"How to run Python code" matching MCP tools:

• dossier_full

  drwho.me developer tools

  Aggregate dossier check: Run all 10 Domain Dossier checks — dns, mx, spf, dmarc, dkim, tls, redirects, headers, cors, web-surface — in parallel and return all results in a single response. Use when you need a comprehensive domain health snapshot in one call; counts as ONE paywall call regardless of how many checks run. For a single focused check, prefer the individual dossier_* tools to minimise latency. Fires all 10 checks concurrently via Cloudflare DoH or direct HTTPS, 5 s per-check timeout. Returns a JSON object keyed by check id (dns, mx, etc.), each value a CheckResult discriminated union ({status:"ok",...} or {status:"error", reason}).

  Connector

• setup_instructions

  Coal — Payments for AI agents

  Print step-by-step instructions for using Coal MCP from Claude / Cursor / any MCP client. Run this FIRST if you are unsure how to authenticate or which credentials to provide.

  Connector

• atc_lookup

  Medical Terminologies MCP

  Look up an ATC code at level 1-4 to get its name and hierarchy level. Use this tool to: - Resolve an ATC code (e.g., "A10BA") to its class name ("Biguanides") - Confirm a code exists in the current ATC index - Identify the level (anatomical / therapeutic / pharmacological / chemical) Accepts codes 1-5 characters long: "A" (anatomical), "A10" (therapeutic), "A10B" (pharmacological), "A10BA" (chemical). Substance-level codes (7 chars, e.g., "A10BA02") are not exposed by this endpoint — use atc_classify with the drug name to retrieve the substance code.

  Connector

• get_strategy_code

  quantifyme

  Get the actual Python code behind a community leaderboard strategy. Use after `browse_community`: pass an entry's `id` here to read its real `feature_engineering()` + `strategy_config()` source so the user can inspect or tweak it. To deploy it unchanged, pass the same id to `one_shot` as `community_id`. Read-only, no signup needed. Args: community_id: The `id` of a community entry (from `browse_community`). Returns: dict with: id, title, username, description, symbol, timeframe, metrics {total_ret, win_rate, profit_factor, n_trades, mdd, sharpe_strat}, and `code` (the full Python source). SHOW the code to the user, and offer to deploy it via one_shot(community_id=...) or tweak it first.

  Connector

• architect.certify

  AI Design Blueprint

  Pro/Teams — second-pass adversarial certification of an architect.validate run that scored production_ready (A or B first-pass tier). ON CLIENT TIMEOUT — DO NOT RETRY THIS TOOL. **RECOVERY FIRST**: the run_id is emitted in the FIRST notifications/progress event at t=0s (BEFORE the LLM call begins). Capture it. On timeout, call `me.validation_history(run_id='<that-id>')` to fetch the persisted cert verdict; the server-side run completes independently within a 20-minute budget. This is the canonical recovery path. Use it before considering any retry. Long-running LLM call (60-180s typical; exceeds Claude Code's ~60s idle budget); MCP clients commonly close the call before the server returns. Retrying re-runs the LLM call AND burns one of your 3 cert retry-budget attempts. Mints the certified production_ready badge when both reviewers sign off; caps the run to C/emerging when the second pass surfaces a missed production_blocker. MANDATORY DOCTRINE RULE (load-bearing): the badge certifies the EXACT code that produced the validate run_id, NOT 'this codebase' in general. If you modify, fix, or iterate the code between architect.validate and architect.certify — even a single character — cert rejects with code_fingerprint_mismatch. Fixing the code voids the run. The recovery path is always: edit code → architect.validate → fresh run_id → architect.certify on the fresh run. Do NOT cert from a stale run_id after iteration; ask the user to re-validate first. WHEN TO CALL: only after architect.validate returned tier=production_ready AND the user wants the certified badge AND the code has not been touched since the validate run. NOT for tier=draft/emerging/not_applicable runs (typed rejections fire — see below). NOT idempotent across attempts: each call is one of the 3 attempts in the retry budget. BEHAVIOR: atomic one-shot single LLM call, ~60-180s server-side at high reasoning effort (small payloads finish faster; observed p99 ~250s; server-side budget is 20 min, ~5× observed max). Exceeds typical MCP-client tool-call idle budget (~60s in Claude Code), so the FIRST notifications/progress event fires at t=0 carrying the run_id. The run is atomic by contract — no in_progress lifecycle, no cancellation, no resume. Updates the persisted run's result_json (public review URL + me.validation_history(run_id=...) reflect the cert outcome). ELIGIBILITY GATE (typed rejection enum on failure): caller must own the run, tier=production_ready, less than 24h old, not already certified, within cert retry budget (max 3 attempts), no other cert call in flight for the same run_id, code fingerprint must match the validated code, AND the submitted payload must be cert-payload-complete (see Payload Completeness below — cert rejects pre-LLM with `payload_incomplete` when an imported module's surface isn't visible in the validate payload that produced this run_id). Rejection reasons (typed Literal): auth_required, paid_plan_required, run_not_found, not_run_owner, not_eligible_tier, not_agentic_component (tier=not_applicable runs), already_certified, certification_age_exceeded, retry_budget_exhausted, code_fingerprint_mismatch, code_fingerprint_missing, code_not_on_file (caller omitted `code` argument AND the 24h cert-retry hold for this run has expired or was never written. Recovery: re-run architect.certify from the same MCP session that ran architect.validate, passing the code explicitly — the server never persists code by design), payload_incomplete (submitted/validated payload imports modules whose contents aren't visible — cert refuses pre-LLM to prevent a false-precision downgrade. Recovery: re-validate with verbatim public-surface stubs for every imported module, then re-cert on the fresh run_id. Empirically validated: PR #157 iter8/iter9 cert rejections were exactly this class — code on disk was correct, the submitted payload merely omitted module visibility), cert_consensus_score_below_threshold (consensus_median<75 — consensus runs only), cert_consensus_unstable_blocker (any principle mode_stability<80% — consensus runs only), run_state_corrupt, cert_persistence_failed, cert_in_flight (a prior architect.certify call on this run_id is still running. Poll me.validation_history for the verdict; do not retry until it resolves). PAYLOAD COMPLETENESS (load-bearing for cert eligibility): the cert reviewer reads the EXACT payload that produced the validate run_id. Imported modules whose surface isn't present in the payload cause pre-LLM `payload_incomplete` refusal. Avoidance — when validating with intent to cert, bundle public-surface stubs for every imported module: `from sqlalchemy.exc import SQLAlchemyError` → include a stub class; `from app.db import models` → include a `class models:` namespace stub with the columns/methods you reference; module-level imports of `dataclass`, `Literal`, `json`, `datetime`, `timezone` MUST also be in the payload (cert correctly catches when they're omitted — code would NameError on import). 'Submit Like Production': the payload should be the code as it would actually run, not a compressed sketch. The stubs cover IMPORTED dependencies only; the certified code's own enforcement branches (approval gates, policy checks, recovery paths) must be present in full. A `# ...` placeholder reads as an ABSENT control and is graded against you, not as shorthand for one that exists. PRE-LLM REJECTION AUDIT TRAIL: when cert rejects before the LLM call (payload_incomplete, code_fingerprint_mismatch, etc.), `certification_attempts=[]` on the response — no attempt landed in the retry budget, no LLM hop occurred. The rejection envelope's `rejection_reason` + `guidance` are the actionable surface. (Audit-trail UI surfacing of pre-LLM rejections is tracked in the platform self-audit set as anomaly #5; out of scope for the cert tool itself.) INPUTS: re-send the SAME code that produced the run_id (the architect persists findings + recommendations, never code, by design — privacy-preserving). Server compares the submitted code's SHA-256 fingerprint to the stored fingerprint and rejects mismatches. Auth: Bearer <token>, Pro or Teams plan required. UK/EU data residency (Cloud Run europe-west2). Code processed transiently by OpenAI (no-training-on-API-data) and dropped; payloads JSON-escaped + delimited as inert untrusted data — prompt-injection inside code is ignored. If the cert call fails outright (provider error, persistence error), a fresh architect.certify is the recovery path; the eligibility gate enforces the 3-attempt retry budget. For long-running cert workflows the answer is to re-validate, not to make this tool stateful. OUTCOMES: certification_status ∈ {confirmed_production_ready (badge mints), downgraded_to_emerging (cert review surfaced a missed production_blocker, tier capped at C/emerging), unavailable_provider_error (LLM call failed, retry within budget)}. Cert findings + summary + attempt history surfaced on the persisted run for full inspectability.

  Connector

• aws___search_documentation

  AWS Knowledge

  # AWS Documentation Search Tool Use this tool to find relevant AWS documentation — always follow up with `read_documentation` to get complete answers. Prefer this over general knowledge for AWS services, features, configurations, troubleshooting, and best practices. ## When to Use This Tool **Always search when the query involves:** - Any AWS service or feature (Lambda, S3, EC2, RDS, etc.) - AWS architecture, patterns, or best practices - AWS CLI, SDK, or API usage - AWS CDK or CloudFormation - AWS Amplify development - AWS errors or troubleshooting - AWS pricing, limits, or quotas - Strands Agents development - "How do I..." questions about AWS - Recent AWS updates or announcements **Only skip this tool when:** - Query is about non-AWS technologies - Question is purely conceptual (e.g., "What is a database?") - General programming questions unrelated to AWS ## Skill Suggestions for Actionable Queries When your search query matches tasks that benefit from domain-specific expertise, this tool will suggest relevant **Agent Skills**. Skills package domain knowledge, workflows, best practices, decision frameworks, and reference materials that make you a specialist in a particular AWS domain. **How it works:** - Your search query is scored against the skills registry using semantic search over skill descriptions and metadata tags - If your query matches a skill's domain, relevant skills are returned alongside documentation results - Skills cover a wide range of domains: deployment, troubleshooting, security, optimization, architecture, and more - To load a suggested skill, use the `retrieve_skill` tool with the `skill_name` - Once loaded, follow the skill's workflows and retrieve any referenced files as needed **Example queries that may return skills:** - "deploy a web application to AWS" — may return a deployment skill with architecture guidance and step-by-step deployment instructions - "debug Lambda cold start issues" — may return a troubleshooting skill with diagnostic workflows - "secure S3 buckets" — may return a security skill with best practices and compliance checklists - "optimize API Gateway latency" — may return a performance skill with decision frameworks - "set up VPC peering" — may return a networking skill with step-by-step procedures ## Quick Topic Selection | Query Type | Use Topic | Example | |------------|-----------|-------| | API/SDK/CLI code | `reference_documentation` | "S3 PutObject boto3", "Lambda invoke API" | | New features, releases | `current_awareness` | "Lambda new features 2024", "what's new in ECS" | | Errors, debugging | `troubleshooting` | "AccessDenied S3", "Lambda timeout error" | | Amplify apps | `amplify_docs` | "Amplify Auth React", "Amplify Storage Flutter" | | CDK concepts, APIs, CLI | `cdk_docs` | "CDK stack props Python", "cdk deploy command" | | CDK code samples, patterns | `cdk_constructs` | "serverless API CDK", "Lambda function example TypeScript" | | CloudFormation templates | `cloudformation` | "DynamoDB CloudFormation", "StackSets template" | | Architecture, blogs, guides | `general` | "Lambda best practices", "S3 architecture patterns" | | Strands Agents | `strands_docs` | "Strands Agents Python structured output", "Strands Agents AWS CDK EC2 Deployment Example" | | Domain expertise, workflows, guided procedures | `agent_skills` | "deploy serverless app", "debug Lambda cold starts", "secure IAM policies" | ## Documentation Topics ### reference_documentation **For: API methods, SDK code, CLI commands, technical specifications** Use for: - SDK method signatures: "boto3 S3 upload_file parameters" - CLI commands: "aws ec2 describe-instances syntax" - API references: "Lambda InvokeFunction API" - Service configuration: "RDS parameter groups" Don't confuse with general—use this for specific technical implementation. ### current_awareness **For: New features, announcements, "what's new", release dates** Use for: - "New Lambda features" - "When was EventBridge Scheduler released" - "Latest S3 updates" - "Is feature X available yet" Keywords: new, recent, latest, announced, released, launch, available ### troubleshooting **For: Error messages, debugging, problems, "not working"** Use for: - Error codes: "InvalidParameterValue", "AccessDenied" - Problems: "Lambda function timing out" - Debug scenarios: "S3 bucket policy not working" - "How to fix..." queries Keywords: error, failed, issue, problem, not working, how to fix, how to resolve ### amplify_docs **For: Frontend/mobile apps with Amplify framework** Always include framework: React, Next.js, Angular, Vue, JavaScript, React Native, Flutter, Android, Swift Examples: - "Amplify authentication React" - "Amplify GraphQL API Next.js" - "Amplify Storage Flutter setup" ### cdk_docs **For: CDK concepts, API references, CLI commands, getting started** Use for CDK questions like: - "How to get started with CDK" - "CDK stack construct TypeScript" - "cdk deploy command options" - "CDK best practices Python" - "What are CDK constructs" Include language: Python, TypeScript, Java, C#, Go **Common mistake**: Using general knowledge instead of searching for CDK concepts and guides. Always search for CDK questions! ### cdk_constructs **For: CDK code examples, patterns, L3 constructs, sample implementations** Use for: - Working code: "Lambda function CDK Python example" - Patterns: "API Gateway Lambda CDK pattern" - Sample apps: "Serverless application CDK TypeScript" - L3 constructs: "ECS service construct" Include language: Python, TypeScript, Java, C#, Go ### cloudformation **For: CloudFormation templates, concepts, SAM patterns** Use for: - "CloudFormation StackSets" - "DynamoDB table template" - "SAM API Gateway Lambda" - "CloudFormation template examples" ### strands_docs **For: Strands Agents API reference, integrations, model providers, session managers, tools, examples, user-guide** Use for: - "Strands Agents Python SDK example" - "Strands Agents AWS integration" - "Strands Agents community contributions" - "Strands Agents usage examples" - "Strands Agents usage guide" ### general **For: Architecture, best practices, tutorials, blog posts, design patterns** Use for: - Architecture patterns: "Serverless architecture AWS" - Best practices: "S3 security best practices" - Design guidance: "Multi-region architecture" - Getting started: "Building data lakes on AWS" - Tutorials and blog posts **Common mistake**: Not using this for AWS conceptual and architectural questions. Always search for AWS best practices and patterns! **Don't use general knowledge for AWS topics—search instead!** ### agent_skills **For: Discovering agent skills — domain-specific expertise packages for AWS workflows** Use for: - Complex tasks that benefit from guided workflows: "deploy a serverless application" - Troubleshooting scenarios: "debug Lambda cold starts", "resolve ECS task failures" - Security and compliance: "secure S3 buckets", "review IAM policies for least privilege" - Architecture and optimization: "optimize API Gateway latency", "design multi-region architecture" - When you need domain expertise beyond what documentation provides Skills go beyond documentation — they provide workflows, decision frameworks, best practices, and may include embedded procedures for critical sub-tasks. **Important**: This topic is meant for discovery. Once you identify the skill you need, use `retrieve_skill` tool with the `skill_name` to load the full skill and its reference materials. **Note**: If combined with other topics, skills will be mixed into the documentation results. Use `agent_skills` alone for a clean skill-only listing. ## Search Best Practices **Be specific with service names:** Good examples: ``` "S3 bucket versioning configuration" "Lambda environment variables Python SDK" "DynamoDB GSI query patterns" ``` Bad examples: ``` "versioning" (too vague) "environment variables" (missing context) ``` **Include framework/language:** ``` "Amplify authentication React" "CDK Lambda function TypeScript" "boto3 S3 client Python" ``` **Use exact error messages:** ``` "AccessDenied error S3 GetObject" "InvalidParameterValue Lambda environment" ``` **Add temporal context for new features:** ``` "Lambda new features 2024" "recent S3 announcements" ``` **If the first search does not return results that directly answer the question, refine your query and search again with different terms, a more specific phrase, or a different topic. Try conceptual/architectural topics (general, blogs) if reference docs are too narrow.** **After searching, use `read_documentation` on the top-ranked URLs to verify and complete your answer.** ## Multiple Topic Selection You can search multiple topics simultaneously for comprehensive results: ``` # For a query about Lambda errors and new features: topics=["troubleshooting", "current_awareness"] # For CDK examples and API reference: topics=["cdk_constructs", "cdk_docs"] # For Amplify and general AWS architecture: topics=["amplify_docs", "general"] # For actionable tasks: topics=["agent_skills"] ``` ## Response Format Results include: - `rank_order`: Relevance score (lower = more relevant) - `url`: Direct documentation link — use with `read_documentation` to get the full page content - `title`: Page title - `context`: Partial excerpt only — not the complete documentation. After reviewing results, call `read_documentation` on the most relevant URLs before answering. Do not answer based on the context excerpt alone. ## Parameters ``` search_phrase: str # Required - your search query topics: List[str] # Optional - up to 3 topics. Defaults to ["general"] limit: int = 5 # Optional - max results per topic ``` --- **Remember: When in doubt about AWS, always search. This tool provides the most current, accurate AWS information. But search is only step 1 — always read the full documentation to give complete answers.**

  Connector

• ateam_redeploy

  ateam-mcp

  Re-deploy skills WITHOUT changing any definitions. ⚠️ HEAVY OPERATION: regenerates MCP servers (Python code) for every skill, pushes each to A-Team Core, restarts connectors, and verifies tool discovery. Takes 30-120s depending on skill count. Use after connector restarts, Core hiccups, or stale state. For incremental changes, prefer ateam_patch (which updates + redeploys in one step).

  Connector

• check_injection

  ContrastAPI

  Scan source code for injection vulnerabilities: SQL injection, command injection, path traversal via unsafe string concatenation/unsanitized input. Supports Python, JavaScript, TypeScript, Java, Go, Ruby, Shell, Bash. Use to detect input-handling bugs; for secrets use check_secrets. Companion code-security tools: check_secrets (hard-coded credential detection), check_dependencies (known-CVE vulnerability audit), check_headers (live HTTP security-header validation), scan_headers (live HTTP scan via domain). Free: 30/hr, Pro: 500/hr. Returns {total, by_severity, findings}. No data stored.

  Connector

• get_skill

  civilquants

  Paid tier only. Fetch a senior-QS skill methodology by slug (see list_skills) and APPLY it to the user's documents — the returned body is the system instruction for you to run the methodology on the customer's tokens; CivilQuants does not run inference. Paid callers get the full methodology; anonymous/free callers get a TIER_INSUFFICIENT upsell body; a rejected token gets an INVALID_TOKEN re-authenticate body. The document-heavy skills assume you can chunk/parse the customer's files and render a Word pack locally — that needs a code-execution client (Claude Code / Codex / VS Code) and the pack from get_document_pipeline; on a chat connector you can still read and reason with the methodology. Sign up at https://civilquants.com/pricing. Example: get_skill(skill="tender_risk_assessment").

  Connector

• tfgenerate

  InsideOut (Riley)

  WORKFLOW: Step 3 of 4 - Generate Terraform files from completed design Generate Terraform files from an InsideOut session that has completed infrastructure design. ⚠️ PREREQUISITE: Only call this AFTER convoreply returns with `terraform_ready=true` in the response metadata. DO NOT call this while convoreply is still running or before terraform_ready is confirmed! If you get 'session has not reached terraform-ready state', wait for convoreply to complete first. 🎯 USE THIS TOOL WHEN: convoreply has returned with terraform_ready=true, OR the user asks to 'see the terraforms', 'generate terraform', 'show me the code', etc. **DEFAULT RESPONSE**: Returns summary table + download URL (keeps code out of LLM context). **FALLBACK**: Set `include_code: true` to get full code inline if curl/unzip fails. **CRITICAL WORKFLOW** (default mode): 1. Call this tool to get file summary and download URL 2. ASK the user: 'Where would you like me to save the Terraform files? Default: ./insideout-infra/' 3. WAIT for user confirmation before running the download command 4. Run the curl/unzip command with the user's chosen directory 5. If curl/unzip FAILS (sandbox, security, platform issues), retry with `include_code: true` **AFTER GENERATION**: Ask user if they want to review the files and then deploy with tfdeploy REQUIRES: session_id from convoopen response (format: sess_v2_...). OPTIONAL: include_code (boolean) - set true to return full code inline as fallback. 💡 TIP: Examine workflow.usage prompt for more context on how to properly use these tools.

  Connector

• architect.certify

  AI Design Blueprint Doctrine

  Pro/Teams — second-pass adversarial certification of an architect.validate run that scored production_ready (A or B first-pass tier). ON CLIENT TIMEOUT — DO NOT RETRY THIS TOOL. **RECOVERY FIRST**: the run_id is emitted in the FIRST notifications/progress event at t=0s (BEFORE the LLM call begins). Capture it. On timeout, call `me.validation_history(run_id='<that-id>')` to fetch the persisted cert verdict; the server-side run completes independently within a 20-minute budget. This is the canonical recovery path. Use it before considering any retry. Long-running LLM call (60-180s typical; exceeds Claude Code's ~60s idle budget); MCP clients commonly close the call before the server returns. Retrying re-runs the LLM call AND burns one of your 3 cert retry-budget attempts. Mints the certified production_ready badge when both reviewers sign off; caps the run to C/emerging when the second pass surfaces a missed production_blocker. MANDATORY DOCTRINE RULE (load-bearing): the badge certifies the EXACT code that produced the validate run_id, NOT 'this codebase' in general. If you modify, fix, or iterate the code between architect.validate and architect.certify — even a single character — cert rejects with code_fingerprint_mismatch. Fixing the code voids the run. The recovery path is always: edit code → architect.validate → fresh run_id → architect.certify on the fresh run. Do NOT cert from a stale run_id after iteration; ask the user to re-validate first. WHEN TO CALL: only after architect.validate returned tier=production_ready AND the user wants the certified badge AND the code has not been touched since the validate run. NOT for tier=draft/emerging/not_applicable runs (typed rejections fire — see below). NOT idempotent across attempts: each call is one of the 3 attempts in the retry budget. BEHAVIOR: atomic one-shot single LLM call, ~60-180s server-side at high reasoning effort (small payloads finish faster; observed p99 ~250s; server-side budget is 20 min, ~5× observed max). Exceeds typical MCP-client tool-call idle budget (~60s in Claude Code), so the FIRST notifications/progress event fires at t=0 carrying the run_id. The run is atomic by contract — no in_progress lifecycle, no cancellation, no resume. Updates the persisted run's result_json (public review URL + me.validation_history(run_id=...) reflect the cert outcome). ELIGIBILITY GATE (typed rejection enum on failure): caller must own the run, tier=production_ready, less than 24h old, not already certified, within cert retry budget (max 3 attempts), no other cert call in flight for the same run_id, code fingerprint must match the validated code, AND the submitted payload must be cert-payload-complete (see Payload Completeness below — cert rejects pre-LLM with `payload_incomplete` when an imported module's surface isn't visible in the validate payload that produced this run_id). Rejection reasons (typed Literal): auth_required, paid_plan_required, run_not_found, not_run_owner, not_eligible_tier, not_agentic_component (tier=not_applicable runs), already_certified, certification_age_exceeded, retry_budget_exhausted, code_fingerprint_mismatch, code_fingerprint_missing, code_not_on_file (caller omitted `code` argument AND the 24h cert-retry hold for this run has expired or was never written. Recovery: re-run architect.certify from the same MCP session that ran architect.validate, passing the code explicitly — the server never persists code by design), payload_incomplete (submitted/validated payload imports modules whose contents aren't visible — cert refuses pre-LLM to prevent a false-precision downgrade. Recovery: re-validate with verbatim public-surface stubs for every imported module, then re-cert on the fresh run_id. Empirically validated: PR #157 iter8/iter9 cert rejections were exactly this class — code on disk was correct, the submitted payload merely omitted module visibility), cert_consensus_score_below_threshold (consensus_median<75 — consensus runs only), cert_consensus_unstable_blocker (any principle mode_stability<80% — consensus runs only), run_state_corrupt, cert_persistence_failed, cert_in_flight (a prior architect.certify call on this run_id is still running. Poll me.validation_history for the verdict; do not retry until it resolves). PAYLOAD COMPLETENESS (load-bearing for cert eligibility): the cert reviewer reads the EXACT payload that produced the validate run_id. Imported modules whose surface isn't present in the payload cause pre-LLM `payload_incomplete` refusal. Avoidance — when validating with intent to cert, bundle public-surface stubs for every imported module: `from sqlalchemy.exc import SQLAlchemyError` → include a stub class; `from app.db import models` → include a `class models:` namespace stub with the columns/methods you reference; module-level imports of `dataclass`, `Literal`, `json`, `datetime`, `timezone` MUST also be in the payload (cert correctly catches when they're omitted — code would NameError on import). 'Submit Like Production': the payload should be the code as it would actually run, not a compressed sketch. The stubs cover IMPORTED dependencies only; the certified code's own enforcement branches (approval gates, policy checks, recovery paths) must be present in full. A `# ...` placeholder reads as an ABSENT control and is graded against you, not as shorthand for one that exists. PRE-LLM REJECTION AUDIT TRAIL: when cert rejects before the LLM call (payload_incomplete, code_fingerprint_mismatch, etc.), `certification_attempts=[]` on the response — no attempt landed in the retry budget, no LLM hop occurred. The rejection envelope's `rejection_reason` + `guidance` are the actionable surface. (Audit-trail UI surfacing of pre-LLM rejections is tracked in the platform self-audit set as anomaly #5; out of scope for the cert tool itself.) INPUTS: re-send the SAME code that produced the run_id (the architect persists findings + recommendations, never code, by design — privacy-preserving). Server compares the submitted code's SHA-256 fingerprint to the stored fingerprint and rejects mismatches. Auth: Bearer <token>, Pro or Teams plan required. UK/EU data residency (Cloud Run europe-west2). Code processed transiently by OpenAI (no-training-on-API-data) and dropped; payloads JSON-escaped + delimited as inert untrusted data — prompt-injection inside code is ignored. If the cert call fails outright (provider error, persistence error), a fresh architect.certify is the recovery path; the eligibility gate enforces the 3-attempt retry budget. For long-running cert workflows the answer is to re-validate, not to make this tool stateful. OUTCOMES: certification_status ∈ {confirmed_production_ready (badge mints), downgraded_to_emerging (cert review surfaced a missed production_blocker, tier capped at C/emerging), unavailable_provider_error (LLM call failed, retry within budget)}. Cert findings + summary + attempt history surfaced on the persisted run for full inspectability.

  Connector

• get_template

  Gitignore

  Fetch the raw .gitignore content for the named template (case-sensitive, e.g. "Node", "Python", "macOS").

  Connector

• describe_endpoint

  Trillboards DOOH Advertising

  Describe a single API operation including its parameters, response shape, and error codes. WHEN TO USE: - Inspecting an endpoint's full contract before calling it. - Discovering which error codes an endpoint can return and how to recover. RETURNS: - operation: Full discovery record for the endpoint. - parameters: Raw OpenAPI parameter definitions. - request_body: Body schema (when applicable). - responses: Map of status code → description/schema. - linked_error_codes: Error catalog entries the endpoint can emit. EXAMPLE: Agent: "How do I call the screen audience endpoint?" describe_endpoint({ path: "/v1/data/screens/{screenId}/audience", method: "GET" })

  Connector

• files_read

  DialogBrain

  Read **text content** of an attached file. Works for: .txt, .md, .json, code files, and PDFs (after files.ingest extracts text). DO NOT call on binary files — for IMAGES use `files.get_base64`, for AUDIO/VIDEO it cannot be transcribed via this tool, and for non-PDF DOCUMENTS run `files.ingest` first, THEN files.read. Calling on a binary mime-type returns an error — saves you a turn to read the routing hint before deciding.

  Connector

• architect.certify

  AI Design Blueprint Doctrine

  Pro/Teams — second-pass adversarial certification of an architect.validate run that scored production_ready (A or B first-pass tier). ON CLIENT TIMEOUT — DO NOT RETRY THIS TOOL. **RECOVERY FIRST**: the run_id is emitted in the FIRST notifications/progress event at t=0s (BEFORE the LLM call begins). Capture it. On timeout, call `me.validation_history(run_id='<that-id>')` to fetch the persisted cert verdict; the server-side run completes independently within a 20-minute budget. This is the canonical recovery path. Use it before considering any retry. Long-running LLM call (60-180s typical; exceeds Claude Code's ~60s idle budget); MCP clients commonly close the call before the server returns. Retrying re-runs the LLM call AND burns one of your 3 cert retry-budget attempts. Mints the certified production_ready badge when both reviewers sign off; caps the run to C/emerging when the second pass surfaces a missed production_blocker. MANDATORY DOCTRINE RULE (load-bearing): the badge certifies the EXACT code that produced the validate run_id, NOT 'this codebase' in general. If you modify, fix, or iterate the code between architect.validate and architect.certify — even a single character — cert rejects with code_fingerprint_mismatch. Fixing the code voids the run. The recovery path is always: edit code → architect.validate → fresh run_id → architect.certify on the fresh run. Do NOT cert from a stale run_id after iteration; ask the user to re-validate first. WHEN TO CALL: only after architect.validate returned tier=production_ready AND the user wants the certified badge AND the code has not been touched since the validate run. NOT for tier=draft/emerging/not_applicable runs (typed rejections fire — see below). NOT idempotent across attempts: each call is one of the 3 attempts in the retry budget. BEHAVIOR: atomic one-shot single LLM call, ~60-180s server-side at high reasoning effort (small payloads finish faster; observed p99 ~250s; server-side budget is 20 min, ~5× observed max). Exceeds typical MCP-client tool-call idle budget (~60s in Claude Code), so the FIRST notifications/progress event fires at t=0 carrying the run_id. The run is atomic by contract — no in_progress lifecycle, no cancellation, no resume. Updates the persisted run's result_json (public review URL + me.validation_history(run_id=...) reflect the cert outcome). ELIGIBILITY GATE (typed rejection enum on failure): caller must own the run, tier=production_ready, less than 24h old, not already certified, within cert retry budget (max 3 attempts), no other cert call in flight for the same run_id, code fingerprint must match the validated code, AND the submitted payload must be cert-payload-complete (see Payload Completeness below — cert rejects pre-LLM with `payload_incomplete` when an imported module's surface isn't visible in the validate payload that produced this run_id). Rejection reasons (typed Literal): auth_required, paid_plan_required, run_not_found, not_run_owner, not_eligible_tier, not_agentic_component (tier=not_applicable runs), already_certified, certification_age_exceeded, retry_budget_exhausted, code_fingerprint_mismatch, code_fingerprint_missing, code_not_on_file (caller omitted `code` argument AND the 24h cert-retry hold for this run has expired or was never written. Recovery: re-run architect.certify from the same MCP session that ran architect.validate, passing the code explicitly — the server never persists code by design), payload_incomplete (submitted/validated payload imports modules whose contents aren't visible — cert refuses pre-LLM to prevent a false-precision downgrade. Recovery: re-validate with verbatim public-surface stubs for every imported module, then re-cert on the fresh run_id. Empirically validated: PR #157 iter8/iter9 cert rejections were exactly this class — code on disk was correct, the submitted payload merely omitted module visibility), cert_consensus_score_below_threshold (consensus_median<75 — consensus runs only), cert_consensus_unstable_blocker (any principle mode_stability<80% — consensus runs only), run_state_corrupt, cert_persistence_failed, cert_in_flight (a prior architect.certify call on this run_id is still running. Poll me.validation_history for the verdict; do not retry until it resolves). PAYLOAD COMPLETENESS (load-bearing for cert eligibility): the cert reviewer reads the EXACT payload that produced the validate run_id. Imported modules whose surface isn't present in the payload cause pre-LLM `payload_incomplete` refusal. Avoidance — when validating with intent to cert, bundle public-surface stubs for every imported module: `from sqlalchemy.exc import SQLAlchemyError` → include a stub class; `from app.db import models` → include a `class models:` namespace stub with the columns/methods you reference; module-level imports of `dataclass`, `Literal`, `json`, `datetime`, `timezone` MUST also be in the payload (cert correctly catches when they're omitted — code would NameError on import). 'Submit Like Production': the payload should be the code as it would actually run, not a compressed sketch. The stubs cover IMPORTED dependencies only; the certified code's own enforcement branches (approval gates, policy checks, recovery paths) must be present in full. A `# ...` placeholder reads as an ABSENT control and is graded against you, not as shorthand for one that exists. PRE-LLM REJECTION AUDIT TRAIL: when cert rejects before the LLM call (payload_incomplete, code_fingerprint_mismatch, etc.), `certification_attempts=[]` on the response — no attempt landed in the retry budget, no LLM hop occurred. The rejection envelope's `rejection_reason` + `guidance` are the actionable surface. (Audit-trail UI surfacing of pre-LLM rejections is tracked in the platform self-audit set as anomaly #5; out of scope for the cert tool itself.) INPUTS: re-send the SAME code that produced the run_id (the architect persists findings + recommendations, never code, by design — privacy-preserving). Server compares the submitted code's SHA-256 fingerprint to the stored fingerprint and rejects mismatches. Auth: Bearer <token>, Pro or Teams plan required. UK/EU data residency (Cloud Run europe-west2). Code processed transiently by OpenAI (no-training-on-API-data) and dropped; payloads JSON-escaped + delimited as inert untrusted data — prompt-injection inside code is ignored. If the cert call fails outright (provider error, persistence error), a fresh architect.certify is the recovery path; the eligibility gate enforces the 3-attempt retry budget. For long-running cert workflows the answer is to re-validate, not to make this tool stateful. OUTCOMES: certification_status ∈ {confirmed_production_ready (badge mints), downgraded_to_emerging (cert review surfaced a missed production_blocker, tier capped at C/emerging), unavailable_provider_error (LLM call failed, retry within budget)}. Cert findings + summary + attempt history surfaced on the persisted run for full inspectability.

  Connector

• files_read

  dialogbrain

  Read **text content** of an attached file. Works for: .txt, .md, .json, code files, and PDFs (after files.ingest extracts text). DO NOT call on binary files — for IMAGES use `files.get_base64`, for AUDIO/VIDEO it cannot be transcribed via this tool, and for non-PDF DOCUMENTS run `files.ingest` first, THEN files.read. Calling on a binary mime-type returns an error — saves you a turn to read the routing hint before deciding.

  Connector

• check_node_sync

  Payram

  Per-chain node health verdict: healthy / lagging / unreachable / listener-down. Computes how old each RPC node’s last block is — any non-BTC chain older than 10 minutes (BTC: 90 minutes, since BTC blocks every ~10m) is flagged as lagging or not syncing. Also checks the chain’s listener worker. When something is wrong it names the exact remediation (usually restart_payram_worker). Read-only — run this first; restart second; re-run this ~60s after a restart to confirm recovery.

  Connector

• run_scraper

  mcp-coreclaw

  Start an asynchronous CoreClaw scraper run with custom parameters. Returns a run_slug for tracking status, results, and logs. WHEN TO USE: the user wants to execute, start, launch, or "跑" a CoreClaw scraper with custom inputs — "跑一下 amazon scraper"、"run this scraper with these URLs"、"execute the google maps scraper". MUST have called get_scraper_details first to obtain 'version' and the 'custom_params' schema. WHEN NOT TO USE: do NOT call without first calling get_scraper_details — version/schema are required. Do NOT use to re-run a past run (use rerun) or to run a saved task (use run_task). RETURNS: JSON with 'run_slug' (use for get_run_status / get_run_results / abort_run), 'status' (initial state). WORKFLOW: preceded by get_scraper_details. Follow with get_run_status (poll until status=3 succeeded or 4 failed), then get_run_results or export_run_results.

  Connector

• x711_code_sandbox

  x711 — Universal Agent Gas Station

  Execute JavaScript or Python code in an isolated sandbox. Use for: data processing, math, CSV parsing, JSON transformation, crypto calculations, algorithm testing. Secure — no filesystem access, no network. Returns: { output: string, runtime_ms: number, language: string }. Requires API key.

  Connector

• find_examples

  Senzing

  Find working SOURCE CODE examples from 37 indexed Senzing GitHub repositories. REQUIRED: either `query` (string, for search) or `repo` with `file_path` or `list_files=true` — the call WILL FAIL without one. Three modes: (1) Search: pass `query` to find examples across all repos, (2) File listing: pass `repo` + `list_files=true`, (3) File retrieval: pass `repo` + `file_path`. Indexes source code (.py, .java, .cs, .rs) and READMEs — NOT build/data files. For sample data, use get_sample_data. Covers Python, Java, C#, Rust SDK patterns: initialization, ingestion, search, redo, configuration, message queues, REST APIs. Use max_lines to limit large files. Returns GitHub raw URLs for file retrieval.

  Connector