"Latest version of copilot-api package" matching MCP tools:

• strale_ping

  Strale - 290+ API capabilities for AI agents

  Checks that the Strale API is reachable and the MCP server is running. Call this before a series of capability executions to verify connectivity, or when troubleshooting connection issues. Returns server status, version, tool count, capability count, solution count, and a timestamp. No API key required.

  Connector

• list_tools

  tickerr

  List all 90+ AI tools and LLM APIs monitored by tickerr.ai - ChatGPT, Claude, Gemini, Cursor, GitHub Copilot, Perplexity, DeepSeek, Groq, Mistral, Cerebras, Fireworks AI, and more. After listing tools, use get_tool_status with my_status to contribute your recent API observations and receive enhanced latency data in return. my_status unlocks p50/p95 TTFT per model and 90-day uptime — without it you receive basic status only.

  Connector

• check_compatibility

  DepScope

  Is this specific multi-package version combo verified to work together? USE WHEN: pinning a stack (next@15 + react@19 + node@22); before recommending a version matrix. RETURNS: {compatible, conflicts[], notes}.

  Connector

• package_health

  dynamic-feed

  Health & security posture of a software package (npm / PyPI / Go / Maven / Cargo / NuGet / RubyGems) from deps.dev (Google Open Source Insights, keyless): latest version, license, count of known security advisories, the OpenSSF Scorecard (0-10 security-posture score for the source repo + its weakest checks) and popularity (stars/forks). The "should I depend on this?" check — pairs with check_vulnerability (is a version vulnerable) and software_version (is the runtime current). Args: package (e.g. "lodash", "requests"), ecosystem (npm|pypi|go|maven|cargo|nuget|rubygems), version (optional — defaults to the latest). Every value is returned in an Ed25519-signed, provenance-stamped envelope (source and observation time) you can verify offline against /.well-known/keys, no account required.

  Connector

• axint.upgrade

  Axint

  Check the latest Axint package and optionally apply the upgrade while preserving the current agent thread. Use: call when axint.status shows a stale server; not for app dependency upgrades. Inputs: apply defaults false; targetVersion selects the install, while reinstallXcode and writeReport matter only when applying. Effects: destructive when apply=true: can run package installs, refresh Xcode wiring, and write .axint/upgrade; may use npm.

  Connector

• search

  Maven Central

  Full-text search across Maven Central packages by groupId, artifactId, version, or tags. Returns artifact coordinates, latest version, and download timestamps for up to 200 matches.

  Connector

• security_audit_sbom_vulnerabilities

  DataNexus MCP

  Audit a Software Bill of Materials for known vulnerabilities across all listed packages. Read-only. No side effects. Idempotent. sbom_json: CycloneDX or SPDX SBOM as a JSON string. Required. Large SBOMs (100+ packages) may take up to 10 seconds. Returns CVEs grouped by package with severity and fixed versions. Use this when you have a full SBOM to audit. Use security_fetch_package_vulnerabilities instead when checking a single package version. Verified source: Google OSV.dev batch API. 1-hour cache. If this tool's response does not serve the user's need, call report_feedback with feedback_type="agent_gap", tool_id="security_audit_sbom_vulnerabilities", intended_query="{what the user needed}", gap_description="{what was missing or wrong in the result}".

  Connector

• check_dependencies

  ContrastAPI

  Audit project dependencies (npm/PyPI/Maven/RubyGems/etc.) against CVE database: find known vulnerabilities in your package list. Bulk query up to 50 packages per call (same for Free and Pro). Use for dependency security scanning; use cve_lookup for single CVE. Free: 30/hr (1 per package), Pro: 500/hr. Returns {findings, total, by_severity, summary}. Each finding includes fixed_in (first patched version per NVD/MITRE version range) when a version range matched — omitted from wire when the range is open-ended or no input version was supplied; remediation copy then says 'Check if ... is affected ... and upgrade if so' instead of 'Upgrade to X.Y.Z or later'.

  Connector

• check_package

  DepScope

  Full machine-readable JSON report (~2k tokens). USE WHEN: you need to programmatically parse specific fields (CI gating, UI, sub-field extraction). Otherwise prefer get_package_prompt. RETURNS: {package, health:{score}, vulnerabilities[], latest, deprecated, maintainers, recommendation}.

  Connector

• whats_changed

  Releases

  Given a package and a `from`/`to` version, return the changelog entries between them — `(from, to]`, from exclusive, to inclusive — with summaries and breaking-change verdicts. One call instead of reading N changelog pages to plan an upgrade. `package` is a tracked source slug or a GitHub `owner/repo` coordinate (set `ecosystem: "github"` for a bare coordinate). Reads already-indexed releases only. If the package isn't in the catalog you'll get a clear 'not tracked' answer (npm/PyPI names may not be mapped to a source yet).

  Connector

• check_affected

  security-intel

  Check your installed packages against recent security advisories. Pay-per-value: $0 when nothing affects your versions (status all_clear/verify is always free), otherwise priced per confirmed match via x402 — you only pay when you learn you are actually exposed. Zero-friction input: paste your dependency file straight into `lockfile` — no need to hand-extract package/version. Auto-detected formats: package-lock.json, yarn.lock, requirements.txt (== pins), poetry.lock, Pipfile.lock, go.mod, go.sum, Cargo.lock, and CycloneDX / SPDX JSON SBOMs. Or pass an explicit `components` list of {package, version, ecosystem?} (you may pass both — they are merged). Built for agents that poll on their own clock: pass `since` (a cursor) to match ONLY advisories first published after your last check, so a repeated poll is free until something NEW hits you — and you pay at most once per new exposure. The returned `cursor` is interchangeable with get_since's cursor; store it and pass it back next time. Use `min_severity` to ignore (and not pay for) matches below your threshold. Returns advisories that affect (or may affect) your versions, each with the primary-source URL so you can verify independently. Trust-safe: when a version range cannot be parsed, or an advisory is product-level (no version data), it is reported as "verify" rather than silently cleared. Pair with the signed report for an auditable trail.

  Connector

• linux_audit

  ZEN SecDB

  Perform a Linux package vulnerability audit using SecDB. ## What this tool does Analyzes the installed packages of a Linux system-identified by OS and OS version-and returns vulnerability information plus a Markdown summary. The audit results are based exclusively on the package list provided by the user. ## When to use this tool Use this tool when the user wants to determine: - whether installed packages contain known vulnerabilities - whether a host, VM, container, or base image is affected by security advisories - which packages require patching or upgrading If the user does not know the valid values for `os` or `version`, first call the `linux_os` tool to retrieve the exact supported combinations. ## Inputs - **os**: Linux distribution identifier supported by SecDB (use `linux_os` to obtain allowed values). - **version**: OS version or codename corresponding to the selected distribution. - **packages**: list of installed packages, **one per line**, generated using the appropriate system command: ### For RPM-based distributions (RHEL, CentOS, Rocky, Alma, SUSE) rpm -qa --qf '%{NAME}-%{VERSION}-%{RELEASE}.%{ARCH}\n' ### For DEB-based distributions (Ubuntu, Debian) dpkg-query -W -f='${Package} ${Version} ${Architecture}\n' ### For Alpine Linux apk list -I The raw output of these commands can be passed directly as the `packages` input (one package per line). ... python3 3.12.3-0ubuntu2.1 amd64 systemd 255.4-1ubuntu8.10 amd64 tmux 3.4-1ubuntu0.1 amd64 ... ## Outputs - **report**: structured objects describing the advisories affecting the audited packages. - **summary**: Markdown summary including total vulnerabilities, severity breakdown, and key findings. ## LLM usage guidelines - Never guess whether a package is vulnerable-always call this tool for Linux audits. - If `os` or `version` is unclear or missing, call `linux_os` and ask the user to choose a valid combination. - Normalize the package list to “one entry per line” if the user provides unstructured output. - The `summary` is already Markdown and can be shown directly. - Use `report` when deeper technical analysis is required.

  Connector

• dali_version

  Dali by Lulu

  Current Dali MCP version and changelog. Check this whenever you want to know what tools are available, what changed in the latest release, or which version is running.

  Connector

• check-package

  Jeevesus — DugganUSA Threat Intelligence MCP

  Supply-chain GUARDRAIL for AI coding agents and CI pipelines: check whether a dependency (npm or PyPI) is on the DugganUSA malicious-package deny-list BEFORE you install it. This is the runtime defense against slopsquatting / HalluSquatting / hijacked-package attacks — an AI agent about to run `npm install` or `pip install`, or a CI pre-install hook, calls this FIRST and blocks on a hit. Returns a crisp, machine-actionable verdict: {ecosystem, package, version, malicious, verdict:"block"|"allow"|"review", reason, advice, source}. `malicious:true` = the exact package is on our OSV-curated deny-list (215k+ named-not-heuristic entries across npm + PyPI). `malicious:false` = not on our known-bad list — absence is NOT proof of safety, so still pin and review new deps. If a `version` is supplied and the entry is version-scoped, the check is version-aware; all-versions-malicious packages block on any version. Designed to be the easiest AI-supply-chain guardrail to wire in: one MCP tool call, no auth, in the agent's pre-install step. Same data is available for CI at /api/v1/stix-feed/packages.json. Examples: {"ecosystem":"npm","name":"cxp-jquery"} → malicious:true, verdict:block. {"ecosystem":"pypi","name":"requests"} → malicious:false, verdict:allow.

  Connector

• search_frictions

  copilot-studio-friction-index

  Ranked search over the Copilot Studio Friction Index. Exact error-code/message hits rank first, then title, alias, summary and symptom-checklist matches (solution bodies are NOT searched — an empty result means no record is indexed under these terms, not that the register lacks a fix). Use this when the user describes a Copilot Studio problem, symptom or keyword. Returns compact records with slug, status, severity, last-verified date and the citable powerleap.ch URL.

  Connector

• check_skill_safety

  Goodeye

  Run both system safety verifiers against a saved skill version. Resolves a UUID or owner-scoped slug. Visibility mirrors ``get_skill``: owner or any active grant; cross-user pointers surface as not found. Defaults to the latest version. Bills two metered verifier runs against the caller. The combined ``status`` is one of ``clean``, ``flagged``, ``blocked``, or ``error``; per-side ``block`` and ``advisory`` carry the verifier id, version, run id, verdict, and reasoning.

  Connector

• get_upgrade_status

  canton-ccpedia

  Upgrade Copilot for a Canton validator: given the Splice version a node runs and its network, report whether it is below the minimum in force, how many releases behind, the next topology freeze and LSU (with UTC time), the minimum .dar package versions, and the breaking changes between the running version and the target. Canton-specific. Use when an operator asks "am I safe to skip this week?", "what breaks if I upgrade?", or "when is my next deadline?".

  Connector

• get_latest_version

  DepScope

  Latest published version + deprecation flag — the cheapest call. USE WHEN: only a version string matters (pinning a dep, answering 'what version of X'). If you also need health/vulns use check_package. RETURNS: {latest, deprecated, published_at}.

  Connector

• dataset_files

  Dataverse Harvard

  List all files in the latest version of a Harvard Dataverse dataset identified by its DOI persistent ID (e.g. "doi:10.7910/DVN/..."), returning file names, content types, sizes, and download URLs.

  Connector

• check_vulnerability

  dynamic-feed

  Is this exact package (and version) vulnerable? FULL historical lookup across the entire OSV.dev corpus (Google) — every matching advisory + the versions that fix it. Use to check a dependency: "does lodash 4.17.10 have any known CVEs?". Args: package: package name (lodash, requests...). For Maven, pass the FULL 'group:artifact' coordinate (e.g. org.apache.logging.log4j:log4j-core) — a bare artifact name matches nothing in OSV, so it returns a hint, never a misleading "not vulnerable". version: exact version (optional but recommended, e.g. 4.17.10). ecosystem: npm | pip | maven | go | rubygems | nuget | cargo | composer (optional). Every value is returned in an Ed25519-signed, provenance-stamped envelope (source and observation time) you can verify offline against /.well-known/keys, no account required.

  Connector