"Exposing an MCP server via a public tunnel with mcp-proxy" matching MCP tools:

• start_auditA

  webabilityA

  Kick off a FULL accessibility audit deliverable for a URL — a persistent, timestamped artifact, not an inline scan. Runs the server-side pipeline (axe + advanced checks + mobile viewports + annotated screenshots + optional agent spot-check) and produces a downloadable report and a formatted Excel workbook (Cover / Status / Barriers / ADA context sheets) stored durably. Returns immediately with an audit `id`; poll `get_audit` for progress and, when complete, download URLs. Use this when someone needs a durable artifact to attach as evidence of testing effort for a compliance officer or legal response — for iterating on code, use scan_page + verify_fix instead. Needs a free WebAbility account (sign in by connecting https://mcp.webability.io/mcp/auth, or run `webability login`). Set includeAgent:true to add the slower agentic manual-audit pass. To audit a local dev server, open a tunnel (`webability-tunnel --port 3000`) and pass its URL as `url` with the printed secret as `tunnel_secret`; keep the tunnel open until get_audit reports complete (about 5 minutes) — the pipeline loads the page several times.

  ConnectorNo auth

• create_webhookA

  Porkbun (official)A

  Register a webhook endpoint. Porkbun will POST a signed JSON payload to `url` whenever a subscribed event occurs. Returns the new endpoint including its `secret` — store it securely; it's used to verify the `X-Porkbun-Signature` header (HMAC-SHA256 over `{timestamp}.{rawBody}`). `url` must be a publicly reachable HTTPS endpoint: `https://` on port 443, no credentials embedded in the URL, and a hostname that resolves to a public internet address. Private, loopback (including tricks like `127.0.0.1.sslip.io`), link-local, CGNAT and reserved addresses are rejected with `INVALID_WEBHOOK_URL` — do not try to point this at localhost or an internal host. For local development use a public HTTPS tunnel (ngrok, Cloudflare Tunnel), or the local npm package with a sandbox key, which can fire test events on demand. A hostname that does not resolve yet is accepted so you can register before the receiver is deployed, but the rules are re-checked before every delivery. Omit `events` (or pass `['*']`) to subscribe to all event types; you can also pass prefix wildcards like `dns.*`.

  ConnectorOAuth

• vault_listA

  mosADD — the comms layer for AI agentsB

  Entries of the vault (passwords, API keys, tokens, notes) this tunnel may use: its own and the whole account's, with name, description, kind, service, status and expiry. Never the values: read one with vault_get. Live entries come first. status is "zywy" (live) or "martwy" (dead: revoked or replaced by a newer key); expired is true once expires_at has passed. Pick an entry that is live and not expired. Only the agent on duty in the tunnel (the cable that holds the lease) reads the vault.

  ConnectorOAuth

• marketsummary__get_liquidityA

  tachyoA

  [marketsummary] How liquid is a token — can you size into it without moving the price? A daily-USD-volume proxy from our market watchlist, bucketed (deep / ok / thin / micro / unknown) with a squeeze-risk flag. Free = the tier + squeeze-risk; premium unlocks the exact volume figure via session_token (from verify_wallet_ownership) OR an x402 `payment` proof. 'unknown' = off our watchlist. Not advice.

  ConnectorNo auth

• marketsummary__get_liquidityA

  TachyoA

  [marketsummary] How liquid is a token — can you size into it without moving the price? A daily-USD-volume proxy from our market watchlist, bucketed (deep / ok / thin / micro / unknown) with a squeeze-risk flag. Free = the tier + squeeze-risk; premium unlocks the exact volume figure via session_token (from verify_wallet_ownership) OR an x402 `payment` proof. 'unknown' = off our watchlist. Not advice.

  ConnectorNo auth

• search_businessesA

  knowledge-baseA

  Find businesses, merchants and websites in the tunnel knowledge base by name or topic. Start here: every other tool needs a `slug`, and this is where a `slug` comes from. Returns an array of summaries, each with `slug`, `kind`, name, description and a `verification` object. Read `verification.level` rather than assuming: "human" means a tunnel employee checked the business, "automated" means machines proved only that the business controls its own channels, and null means neither. Zero matches is a normal answer, not an error — it comes back with `completeness` "empty". Authentication: none. This tool works with no credentials.

  ConnectorNo auth

• check_live_facebookA

  HOTLIKESHOP MCPA

  Check whether ONE Facebook UID (numeric) is live or dead via the public profile-picture endpoint (server-side). Read-only, free, no api_key required. Facebook blocks datacenter IPs, so if it cannot verify it returns status "needs_proxy" — pass your own "proxy" to check reliably. WHEN TO USE: a single Facebook UID. PREFER INSTEAD: check_health_bulk for many accounts at once or for Instagram/Telegram/TikTok, deep_inspect for a detailed profile (followers, bio, media). Kiểm tra 1 UID Facebook (số) sống/chết; FB chặn IP máy chủ nên nếu không check được sẽ trả "needs_proxy" — truyền "proxy" riêng để check chuẩn.

  ConnectorNo auth

• check_live_facebookA

  HOTLIKESHOPA

  Check whether ONE Facebook UID (numeric) is live or dead via the public profile-picture endpoint (server-side). Read-only, free, no api_key required. Facebook blocks datacenter IPs, so if it cannot verify it returns status "needs_proxy" — pass your own "proxy" to check reliably. WHEN TO USE: a single Facebook UID. PREFER INSTEAD: check_health_bulk for many accounts at once or for Instagram/Telegram/TikTok, deep_inspect for a detailed profile (followers, bio, media). Kiểm tra 1 UID Facebook (số) sống/chết; FB chặn IP máy chủ nên nếu không check được sẽ trả "needs_proxy" — truyền "proxy" riêng để check chuẩn.

  ConnectorNo auth

• agent_servicesA

  Netmon (demo)A

  List Windows services on an agent-managed device — live read via the WMI tunnel. Wraps POST /api/getDeviceServices (permission: devices). Returns rows of {Name, State, DisplayName} as reported by Win32_Service. Use this to answer 'is service X running on host Y' without trawling event logs. Read-only by design — the service-control endpoints (start/stop/restart) are deliberately NOT exposed via mcpmond. Latency: server-side timeout is 60s — agents on slow links may approach that. Returns 400 if the device is offline or not agent-enrolled. Example: agent_services({device_id: 42})

  ConnectorNo auth

• agent_processesA

  Netmon (demo)A

  List running processes on an agent-managed device — live read via the agent tunnel. Wraps POST /api/getDeviceProcesses (permission: devices). Returns rows as reported by GETPS: (process id, name, parent, memory, etc. — exact shape depends on the agent version). Common diagnostic patterns: pair with agent_services to answer 'is the SQL Server service running but stuck?'; correlate top memory/cpu processes with eventlog_search criticals. Read-only by design — the process-kill endpoint (KILLPS) is deliberately NOT exposed via mcpmond. Server-side timeout is 60s; expect 400 if the device is offline or not enrolled. Example: agent_processes({device_id: 42})

  ConnectorNo auth

• set_proxyA

  AgentDomainsA

  Serve a backend at this subdomain through the AgentDomains edge, which terminates TLS with its own certificate — this is how you get working HTTPS on an origin that has no certificate of its own (a bare IP-less PaaS host, a tunnel, an internal box). Unlike a forward, the URL stays on your domain and the response is proxied, not redirected. Claims the label first if needed. Like a forward, a proxy TAKES OVER the hostname: A/AAAA/CNAME records on the label itself are deleted and returned in 'replaced_records', while sub-label and TXT records are untouched. A proxy and a forward are mutually exclusive on one label. Caveat: apps that hardcode their own hostname (OAuth callbacks especially) may need your new hostname registered on their side.

  ConnectorNo auth

• deleteProxyResourceA

  2extractA

  Permanently delete a proxy resource. This action is irreversible — the proxy and all its settings will be removed. User confirmation is required before proceeding. To stop traffic but keep the proxy for later, use deactivateProxyResource instead. Returns a snapshot of the deleted proxy with status deleted. Response fields: docs://proxies/deleteProxyResource.

  Connector

  Destructive

  No auth

• register_test_providerA

  TricklA

  Registers a seller (provider) under the test key via POST /providers/register and returns providerLinkCode (needed to create goals) and webhookSecret (to verify webhooks). Idempotent on externalCreatorId. webhookUrl must be a public https URL that reaches the user's receiver, e.g. an ngrok or cloudflared tunnel to localhost. Sandbox webhooks are real signed HTTP requests.

  ConnectorNo auth

• facebook_name_searchA

  osint.foundationB

  People with a given name from Facebook's public directory (about a dozen per name, people only): name, numeric profile ID, profile link and any public details. Pass an ID to facebook_profile for the full public profile. Without an API key: $0.05 USDC per successful call via x402 (Base or Solana).

  ConnectorNo auth

• cc.blofin_publicA

  Central Command — x402 Trading IntelligenceA

  Call cc.blofin_public — Proxy to BloFin public API (tickers, instruments, orderbook, trades, candles) bypassing CORS restrictions. Purpose: Proxy to BloFin public API (tickers, instruments, orderbook, trades, candles) bypassing CORS restrictions. Behavior: READ-ONLY. Does not place orders, move funds, or mutate your exchange account. Responses may be cached (~60s). Auth: X-Api-Key or x402 payment proof (X-PAYMENT / __x_payment). Anonymous unauthenticated calls receive HTTP 402 with payment accepts. Cost: $0.0005 USDC per successful call (x402 Base USDC pay-per-use or prepaid X-Api-Key balance). Linked Connect keys are free. This is billing, not a side effect. Rate limit: 120/min (per API key). Tier: standard. Returns: Raw BloFin public API response for any public endpoint: real-time tickers, full orderbook depth, recent trades, OHLCV candles. Guidelines: Pass required parameters exactly; omit unknown fields. On 402, settle payment then retry with X-PAYMENT. Tags: blofin, orderbook, tickers, candles, exchange-data.

  ConnectorNo auth

• cc.blofin_publicA

  Central CommandA

  Call cc.blofin_public — Proxy to BloFin public API (tickers, instruments, orderbook, trades, candles) bypassing CORS restrictions. Purpose: Proxy to BloFin public API (tickers, instruments, orderbook, trades, candles) bypassing CORS restrictions. Behavior: READ-ONLY. Does not place orders, move funds, or mutate your exchange account. Responses may be cached (~60s). Auth: X-Api-Key or x402 payment proof (X-PAYMENT / __x_payment). Anonymous unauthenticated calls receive HTTP 402 with payment accepts. Cost: $0.0005 USDC per successful call (x402 Base USDC pay-per-use or prepaid X-Api-Key balance). Linked Connect keys are free. This is billing, not a side effect. Rate limit: 120/min (per API key). Tier: standard. Returns: Raw BloFin public API response for any public endpoint: real-time tickers, full orderbook depth, recent trades, OHLCV candles. Guidelines: Pass required parameters exactly; omit unknown fields. On 402, settle payment then retry with X-PAYMENT. Tags: blofin, orderbook, tickers, candles, exchange-data.

  ConnectorNo auth

• resolve_abiA

  🐴 GulltopprA

  Resolve a contract's interface from chain + address via a fallback ladder (Etherscan → Sourcify → proxy → heimdall decompile → 4byte). Returns a compact capability manifest (read vs write functions, the 'buttons'), proxy chain, token metadata, and PROVENANCE. ALWAYS read `provenance`: a `decompiled` ABI has synthetic function names — treat it with care and confirm intent before writing. Partial, proxy, and bytecode-match results lead with a WARNING before the JSON. The compact manifest/provenance is also returned as structuredContent. Use method_q/method_kind/method_limit for large ABIs. Raw ABI is omitted from MCP output to save tokens; use REST/SDK resolve_abi with include_abi=true if needed.

  ConnectorNo auth

• proxy_1gbA

  US Company Intelligence for AI Agents (SEC EDGAR, x402)A

  Get a working HTTP/HTTPS proxy on a real French home line (Caribbean, Outremer Telecom) with 1 GB of traffic, as a key you use in curl -x, valid 30 days. Buy 1 GB of French West Indies residential proxy bandwidth for scraping and agent traffic, delivered as a ready-to-use key in the form http://buyer:KEY@host, valid 30 days and metered per gigabyte at 3.50 USD. The exit is a real FTTH home line in the French West Indies on Outremer Telecom / SFR Caraibe (AS20776), reverse DNS ftthcc.*.sfrcaraibe.fr. Geolocation is split across databases and we say so rather than pick the flattering one: ipinfo and ipwho.is place it in Martinique (MQ), ip-api and db-ip place it in mainland France (FR). Reachability, carrier and proxy-blacklist status are probed from the public internet before every sale: the address currently comes back clean, not flagged as a proxy or VPN. If no exit is verified live you are not charged. A Caribbean residential exit is rare, so a site fingerprinting by region sees an address no datacenter range can imitate. — $3.500000/call, paid per request via x402 (USDC). Use when asked: "residential proxy, pay per gb", "get a residential ip for my agent", "http proxy with a french home ip".

  ConnectorNo auth

• get_cross_intelligenceA

  TrendIdeaA

  Return cross-user intelligence for an idea: anonymous, aggregated insights from similar ideas across the platform. Use it to learn how comparable ideas performed without exposing any private data. Read-only and free; pass an ideaId you own.

  ConnectorNo auth

• run_api_endpointA

  pipeheroA

  Send an endpoint against an environment and return the real response (status, headers, body up to 20 KB). A `local` environment goes through the user's tunnel to their localhost (the CLI must be running); staging/prod are sent from Pipehero's cloud (Pro/Team) to public addresses only. Sending to a `prod` environment with a write method needs confirm_write_to_prod: true, which you should only pass after the user agrees. Use it to check that the code you wrote behaves as documented.

  Connector

  Destructive

  No auth

• li_check_proxyA

  PoliteReachA

  OPERATOR ONLY. Asks ipinfo, THROUGH the proxy, which IP it really exits from, then what type that IP's network (ASN) is. `verdict`: `pass` = `isp`, `reject` = `hosting` (a datacenter — a known LinkedIn risk), `review` = anything else or the type lookup failed, `failed` = the proxy could not be reached (the error says why; credentials are never in it). "ISP proxy" is a vendor label — this is the check that counts, and vendors have changed the network under an unchanged label, so re-check after any renewal. Pass `proxyId` from li_proxies, or `default` for the install-wide env proxy. No browser, no LinkedIn traffic; the result is stored on the proxy.

  ConnectorOAuth