"DevOps tools and practices including CI/CD pipelines, GitOps, and DevSecOps" matching MCP tools:

• env_parse

  IA-QA — 130+ QA & Dev Tools for AI Agents

  Parse a .env file content into a JSON object. Handles quoted values (single and double), inline comments, export prefix, and escaped sequences (\n, \t inside double quotes). Returns all key-value pairs. Use in CI/CD pipelines, agent config loaders, or when processing dotenv files programmatically.

  Connector

• score_skill

  claude-skill-validator

  Run full validation and return a 0–100 score plus a ship gate (pass/review/fail). Minimal payload suitable for CI/CD pipelines.

  Connector

• resolve_client_profile

  ALM X++ MCP Server

  WHEN: at the START of any release-note / upgrade-impact conversation -- call this BEFORE list_release_note_inputs to check whether a Client Profile already exists for the CURRENT caller's Azure DevOps org/project (auto-detected from DEVOPS_ORG_URL/DEVOPS_PROJECT MCP headers -- you don't pass anything). If found, it gives you the client's currentVersionTag, targetVersionTag, customModelIds (their own extensions AND any attached ISV/vendor models) and the latest diff snapshot in one call -- use those directly as v1/v2/customModelIds for prepare_release_note_context, no further discovery needed. If not found, fall back to list_release_note_inputs and/or save_client_profile.

  Connector

• convoopen

  InsideOut (Riley)

  WORKFLOW: Step 1 of 4 - Start infrastructure design conversation Open an InsideOut V2 session and receive the assistant's intro message. The response contains a clean message from Riley (the infrastructure advisor) - display it to the user. ⚠️ Riley will ask questions - forward these to the user, DO NOT answer on their behalf. CRITICAL: This tool returns a session_id in the response metadata. You MUST use this session_id for ALL subsequent tool calls (convoreply, tfgenerate, tfdeploy, etc.). ⚠️ The session_id includes a ?token=... suffix (format: sess_v2_xxx?token=yyy) which is part of the session credential — without it, downstream tools fall back to a tokenless connect URL that 401s. Always pass session_id verbatim to subsequent tools and to the user; do NOT shorten, paraphrase, or strip the ?token= portion when summarizing the session in chat or in your own scratch notes. Use when the user mentions keywords like: 'setup my cloud infra', 'provision infrastructure', 'deploy infra', 'start insideout', 'use insideout', or similar intent to begin infra setup. OPTIONAL: project_context (string) - General tech stack summary so Riley can skip discovery questions and jump to recommendations. The agent should confirm this with the user before sending. Include whichever apply: language/framework, databases/services, container usage, existing IaC, CI/CD platform, cloud provider, Kubernetes usage, what the project does. Example: 'Next.js 14 + TypeScript, PostgreSQL, Redis, Docker Compose, deployed to AWS ECS, GitHub Actions CI/CD, ~50k MAU'. NEVER include credentials, secrets, API keys, PII, source code, or internal URLs/IPs -- only general metadata summaries useful to a cloud architect agent. IMPORTANT: source (string) - You MUST set this to identify which IDE/tool you are. Auto-detect from your environment: 'claude-code', 'codex', 'antigravity', 'kiro', 'vscode', 'web', 'mcp'. If unsure, use the name of your IDE/tool in lowercase. Do NOT omit this — it controls the 'Open {IDE}' button on the credential connect screen. OPTIONAL: github_username (string) - GitHub username for deploy commit attribution. Pre-populates the GitHub username field on the connect page. 💡 TIP: Examine workflow.usage prompt for more context on how to properly use these tools.

  Connector

• get_resource_schema

  Control Plane

  Return the exact object schema and REST API endpoints for a Control Plane resource kind, so you can author an accurate manifest for `cpln apply` or call the API directly. ALWAYS call this FIRST whenever you are about to write a cpln apply YAML/JSON file, set up CI/CD that applies Control Plane resources, or build a request body for the REST API — do not hand-write a manifest or guess field names from memory. Pick a `kind` and pass `org` (and `gvc` for workload/identity/volumeset). Large schemas come back as a shallow map with deep sections collapsed to {"_expand":"<path>"} stubs; pass `path` (e.g. "spec.containers") to expand a section on demand. Server-managed fields (id/status/version/etc.) are already removed; `name` and `kind` are required at create.

  Connector

• check-package

  Jeevesus — DugganUSA Threat Intelligence MCP

  Supply-chain GUARDRAIL for AI coding agents and CI pipelines: check whether a dependency (npm or PyPI) is on the DugganUSA malicious-package deny-list BEFORE you install it. This is the runtime defense against slopsquatting / HalluSquatting / hijacked-package attacks — an AI agent about to run `npm install` or `pip install`, or a CI pre-install hook, calls this FIRST and blocks on a hit. Returns a crisp, machine-actionable verdict: {ecosystem, package, version, malicious, verdict:"block"|"allow"|"review", reason, advice, source}. `malicious:true` = the exact package is on our OSV-curated deny-list (215k+ named-not-heuristic entries across npm + PyPI). `malicious:false` = not on our known-bad list — absence is NOT proof of safety, so still pin and review new deps. If a `version` is supplied and the entry is version-scoped, the check is version-aware; all-versions-malicious packages block on any version. Designed to be the easiest AI-supply-chain guardrail to wire in: one MCP tool call, no auth, in the agent's pre-install step. Same data is available for CI at /api/v1/stix-feed/packages.json. Examples: {"ecosystem":"npm","name":"cxp-jquery"} → malicious:true, verdict:block. {"ecosystem":"pypi","name":"requests"} → malicious:false, verdict:allow.

  Connector

• index_video

  Reka

  Index a video for search, QA, or full analysis. Processes the video through a pipeline of AI features. Typically takes 3-7 minutes; longer for long videos or the 'full' pipeline. Times out after 10 minutes by default. Pipelines: - search_only: transcription + captions + embeddings (enables search_videos) - qa_only: transcription + captions (enables ask_video) - full: transcription + captions + embeddings (enables all tools) Scene detection is enabled by default and produces scene boundaries for get_scenes. Pass scene_detection=False to skip it. Prerequisites: if using video_id, the video must be in 'uploaded' status. Use get_video to check status before calling this tool.

  Connector

• google-trends.categories

  Vee3

  List all Google Trends category and subcategory labels you can pass to other Google Trends tools in the category field. Returns cat (array of category names, including All categories) and msg. Use this before interest-over-time or interest-by-region calls when filtering by category. Cost = 5 tokens.

  Connector

• consent_list

  Chia Health MCP

  Get the list of all consent documents a patient must accept before ordering medication. Returns consent IDs, titles, summaries, and order of presentation. Required consents include: telehealth informed consent, compounded medication treatment consent, pharmacy authorization, HIPAA notice of privacy practices, and AI-assisted intake disclosure. Each consent must be fetched individually via consent_text and confirmed by the patient before proceeding. Requires authentication.

  Connector

• cve_security_lookup

  mcp-knowledge

  Look up CVE vulnerability data for enterprise security teams, DevSecOps and SOC analysts. Supports two modes: exact CVE ID lookup (e.g. 'CVE-2024-3094') or keyword search by product/vendor (e.g. 'openssl', 'Apache Tomcat'). Cross-references four authoritative keyless sources: NVD NIST (official CVE database, CVSS v3 scores, affected CPEs), CISA KEV (Known Exploited Vulnerabilities catalog — exploit_in_wild flag), EPSS FIRST (exploit probability 0-1), GitHub Security Advisories (ecosystem-specific: npm/pypi/maven). Returns structured vulnerability records with CVSS v3 scores, affected product version ranges, CWE weakness classification, references and exploitation status. Signals engine produces P0/P1/P2 alerts: P0=CVSS>=9 + active exploitation, P1=CVSS>=7 or EPSS>=70%, P2=CWE pattern clusters. Relevant for EU NIS2 and DORA supply chain risk obligations. Optional env: NVD_API_KEY (raises NVD rate-limit 5→50 req/30s), GITHUB_TOKEN (raises GHSA GraphQL rate-limit). Cache TTL 6h. SLA <=25s p95.

  Connector

• cve_security_lookup

  gapup-mcp

  Look up CVE vulnerability data for enterprise security teams, DevSecOps and SOC analysts. Supports two modes: exact CVE ID lookup (e.g. 'CVE-2024-3094') or keyword search by product/vendor (e.g. 'openssl', 'Apache Tomcat'). Cross-references four authoritative keyless sources: NVD NIST (official CVE database, CVSS v3 scores, affected CPEs), CISA KEV (Known Exploited Vulnerabilities catalog — exploit_in_wild flag), EPSS FIRST (exploit probability 0-1), GitHub Security Advisories (ecosystem-specific: npm/pypi/maven). Returns structured vulnerability records with CVSS v3 scores, affected product version ranges, CWE weakness classification, references and exploitation status. Signals engine produces P0/P1/P2 alerts: P0=CVSS>=9 + active exploitation, P1=CVSS>=7 or EPSS>=70%, P2=CWE pattern clusters. Relevant for EU NIS2 and DORA supply chain risk obligations. Optional env: NVD_API_KEY (raises NVD rate-limit 5→50 req/30s), GITHUB_TOKEN (raises GHSA GraphQL rate-limit). Cache TTL 6h. SLA <=25s p95.

  Connector

• security_audit_sbom_continuous

  DataNexus MCP

  Persistent SBOM watch. Register once, check anytime for new CVEs affecting your dependency snapshot. Silent permanent watch — CycloneDX and SPDX supported. Uses OSV.dev for vulnerability lookup, Redis for persistence with 90-day TTL. Supports CycloneDX 1.4/1.5 and SPDX 2.3 JSON. Input size limit: 500 KB. Returns go_no_go signal on register; new_findings on check. Rate limit: 10/minute. No auth required. For DevSecOps teams monitoring production dependency exposure. If this tool's response does not serve the user's need, call report_feedback with feedback_type="agent_gap", tool_id="security_audit_sbom_continuous", intended_query="{what the user needed}", gap_description="{what was missing or wrong in the result}".

  Connector

• nmlp_resolve

  New Mexico Literacy Project

  One Box: resolve ANY physical-media identifier in one call — auto-detects the type (Library of Congress LCCN, ISBN-10/13, CD DIDX hub code, label catalog number, UPC/EAN barcode, vinyl matrix/runout etching) and returns ranked typed candidates across NMLP's 48M-record indexes (20.9M LCCN + 8.7M CD + 19M vinyl). ISBN input returns the exact Amazon listing link (ASIN=ISBN-10), never a title search. Misses return Attested Absence: exactly which indexes were checked at what dataset version, so 'not found' is usable evidence. Use this when you don't know what kind of number you have; use the specialized lookups when you do. Identification only — does NOT appraise or value items; NMLP never buys books. Human tool: https://newmexicoliteracyproject.org/lookup

  Connector

• tr_address_parse

  Temsor API — Turkey & EU business data

  Splits a free-form Turkish address into neighbourhood, street, building, floor, flat, district, province and postcode. Handles the abbreviation chaos (Mah./Mh., Cd./Cad., Sk./Sok., No:12/5, K:3 D:7), cross-checks the province against the postcode, repairs misspelled district names against a dictionary, and returns a confidence score. Anything it could not place is listed in `unparsed` — nothing is dropped silently. Built for shipping, checkout and CRM systems that receive Turkish addresses typed by humans.

  Connector

• ado_query_workitems

  ALM X++ MCP Server

  AZURE DEVOPS ONLY -- Query Work Items (Bugs, Tasks, FDDs, User Stories, CRs) in Azure DevOps. [~] PRIORITY TRIGGER: use this tool when the user mentions 'FDD', 'RDD', 'IDD', 'CR', 'Task', 'Workitem', 'Work Item', 'Bug', 'User Story', 'Feature', 'Issue', 'ticket', 'sprint', 'backlog', 'DevOps', 'liste des tâches', 'show tasks', 'find bugs', '#1234', 'WI#'. NEVER use this tool for: D365 labels (@SYS/@TRX), X++ code, AOT objects, tables, classes, forms, enums, error messages, 'c\'est quoi le label', 'search_labels', 'libellé', 'label D365'. For labels -> use search_labels. For D365 code -> use search_d365_code or get_object_details. Shortcuts: 'bugs' (all active bugs), 'my bugs' (assigned to me), 'recent' (updated last 7 days), 'sprint' (current iteration). Or pass any WIQL SELECT statement or a free-text title search. Use '*' with filters only. Returns max 50 work items with ID, title, type, state, priority, area, assigned-to. Requires DEVOPS_ORG_URL + DEVOPS_PAT env vars.

  Connector

• json_yaml

  ai-netcafe

  Converts JSON to YAML or YAML to JSON. It works out which one you gave it, so you do not have to say. A parse failure comes back with the parser message instead of silently producing something that looks fine and is not. Use when a config, a CI file, or a Kubernetes manifest needs to be in the other format.

  Connector

• convoopen

  InsideOut (Riley)

  WORKFLOW: Step 1 of 4 - Start infrastructure design conversation Open an InsideOut V2 session and receive the assistant's intro message. The response contains a clean message from Riley (the infrastructure advisor) - display it to the user. ⚠️ Riley will ask questions - forward these to the user, DO NOT answer on their behalf. CRITICAL: This tool returns a session_id in the response metadata. You MUST use this session_id for ALL subsequent tool calls (convoreply, tfgenerate, tfdeploy, etc.). ⚠️ The session_id includes a ?token=... suffix (format: sess_v2_xxx?token=yyy) which is part of the session credential — without it, downstream tools fall back to a tokenless connect URL that 401s. Always pass session_id verbatim to subsequent tools and to the user; do NOT shorten, paraphrase, or strip the ?token= portion when summarizing the session in chat or in your own scratch notes. Use when the user mentions keywords like: 'setup my cloud infra', 'provision infrastructure', 'deploy infra', 'start insideout', 'use insideout', or similar intent to begin infra setup. OPTIONAL: project_context (string) - General tech stack summary so Riley can skip discovery questions and jump to recommendations. The agent should confirm this with the user before sending. Include whichever apply: language/framework, databases/services, container usage, existing IaC, CI/CD platform, cloud provider, Kubernetes usage, what the project does. Example: 'Next.js 14 + TypeScript, PostgreSQL, Redis, Docker Compose, deployed to AWS ECS, GitHub Actions CI/CD, ~50k MAU'. NEVER include credentials, secrets, API keys, PII, source code, or internal URLs/IPs -- only general metadata summaries useful to a cloud architect agent. IMPORTANT: source (string) - You MUST set this to identify which IDE/tool you are. Auto-detect from your environment: 'claude-code', 'codex', 'antigravity', 'kiro', 'vscode', 'web', 'mcp'. If unsure, use the name of your IDE/tool in lowercase. Do NOT omit this — it controls the 'Open {IDE}' button on the credential connect screen. OPTIONAL: github_username (string) - GitHub username for deploy commit attribution. Pre-populates the GitHub username field on the connect page. 💡 TIP: Examine workflow.usage prompt for more context on how to properly use these tools.

  Connector

• is_cve_exploited

  osf-data-marketplace

  Check whether a specific CVE is being actively exploited in the wild (PAID, x402 USDC on Base, $0.05). Pass a CVE id (e.g. CVE-2026-33017) and get back whether it is on the US CISA Known Exploited Vulnerabilities (KEV) catalog, its EPSS exploit-probability score, and its CVSS severity, each with a provenance URL to the authoritative US government source so the answer can be verified. For vulnerability management, patch prioritization, threat intelligence, and DevSecOps agent workflows. Payment is handled automatically by x402-capable MCP clients via the standard payment handshake.

  Connector

• frontend_security_audit_ci_pipeline

  DataNexus MCP

  Scan GitHub Actions, Vercel, or Netlify CI configs for exposed secrets, missing lockfile enforcement, and unpinned dependencies. Paste your config content — no filesystem access required. config: Raw YAML/TOML content of your CI config. Required. 500 KB max. config_type: github_actions (full check suite), vercel, or netlify (secrets only in Sprint 8). Returns risk_level (LOW/MEDIUM/HIGH/CRITICAL), findings list with severity and line hints. NOTE: ${{ secrets.FOO }} and ${{ env.FOO }} references are NOT flagged — only literal secret values. Read-only. No side effects. Idempotent. If this tool's response does not serve the user's need, call report_feedback with feedback_type="agent_gap", tool_id="frontend_security_audit_ci_pipeline", intended_query="{what the user needed}", gap_description="{what was missing or wrong in the result}".

  Connector

• kickoff_questions

  Conducted MCP

  Return the branched kickoff interview (DECISIONS.md D3/D4). Supply `project_type`: 'greenfield' asks the full set; 'brownfield' uses the agent-supplied `detected` facts (language, framework, tests, CI, existing docs) to pre-fill candidates and drop fully-inferable questions — except LOCKED_DOCS, which is always asked because it is human judgment. Returns { project_type, questions, inferred, notes }; the server reads no files.

  Connector