"Guidance on Dependency Checks and Latest Best Practices" matching MCP tools:

• vibekit_get_skillA

  VibeKitA

  Fetch the full content of a specific skill — implementation patterns, code examples, and best practices for a domain. Fetch on-demand when you need guidance on a specific topic.

  ConnectorNo auth

• get_earnings_call_summaryA

  TipRanksA

  Returns the most recent earnings call summary for a ticker — management guidance text, overall call sentiment (positive / neutral / negative with a one-line rationale), and AI-extracted highlights and lowlights from the call as {title, content} bullets. This is a structured summary derived from the call, not the raw transcript text. Useful for "what did management say about X on the last call", "was the most recent call bullish or bearish", or "summarise the highlights from MSFT's latest earnings". Only the most recent quarter is stored per ticker; for historical EPS actual-vs-estimate series use get_earnings_history. Args: ticker: Stock ticker (e.g. 'AAPL', 'NVDA'). Returns: { ticker, fiscal_year, fiscal_quarter, guidance, sentiment: { label, summary }, highlights: [ { title, content }, ... ], lowlights: [ { title, content }, ... ] }

  ConnectorNo auth

• get_filing_indexA

  MetricDuck — Financial AnalysisA

  Use this when the user asks what matters in a company's latest 10-K or 10-Q — red flags, accounting quality, debt and liquidity stress, top risks, management tone and guidance, segments and customer concentration. Returns the facts MetricDuck extracted from that filing, each with evidence and a pointer to the section to read next with get_filing_section(). Facts are presented neutrally; those from LLM analysis are labeled. The optional `lens` narrows it to one view (listed on that parameter). Only the LATEST filing is indexed. For a PRIOR quarter's operating KPIs (same-store / comparable sales, ARPU, take-rate, bookings), guidance, or a beat/miss question (e.g. "FND same-store sales in Q4 2024", "did MU beat its Q3 gross-margin guidance"), don't page through the latest 10-Q/10-K — read that quarter's earnings-release 8-K: list_filings(ticker, form_subtype="8-K-earnings", years=N) labels each row with its implied fiscal period (8-Ks are not period-indexed, so don't pass fiscal_year/fiscal_period there); then get_filing_section(ticker, "earnings_press_release" | "earnings_income_statement" | "earnings_segment_data", accession_number=<that 8-K>). Highlights, guidance/outlook and CEO commentary are in "earnings_press_release" (query="outlook"); omit section_id for the release's outline. Use Cases: - "What should I look at in AAPL's 10-K?" -> get_filing_index("AAPL") - "Any accounting red flags for ENPH?" -> get_filing_index("ENPH", lens="earnings_quality") - "What are UNH's biggest risks right now?" -> get_filing_index("UNH", lens="risk_trajectory") For earnings-call trends across quarters, use `compare_earnings_calls`.

  ConnectorAPI key

• get_guidance_vs_actualA

  MetricDuck — Financial AnalysisA

  Did management deliver what they guided? Joins forward guidance from earnings-call transcripts to reported actuals from 10-K/10-Q + 8-K earnings for the same ticker + fiscal period. Returns both sides verbatim with quotes and locators. Use Cases: - "Did NVDA deliver on Q2 FY2026 guidance?" -> get_guidance_vs_actual("NVDA", fiscal_period="Q2 FY2026") - "How disciplined has MSFT been against its own guidance?" -> get_guidance_vs_actual("MSFT") then compare across periods - "Latest period's guidance-vs-actual" -> get_guidance_vs_actual("TSLA") (period defaults to most recent) Returns everything a beat/miss verdict needs — never the verdict: the comparison is basis-matched, as-reported arithmetic, and whether "above guidance" is good is the caller's judgment. Output: - Guidance: forward items targeting the period — from earnings-call transcripts AND 8-K earnings releases (metric, value/range, basis, period, verbatim quote, source). - Actuals: SEC 10-Q/K metric + narrative signals for that period, plus 8-K earnings signals when present. - Comparison: for each guidance item, when it can be recomputed from the receipts on its OWN basis (GAAP vs non-GAAP matched, units aligned, period settled) — a neutral `range_position` (above | within | below the guided band) + signed `delta`. Otherwise a typed `status` says why NOT (no_actual_on_basis / not_yet_settled / value_unparsed / period_unresolved / value_incongruent) — never a false or guessed verdict. A non-GAAP guide is never compared to a GAAP actual. - Notes: calls/filings covered + comparison statuses, so you know coverage depth before interpreting. Not point-in-time: the join uses everything stored today; for as-of work use a tool that takes `vantage_date` (e.g. get_earnings, get_financials).

  ConnectorAPI key

• get_ir_documentsA

  MetricDuck — Financial AnalysisA

  Retrieve IR earnings-PRESENTATION-DECK text — forward guidance, operational KPIs, and segment outlook that are ONLY in the company's investor-relations slide deck and NOT in the SEC 8-K/10-Q release text or XBRL. Reach for this when get_metric_history / get_xbrl_facts have no series for a KPI or guidance figure, or the 8-K earnings release from get_filing_section lacks it (decks are a separate source): production or revenue guidance ranges, segment/division outlook, KPIs shown as slide charts (e.g., berth capacity %, Mboed production guidance, adjusted-EBITDA guidance). Use Cases: - "OXY Q3 2024 production guidance" -> get_ir_documents("OXY", fiscal_year=2024, fiscal_period="Q3", query="production guidance") - "NCLH berth capacity outlook" -> get_ir_documents("NCLH", fiscal_year=2021, fiscal_period="Q3", query="berth") - "KNTK adjusted EBITDA guidance range" -> get_ir_documents("KNTK", fiscal_year=2023, fiscal_period="Q3", query="EBITDA") Each deck returns its title, original IR url, a stable MetricDuck-hosted gcs_uri, and the matching slide text cited by page. Pass a `query` to land on the exact page; omit it for a bounded prefix of the latest deck. Resolve by ticker or cik; narrow with fiscal_year/fiscal_period.

  ConnectorAPI key

• fetch_qencode_docA

  qencodeA

  Read the full content of a Qencode knowledge-base resource by URI. Works for every URI returned by `search_qencode_docs` — recipes, best practices, storage, gotchas, error codes, and the schema digest. Call this after `search_qencode_docs` (or with a known `qencode://...` URI) whenever you need the full markdown or JSON of a recipe or reference doc. Args: uri: a `qencode://...` URI from a `search_qencode_docs` hit. Examples: - qencode://recipe/hls_abr - qencode://docs/best-practices - qencode://docs/storage - qencode://docs/error-codes - qencode://schema/digest Returns: A dict with `uri`, `mime_type`, and `content` (the full markdown or JSON, depending on the doc). On unknown URI, returns `{"error": "...", "available_uris": [...]}` listing the URIs you can try instead.

  ConnectorOAuth

• run_checksA

  NovenceA

  Start a Lighthouse, a11y, and link check cycle on the latest deployment. Does not publish a new deploy — use deploy for that. Then poll get_checks_results (not get_deployment_status) until scores appear. Unverified accounts skip checks on deploy; this still queues a cycle when allowed.

  ConnectorNo auth

• load_skillA

  FormstepA

  Load a domain-knowledge skill — themes, settings, analytics, logic-rules, editing-flows, question-types, etc. Returns markdown reference content. Use when the task touches a domain whose conventions or constraints are not obvious from the surrounding tools. For loading additional MCP tool catalogs (deferred tools by bundle name) use `load_tools` instead. Available skills: - toon-format: TOON format reference for reading and parsing form document structure - question-types: All question types with parameters, validation, and when to use each - logic-rules: Conditional logic conditions, actions, patterns, and examples - editing-flows: Editing workflows, node chaining, batch operations, and best practices - form-best-practices: Form design best practices for question design, ordering, and type selection. - analytics: Form analytics interpretation, metrics, and actionable insights - form-settings: Form configuration options, security, notifications, email customization, and data retention - form-themes: Form visual theming system — schema, constraints, design guidelines, and examples - requests: Requests: asking named people to fill a form — field keys, prefill shapes, building the form in the same call, delivery, callbacks, polling

  ConnectorOAuth

• check_package_provenanceA

  NPMScanA

  Checks whether a package version was published with npm's own Sigstore-backed publish provenance (`npm publish --provenance`), and cross-checks that provenance against reality rather than just reporting its presence. Three checks: (1) parses the SLSA build attestation (declared source repo, commit, builder identity, GitHub Actions run URL) and flags a builder that isn't GitHub-hosted, or an attested source repo that doesn't match package.json's own `repository` field; (2) when this version LACKS provenance, checks whether most peer packages (same npm scope, or same maintainer for an unscoped name) DO have it — a package that's the odd one out in an org that otherwise always publishes from CI is a real anomaly, not proof of malice; (3) fetches package.json from the source repository at the exact attested commit (or a best-effort matching git tag when no provenance/commit is available) and diffs its install-lifecycle scripts (preinstall/install/postinstall/prepare) and dependency names against what's actually in the published tarball — this is the single highest-signal check here, since a script or dependency that exists on npm but was never committed is exactly the pattern of a stolen-npm-token publish that bypasses CI (the event-stream/ua-parser-js incident shape). This is a heuristic, structural check: it does NOT cryptographically re-verify the Sigstore bundle (Fulcio cert chain, Rekor inclusion proof) — it trusts that npm's registry already refused to accept a publish that failed that verification, and checks the CONTENT of what the registry reports instead. Most packages don't use --provenance yet, so its bare absence is never scored on its own — only an org-norm anomaly or an actual source mismatch is. Use get_package/get_package_version first for basic package info; use this specifically to assess publish-integrity risk.

  ConnectorNo auth

• check_package_provenanceA

  NPMScanA

  Checks whether a package version was published with npm's own Sigstore-backed publish provenance (`npm publish --provenance`), and cross-checks that provenance against reality rather than just reporting its presence. Three checks: (1) parses the SLSA build attestation (declared source repo, commit, builder identity, GitHub Actions run URL) and flags a builder that isn't GitHub-hosted, or an attested source repo that doesn't match package.json's own `repository` field; (2) when this version LACKS provenance, checks whether most peer packages (same npm scope, or same maintainer for an unscoped name) DO have it — a package that's the odd one out in an org that otherwise always publishes from CI is a real anomaly, not proof of malice; (3) fetches package.json from the source repository at the exact attested commit (or a best-effort matching git tag when no provenance/commit is available) and diffs its install-lifecycle scripts (preinstall/install/postinstall/prepare) and dependency names against what's actually in the published tarball — this is the single highest-signal check here, since a script or dependency that exists on npm but was never committed is exactly the pattern of a stolen-npm-token publish that bypasses CI (the event-stream/ua-parser-js incident shape). This is a heuristic, structural check: it does NOT cryptographically re-verify the Sigstore bundle (Fulcio cert chain, Rekor inclusion proof) — it trusts that npm's registry already refused to accept a publish that failed that verification, and checks the CONTENT of what the registry reports instead. Most packages don't use --provenance yet, so its bare absence is never scored on its own — only an org-norm anomaly or an actual source mismatch is. Use get_package/get_package_version first for basic package info; use this specifically to assess publish-integrity risk.

  ConnectorNo auth

• package_infoA

  A.U.G.U.R Synapse · Web & ResearchA

  Any npm, PyPI or crates.io package: latest version and release date, license, downloads, maintainers, repo, dependency count, deprecation — to pick or vet a dependency. Straight from each registry (plus npm and pypistats download counts). Flags deprecated packages and ones with no release in 2+ years. When to use: For package metadata; for known vulnerabilities in a version use vuln_check (on the A.U.G.U.R Foresight · Wallets & Risk server, https://augur-trade.com/hub/mcp/risk). Price: $0.001 per call (10 free/day; after that a payment-required result lists x402 options). Errors: returns isError with a message for invalid input or an upstream failure (not charged).

  ConnectorNo auth

• validate_stackA

  AnkraB

  Validate a stack specification against the cluster without creating or deploying anything: replays the same validation the create lane runs (duplicate stack name, member shape, chart and dependency checks) and reports the errors. The stack object uses the same shape as create_stack, including the parents dependency edges. Returns {valid, errors}, plus a dependency_review whenever a multi-member specification declares no parents at all - those members would deploy in parallel and race each other. Use this before create_stack, and add the missing parents before deploying. Read-only.

  ConnectorOAuth

• pypiA

  Agent Data ToolsA

  Latest version, summary, licence, required Python version, home page, release date and number of releases of a Python package on PyPI. Use to check a dependency before installing it. Example: package=requests. Price $0.01/call via x402 USDC or a card key (/credits), first 25 free; failed calls free. Reads or computes only and changes nothing; each call is charged, so repeats are not free.

  ConnectorNo auth

• pypiA

  Agent Data Tools: Everyday dataA

  Latest version, summary, licence, required Python version, home page, release date and number of releases of a Python package on PyPI. Use to check a dependency before installing it. Example: package=requests. Price $0.01/call via x402 USDC or a card key (/credits), first 25 free; failed calls free. Reads or computes only and changes nothing; each call is charged, so repeats are not free.

  ConnectorNo auth

• pypiA

  Agent Data Tools: Everyday dataA

  Latest version, summary, licence, required Python version, home page, release date and number of releases of a Python package on PyPI. Use to check a dependency before installing it. Example: package=requests. Price $0.01/call via x402 USDC or a card key (/credits), first 25 free; failed calls free. Reads or computes only and changes nothing; each call is charged, so repeats are not free.

  ConnectorNo auth

• pagespeed_auditA

  Pagespeed InsightsA

  Run Google's PageSpeed Insights (Lighthouse) against any public URL and get back the performance, accessibility, best-practices and SEO scores, the lab timing metrics behind them, and the RANKED list of specific fixes with the milliseconds or bytes each one would save — render-blocking resources, unused JavaScript and CSS, unoptimised images, missing text compression. AUTHORITATIVE for "why is this page slow and what do I fix first": this is Google's own analyser running the page on Google's infrastructure, which is what no amount of reading a site's HTML can substitute for. Works on any public site, including a competitor's. A call takes 10-40 seconds because the page is genuinely loaded.

  ConnectorNo auth

• package_infoA

  A.U.G.U.R Foresight · Web & ResearchA

  Any npm, PyPI or crates.io package: latest version and release date, license, downloads, maintainers, repo, dependency count, deprecation — to pick or vet a dependency. Straight from each registry (plus npm and pypistats download counts). Flags deprecated packages and ones with no release in 2+ years. When to use: For package metadata; for known vulnerabilities in a version use vuln_check (on the A.U.G.U.R Foresight · Wallets & Risk server, https://augur-trade.com/hub/mcp/risk). Price: $0.001 per call (10 free/day; after that a payment-required result lists x402 options). Errors: returns isError with a message for invalid input or an upstream failure (not charged).

  ConnectorNo auth

• list_themesA

  Charts by SzumA

  Use this when choosing a visual theme for a chart. Returns every built-in theme with guidance on where each works best and, when signed in, the workspace's shared themes.

  ConnectorNo auth

• list_themesA

  szumA

  Use this when choosing a visual theme for a chart. Returns every built-in theme with guidance on where each works best and, when signed in, the workspace's shared themes.

  ConnectorNo auth

• plan_change_verificationA

  Reality Graph Verification ToolsA

  Turn explicit change characteristics into a risk tier, required automated checks, manual scenarios, evidence, release blockers, role handoff, and canonical Reality Graph guidance. Use before implementation or review. It does not inspect code and never invents a confidence score.

  ConnectorNo auth

• evaluate_dependency_changeA

  RepoPilotA

  CALL immediately before adding or upgrading an npm dependency. Answers "is this exact version safe to take on" from registry metadata, advisory deltas (for the version itself and for every package in the dependency tree a fresh install resolves to), provenance, license, and repository evidence, and returns blockers, warnings, a recommendation, and a verification plan. Example: {"dependency":"lodash","to_version":"4.17.21"} — every field is top-level, never nested under a "change" key. Only `dependency` is required — omit to_version to evaluate the latest published version, exactly as `npm install <pkg>` would. to_version also accepts a dist-tag ("latest") or a SemVer range ("^4.17.0"); it resolves to one exact version, reported back in change.to_version. Everything RepoPilot can infer is inferred, and every default, repair, and resolution is listed in input_adjustments. Evaluates only; never installs or edits anything.

  ConnectorNo auth