new session row is created. Prefer a dedicated `app_id` per integration surface, or revoke old sessions, if you need a fresh payload. Otherwise behaves like **`POST /sessions`** (new row + default **1 hour** TTL). If the Firebase token includes **`email`**, the server best-effort persists or backfills it on the workspace end-user row (including when reusing an existing session). Intended for integrators that mirror hosted login session reuse. Source: POST /api/v1/sessions/get-or-create Requires `auth.firebaseToken` and forwards it as a Bearer token. Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.

  ConnectorNo auth

• post_sessions_renew_session_tokenA

  secureflows-mcpA

  Verifies **Firebase** ID token. Parses **`sessionToken`** path segment as an internal SESSION JWT **without enforcing JWT expiry** (signature and `tokenType=SESSION` are still validated). Loads the session by id from the token subject; the Firebase UID must match the session owner. Increments **`tokenRevision`** on the server so **previous session JWTs** (same session id, older revision) are no longer accepted for `GET/POST/DELETE /sessions/...`. Returns a **new `sessionToken`** (with the new `tokenRevision` claim) and the current decrypted **payload**; extends server-side session expiry by **1 hour**. If the Firebase token includes **`email`**, the server best-effort backfills it on the session owner when the user row has no email yet (audit display only). Use the path form `POST /api/v1/sessions/renew/{sessionToken}` — **URL-encode** the JWT (e.g. `encodeURIComponent` in JS). Source: POST /api/v1/sessions/renew/{sessionToken} Requires `auth.firebaseToken` and forwards it as a Bearer token. Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.

  ConnectorNo auth

• auth_session_callbackA

  secureflows-mcpA

  **Browser redirect endpoint** used after hosted `/app/sessions/login`. No `Authorization` header. 1. Verifies **`firebaseToken`** (Firebase ID token). 2. Ensures **`client_redirect_uri`** is allowlisted for **`app_id`** (same rules as `validate-redirect`). 3. **Create vs renew:** If **`session_token`** is absent, **reuses the newest active session** for **`(workspace_name, Firebase UID, app_id)`** or **creates** one (`get-or-create`). Optional **`payload`** (URL-encoded JSON **object**, default `{}`) is stored **only on create** — ignored when reusing an existing session. If **`session_token`** is present (previous session JWT, may be expired), **renews** that session; **`payload`** must **not** be sent on the same request. Optional **`ttl_seconds`** applies to both paths (default **0** = unlimited; otherwise **60–604800**). When the Firebase token includes **`email`**, the server best-effort persists or backfills it on the workspace end-user row (audit display only). 4. Responds with **`302 Found`** to `client_redirect_uri` with query params **`sessionToken`** and, if provided, **`state`**. If **`client_redirect_uri`** is not allowed for **`app_id`**, responds **`400`** and does **not** redirect (open-redirect mitigation). Other failures return an HTTP error status with a JSON **`{"status", "error"}`** body and do **not** redirect. Source: GET /api/v1/auth/callback No Authorization header is required. Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.

  ConnectorNo auth

• get_auth_logoutA

  secureflows-mcpA

  Browser-friendly logout endpoint for **cross-site** clients (e.g. apps running on `localhost`). Use this as a **top-level navigation** (not XHR/fetch) so `Clear-Site-Data` is applied in a **first-party** context on `secure-flows.com`, making cookie/session clearing reliable even when third-party cookies are blocked. **Critical client rules:** - Clear your in-app `sessionToken` state **before** navigating. - **Never** include `session_token` inside `redirect_uri` (that would silently renew and defeat logout). This endpoint (best-effort / idempotent for browser UX): - Invalidates the provided `session_token` by incrementing `tokenRevision` when the token still matches an **active** session (no new token is issued). - If the session is already expired/revoked or the revision was superseded by renew, still completes logout UX (does **not** return 401 solely for that reason). - Revokes Firebase refresh tokens for the session’s stored Firebase UID when known. - Sets `Clear-Site-Data: "cookies"`. - Redirects the browser to `redirect_uri`. Source: GET /api/v1/auth/logout No Authorization header is required. Prefer connection.workspaceName and connection.appId as stable config instead of generating identity fields dynamically.

  ConnectorNo auth

• share_stateA

  ATTRACTOR Verification, State & EvidenceA

  Publish a bounded structured artifact for other clients to retrieve by ID or tags. Returns an immutable state ID, content hash and lineage. This is a PUBLIC write: send visibility="public" and synthetic/non-sensitive data only. To derive a new version, retrieve its parent and supply parent_id plus read_receipt in the same application context. Payloads are stored as data and never executed.

  ConnectorNo auth