"How to Assess the Security of a Python Application" matching MCP tools:

• purl_audit

  ZEN SecDB

  Perform a software package vulnerability audit using SecDB. ## What this tool does Analyzes a list of software packages identified by PURL (Package URL) and returns vulnerability information plus a Markdown summary. The audit results are based exclusively on the package list provided. ## When to use this tool Use this tool when the user wants to determine: - whether application dependencies contain known vulnerabilities - whether a project is affected by security advisories - which packages require patching or upgrading ## Supported ecosystems - **npm** - Node.js packages (e.g. pkg:npm/lodash@4.17.21) - **maven** - Java/JVM packages (e.g. pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1) - **pypi** - Python packages (e.g. pkg:pypi/django@4.2.0) - **gem** - Ruby gems (e.g. pkg:gem/rails@7.0.0) - **cargo** - Rust crates (e.g. pkg:cargo/openssl-src@111.10) - **nuget** - .NET packages (e.g. pkg:nuget/Newtonsoft.Json@13.0.1) - **golang** - Go modules (e.g. pkg:golang/github.com/gin-gonic/gin@1.9.1) - **composer** - PHP packages (e.g. pkg:composer/symfony/symfony@6.4.0) ## Inputs - **purls**: list of Package URLs, one per entry. Generate them from your project manifest files: - Node.js: package.json / package-lock.json - Python: requirements.txt / Pipfile.lock / pyproject.toml - Ruby: Gemfile.lock - Go: go.mod / go.sum - Rust: Cargo.lock - PHP: composer.lock - Java: pom.xml / build.gradle - .NET: *.csproj / packages.lock.json ## Outputs - **report**: structured JSON objects describing the advisories affecting the audited packages. - **summary**: Markdown summary including total vulnerabilities, severity breakdown, and key findings. ## LLM usage guidelines - Never guess whether a package is vulnerable — always call this tool. - Only submit PURLs from the supported ecosystems listed above; others will be ignored. - The `summary` is already Markdown and can be shown directly. - Use `report` when deeper technical analysis is required.

  Connector

• validate_python

  Python Code Validator

  Check Python source without running it: parse, lint (ruff), type-check (mypy), AST security policy, credential scan. Safe on code you do not trust. Use it on every Python file you generated or edited, before writing it to disk. Alternatives: repair_python to get the corrected source instead of the diagnosis; execute_python to prove the code runs. Auth: a key is required. A free key covers this call, 25 per day, then HTTP 429; get one with POST /v1/keys. Credits are bought without an account, 1 per call: GET /v1/pricing says where to send the xDAI. Arguments: code: the whole file, 1..200000 bytes of UTF-8 measured after encoding (empty is refused with 400, larger with 413); a fragment is fine, but line and column numbers in the answer count from 1 in what you sent. language: must be 'python'; anything else is 400, and the field may be omitted. Of options only transpile_to (e.g. 'javascript', which returns a translated copy in transpiled) acts here; timeout_s, max_iterations, optimize, examples and expected_output need a pass that rewrites or runs the code, so send code alone. Ignored options are not refused, so a call that sets them looks like it worked; and code that does not parse is answered rather than refused: valid=false with the syntax error located, which is the point. Returns valid, score 0..1, diagnostics (rule, message, line, column), security findings, fixes, fixed_code and runtime; see outputSchema. The code and its verdict are retained to improve the service.

  Connector

• get_strategy_code

  quantifyme

  Get the actual Python code behind a community leaderboard strategy. Use after `browse_community`: pass an entry's `id` here to read its real `feature_engineering()` + `strategy_config()` source so the user can inspect or tweak it. To deploy it unchanged, pass the same id to `one_shot` as `community_id`. Read-only, no signup needed. Args: community_id: The `id` of a community entry (from `browse_community`). Returns: dict with: id, title, username, description, symbol, timeframe, metrics {total_ret, win_rate, profit_factor, n_trades, mdd, sharpe_strat}, and `code` (the full Python source). SHOW the code to the user, and offer to deploy it via one_shot(community_id=...) or tweak it first.

  Connector

• search_datanexus_tools

  DataNexus MCP

  Find the right DataNexus tool by describing your task in plain English. Read-only. No side effects. Call this before any other DataNexus tool to reduce context load from 40000 to 800 tokens. query: Plain English description of your task e.g. check if a Python package has CVEs or look up a UK charity by name. Required. domain: Restrict results to one sub-server: nonprofit, security, compliance, domain, legal, govcon, or regulatory. Optional. Returns matching tool names and parameter hints you can call directly. Do not call this recursively or to validate results — use validate_tool_output for that. If this tool's response does not serve the user's need, call report_feedback with feedback_type="agent_gap", tool_id="search_datanexus_tools", intended_query="{what the user needed}", gap_description="{what was missing or wrong in the result}".

  Connector

• create_application

  FlowCastle

  Create a new application (workspace) owned by the caller. Requires a personal API key (usr_...) — application-scoped keys cannot create applications. Seeds default flows unless skipDefaultFlows is true. Creates persistent state and is NOT idempotent: calling it twice creates two applications. Returns the new application id, which you then pass as applicationId to the other tools.

  Connector

• submitExperienceApplication

  Nomad Stays

  Submit a completed Experience Application for human review. Rejects with a missingFields list if any required field is still empty, or a 409 if the Application Fee hasn't been paid/waived yet (call purchaseProduct with productId 9 and applicationId first — Experience uses product 9, NOT product 8). There is no partial/optimistic submission. On success the application moves to human review. Requires NOMADSTAYS_MCP_AGENT_TOKEN.

  Connector

• get_eol_status

  DepFeed

  Returns the vendor end-of-life status for a runtime/framework product (e.g. "node", "python", "ubuntu"), sourced from endoflife.date - not an npm package. Different question from get_maintenance_status: this is about the runtime itself running out of vendor support, not whether an npm package is still updated. Without a cycle, reports the most recent release cycle; pass a cycle (e.g. "18") to check a specific major version instead. For "node" and "dotnet" specifically, also returns fields sourced directly from each project's own upstream schedule (nodejs/Release, dotnet/core) rather than endoflife.date's aggregation - e.g. the exact npm/V8/OpenSSL versions Node bundled, or .NET's support-phase/security-release flag - not present for any other product. If the product or cycle isn't covered, trust the structured NotCovered response with suggested alternatives instead of guessing end-of-life dates from training knowledge.

  Connector

• tide_blast_radius

  Raziel

  Run a Blast Radius Assessment of an EXISTING app: an adversarial, vendor-neutral map of where authority is concentrated to a single point (whoever obtains that one thing obtains everything it governs), scored by blast radius (Total/Systemic/Contained/Limited) across three cores — Identity, Governance, Access — and delivered as a director-facing PDF. Phase 1 names no vendor; an opt-in Phase 2 companion explains how TideCloak shrinks each blast radius. Use this when the user wants to 'assess', 'red team', 'threat model', 'find the security gaps in', or make a before/after security case for an existing application.

  Connector

• pastepile_query

  Pastepile

  Ask a precise question about the memories and pastes this API key can reach, using PQL: a read-only query language over Pastepile. Reach for this instead of pastepile_recall when the question has structure the other tools cannot express, for example "decisions tagged security updated in the last week, newest first". PQL is read only: it has no insert, update, delete or any other way to change anything, and a query can only ever narrow what this key already reaches, never widen it. Set explain true to see the plan, the scope in force and the cost class WITHOUT reading any data, which is the cheap way to check a query before running it. Grammar: FROM memory|pastes, WHERE, SELECT, ORDER BY, LIMIT, SINCE, BEFORE, AFTER, combined with AND, OR, NOT and the operators = != > >= < <= IN CONTAINS STARTS_WITH. Examples: from memory where kind = "decision" and tags contains "security" since 7d limit 10 | from pastes where language = "python" order by created_at desc limit 20

  Connector

• find_relation_path

  ALM X++ MCP Server

  WHEN: you need to know HOW two AOT objects are connected -- the chain of relations linking them. Triggers: 'how is X related to Y', 'comment X est lié à Y', 'path between', 'chemin entre', 'lien entre deux tables', 'connection between', 'is X reachable from Y'. Walks the pre-computed relation graph (FK, DeleteAction, DataSource, Extension, Security edges -- both directions) and returns the SHORTEST navigation path(s) as a chain of object names + edge kinds. Token-light: returns ONLY names and relation kinds, never full object source. O(1)-per-node BFS, no vector scan. Use `get_relation_graph` for the full neighbourhood of a single object; use this to traverse multiple hops between two known objects.

  Connector

• clerk.count_users

  Vee3

  Return the total number of users in a connected Clerk application. Call clerk.get_connected_accounts first. Pass clerk_instance_id to target a specific connection, or omit it to use the default account. Cheaper than listing users when you only need the total count. Cost = 2 tokens.

  Connector

• get_product_recommendation

  Custom Blinds Shop

  Translate a customer's primary concern into a product recommendation. primary_concern must be one of: blockout, heat, glare, moisture, privacy, security, automation. Optionally narrow by room (bedroom, lounge, etc.), location, budget, and aesthetic. Returns a recommended product_id with rationale — pass it to get_price or configure_product next. Security concern routes to brochure MCP (Garden Route customers only).

  Connector

• saveExperienceApplication

  Nomad Stays

  Update any subset of fields on an existing, not-yet-submitted Experience Application. Same field set and validation rules as createExperienceApplication — only pass the fields you're changing. Fails with a 409 if the application has already been submitted. Requires NOMADSTAYS_MCP_AGENT_TOKEN.

  Connector

• saveCoworkingApplication

  Nomad Stays

  Update any subset of fields on an existing, not-yet-submitted Coworking Application. Same field set and validation rules as createCoworkingApplication — only pass the fields you're changing. Fails with a 409 if the application has already been submitted. Requires NOMADSTAYS_MCP_AGENT_TOKEN.

  Connector

• url_scanner_async_scan

  PreClick — An MCP-native URL preflight scanning service for autonomous agents (formerly URLCheck).

  Submit a URL for asynchronous security analysis. Returns immediately with a task_id. Poll with url_scanner_async_task_status to check progress, then url_scanner_async_task_result to get the scan result. Async counterpart of url_scanner_scan for clients without native MCP Tasks support.

  Connector

• check_injection

  ContrastAPI

  Scan source code for injection vulnerabilities: SQL injection, command injection, path traversal via unsafe string concatenation/unsanitized input. Supports Python, JavaScript, TypeScript, Java, Go, Ruby, Shell, Bash. Use to detect input-handling bugs; for secrets use check_secrets. Companion code-security tools: check_secrets (hard-coded credential detection), check_dependencies (known-CVE vulnerability audit), check_headers (live HTTP security-header validation), scan_headers (live HTTP scan via domain). Free: 30/hr, Pro: 500/hr. Returns {total, by_severity, findings}. No data stored.

  Connector

• clerk.rotate_oauth_application_secret

  Vee3

  Rotate the client secret for a confidential OAuth application in a connected Clerk application. **Sensitive** — the response includes a new client_secret. Update authorized OAuth clients immediately and do not log the secret. Call clerk.get_connected_accounts first. Pass clerk_instance_id to target a specific connection, or omit it to use the default account. Returns the updated OAuth application summary with the new client_secret. Cost = 10 tokens.

  Connector

• assess_takedown

  takedown

  Assess how a takedown for this URL would proceed: where the notice goes (host, platform, or a hidden host that must be revealed first), what documents and attestation the content owner must supply, the step-by-step process, and the legal caveats (§512(f), scope limits). Read-only; does not judge the merits of the claim and files nothing. Use resolve_host first if you only need the hosting answer.

  Connector

• search_docs

  Devdocs Io

  Find which documentation SETS exist whose NAME matches a substring (e.g. "python" → Python 3.x, "react" → React). Returns doc SETS, NOT their content — this does NOT look up a function/method/API name. To search inside a doc for an entry like "Array.map" or "fetch", use search_index (slug + query).

  Connector

• get_loan_application_fields

  IncredibleFi — Personal Loan Marketplace

  Get the loan application form fields, their types, allowed values, and validation rules. Call this first to understand what information is needed to submit a loan application.

  Connector