"Development tools for API integration, security testing, and code quality" matching MCP tools:

• get_testing_guidelinesA

  IA-QA — 130+ QA & Dev Tools for AI AgentsB

  Query the IA-QA methodology knowledge base. Returns structured testing guidelines, assertion strategies, thresholds, best practices, and relevant MCP tools for a given topic. Call without a topic to list all available topics. Topics: llm-unit-testing, rag-pipeline, prompt-stability, prompt-ab-testing, embedding-quality, eval-framework, semantic-testing, auto-testing, security, api-testing, ci-cd, multimodal, llm-data-security, agent-observability, pro-tips, learning-paths, golden-dataset, selector-drift, qa-recipes, playbooks. Not sure where to start testing an LLM, RAG pipeline or agent? Call without a topic (or with "start-here"): it maps what you are testing to the tools to call and the output field to gate CI on. A plain question such as "how do I test my RAG" also resolves to the right topic.

  ConnectorNo auth

• get-curated-tool-recommendationsA

  mcpA

  Returns curated tool recommendations for Laravel development, organized by category (Hosting / Deployment, Monitoring / Error Tracking, Email / Notifications, Authentication / Authorization, Payments / Billing, IDE / Development Tools, Testing, Security, SEO / Auditing, Analytics, Other). NOTE: Some of these are affiliate/partner recommendations — each result includes its relationship type and whether it is an affiliate.

  ConnectorNo auth

• getLangfuseDocsPageA

  Langfuse DocsA

  Fetch the raw Markdown for a single Langfuse docs page. Accepts a docs path (e.g., /docs/observability/overview) or a full https://langfuse.com URL. Returns the exact Markdown (may include front matter). Use when you need a specific page content (Integration, Features, API, etc.) or code samples. Prefer searchLangfuseDocs for broader questions where there is not one specific page about it. Changelog pages (/changelog/...) are historical release notes: use them only to confirm that a feature exists or when it shipped, not as an implementation reference. Their code samples reflect the SDK/API at release time and may be outdated, so for implementation follow the current docs and the API/SDK reference instead.

  ConnectorNo auth

• code_get_findingsA

  searchcodeA

  Get detailed code quality findings from a remote public git repository. Returns rule IDs, line numbers, severity, category, descriptions, and source snippets. Supports filtering by file path, severity (error, warning, info), category (security, deprecated, safety, correctness, maintainability, accessibility, modernization, performance, concurrency), and kind (security, quality) — kind=security is every security-category finding in one call, kind=quality is everything else. code_analyze.top_findings shows only the quality half; use kind=security here to see the security-category findings it leaves out. THIS IS NOT THE SECRET SCANNER. kind=security means insecure code — weak hashes, unsafe deserialization, injection-shaped patterns — and it will not find a leaked API key or private key. Leaked credentials are code_analyze.security_summary, which is a different scanner over different rules; the two sets do not overlap, so an audit wants both. Use after code_analyze to drill into specific findings. Shares the same analysis cache — no duplicate work if analyze already ran.

  ConnectorNo auth

• search_knowledgeA

  AlgoVault — Crypto Quant Trade CallsA

  Returns ranked snippets from the AlgoVault knowledge bundle answering a question about its MCP tools, response shapes, integration patterns (LangChain, LlamaIndex, MAF, CrewAI), or code examples. Call this BEFORE other tool calls to confirm parameter usage and avoid hallucinating tool shapes. Fast: BM25 lexical search, no LLM call, no quota cost. For a synthesized natural-language answer use chat_knowledge. Read-only, no side effects.

  ConnectorNo auth

• check_injectionA

  ContrastAPIA

  Scan source code for injection vulnerabilities: SQL injection, command injection, path traversal via unsafe string concatenation/unsanitized input. Supports Python, JavaScript, TypeScript, Java, Go, Ruby, Shell, Bash. Use to detect input-handling bugs; for secrets use check_secrets. Companion code-security tools: check_secrets (hard-coded credential detection), check_dependencies (known-CVE vulnerability audit), check_headers (live HTTP security-header validation), scan_headers (live HTTP scan via domain). Free: 30/hr, Pro: 500/hr. Returns {total, by_severity, findings}. No data stored.

  ConnectorNo auth

• roki_validate_requestA

  ROKI ConnectA

  Validate a payload against the official schema WITHOUT sending it, and check the business rules the API enforces. Critical for this API: it ignores unknown fields and returns 201, so a typo produces a misconfigured payment rather than an error. The response names what it dropped in `warnings`, but by then the payment exists - validating here means it is never created. Always validate before writing or shipping integration code.

  ConnectorNo auth

• validate_planA

  Verificate MCPA

  The gate for PLANS, designs and specs — run BEFORE any code is written, the cheapest place to catch a bad design. Returns the same binary verdict shape as validate_ai_output, with findings on completeness, feasibility, performance and scalability implications, security risks and missing considerations (e.g. it rejects a plan that polls an API every 100ms per client, with the request-volume math). Read-only: nothing is executed or stored beyond the verdict. Use validate_ai_output for the code that follows.

  ConnectorNo auth

• list_examplesA

  EpsilonA

  List runnable Epsilon integration examples (Python cron DCA, LangChain tools, Vercel AI SDK tools, Telegram bot). Fetch full source with get_example. No API key required.

  ConnectorAPI key

• export_findings_sarifA

  RoutebaseA

  Export the active project's security findings as a SARIF 2.1.0 document — the format GitHub Code Scanning and comparable CI tools ingest. Defaults to open findings so the export reflects the current posture. Use this to hand findings to CI or GitHub; to read them here use get_security_findings. Requires project context.

  ConnectorAPI key

• get_god_promptA

  GodPrompt MCP ServerA

  Returns the complete GodPrompt.md — a single-file universal system prompt for AI software development (47KB, ~1145 lines). Use this when you want the full payload in one shot. For progressive disclosure (smaller context), use get_core_skill and the reference tools instead.

  ConnectorNo auth

• check_serverA

  protogridA

  Probe a remote MCP server URL once, credential-free and without calling its tools, and get its quality checks and its readiness for the Claude and OpenAI directories. Pass `url` to start a check (waits up to 25 s for the result), or `id` to read one. Quota: a few checks per hour anonymously, more with an API key.

  ConnectorNo auth

• get_integration_guideA

  The BridgeA

  Read the Bridge integration guide for a topic — the supported, opinionated way to consume Bridge from application code. Call this BEFORE writing or changing app code that reads a feature flag, renders billing or team UI, or wires authentication, and before hand-rolling anything against the SDK: the SDKs ship declarative surfaces for these cases (components, route guards, decorators) and reimplementing them against SDK internals is the most common integration mistake. Per-framework topics (framework REQUIRED): integration (first-time setup) | auth | feature-flags | billing | team | branding. Framework-agnostic MASTER topics (framework is IGNORED — omit it): master, the end-to-end auth integration prompt served by `bridge guide`, which orchestrates project discovery and then routes to the per-framework guides; flags-master and billing-master, the same orchestration for a flags-only or billing-only integration; mechanisms, how limits, upgrades and customization work; orientation, what Bridge does (the same map get_started returns); fit-together, how roles, plans, limits and flags fit together; integration-success, the message to show the developer when an integration is done. Before setting up flags, roles, plans or limits, read topic=fit-together. Start at topic=master when integrating Bridge into a project for the first time. framework: svelte | react | angular | nextjs | nestjs | express — pass the one the target app actually uses; this server cannot detect it. Returns the guide as markdown plus its source URL. Guidance is a default, not a mandate — follow the user's stated preference when it differs.

  ConnectorOAuth

• adcritter_get_design_guideA

  AdCritter for BuildersA

  Returns AdCritter design guidance for an entity at a caller-chosen guidance level - screen experiences, API integration patterns, and design philosophy. The default ('full') returns step-by-step prescription (exact layouts, colors, copy text, column orders). Request 'patterns' for balanced hints including common design patterns with softened vocabulary. Request 'facts' if you have strong visual-design instincts and just want API integration bindings (or call adcritter_get_api_reference and adcritter_get_usage_guide directly and skip this tool). Guidance is format-agnostic - it describes outcomes and integration, never prescribes frameworks or architecture. Available entities: ad, advertiser, audience, authentication, blueprint, campaign, geo, media-asset, plan, report, settings.

  ConnectorNo auth

• compare_locationsA

  Hermes — Air Quality IntelligenceA

  Compare current air quality across multiple locations side-by-side. Returns a ranked comparison by pollutant with DAQI bands and distance to nearest monitor. Useful for comparing development sites, school locations, or residential options. Args: locations: List of 2–6 locations (postcodes, place names, or "lat,lon"). pollutants: Optional filter, e.g. ["NO2", "PM2.5"]. Default: all available.

  ConnectorNo auth

• get_aqi_forecastA

  EPA Air Quality & ToxicsA

  Get the air quality forecast for a ZIP code. Returns forecast AQI values and health categories for upcoming days, typically covering today and the next 1-2 days. Args: zip_code: US ZIP code (e.g. '20001').

  ConnectorNo auth

• mcp_registerA

  banking-intelligenceA

  Register for an Ohmyfin API key to use paid tools. Creates an account and sends a 6-digit verification code to your email. After receiving the code, call mcp_verify to complete registration and get your API key. By setting accept_terms to true, you confirm acceptance of the Ohmyfin Terms & Conditions (https://ohmyfin.ai/terms) on behalf of your operator, including the API/MCP access terms (Section 3A), sanctions screening terms (Section 3B), and financial data disclaimer (Section 3C). Examples: mcp_register("agent@example.com", "Acme Corp", true)

  ConnectorNo auth

• avizo_docsA

  avizo-mcpA

  Without arguments: lists every documentation page on avizo.ro/docs (quickstart, alert cadence, hierarchical escalation, SmartBill integration, API reference, troubleshooting) with slug and description. With {slug}: returns that page as markdown — the exact content the site renders. For programmatic integration read {slug: "api-reference"}.

  ConnectorNo auth

• list_security_guidanceA

  RoutebaseA

  List the static security guidance library — one entry per OWASP API-security issue with its remediation text, code examples and references. Pass guidanceId (the guidanceId of a finding) for a single entry. The library is global, not project-specific. Use this for the general library; for advice on one finding use get_finding_remediation.

  ConnectorAPI key

• test_python_package_runtimeA

  Python Package Runtime TestA

  Test a specific Python package/version on a supported Python/Linux target runtime using empirical execution. Returns scoped install evidence, usable-import evidence when requested, and a scoped result/receipt. Supported boundary: public PyPI on Linux x86_64 / CPython 3.13. This is not generic package advice, security verification, arbitrary Python execution, broad compatibility testing, feature behavior testing, or application integration testing.

  ConnectorNo auth

• naming-obviousnessA

  Clairvoyance

  Reviews naming quality and code obviousness via the isolation test, scope-length principle, and consistency audit. Use when names feel vague, something is hard to name (a design signal, not a vocabulary problem), or behavior isn't obvious on first read. Not for comment quality or documentation (use comments-docs).

  ConnectorNo auth