"Information on Vulnerabilities in Systems or Networks" matching MCP tools:

• string_interactions_query_set

  STRING Database MCP Server

  Retrieves the interactions between the query proteins. Use this method only when you specifically need to list the interactions between all proteins in your query set. If user asks for 'physical' or 'complex' use 'physical' network type. - For a **single protein**, the network includes that protein and its top 10 most likely interaction partners, plus all interactions among those partners. - For **multiple proteins**, the network includes all direct interactions between them. - If the user refers to "physical interactions", "complexes", or "binding", set the network type to "physical". - STRING does not store or report information about self-interactions/homomers; if asked, explain the limitation. If few or no interactions are returned, consider reducing the `required_score`. For large query sets (>50 proteins), consider increasing the `required_score` (e.g. ≥700) to focus on high-confidence interactions and avoid overly dense networks. - Expand the names of score sources: `nscore` (neighborhood), `fscore` (fusion), `pscore` (phylogenetic profile), `ascore` (coexpression), `escore` (experimental), `dscore` (database), `tscore` (text-mining)

  Connector

• designesy_compare

  Designesy

  Diff two design systems from live URLs — the only URL-scoped design-token diff engine. Fetches both URLs in parallel, extracts their :root custom properties, and produces a structured diff across 8 dimensions: tokens added (in A not B), removed (in B not A), renamed (heuristic Levenshtein ≤ 2), value-changed (same name, different value), scale-stop-changed (spacing/radius/color scale steps), contrast-drift-per-pair (WCAG contrast ratio change for shared color tokens), structure-delta (token count + category distribution), and score-delta (runs /score on both URLs and diffs). Use this to answer "what actually changed between two design systems" or "how does our design system differ from a reference". When NOT to use: for single-site drift detection, use designesy_drift_score; for continuous monitoring, use designesy_monitor_score. Executable — fetches both URLs, extracts CSS + tokens, computes diff. No browser needed. Returns JSON: { ok, urlA, urlB, score (0-100, diff completeness), grade, pass, warn, fail, total, tokensA, tokensB, added[], removed[], renamed[], valueChanged[], scaleDiff, structureDelta, contrastDrift[], scoreDelta, checks[] }. Results cached ~24h per URL pair.

  Connector

• pkg_vulns

  GitHits

  Use when the user asks whether a package or pinned version has known vulnerabilities, advisories, CVEs, malware, affected ranges, or fix versions. Check known vulnerabilities for a package on npm, PyPI, Hex, Crates, NuGet, Maven, Packagist, RubyGems, Go, or Swift (vcpkg and Zig are not supported for vulnerability data). Returns a count summary, each advisory with OSV ID, severity, affected ranges, and fix versions. Malicious-package advisories surface in a separate bucket. Example: `{"registry":"npm","package_name":"lodash","version":"4.17.20","min_severity":"high"}`. Pass `version` to inspect a pinned release; omit it for latest. Default text is capped for readability; use `verbose:true` for all selected advisory rows or `format:"json"` for the complete envelope. Use `min_severity` to filter to a threshold (`low`, `medium`, `high`, `critical`) and `include_withdrawn` to also see retracted advisories. Use `advisory_scope:"non_affecting"` to list historical advisories that do not affect the inspected version, or `advisory_scope:"all"` to list affected and historical advisories together.

  Connector

• lora_airtime

  calc.engineer

  Calculates LoRa packet time-on-air using the Semtech AN1200.13 formula. Computes symbol duration, preamble time, payload symbol count, effective data rate, and the minimum transmission interval for 1% duty cycle compliance. Essential for capacity planning in LoRaWAN and Meshtastic mesh networks. Accepts spreading factor (SF7-SF12), bandwidth (125/250/500 kHz), coding rate (4/5-4/8), payload size, header mode, CRC, and optional low data rate optimization. Feeds airtime_ms to channel_utilization for mesh load analysis.

  Connector

• string_network_clustering

  STRING Database MCP Server

  Performs **network clustering** on a STRING interaction network and returns both a **network image URL** and details about each detected cluster. Use the same parameters as in the network creation step to ensure consistency. If the network already contains disconnected subgraphs, the resulting number of clusters may differ from the requested value. Dashed lines represent connections between clusters, while solid lines indicate interactions within clusters. Notes: - For small queries (≤5 proteins), the `required_score` parameter is automatically lowered to 0. - If only a single cluster is produced, try increasing `required_score`, adjusting the inflation parameter, or switching to `kmeans` for small, highly interconnected networks.

  Connector

• string_help

  STRING Database MCP Server

  Provides explanatory text for STRING features and limitations. Use this tool when the user question involves: - What is STRING is or how to use the tool (how_to_use_string, cytoscape) - functionality not available via MCP tools (e.g. GSEA, regulatory networks, large datasets). - meaning of the lines in the network (line_colors)

  Connector

• search_cves

  nvd

  Search NVD for CVE vulnerabilities by product or component name. Returns CVE ID, description, severity, and CVSS score. Search terms are matched against CVE description text and EVERY word must appear, so pass the product name ("OpenSSL", "log4j", "nginx") optionally with a technical term ("buffer overflow") — not a plain-English question. Use when researching security threats or checking if a known vulnerability affects your systems.

  Connector

• lunium_list_settlement_options

  lunium

  Requires an API key. Lists the assets and networks that can settle right now, with limits and expected timing. Call it before quoting whenever the user names an asset or a network you have not already confirmed in this session. The list changes on its own — assets appear and networks get suspended without notice — so never hard-code it, never cache it across sessions, never answer from memory. Polygon (USDT/USDC) is the default and settles in seconds; every other network waits for that chain's confirmations, from about a minute to a few hours. Never promise "instant" outside Polygon. Do not use it to price anything: it carries no rate. Do not offer the user an asset that is absent from this response, even if it worked yesterday. Errors: acao=repetir → retry once. acao=esperar → you are over the request budget; back off. acao=parar → the connector is not configured; tell the user instead of retrying.

  Connector

• onramp-coverage

  x402 Bazaar

  Can money get in and out of crypto here, and how? — The feasibility check before you ask a user for money: which fiat-in and cash-out rails Coinbase actually runs in a country, the currencies and min/max limits for each, and how many assets across which networks. Distinguishes a country with card rails from one where crypto can only be transferred in — a difference most integrations discover only after a user fails. 122 countries covered. Required input: country. Priced $0.02 per call over x402 on Base; send a prepaid x-credit-token header for unlimited calls, or get 1 free call/day per tool. No wallet or API key required.

  Connector

• intelligence.contagion

  DPX — Institutional Cross-Border Settlement

  Contagion Intelligence — simulates how a macro or financial shock spreads through 30 nodes across 6 domains (financial systems, real economies, commodity networks, policy anchors, social systems, physical infrastructure) using an epidemiological R-value model. Returns system R trajectory, per-epoch spread map, superspreader nodes, containment forecast, and AI briefing. R < 1.0 = self-limiting; R ≥ 1.0 = expanding. Call /contagion/nodes first to discover valid origin IDs. POST with origin and magnitude.

  Connector

• list_social_accounts

  PostLake

  List every connected social account with its id, profile, platform, handle and connection status. Call this before publishing: the ids are what create_post takes in `accounts`. If none are connected, use get_connect_link for OAuth networks or connect_account for supported credential-based networks. A status of 'needs_reauth' means the owner must reconnect that channel.

  Connector

• get_dasha

  Jagannatha Hora — Vedic Astrology (Jyotish, Kundli, Horoscope, Panchang)

  Return a dasha (planetary period) timeline as a nested tree anchored on a date — past, present and future in ONE call. Works for BOTH planetary (graha) and sign (rasi) dasha systems; just name the system and the tool routes it automatically. Every period node has the SAME shape: 'level' (maha/antar/pratyantar/sookshma), 'ruler' (planet for graha, sign for rasi), 'start', 'end' (YYYY-MM-DD) and 'relation' (past/current/future). The result has 'dasha_type' ('graha' or 'rasi'), 'system', 'as_of' (anchor date), 'depth', and: 'current' — a ready-made summary of the running period ('maha'/'antar'/'pratyantar', a 'path' string, and 'current_period_ends'); 'maha_timeline' — every Maha-dasha over the life; 'current_maha' with its 'antars'; for graha systems 'current_antar' with its 'pratyantars'; and, at depth 4, 'current_pratyantar' with its 'sookshmas'. Rasi systems have two levels (no pratyantar). To drill into a SPECIFIC period regardless of date, pass 'maha' (and optionally 'antar') as a ruler name — the matching branch comes back under 'selected_maha'/'selected_antar' with a 'selection' echo. HOW TO REQUEST: send only birth details for the default (vimsottari, anchored today, depth 3). Optionally set 'system' to EXACTLY one enum token. Planetary (graha) systems: vimsottari (standard 120-yr), ashtottari, yogini, shodasottari, dwadasottari, panchottari, satabdika, chaturaaseeti_sama, shashtisama, shattrimsa_sama, dwisatpathi, kaala, buddhi_gathi, naisargika, aayu, tara, karaka, tithi_ashtottari, tithi_yogini, karana_chaturaaseeti_sama, saptharishi_nakshathra, rasi_bhukthi_vimsottari, yoga_vimsottari, ashtaka_varga_planet, ashtaka_varga_sign, ashtaka_varga_pinda, moola_graha, rashmi. Sign (rasi) systems: narayana, chara, kendraadhi_rasi, sudasa, drig, nirayana, shoola, kendraadhi_karaka, lagnamsaka, padhanadhamsa, mandooka, sthira, tara_lagna, brahma, varnada, yogardha, navamsa, paryaaya, trikona, kalachakra, chakra, sandhya_panchaka, chathurvidha_utthara, karaka_kendraadhi, lagna_kendraadhi, niryaana, raashiyanka. Optionally set 'as_of_date' (YYYY-MM-DD, separate from birth 'date') to anchor on another time, e.g. '2030-01-01'. Data only — no interpretation.

  Connector

• get_player_rankings

  livetennisapi-mcp

  Point-in-time ranking records for SPECIFIC players: per system, the newest record in force ON OR BEFORE as_of — never one dated after it. Every other ranking field in this API is the CURRENT value joined at read time; this is the historical answer. Systems are never collapsed: ATP/WTA and the ITF circuits carry rank+points, UTR a rating. ITF and UTR history begins 2026-07-29. Requires the ULTRA plan.

  Connector

• files.download_file

  Vee3

  Reserve a direct download for a previously uploaded file. Pass the file_name from files.list_uploaded_files (paths such as folder/subfolder/name.ext are supported). Vee3 returns a download_code. Install the Vee3 CLI once with `npm install -g @vee3/cli` (requires Node 18+), then run `vee3-get-file {download_code} ./path/to/save` in the terminal. The CLI does not need an API key. If installation fails with a TLS or certificate error (common on networks that inspect HTTPS traffic), use Node 22.15 or newer and run with NODE_OPTIONS=--use-system-ca, or configure npm to trust your network's root certificate. Download codes can be resolved within 60 minutes of reserve. Cost = 0 tokens.

  Connector

• credawait

  InsideOut (Riley)

  Wait for the user to securely connect their cloud account and subscribe to Luther Systems. Polls until credentials appear on the session. 🎯 USE THIS TOOL WHEN: tfdeploy returns an 'auth_required', 'no_credentials', or 'credentials_expired' error. The user needs to visit the connect URL to: 1. Connect their cloud credentials (AWS or GCP) 2. Sign up and subscribe to a Luther Systems plan (required for deployment) This secure connection allows InsideOut to deploy and manage infrastructure in the user's cloud account on their behalf. Credentials are handled securely and only used for deployment and management sessions. WORKFLOW: 1. FIRST: Present the connect URL and explanation to the user (from the tfdeploy error response) 2. THEN: Call this tool to begin polling for credentials 3. The user opens the URL in their browser to subscribe and add credentials 4. When credentials are found, inform the user and call tfdeploy to deploy IMPORTANT: Do NOT call this tool without first showing the connect URL to the user. The user needs to see the URL to complete the process. REQUIRES: session_id from convoopen response (format: sess_v2_...). OPTIONAL: cloud ('aws' or 'gcp'), timeout (integer, seconds to wait, default 300, max 600).

  Connector

• is_cve_exploited

  osf-data-marketplace

  Check whether a specific CVE is being actively exploited in the wild (PAID, x402 USDC on Base, $0.05). Pass a CVE id (e.g. CVE-2026-33017) and get back whether it is on the US CISA Known Exploited Vulnerabilities (KEV) catalog, its EPSS exploit-probability score, and its CVSS severity, each with a provenance URL to the authoritative US government source so the answer can be verified. For vulnerability management, patch prioritization, threat intelligence, and DevSecOps agent workflows. Payment is handled automatically by x402-capable MCP clients via the standard payment handshake.

  Connector

• search_play_challenges

  mcp

  Return a list of hands-on SecDim Play secure coding challenges (labs) related to a detected or suspected vulnerability. SecDim Play challenges are scored, hands-on labs: find and fix a real vulnerability in running code to earn points and badges. Use this tool to: - Find hands-on SecDim Play labs for specific vulnerabilities like XSS, SQL Injection, etc. - Explore OWASP Top 10 vulnerabilities and related labs - Provide additional resources and guides to help developers improve their secure coding skills For structured tutorial content (text, video, and lab-based courses) on the same vulnerability, use search_learn_courses (SecDim Learn) instead or in addition. Args: search: Search term for the vulnerability (e.g., 'xss', 'sql-injection', 'injection') cwe: Common Weakness Enumeration (CWE) ID to filter by owasp: OWASP category to filter by (e.g., 'a03:2021') technology: Technology or framework to filter by (e.g., 'react', 'django') language: Programming language to filter by (e.g., 'javascript', 'python') difficulty: Difficulty level to filter by (e.g., 'trivial', 'easy', 'medium', 'hard') type: Challenge format to filter by (e.g., 'battle', 'exploitation', 'incident-response') mitre: MITRE ATT&CK ID to filter by (e.g., 'T1102.003') SecDim Play challenges (labs) each simulate a real vulnerability. They are scored according to the following difficulty levels: - Trivial: Easy to find and path vulnerabilities. It can be completed in 5-10 minutes. 1-15 points. - Easy: Known vulnerabilities. It can be completed in 10-30 minutes. 16-35 points. - Medium: Known vulnerabilities but require defence-in-depth patch. It can be completed in 20-30 minutes. 36-70 points. - Hard: Hard to find or patch vulnerabilities. It can be completed in 30-60 minutes. 71-100 points. - Battle: SecDim Flagship attack and defence challenge that require both vulnerability exploitation and mitigation skills. Points are accumulated. Returns: Dictionary containing SecDim Play labs results or error If there are no results, user can perform a manual search on the SecDim Play frontend (SECDIM_PLAY_FRONTEND_BASE_URL)

  Connector

• getAdditionalInformationOptions

  Nomad Stays

  List valid values for one of the Additional Information picklists used in updateStayOrganisationalData: Children Allowed, Pets Allowed, or Parking. These are NOT booleans — they're lookup IDs (e.g. 'Yes', 'No', 'On Request') — call this to find the right value before writing petsAllowedId/childrenAllowedId/parkingId. Requires NOMADSTAYS_MCP_AGENT_TOKEN.

  Connector

• list_26_systems

  mythsensus-mcp

  Return the canonical list of 26 ancient divination systems Mythsensus implements (slug, English + Thai name, region, required inputs). Use first when asked "what systems do you support?".

  Connector

• list_networks

  Citybikes

  Browse all bike-sharing networks worldwide. Returns network name, ID, city, country, and coordinates for each network.

  Connector