"Nginx Proxy Manager" matching MCP tools:

• list_variables

  mcp

  List account variable NAMES (values are write-only — they are injected into proxy calls and container apps, never read back).

  Connector

• edgar_company_filings

  Edgar

  AUTHORITATIVE list of recent SEC filings for a specific US public company. Pass a ticker ("AAPL") or CIK ("320193"). Filter by form type — "10-K" (annual report), "10-Q" (quarterly), "8-K" (material event — but for severity-classified 8-Ks specifically, prefer sec_8k_recent), "DEF 14A" (proxy), "S-1" (IPO registration), etc. Returns filing dates, form types, accession numbers, document links. Use for "what did $TICKER recently file" or "show me the last N proxy statements for $TICKER". For specific financial metrics over time use edgar_company_concept; for the full XBRL dump use edgar_company_facts.

  Connector

• colony_list_mod_invites

  mcp-server

  List pending moderator invites. With ``colony_name``: the colony's outstanding invites (manager view; requires can_manage_mods). Without it: the invites awaiting *your* response.

  Connector

• ic_admin_approve_key_request

  Immersive Commons

  Approve a pending Z.ai key request and MINT the proxy key. Two-step: omit `confirm` (or pass false) for a dry-run preview of the exact proxy block that would be minted; pass `confirm: true` to mint. IDEMPOTENT on request_id — a second confirmed approve returns the SAME key (it does NOT mint a second key); the plaintext key is surfaced ONLY on the first mint. For member keys, `multiplier` overrides the requested multiplier. The minted key works ONLY against the IC→Z.ai gateway (it carries zero IC tool scopes). Rate-limited to 20 approve+deny mutations per token per UTC day; dry-run + idempotent re-approve do NOT count. Args: { request_id, multiplier?: 1|2|5|10|20, confirm? }. Returns dry-run shape on confirm=false; on the first confirm:true mint, { ok, minted:true, agent_token, token_prefix, proxy }. Required scope: admin:llm_keys.

  Connector

• add_firewall_rule

  BorealHost

  Add an IP firewall rule (allow or deny) and reload Nginx. Supports IPv4, IPv6, and CIDR notation. Max 100 rules per site. If a rule already exists for the IP, the action is updated. Requires: API key with write scope. Args: slug: Site identifier ip: IP address or CIDR (e.g. "1.2.3.4", "10.0.0.0/8", "2001:db8::/32") action: "deny" (block) or "allow" (whitelist). Default: "deny" Returns: {"added": true, "ip": "1.2.3.4", "action": "deny"}

  Connector

• mobile-proxy_5gb

  x402-farm

  Buy 5 GB of mobile proxy bandwidth on a real 4G/5G carrier IP address (Orange, France and Guadeloupe, AS16028), delivered as a proxy key valid for 30 days. Mobile addresses are shared by thousands of subscribers, making them the hardest class of IP to block without hitting legitimate users. Carrier, ASN and uptime verified live at purchase. Suited to agents running sustained collection against sites that already reject residential exits. — $30.00/call, paid per request via x402 (USDC).

  Connector

• add_subdomain

  BorealHost

  Create and route a subdomain of a site-linked domain. Creates the DNS A record (if absent) pointing at the site's server, then configures the nginx vhost and SSL certificate on that server. The domain must already be linked to a site (see link_domain). Idempotent: if the DNS record already exists and points at the site's server, the nginx/SSL steps are (re)applied — safe to re-call, e.g. to retry SSL after DNS propagation. May take up to 3 minutes when a certificate is issued. Requires: API key with write scope. Args: domain_name: Registrable domain linked to a site (e.g. "example.com") subdomain: Subdomain label only, no dots (e.g. "blog") Returns: {"fqdn": "blog.example.com", "domain": "example.com", "site": "my-site", "message": "..."} Errors: NOT_FOUND: Domain not found VALIDATION_ERROR: Domain not linked to a site, invalid label, or an existing record points at a different server

  Connector

• audit_stack

  Exploit Intelligence Platform — CVE, Vulnerability and Exploit Database

  Audit a technology stack for exploitable vulnerabilities. Accepts a comma-separated list of technologies (max 5) and searches for critical/ high severity CVEs with public exploits for each one, sorted by EPSS exploitation probability. Use this when a user describes their infrastructure and wants to know what to patch first. Example: technologies='nginx, postgresql, node.js' returns a risk-sorted list of exploitable CVEs grouped by technology. Rate-limit cost: each technology requires up to 2 API calls; 5 technologies counts as up to 10 calls toward your rate limit.

  Connector

• fetch_feed

  Crypto Feeds

  Fetch and normalize any RSS / Atom / RDF feed by URL. CF-robust: fetches directly and falls back to a proxy if the source blocks the gateway. Use list_feeds first for curated sources.

  Connector

• fdic_compare_peer_health

  FDIC BankFind MCP Server

  Compare CAMELS-style health scores across a group of FDIC-insured institutions. Three usage modes: - Explicit list: provide certs (up to 50) for a specific comparison set - State-wide scan: provide state to compare all active institutions in that state - Asset-based: provide asset_min/asset_max to compare institutions by size Optionally provide cert to highlight a subject institution's position in the ranking. Output: structuredContent includes {model, official_status, report_date, institutions, metrics, peer_context, proxy_summary, proxy, deprecations}. Institutions include proxy scores and name_source. When a subject cert is provided, metrics[] is the preferred subject-vs-peer array for new UI bindings and proxy_summary is a flattened subject proxy. peer_context.subject_percentiles is deprecated, remains for backward compatibility, and is targeted for removal only in a future coordinated major release. Auto-peer selection derives asset bands from report-date financials and broadens the cohort if fewer than 10 peers match. NOTE: Public off-site analytical proxy — not official supervisory ratings.

  Connector

• search_cves

  nvd

  Search NVD for CVE vulnerabilities by product or component name. Returns CVE ID, description, severity, and CVSS score. Search terms are matched against CVE description text and EVERY word must appear, so pass the product name ("OpenSSL", "log4j", "nginx") optionally with a technical term ("buffer overflow") — not a plain-English question. Use when researching security threats or checking if a known vulnerability affects your systems.

  Connector

• security_headers_check

  IA-QA — 130+ QA & Dev Tools for AI Agents

  Analyse the HTTP security headers of a public URL OR of raw response headers you paste in. Grades each header (A–F) for: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, X-XSS-Protection, Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy, and Cross-Origin-Embedder-Policy. Returns an overall score (0–100), per-header grades, missing headers, and fix snippets for Express, Nginx, and Apache. For localhost/private targets the remote server cannot reach, pass the `headers` parameter instead of `url`.

  Connector

• sigil_verify_ip_type

  TunnelMind Data API

  Classifies an IPv4 or IPv6 address by network type — the high-value ad-fraud signal being datacenter traffic posing as residential or living-room (CTV) devices. IP→ASN resolution uses Team Cymru's public service; the ASN is then classified by its registered organization name. It also cross-references the Scry attacker-observation corpus to detect anonymizing EGRESS — the thing a rotating-residential proxy provider is built to hide. A residential- or mobile-looking IP that Scry has observed acting as a hostile actor is a residential-proxy exit node (home devices don't scan honeypots); tor and vpn egress are named outright. It also identifies the proxy COMPANY by network: if the IP's ASN belongs to a known VPN/anonymizing-egress provider (X4BNet's curated list), the verdict is `vpn` and `scry_signals` carries `vpn_provider_asn` — even when Scry has never observed the IP acting. Datacenter and residential proxy verdicts still require observed conduct. PRIVACY: the IP is used for lookup only — never logged, never stored. The Scry cross-reference is likewise a read-only corpus lookup. Inputs: - `ip` (query, required): IPv4 or IPv6 address. Returns: - `ip_type`: datacenter | residential | mobile | unknown. - `confidence`: high | medium | low. - `asn`, `asn_name`: the resolved autonomous system. - `proxy_suspected`: boolean — the IP is an anonymizing egress. - `proxy_type`: tor | vpn | residential_proxy | datacenter_proxy | null. - `scry_signals`: evidence strings from the corpus (actor_class, threat feeds, observation counts); empty when the IP is unknown to Scry. Latency: - Typical: 100-250ms (DNS + a parallel corpus lookup).

  Connector

• foura_auto

  mcp

  Give it a public URL and get the content back. This is the default when you don't want to choose between HTTP, proxy rotation, and a full browser. On protected targets, or whenever HTTP 200 may still be a challenge or incomplete page, pass validate.data.accept with text unique to the real content. Auto makes bounded attempts and returns either validated content or a failure; it cannot guarantee a match. The response includes completion details and, by default, reusable session values for follow-up calls. Use a lower-level tool when you need direct control over HTTP, proxy selection, or browser navigation, or to choose which browser is presented to the target: that lives on foura_single and foura_proxy.

  Connector

• get_mindshare

  n0brains

  [DRILL-DOWN] Mindshare leaderboard: each asset's share of crypto attention across n0brains' sources over the window, ranked, with velocity (rising / falling / emerging). The edge is a coin's attention ACCELERATING before price moves. Directional proxy over n0brains sources, NOT a market-wide social-firehose absolute. Same data as REST /mindshare.

  Connector

• abi_fetch

  FabTally Decode

  PAID $0.002 (x402, USDC on Base). Fetch the verified ABI + metadata for a contract. Give {address, chain}; get the ABI JSON, verification status/source (Sourcify or Blockscout), the callable function/event signatures, and full proxy-implementation resolution (EIP-1967/1822/OZ-legacy/beacon) — returning the implementation's ABI when it's a proxy. Without payment returns the x402 challenge; pass x_payment to settle.

  Connector

• ios_traffic_start

  Robot Actions — Remote Device Control

  Start TLS inspection on a physical iOS device: brings up a per-device TLS-inspecting proxy and installs a CA-trust + HTTP-proxy config profile, so subsequent HTTPS traffic is DECRYPTED and captured (works for native apps too, unlike Safari DevTools). Then drive the app and read flows with ios_traffic_flows. Defaults to the supervised SILENT install (zero on-device interaction); if no supervision keybag is configured it falls back to a prompt install (user taps Install on the device). Certificate-pinned apps will not decrypt.

  Connector

• manager_holdings

  Sausage Finance

  An institutional manager's 13F holdings for the latest quarter. Pass a CIK for the portfolio, or a name to search managers first. Examples: {manager:'1067983'} (Berkshire's book), {manager:'bridgewater'} (search). Paid: call without x_payment to receive this call's exact terms (amount, asset, network), sign them, then call again with x_payment. The free `pricing` tool lists every price at once.

  Connector

• get_web_page_text

  mcp

  Fetch (scrape) a URL using ScrapingAnt and return the web page content as plain text. Args: url: The URL of the page to extract (scrape). browser: Whether to use browser rendering. Default: True. proxy_type: Type of proxy to use. Default: 'datacenter'. Use 'residential' if you encounter anti-bot detection, which improves anti-bot avoidance. proxy_country: Optional ISO-3166 country code. Default: random worldwide proxy. Use when facing geo-restrictions. Available country codes: ae, au, br, ca, cn, cz, de, es, fr, gb, hk, id, il, in, it, jp, kr, my, nl, ph, pl, ru, sa, sg, th, us, vn.

  Connector

• cloudflare_set_proxy

  BorealHost

  Enable or disable Cloudflare CDN proxy for a site. When enabled (orange cloud): traffic goes through Cloudflare's CDN, gets caching, DDoS protection, and SSL termination at the edge. When disabled (grey cloud): traffic goes directly to origin server. Requires: API key with write scope. Args: slug: Site identifier proxied: true to enable CDN proxy, false to disable Returns: {"domain": "my-site.borealhost.ai", "proxied": true, "ip": "1.2.3.4"}

  Connector