"Guidance on Dependency Checks and Latest Best Practices" matching MCP tools:

• get-logsA

  mcpA

  Get build and runtime logs for a deployment. If no deployment_id is provided, returns logs for the latest deployment. Use this after calling deploy to monitor build progress and diagnose failures. Logs include: framework detection output, dependency installation, build steps, container startup, and health check results. If a deployment fails, check the logs for error details — common issues include missing dependencies, build errors, or the app not listening on the correct PORT (check the PORT env var — 8080 for auto-detected frameworks, or the EXPOSE value from Dockerfile).

  ConnectorNo auth

• update_taskdependenciesA

  ProWoDoA

  Full update (PUT) of a task dependency: predecessor, successor, dependency_type and lag_days must all be supplied. Re-runs the same propagation and validation as create (self-link, cross-project, ancestor/descendant and cycle checks). Prefer the partial-update tool for small edits. Each dependency carries app_url, a deep link to the drawer of the successor (the blocked task), where the dependency is managed.

  ConnectorAPI key

• plan_product_adA

  Claude ImagineA

  Plan a complete product-photo workflow: two image directions from one original product photo, user selection, then a short video. Returns exact account prices, prompts, budget guidance and output checks. Free: never starts a generation. Use before making product ads or product videos.

  ConnectorOAuth

• receipts.verifyA

  gblin-treasury-risk-regimeA

  Verify a gblin-receipt/v1 JSON with pure math (no log lookup, no trust in this server): leaf hash, Ed25519 signature, RFC 6962 inclusion proof, C2SP checkpoint signature, verifier-key hash. Same checks as the zero-dependency verify-receipt.mjs you can run offline. For the extra on-chain-anchor consistency check use GET /v1/verify/:index.

  ConnectorNo auth

• axint.xcode.guardA

  AxintA

  Guard an Xcode agent session against context compaction and Axint drift. Checks project memory files, active Axint session, latest Axint Run or guard proof, and long-task freshness. Use: call around long Xcode tasks, context recovery, broad Swift edits, or before claiming runtime proof; use workflow.check. Inputs: stage selects the gate; modifiedFiles and notes narrow drift checks; autoStartSession defaults true. Effects: writes .axint/guard proof and may start a session; does not edit app source or use network.

  ConnectorNo auth

• get_earnings_call_summaryA

  TipRanksA

  Returns the most recent earnings call summary for a ticker — management guidance text, overall call sentiment (positive / neutral / negative with a one-line rationale), and AI-extracted highlights and lowlights from the call as {title, content} bullets. This is a structured summary derived from the call, not the raw transcript text. Useful for "what did management say about X on the last call", "was the most recent call bullish or bearish", or "summarise the highlights from MSFT's latest earnings". Only the most recent quarter is stored per ticker; for historical EPS actual-vs-estimate series use get_earnings_history. Args: ticker: Stock ticker (e.g. 'AAPL', 'NVDA'). Returns: { ticker, fiscal_year, fiscal_quarter, guidance, sentiment: { label, summary }, highlights: [ { title, content }, ... ], lowlights: [ { title, content }, ... ] }

  ConnectorNo auth

• evaluate_dependency_changeA

  RepoPilotA

  CALL immediately before adding or upgrading an npm dependency. Answers "is this exact version safe to take on" from registry metadata, advisory deltas, provenance, license, and repository evidence, and returns blockers, warnings, a recommendation, and a verification plan. Example: {"dependency":"lodash","to_version":"4.17.21"} — every field is top-level, never nested under a "change" key. Only `dependency` is required — omit to_version to evaluate the latest published version, exactly as `npm install <pkg>` would. to_version also accepts a dist-tag ("latest") or a SemVer range ("^4.17.0"); it resolves to one exact version, reported back in change.to_version. Everything RepoPilot can infer is inferred, and every default, repair, and resolution is listed in input_adjustments. Evaluates only; never installs or edits anything.

  ConnectorNo auth

• tengu_copilot_signal_healthA

  tengu-firmC

  CONTRACT C2 — is the alpha signal fit to trade, and do we actually know? CALL THIS BEFORE acting on /top-picks or /score. Returns a closed-vocabulary `status` (healthy | degraded | do_not_trade | unknown), a `tradeable` boolean to branch on, `decile_convention` (10_is_best), the per-horizon live IC, and prose guidance. Fail CLOSED on anything other than `healthy` — treat it as an empty candidate list. `unknown` is a real verdict, not a placeholder: it means no BELIEVABLE current measurement exists, which carries the same instruction as red. The contract checks whether the measurement is trustworthy, not merely recent — a drift job that re-stamps a frozen input publishes today's date over old numbers, and this refuses to grade that as fresh.

  ConnectorNo auth

• axint.upgradeA

  AxintA

  Check the latest Axint package and optionally apply the upgrade while preserving the current agent thread. Use: call when axint.status shows a stale server; not for app dependency upgrades. Inputs: apply defaults false; targetVersion selects the install, while reinstallXcode and writeReport matter only when applying. Effects: destructive when apply=true: can run package installs, refresh Xcode wiring, and write .axint/upgrade; may use npm.

  Connector

  Destructive

  No auth

• create_taskdependenciesA

  ProWoDoA

  Link two tasks of the same project with a scheduling dependency. `dependency_type` is one of FS (finish-to-start, default), SS, FF, SF; `lag_days` shifts the constraint (may be negative). The successor's planned dates are pushed forward if needed. Rejected (400) on self-link, cross-project, ancestor/descendant, or cycle. Each dependency carries app_url, a deep link to the drawer of the successor (the blocked task), where the dependency is managed.

  ConnectorAPI key

• run_checksA

  NovenceA

  Start a Lighthouse, a11y, and link check cycle on the latest deployment. Does not publish a new deploy — use deploy for that. Then poll get_checks_results (not get_deployment_status) until scores appear. Unverified accounts skip checks on deploy; this still queues a cycle when allowed.

  ConnectorNo auth

• check_marginglow_signal_accessA

  MarginGlow AI SignalA

  Checks the authenticated agent's complimentary and paid MarginGlow AI Signal balances, whether an analysis can run, which allowance will be used next and the latest successfully credited Stripe purchase. This is read-only and does not consume a Signal.

  ConnectorNo auth

• suggest_alternativeA

  NPMScanA

  Given a package that looks deprecated, vulnerable, abandoned, or suspicious, suggest better-maintained alternatives in the same category. This tool first checks the source package's own latest-version health (deprecation, latest-version OSV verdict, popularity/maintenance tiers, typosquat flag), then combines maintainer-provided deprecation hints with deterministic npm search-based category matching. It ranks candidates using category overlap plus search_packages-style popularity/maintenance signals, filters out typosquats and weak/stale contenders, and returns a short list with plain-language whySuggested notes. Best for turning a 'don't use this package' warning into an actionable replacement shortlist.

  ConnectorNo auth

• suggest_alternativeA

  NPMScanA

  Given a package that looks deprecated, vulnerable, abandoned, or suspicious, suggest better-maintained alternatives in the same category. This tool first checks the source package's own latest-version health (deprecation, latest-version OSV verdict, popularity/maintenance tiers, typosquat flag), then combines maintainer-provided deprecation hints with deterministic npm search-based category matching. It ranks candidates using category overlap plus search_packages-style popularity/maintenance signals, filters out typosquats and weak/stale contenders, and returns a short list with plain-language whySuggested notes. Best for turning a 'don't use this package' warning into an actionable replacement shortlist.

  ConnectorNo auth

• run_evaluationA

  Extend MCPA

  Run an evaluation set against a version of its resource and score the results against the ground truth (evaluations group). Async: returns immediately with a bpr_... run ID — poll it with get_evaluation_run (NOT a get-batch tool, even though the ID looks like a batch). Defaults to the set's resource at its latest published version; pass entity to pin { id, version: "1.2" | "latest" | "draft" }. Follow any llmContext guidance included in results.

  ConnectorOAuth

• check_package_provenanceA

  NPMScanA

  Checks whether a package version was published with npm's own Sigstore-backed publish provenance (`npm publish --provenance`), and cross-checks that provenance against reality rather than just reporting its presence. Three checks: (1) parses the SLSA build attestation (declared source repo, commit, builder identity, GitHub Actions run URL) and flags a builder that isn't GitHub-hosted, or an attested source repo that doesn't match package.json's own `repository` field; (2) when this version LACKS provenance, checks whether most peer packages (same npm scope, or same maintainer for an unscoped name) DO have it — a package that's the odd one out in an org that otherwise always publishes from CI is a real anomaly, not proof of malice; (3) fetches package.json from the source repository at the exact attested commit (or a best-effort matching git tag when no provenance/commit is available) and diffs its install-lifecycle scripts (preinstall/install/postinstall/prepare) and dependency names against what's actually in the published tarball — this is the single highest-signal check here, since a script or dependency that exists on npm but was never committed is exactly the pattern of a stolen-npm-token publish that bypasses CI (the event-stream/ua-parser-js incident shape). This is a heuristic, structural check: it does NOT cryptographically re-verify the Sigstore bundle (Fulcio cert chain, Rekor inclusion proof) — it trusts that npm's registry already refused to accept a publish that failed that verification, and checks the CONTENT of what the registry reports instead. Most packages don't use --provenance yet, so its bare absence is never scored on its own — only an org-norm anomaly or an actual source mismatch is. Use get_package/get_package_version first for basic package info; use this specifically to assess publish-integrity risk.

  ConnectorNo auth

• check_package_provenanceA

  NPMScanA

  Checks whether a package version was published with npm's own Sigstore-backed publish provenance (`npm publish --provenance`), and cross-checks that provenance against reality rather than just reporting its presence. Three checks: (1) parses the SLSA build attestation (declared source repo, commit, builder identity, GitHub Actions run URL) and flags a builder that isn't GitHub-hosted, or an attested source repo that doesn't match package.json's own `repository` field; (2) when this version LACKS provenance, checks whether most peer packages (same npm scope, or same maintainer for an unscoped name) DO have it — a package that's the odd one out in an org that otherwise always publishes from CI is a real anomaly, not proof of malice; (3) fetches package.json from the source repository at the exact attested commit (or a best-effort matching git tag when no provenance/commit is available) and diffs its install-lifecycle scripts (preinstall/install/postinstall/prepare) and dependency names against what's actually in the published tarball — this is the single highest-signal check here, since a script or dependency that exists on npm but was never committed is exactly the pattern of a stolen-npm-token publish that bypasses CI (the event-stream/ua-parser-js incident shape). This is a heuristic, structural check: it does NOT cryptographically re-verify the Sigstore bundle (Fulcio cert chain, Rekor inclusion proof) — it trusts that npm's registry already refused to accept a publish that failed that verification, and checks the CONTENT of what the registry reports instead. Most packages don't use --provenance yet, so its bare absence is never scored on its own — only an org-norm anomaly or an actual source mismatch is. Use get_package/get_package_version first for basic package info; use this specifically to assess publish-integrity risk.

  ConnectorNo auth

• search_algaeA

  Atlarium Habitat Database MCPA

  Search public algae diagnostic profiles with symptoms, causes and treatment guidance.

  ConnectorNo auth

• hmrc_search_guidanceA

  UK Legal ResearchA

  USE THIS TOOL WHEN searching GOV.UK for HMRC tax guidance on a topic (VAT, income tax, corporation tax, etc.). Returns matching guidance titles, URLs, summaries, and last-updated dates. Searches the official GOV.UK content API filtered to HMRC publications. Authoritative source for current HMRC tax guidance. Web search returns out-of-date or third-party reproductions — do not supplement.

  ConnectorNo auth

• GetGuidanceA

  equiblesA

  Get company guidance from written Item 2.02 earnings releases and earnings-call transcripts, newest release first, with range, unit, GAAP basis, fiscal period and source provenance. Closed target periods are marked ended. Revenue and diluted-EPS guidance includes the reported actual and verdict once comparable XBRL facts exist; non-GAAP guidance is never compared with GAAP actuals. Coverage notes distinguish unprocessed documents from sources that state no guidance.

  ConnectorNo auth

• get_guideA

  CanvsA

  Returns guidance on diagram-creation workflow and tool selection: how to choose between Mermaid and manual element creation, and the recommended iteration workflow. Consult before building complex diagrams.

  ConnectorNo auth