"LoopBack" matching MCP tools:

• dns_diagnose_sip_target

  Sipflow

  [cost: external_io (DNS via Cloudflare + Google; TLS handshake + a SIP OPTIONS keepalive to public targets when applicable) | read-only | rate-limited per IP: 10/min, 200/day] Walk DNS the same way a SIP UA does (RFC 3263 §4.1): NAPTR → SRV → A/AAAA. Given a SIP URI ("sip:example.com"), bare hostname ("example.com"), or "host:port" string, return the records that exist and the resolution ladder a UA would try. When the queried target uses TLS (`sips:` URI, `transport=tls/wss`, or any `_sips._tcp` SRV record), the tool also performs a TLS handshake against each resolved sips target and reports the negotiated TLS version + cipher, the leaf certificate's subject / issuer / SANs / validity, the chain length and whether it validates against Node's default trust store, plus two cert-domain checks: RFC 5922 §7.2 strict (cert must cover the original SIP domain) and a lenient SAN match against the SRV target hostname. SIP liveness: DNS resolving and a TLS handshake succeeding do NOT prove the endpoint actually speaks SIP - a load-balanced node can accept TCP/TLS yet black-hole SIP. So the tool ALSO sends a real SIP OPTIONS keepalive to each resolved public IP across the relevant transports (UDP/TCP on 5060, TLS on 5061 / SRV port) and reports per-IP answered / timeout / refused. Any SIP response (even 405/403/404) proves the stack is alive on that IP. When a name resolves to multiple IPs it is treated as a load-balancer fan-out and each IP is probed individually, with a warning about the known failure modes of fronting stateful SIP/RTP with a cloud L4 LB (AWS NLB/ALB etc.): cross-zone-off targets that black-hole, the ~120s UDP idle timeout, and per-5-tuple hashing splitting signaling from media. Egress safety: - Per-IP rate limited. - Hostnames that resolve only to RFC 1918 / loopback / link-local / documentation / multicast space are refused (SSRF guard). - Walk depth capped to prevent runaway NAPTR / CNAME chains. - TLS probes capped at 6 (host, port, ip) tuples per call, 5 s handshake timeout each, public-IP only (we connect to the resolved IP, not the hostname, so the system resolver cannot redirect us into private space). - SIP OPTIONS probes capped at 6 (ip, transport) tuples per call, 3 s timeout each, public-IP only; the request carries no SDP/body and an unroutable Via, and only the response status line is captured. Use to diagnose: - "carrier doesn't answer" / "wrong port" / "TLS instead of UDP" routing puzzles - "DNS looks healthy but calls fail" - per-IP SIP OPTIONS surfaces nodes that resolve and accept the transport but never answer SIP (the decisive step for load-balanced / multi-IP targets) - "carrier rejects our target because no SRV is published" - when A/AAAA resolves but SRV is missing the tool synthesises a copy-pasteable suggested zone-record block pointing at the resolved canonical hostname - "TLS handshake works but cert isn't valid for the SIP domain" - RFC 5922 §7.2 compliance is checked separately from generic chain validation, since the SAN must cover the *original* SIP domain (not the SRV-redirected target) ACL caveat: a SIP OPTIONS timeout can also mean the target authorizes inbound SIP by source IP whitelist on the trunk (Twilio, Telnyx, Bandwidth, …; see https://www.twilio.com/docs/sip-trunking/api/ipaccesscontrollist-resource) and is dropping our probe because our egress IP is not on the ACL. An `answered` result is conclusive (the node speaks SIP); a `timeout` is suggestive, not proof of a dead node - confirm reachability from the SBC itself. Pair with: `troubleshoot_response_code` when 503 / 408 / 480 are involved; `search_sip_docs(vendor=...)` for carrier-specific routing docs.

  Connector

• attachments

  Homespun

  Binary attachments (images, PDFs, audio, video) referenced from event payloads and input_data via `format: homespun-attachment-id`. Actions: upload, fetch, presign, finalize, download, show, list, delete, mint_token, revoke_token, list_tokens. Choosing an upload path matters for cost. An inline upload with `content_base64` carries the bytes in the tool-call arguments, so they enter the model context at a token cost proportional to file size, paid again on every retry; a few-hundred-KB image is already expensive. Two paths avoid that entirely: fetch, when the bytes are reachable at a URL, and presign plus finalize, when the client can PUT the raw bytes out of band. Inline upload suits small assets and clients that have neither a URL nor an out-of-band PUT. fetch takes { source_url (https), scope } and the relay downloads the URL itself behind an SSRF guard (https only, no private, loopback or metadata hosts, DNS pinned, redirects refused, size-capped and timed out), then runs the same byte-sniff, allowlist, size, quota and scan checks as any upload. It works on any storage backend. upload takes either `content_base64` (base64 bytes, no filesystem) or `file_path` (an absolute path read on the relay host, so it only applies when the file is local to the relay). presign plus finalize is token-free: presign with { mime, size, sha256, scope } returns { put_url, attachment_id }, the caller PUTs the raw bytes to put_url over plain HTTP out of band, then finalize with the attachment_id. At finalize the relay re-reads the stored bytes, sniffs the real type, and enforces the same allowlist, size, sha256, quota and scan checks, so a presign that misstates its mime is caught and never served inline. The presigned path requires the Azure storage backend; a filesystem-backed relay returns a clear not-supported error and fetch or inline upload apply there instead. download writes to an absolute out_path or returns base64. An upload is scoped to agent (the default, reusable) or app. mint_token returns a /b/<token> capability URL, shown once, that a browser can GET without the caller's API key.

  Connector

• create_geometry_export

  DaedalMap Administrative Boundaries (loc_id to polygon)

  Creates a synchronous v0 geometry export from exact loc_ids or one strict scope as real GeoJSON, gzipped GeoJSON, or zipped GeoJSON. Hosted service default: 250 selected loc_ids, sized around a 10-20 second response budget and configurable by deployment. A direct local-runtime loopback caller has no service item cap. Use estimate_geometry_package or get_tool_help for the effective access lane.

  Connector

• create_webhook

  Kamy

  Register an HTTPS endpoint that Kamy POSTs to when work finishes, so a long render or an e-signature does not have to be polled. Use this when the caller owns a server that can receive callbacks; use get_job or list_renders when it cannot. The response includes a one-time signing secret used to verify delivery signatures — it is shown here and never again, so surface it to the user immediately and tell them to store it. Defaults to the render.completed and render.failed events; the full set is render.completed, render.failed, signature.signed, signature.voided, signature.expired, signature.envelope_completed, signature.envelope_voided, test.ping, and any other string is accepted so new events can be subscribed to without an upgrade. Endpoint URLs on private, loopback, link-local or cloud-metadata hosts are rejected at registration, so a localhost tunnel will not work — use a public URL.

  Connector

• create_webhook

  Dock

  Register a new webhook endpoint on an org. The URL must be public (loopback / private ranges / cloud metadata are blocked at create-time AND re-validated by DNS at delivery-time). Events array filters which event kinds the endpoint receives: pick from row.* / comment.* / member.* / workspace.* / doc.*; an empty array means "none" so always pass at least one. Returns the signing `secret` exactly once (whsec_… prefixed); store it on the receiver to verify HMAC signatures on incoming requests.

  Connector

• attachments

  Pane

  Binary attachments (images, PDFs, audio, video) referenced from event payloads and input_data via `format: homespun-attachment-id`. Actions: upload, fetch, presign, finalize, download, show, list, delete, mint_token, revoke_token, list_tokens. Choosing an upload path matters for cost. An inline upload with `content_base64` carries the bytes in the tool-call arguments, so they enter the model context at a token cost proportional to file size, paid again on every retry; a few-hundred-KB image is already expensive. Two paths avoid that entirely: fetch, when the bytes are reachable at a URL, and presign plus finalize, when the client can PUT the raw bytes out of band. Inline upload suits small assets and clients that have neither a URL nor an out-of-band PUT. fetch takes { source_url (https), scope } and the relay downloads the URL itself behind an SSRF guard (https only, no private, loopback or metadata hosts, DNS pinned, redirects refused, size-capped and timed out), then runs the same byte-sniff, allowlist, size, quota and scan checks as any upload. It works on any storage backend. upload takes either `content_base64` (base64 bytes, no filesystem) or `file_path` (an absolute path read on the relay host, so it only applies when the file is local to the relay). presign plus finalize is token-free: presign with { mime, size, sha256, scope } returns { put_url, attachment_id }, the caller PUTs the raw bytes to put_url over plain HTTP out of band, then finalize with the attachment_id. At finalize the relay re-reads the stored bytes, sniffs the real type, and enforces the same allowlist, size, sha256, quota and scan checks, so a presign that misstates its mime is caught and never served inline. The presigned path requires the Azure storage backend; a filesystem-backed relay returns a clear not-supported error and fetch or inline upload apply there instead. download writes to an absolute out_path or returns base64. An upload is scoped to agent (the default, reusable) or app. mint_token returns a /b/<token> capability URL, shown once, that a browser can GET without the caller's API key.

  Connector

• upshift_site_audit

  Upshift

  Fetch a live website and report how legible it is to search engines and AI assistants: structured data (JSON-LD), llms.txt, robots.txt, title and meta description, headings, image alt text, HTTPS and document weight. Returns findings with severity and a 0-100 score. Use this to check a real site before recommending changes to it. Makes one outbound request to the URL given, so it only sees what a fetch can establish — never rendering or browser metrics. Refuses private, loopback and link-local addresses, and reports a page as unreachable rather than scoring the error body.

  Connector

• clone_site

  WebZum - The Hosting Layer for AI-Generated Web Content

  Clone a public web page into a hosted site. Fetches the URL, walks its same-origin assets (CSS, JS, images, fonts), rewrites references to local paths, and uploads everything as a working hosted copy in one shot. ========================================================================== USE THIS WHEN THE USER SAYS ========================================================================== - "clone this site / page / website" - "copy this site / page" - "mirror this site" - "duplicate this page" - "save this website" - "make me a version of <URL>" - "I want this page on my own domain" - "rip this page", "fork this site", "backup this site" If a user pastes a URL and wants their own copy of what's there — this is the tool. The agent should not try to recreate the page from memory or by describing what it sees: that is slow, lossy, and burns your context window for no benefit. `clone_site` produces a byte-accurate copy in seconds and leaves your context free for the iteration the user actually wants (rewriting copy, swapping images, restyling, etc.). ========================================================================== WHAT IT DOES ========================================================================== Default behavior is to crawl assets so the cloned page actually renders. Set `crawlAssets: false` to save only the single HTML response without following any assets — useful when you only want the markup. Only http:// and https:// URLs are allowed. Private, loopback, and cloud-metadata addresses are refused. Per-asset cap 10MB; per-clone caps 50 files and 50MB total. Cross-origin asset URLs are kept as-is (not fetched) so external CDN references still resolve. If the user wants a polished, researched site (logo, original copy, SEO, mobile-ready, multi-page) rather than a clone of someone else's page, send them to https://webzum.com for a free preview.

  Connector

• create_geometry_export

  DaedalMap Disaster and Geospatial Data

  Creates a synchronous v0 geometry export from exact loc_ids or one strict scope as real GeoJSON, gzipped GeoJSON, or zipped GeoJSON. Hosted service default: 250 selected loc_ids, sized around a 10-20 second response budget and configurable by deployment. A direct local-runtime loopback caller has no service item cap. Use estimate_geometry_package or get_tool_help for the effective access lane.

  Connector

• observe_public_page

  project-little-weirdo

  DETERMINISTIC OBSERVATION. Fetches one lawful public web page and records a bounded representation of it (title, normalized text length, content fingerprint). If the page was observed before, returns an arithmetic comparison against the previous observation: BASELINE_CREATED, NO_CHANGE or CONTENT_CHANGED. Makes no claim about meaning. Input: url (public http/https page). Private, loopback and internal addresses are refused; redirects, response size and timeouts are bounded. Uncertainty: the verdict is arithmetic, not semantic. A CONTENT_CHANGED verdict proves the content differs, not that the difference matters. Cost: free beta, rate limited per credential. No payment capability exists.

  Connector

• scan_mcp

  TunnelMind Data API

  Connect to a caller-supplied MCP server (Streamable-HTTP transport), read its advertised tools, and run the injection corpus over every tool name / description / input schema — plus a capability heuristic that flags broad, dangerous powers (shell execution, filesystem write, credential access, arbitrary network, destructive DB ops). Returns a per-tool safety report. A caution to review, never a verdict. This is a single-target, caller-initiated scan. It is NOT a crawler and does not follow links or enumerate other servers. Loopback / private / internal hosts are rejected. Use this tool when: - You are about to connect an agent to a third-party MCP server and want to inspect its tools for embedded instructions or excessive powers first. Do NOT use this tool when: - You only have a blob of text — use `scan_injection`. - You want a trust verdict on a domain or entity — use `cross_lens_verify`. Inputs: - `url` (body, required): the MCP server endpoint (http/https). Returns: - `server`: `{ name, version }` reported by the server, if any. - `tools_scanned`: number of tools inspected. - `flagged_count`: tools with an injection hit or a flagged capability. - `risk`: worst per-tool risk across the server (`high`/`medium`/`low`/`none`). - `score`: max injection score across tools (0..1). - `tools`: per tool `{ name, risk, injection{...}, capabilities[] }`. Cost: - Free. No API key required. Latency: - Bounded by the target server's handshake; typically <2s.

  Connector

• create_webhook

  Kamy

  Register an HTTPS endpoint that Kamy POSTs to when work finishes, so a long render or an e-signature does not have to be polled. Use this when the caller owns a server that can receive callbacks; use get_job or list_renders when it cannot. The response includes a one-time signing secret used to verify delivery signatures — it is shown here and never again, so surface it to the user immediately and tell them to store it. Defaults to the render.completed and render.failed events; the full set is render.completed, render.failed, signature.signed, signature.voided, signature.expired, signature.envelope_completed, signature.envelope_voided, test.ping, and any other string is accepted so new events can be subscribed to without an upgrade. Endpoint URLs on private, loopback, link-local or cloud-metadata hosts are rejected at registration, so a localhost tunnel will not work — use a public URL.

  Connector

• get_strategy_doc

  flash-props-api

  Returns the Flash Odds Automation OS strategy document (2026-07-17). 14 sections covering: current architecture map, automation scorecard (26/70), event model, state machine, social operating strategy, live automation maturity ladder, competitive differentiation thesis, proprietary analytics catalog, product experience, prioritized roadmap, and a concrete build-now engineering spec for the CDL result-provider adapter. Use this to understand how Flash Odds is built, what is and is not automated, what to build next, and the core design invariants (frozen claims, no fabrication, approval-gated X posts, Chamber loopback-only). Read-only. No side effects. No API key required.

  Connector

• parse_ip

  Ipaddress

  Validate and classify an IP address (IPv4 or IPv6): version, validity, and classification (private/loopback/link-local/multicast/reserved/public). IPv4 also returns its 32-bit integer. Keyless, offline.

  Connector

• fetch_url

  agentsearch-mcp

  Fetches any public http(s) URL, strips boilerplate (scripts, nav, footer, ads), and returns clean text or markdown ready for an LLM context window. SSRF-guarded — refuses private/loopback/internal hosts. Returns url, title, format, length, content (and finalUrl when redirected, plus up to 50 extracted links when links=true), with a meta envelope. Works with no API key.

  Connector

• ingest_url_data_source

  clariBI.com

  Create a new data source by fetching a public URL on the server side. Handles CSV, TSV, JSON, Excel, TXT, and PDF. Private networks (RFC 1918, loopback, cloud metadata) are blocked. Returns the data_source_id once preprocessing has started. Use this for files larger than the 25 MB inline upload cap.

  Connector

• download_url_to_bucket

  qencode

  Server-side copy of a public URL into a bucket (no transcoding). The server fetches `source_url` itself and streams the bytes straight into the bucket via a short-lived presigned upload — use this to ingest an existing asset into Qencode Media Storage as-is. To store a *transcoded* result instead, set a `destination` on a transcoding job. IMPORTANT — this call is synchronous and blocking: it returns only after the whole file has been fetched and uploaded, and there is no job token or progress to poll (unlike transcoding). The transfer must finish inside the presigned upload window (~10 minutes) and is size-capped server-side, so it suits small/medium assets; very large or slow sources may time out — upload those out-of-band instead. Args: source_url: a publicly reachable `http(s)` URL the server can fetch directly. Non-http(s) schemes and private/loopback hosts are rejected up front; a source that responds with a redirect or a 4xx/5xx fails the transfer. bucket: destination bucket name. key: destination object key (e.g. `raw/input.mov`). An existing object at this key is overwritten. Returns `{bucket, key, size_bytes, status: "uploaded"}`.

  Connector

• create_geometry_export

  DaedalMap Geocoding and Reverse Geocoding (loc_id)

  Creates a synchronous v0 geometry export from exact loc_ids or one strict scope as real GeoJSON, gzipped GeoJSON, or zipped GeoJSON. Hosted service default: 250 selected loc_ids, sized around a 10-20 second response budget and configurable by deployment. A direct local-runtime loopback caller has no service item cap. Use estimate_geometry_package or get_tool_help for the effective access lane.

  Connector

• ipv4_private_check

  ToolAPI

  Classify IP as private/loopback/link-local/global (SSRF helper).

  Connector

• ip_reputation_classify_ip

  mcp-revenue-empire — Japan public-data ledgers

  Classify an IPv4/IPv6 address into special-use categories (public, private, loopback, link-local, CGNAT, reserved, etc.) from bundled IANA special-use ranges. Pure; price 0.0 (free).

  Connector