"Information and Resources for Terraform AWS Integration" matching MCP tools:

• tfplanA

  InsideOut (Riley)A

  PREVIEW: Run terraform plan to preview infrastructure changes Runs a terraform plan for an InsideOut session without applying any changes. This lets the user review what will be created/changed/destroyed before committing. Returns job_id, plan_id, and project_id. Use tflogs to stream the plan output. After the plan completes, use tfdeploy with plan_id to apply the exact plan. SINGLE-FLIGHT: only one TF job per session at a time. If another job is already in flight, tfplan returns tf_job_conflict with the live job_id — attach with tfstatus/tflogs, or pass force_new=true to override. REQUIRES: session_id from convoopen response (format: sess_v2_...). OPTIONAL: sandbox (boolean, default false) — plans real generated Terraform. Set to true for cheap sandbox template (testing only). OPTIONAL: force_new (boolean, default false) - bypass the single-flight guard. Use only when the existing run is provably wedged. CREDENTIAL HANDLING: Same as tfdeploy - credentials must be configured first.

  ConnectorNo auth

• tfplanA

  InsideOut (Riley)A

  PREVIEW: Run terraform plan to preview infrastructure changes Runs a terraform plan for an InsideOut session without applying any changes. This lets the user review what will be created/changed/destroyed before committing. Returns job_id, plan_id, and project_id. Use tflogs to stream the plan output. After the plan completes, use tfdeploy with plan_id to apply the exact plan. SINGLE-FLIGHT: only one TF job per session at a time. If another job is already in flight, tfplan returns tf_job_conflict with the live job_id — attach with tfstatus/tflogs, or pass force_new=true to override. REQUIRES: session_id from convoopen response (format: sess_v2_...). OPTIONAL: sandbox (boolean, default false) — plans real generated Terraform. Set to true for cheap sandbox template (testing only). OPTIONAL: force_new (boolean, default false) - bypass the single-flight guard. Use only when the existing run is provably wedged. CREDENTIAL HANDLING: Same as tfdeploy - credentials must be configured first.

  ConnectorNo auth

• tfgenerateA

  InsideOut (Riley)A

  WORKFLOW: Step 3 of 4 - Generate Terraform files from completed design Generate Terraform files from an InsideOut session that has completed infrastructure design. ⚠️ PREREQUISITE: Only call this AFTER convoreply returns with `terraform_ready=true` in the response metadata. DO NOT call this while convoreply is still running or before terraform_ready is confirmed! If you get 'session has not reached terraform-ready state', wait for convoreply to complete first. 🎯 USE THIS TOOL WHEN: convoreply has returned with terraform_ready=true, OR the user asks to 'see the terraforms', 'generate terraform', 'show me the code', etc. **DEFAULT RESPONSE**: Returns summary table + download URL (keeps code out of LLM context). **FALLBACK**: Set `include_code: true` to get full code inline if curl/unzip fails. **CRITICAL WORKFLOW** (default mode): 1. Call this tool to get file summary and download URL 2. ASK the user: 'Where would you like me to save the Terraform files? Default: ./insideout-infra/' 3. WAIT for user confirmation before running the download command 4. Run the curl/unzip command with the user's chosen directory 5. If curl/unzip FAILS (sandbox, security, platform issues), retry with `include_code: true` **AFTER GENERATION**: Ask user if they want to review the files and then deploy with tfdeploy REQUIRES: session_id from convoopen response (format: sess_v2_...). OPTIONAL: include_code (boolean) - set true to return full code inline as fallback. 💡 TIP: Examine workflow.usage prompt for more context on how to properly use these tools.

  ConnectorNo auth

• tfgenerateA

  InsideOut (Riley)A

  WORKFLOW: Step 3 of 4 - Generate Terraform files from completed design Generate Terraform files from an InsideOut session that has completed infrastructure design. ⚠️ PREREQUISITE: Only call this AFTER convoreply returns with `terraform_ready=true` in the response metadata. DO NOT call this while convoreply is still running or before terraform_ready is confirmed! If you get 'session has not reached terraform-ready state', wait for convoreply to complete first. 🎯 USE THIS TOOL WHEN: convoreply has returned with terraform_ready=true, OR the user asks to 'see the terraforms', 'generate terraform', 'show me the code', etc. **DEFAULT RESPONSE**: Returns summary table + download URL (keeps code out of LLM context). **FALLBACK**: Set `include_code: true` to get full code inline if curl/unzip fails. **CRITICAL WORKFLOW** (default mode): 1. Call this tool to get file summary and download URL 2. ASK the user: 'Where would you like me to save the Terraform files? Default: ./insideout-infra/' 3. WAIT for user confirmation before running the download command 4. Run the curl/unzip command with the user's chosen directory 5. If curl/unzip FAILS (sandbox, security, platform issues), retry with `include_code: true` **AFTER GENERATION**: Ask user if they want to review the files and then deploy with tfdeploy REQUIRES: session_id from convoopen response (format: sess_v2_...). OPTIONAL: include_code (boolean) - set true to return full code inline as fallback. 💡 TIP: Examine workflow.usage prompt for more context on how to properly use these tools.

  ConnectorNo auth

• get_tier1_recommendationsA

  Tier1 IT AssessmentA

  Maps only stable Tier1 finding identifiers to approved Tier1 services and public resources. Call after a Tier1 score or email-domain check. Do not submit prose, URLs, customer information, or invented identifiers. This tool performs no arbitrary fetching, makes no contact request, changes nothing, and stores nothing.

  ConnectorNo auth

• convert_to_terraformA

  Control PlaneA

  Convert a Control Plane resource manifest (YAML or JSON) into the equivalent Terraform (HCL). The manifest is first DRY-RUN VALIDATED against the API (no resource is created) — if it fails validation you get the error instead of HCL, so the returned Terraform always corresponds to a schema-valid resource. Pass `gvc` when the kind is GVC-scoped (workload, identity, volumeset). Set `generateImports` to also return ready-to-run `terraform import` commands. To convert an EXISTING resource instead of a manifest, use export_terraform.

  ConnectorOAuth

• integrate_propelauth_oauthA

  PropelAuth Integration MCP ServerA

  IMPORTANT: Do NOT fetch all guidances at once. Fetch the 'Backend Installation' guidance first, apply the necessary setup changes, and then fetch subsequent guidances (e.g., 'Redirect users after login', 'Backend Auth Middleware') sequentially as you implement each specific feature. Returns instructions for integrating PropelAuth via OAuth. Only use this tool when specifically instructed to by another tool or the user or if a PropelAuth SDK does not exist for the project's framework. Guidance includes instructions for the backend and frontend, including installation and configuration, creating access tokens, retrieving user or org information, logging users out, redirecting users to login, and more. It is important to follow the instructions carefully to ensure a successful integration.

  ConnectorNo auth

• upsertAgentTriggerA

  Duvo MCPB

  Create or update the authenticated user's trigger for an integration on an agent. The integration must already be connected to the agent (its OAuth connection set up in the Duvo dashboard). Set `enabled: false` to pause a trigger without deleting it. An agent holds one trigger per integration for a user, so a save with a different `trigger_type` replaces the existing one — except when that trigger is an @mention trigger, which is managed from the agent's mention setting and answers 409 (`mention_trigger_protected`) here. @mention triggers are best managed from that setting throughout: this route leaves an existing one's `filter_config` untouched, and refuses to create a `teams_mention` trigger without a `filter_config.tenantId` (400, `mention_trigger_workspace_required`) — a Slack mention trigger has no equivalent field to supply.

  ConnectorNo auth

• read_resourceA

  PRIMAMCPA

  Read a resource by its URI. For static resources, provide the exact URI. For templated resources, provide the URI with template parameters filled in. Returns the resource content as a string. Binary content is base64-encoded.

  ConnectorAPI key

• export_terraformA

  Control PlaneA

  Generate Terraform (HCL) for EXISTING Control Plane resources from a self link. Single resource (`/org/acme/gvc/prod/workload/api`) or bulk by path depth — `/org/acme` exports the whole org, `/org/acme/gvc/prod/workload` exports every workload in a GVC. Set `generateImports` to get ready-to-run `terraform import` commands for adopting the resources into Terraform state, and `includeDependencies` to pull in referenced resources. Secrets are never exported — a ref that targets secrets is refused, and an export that would pull secrets in is refused wholesale. An unsupported kind is rejected with the supported list (list_terraform_kinds, full profile, enumerates them up front). For an in-memory manifest, use convert_to_terraform. Recommended reading: get_cpln_skill("iac-terraform-pulumi").

  ConnectorOAuth

• get_integrationA

  MisarMail MCP ServerA

  Get one integration in full: its configuration, the scopes it was granted, and the result of its last sync. Use it to diagnose an integration that list_integrations shows as unhealthy, or to check which scopes were granted before relying on a capability. Covers a single integration — list_integrations gives the overview. Reads only; it does not re-run a sync or change any setting. Requires an API key. The response describes what the integration is permitted to do, which is not the same as what it has successfully done — read the last sync result for that.

  ConnectorNo auth

• toggle_integrationA

  MisarMail MCP ServerA

  Turn one third-party integration on or off. This changes live behaviour: DISABLING stops all syncing through that integration, so data quietly stops flowing until it is re-enabled. It does not disconnect the integration or revoke its credentials — the connection and its scopes survive, which is why re-enabling picks up where it left off. Safe to repeat: setting an integration to the state it is already in changes nothing. Requires an API key. Call list_integrations first so you know the current state rather than toggling blind.

  ConnectorNo auth

• oracle.discovery_bundleA

  InterAI Risk OracleA

  Read-only bootstrap or handoff bundle with service identity, interfaces, runtime mode, contracts, schemas, and sample payloads in one response. Use it for complete integration context; use oracle.service_descriptor for focused service metadata, oracle.agent_card for A2A capabilities, or oracle.get_pricing for costs.

  ConnectorNo auth

• oracle.service_descriptorA

  InterAI Risk OracleA

  Read-only general service descriptor with identity, endpoints, billing, trust, and supported agent protocols. Use it to inspect service-level integration metadata; use oracle.agent_card for A2A skills or oracle.discovery_bundle for the complete bootstrap package.

  ConnectorNo auth

• cloud_egress_finopsA

  TrueCalciB

  Analyze tiered AWS/GCP public cloud internet data transfer egress pricing versus Cloudflare Zero-Egress Bandwidth Alliance and edge caching proxies, quantifying monthly and annual infrastructure cost savings. Behavior: Deterministic, idempotent calculation with zero external side effects. Calculates tiered AWS/GCP egress charges ($0.09/GB for first 10TB, $0.085/GB for next 40TB, $0.07/GB for next 100TB, $0.05/GB beyond). Models edge cache offload reduction and compares against Cloudflare zero-egress routing. Returns monthly and annual gross egress costs, post-cache costs, and total net savings. Usage Guidelines: Use for cloud architecture budgeting, FinOps reviews, and evaluating CDN caching or Cloudflare migration economics. Do not use for LLM token pricing; use ai_token_arbitrage instead.

  ConnectorNo auth

• read_resourceA

  PRIMAMCPA

  Read a resource by its URI. For static resources, provide the exact URI. For templated resources, provide the URI with template parameters filled in. Returns the resource content as a string. Binary content is base64-encoded.

  ConnectorAPI key

• awsinspectA

  InsideOut (Riley)A

  INSPECTION: Inspect AWS infrastructure for a deployed project ⚠️ **PREREQUISITE**: This tool requires a prior deployment ATTEMPT (successful or failed). Check convostatus for hasDeployAttempt=true before calling. Works even after failed deploys to inspect orphaned resources. Inspect deployed AWS resources after a deployment attempt. Use this tool when the user asks about the status or details of their deployed infrastructure. It fetches temporary read-only credentials securely and queries the AWS API directly. RESPONSE TIERS (default is summary for token efficiency): - Summary (default): Key fields only (~500 tokens). Set detail=false, raw=false or omit both. - Detail: Full metadata for a specific resource. Set detail=true + resource filter. - Raw: Complete unprocessed API response. Set raw=true. REQUIRES: session_id from convoopen response (format: sess_v2_...). Supported services: account, acm, alb, apigateway, apprunner, backup, bedrock, cloudfront, cloudwatchlogs, cognito, cost-explorer, dynamodb, ebs, ec2, ecs, eks, elasticache, kms, lambda, msk, opensearch, rds, route53, s3, sagemaker, secretsmanager, sqs, vpc, waf For a specific service's actions, call with action="list-actions". METRICS: Use list-metrics to discover available metrics for a service (no credentials needed). Then use get-metrics to retrieve data (auto-discovers resources). Most services return CloudWatch time-series. KMS returns key health (rotation, state). SecretsManager returns secret health (rotation, last accessed/rotated). Optional filters JSON: {"hours":6,"period":300}. BILLING: Use service=cost-explorer to inspect AWS costs. Actions: get-cost-summary (last 30 days by service, filters: {"days":7,"granularity":"DAILY"}), get-cost-forecast (projected spend through end of month), get-cost-by-tag (costs grouped by tag, filters: {"tag_key":"Environment","days":30}). Requires ce:GetCostAndUsage and ce:GetCostForecast IAM permissions. EXAMPLES: - awsinspect(session_id=..., service="ec2", action="describe-instances") - awsinspect(session_id=..., service="cost-explorer", action="get-cost-summary") - awsinspect(session_id=..., service="ec2", action="get-metrics", filters="{\"hours\":6}") - awsinspect(session_id=..., service="rds", action="describe-db-instances", detail=true)

  ConnectorNo auth

• aws___read_documentationA

  AWS KnowledgeA

  Fetch full AWS doc pages as markdown. `search_documentation` already returns verbatim page chunks, so don't re-read a URL whose chunk you already have to "confirm" or "round out" an answer -- the chunk is the real page text; treat it as authoritative. Reading the full page is justified ONLY when the chunks genuinely lack the content: - an enumeration or aggregation ("list all X", "how many X") needs the complete set and the chunks show only part of it; - no search result is on-topic after refining the query, and a known doc URL would have the answer. Otherwise, answer from the chunks. Use exact URLs from `search_documentation`; don't guess slugs. Input: `requests: [{url, max_length?, start_index?}]`. Batch 2-5. - `max_length` default 10000. - `start_index` default 0; use prior `end_index` to continue, TOC offset to jump. Allow-listed prefixes: docs.aws.amazon.com; aws.amazon.com (not /marketplace); repost.aws/knowledge-center; docs.amplify.aws; ui.docs.amplify.aws; github.com/{aws-cloudformation/aws-cloudformation-templates, aws-samples/{aws-cdk-examples, generative-ai-cdk-constructs-samples, serverless-patterns}, awsdocs/aws-cdk-guide, awslabs/aws-solutions-constructs, cdklabs/cdk-nag} (README on `main`); constructs.dev/packages/{@aws-cdk-containers, @aws-cdk, @cdk-cloudformation, aws-analytics-reference-architecture, aws-cdk-lib, cdk-amazon-chime-resources, cdk-aws-lambda-powertools-layer, cdk-ecr-deployment, cdk-lambda-powertools-python-layer, cdk-serverless-clamscan, cdk8s, cdk8s-plus-33}; strandsagents.com/latest/documentation/docs/; karpenter.sh/docs/; Amazon Braket: {amazon-braket-sdk-python, amazon-braket-schemas-python, amazon-braket-default-simulator-python, amazon-braket-pennylane-plugin-python, amazon-braket-algorithm-library, qiskit-braket-provider, autoqasm, qirtoqasm}.readthedocs.io and github.com/amazon-braket/* (blob/tree/raw). Output: SUCCESS -- markdown + `total_length, start_index, end_index, truncated, redirected_url?` (truncated includes TOC with char ranges). ERROR -- `error_code` in {not_found, invalid_url, throttled, downstream_error, validation_error}.

  ConnectorNo auth

• list_nodesA

  Diagrams MCPA

  List available node classes for a provider.service combo. Args: provider: Provider name (e.g. 'aws', 'gcp', 'k8s'). service: Service category (e.g. 'compute', 'database', 'network'). Returns: List of nodes with keys: name, import, alias_of (optional).

  ConnectorNo auth

• adcritter_get_design_guideA

  AdCritter for BuildersA

  Returns AdCritter design guidance for an entity at a caller-chosen guidance level - screen experiences, API integration patterns, and design philosophy. The default ('full') returns step-by-step prescription (exact layouts, colors, copy text, column orders). Request 'patterns' for balanced hints including common design patterns with softened vocabulary. Request 'facts' if you have strong visual-design instincts and just want API integration bindings (or call adcritter_get_api_reference and adcritter_get_usage_guide directly and skip this tool). Guidance is format-agnostic - it describes outcomes and integration, never prescribes frameworks or architecture. Available entities: ad, advertiser, audience, authentication, blueprint, campaign, geo, media-asset, plan, report, settings.

  ConnectorNo auth

• awsinspectA

  InsideOut (Riley)A

  INSPECTION: Inspect AWS infrastructure for a deployed project ⚠️ **PREREQUISITE**: This tool requires a prior deployment ATTEMPT (successful or failed). Check convostatus for hasDeployAttempt=true before calling. Works even after failed deploys to inspect orphaned resources. Inspect deployed AWS resources after a deployment attempt. Use this tool when the user asks about the status or details of their deployed infrastructure. It fetches temporary read-only credentials securely and queries the AWS API directly. RESPONSE TIERS (default is summary for token efficiency): - Summary (default): Key fields only (~500 tokens). Set detail=false, raw=false or omit both. - Detail: Full metadata for a specific resource. Set detail=true + resource filter. - Raw: Complete unprocessed API response. Set raw=true. REQUIRES: session_id from convoopen response (format: sess_v2_...). Supported services: account, acm, alb, apigateway, apprunner, backup, bedrock, cloudfront, cloudwatchlogs, cognito, cost-explorer, dynamodb, ebs, ec2, ecs, eks, elasticache, kms, lambda, msk, opensearch, rds, route53, s3, sagemaker, secretsmanager, sqs, vpc, waf For a specific service's actions, call with action="list-actions". METRICS: Use list-metrics to discover available metrics for a service (no credentials needed). Then use get-metrics to retrieve data (auto-discovers resources). Most services return CloudWatch time-series. KMS returns key health (rotation, state). SecretsManager returns secret health (rotation, last accessed/rotated). Optional filters JSON: {"hours":6,"period":300}. BILLING: Use service=cost-explorer to inspect AWS costs. Actions: get-cost-summary (last 30 days by service, filters: {"days":7,"granularity":"DAILY"}), get-cost-forecast (projected spend through end of month), get-cost-by-tag (costs grouped by tag, filters: {"tag_key":"Environment","days":30}). Requires ce:GetCostAndUsage and ce:GetCostForecast IAM permissions. EXAMPLES: - awsinspect(session_id=..., service="ec2", action="describe-instances") - awsinspect(session_id=..., service="cost-explorer", action="get-cost-summary") - awsinspect(session_id=..., service="ec2", action="get-metrics", filters="{\"hours\":6}") - awsinspect(session_id=..., service="rds", action="describe-db-instances", detail=true)

  ConnectorNo auth