Skip to main content
Glama
650,501 tools. Updated 2026-10-14 00:42

"Open-Source MCP Server in Python with PostgreSQL and OAuth 2.0" matching MCP tools:

  • Attach an image to an existing product by giving Partle a public URL to download the image from. Authenticated. OAuth (scope `products:write`) preferred; `api_key` fallback. **When to use this tool**: the image is already hosted at a public URL (a scraped product page, an Imgur link, a CDN URL the user provided). Partle's server fetches it and stores it. **When NOT to use this tool**: you have local image bytes (a file the user attached, or bytes you generated/downloaded in your sandbox). Sending those bytes through a tool argument blows past conversation context limits — phone-photo-sized payloads can be 6+ MB of base64. Instead, in your code-execution sandbox, POST the file directly to the HTTP endpoint with multipart encoding: requests.post( "https://partle.rubenayla.xyz/v1/external/products/{product_id}/images", files={"file": open("/path/to/photo.jpg", "rb")}, headers={"X-API-Key": "pk_..."}, ) Or, to create the listing and attach an image in one HTTP request: requests.post( "https://partle.rubenayla.xyz/v1/external/products", data={"metadata": json.dumps({"name": ..., "price": ...})}, files={"image": open("/path/to/photo.jpg", "rb")}, headers={"X-API-Key": "pk_..."}, ) Args: product_id: ID of the product to attach the image to. image_url: Publicly fetchable URL of the image. Server fetches it and stores it. api_key: Optional API key (`pk_*`, generate at /account). Used when there is no OAuth token, and also when the OAuth token lacks the required scope — an explicitly passed key overrides an ambient token that is scoped too narrowly. An invalid or revoked token still fails regardless. Omit when using OAuth. Returns: The created `ProductImage` record with its `id` (use for deletion) and storage path, or ``{"error": ...}`` on validation/auth failure.
    ConnectorNo auth
  • Authenticate the MCP session with Quadratic. Actions: • login() — Start an OAuth device authorization flow. Returns a URL the user must open in a browser to authorize. The flow is completed by confirm_login. • confirm_login(device_code) — Complete an in-progress login by polling for user authorization. If the response indicates the user has not yet authorized, this action can be called again with the same device_code to continue polling. confirm_login is idempotent: if a later tool call reports "Not authenticated on this connection", call confirm_login again with the same device_code to re-establish auth (some clients use a new session per request, so the session that ran the tool may differ from the one that logged in). • set_token(token, email?) — Set a JWT directly (used when the OAuth device flow is not available). • logout() — Clear saved authentication for the current session.
    Connector
    Destructive
    No auth
  • Attach an image to an existing product by giving Partle a public URL to download the image from. Authenticated. OAuth (scope `products:write`) preferred; `api_key` fallback. **When to use this tool**: the image is already hosted at a public URL (a scraped product page, an Imgur link, a CDN URL the user provided). Partle's server fetches it and stores it. **When NOT to use this tool**: you have local image bytes (a file the user attached, or bytes you generated/downloaded in your sandbox). Sending those bytes through a tool argument blows past conversation context limits — phone-photo-sized payloads can be 6+ MB of base64. Instead, in your code-execution sandbox, POST the file directly to the HTTP endpoint with multipart encoding: requests.post( "https://partle.rubenayla.xyz/v1/external/products/{product_id}/images", files={"file": open("/path/to/photo.jpg", "rb")}, headers={"X-API-Key": "pk_..."}, ) Or, to create the listing and attach an image in one HTTP request: requests.post( "https://partle.rubenayla.xyz/v1/external/products", data={"metadata": json.dumps({"name": ..., "price": ...})}, files={"image": open("/path/to/photo.jpg", "rb")}, headers={"X-API-Key": "pk_..."}, ) Args: product_id: ID of the product to attach the image to. image_url: Publicly fetchable URL of the image. Server fetches it and stores it. api_key: Optional API key (`pk_*`, generate at /account). Used when there is no OAuth token, and also when the OAuth token lacks the required scope — an explicitly passed key overrides an ambient token that is scoped too narrowly. An invalid or revoked token still fails regardless. Omit when using OAuth. Returns: The created `ProductImage` record with its `id` (use for deletion) and storage path, or ``{"error": ...}`` on validation/auth failure.
    ConnectorNo auth
  • List the OAuth 2.0 tokens cached for an environment, with their grant type and expiry. Access and refresh token values are never returned. Use this to see cached tokens; to request, refresh or drop one use manage_oauth2_token. Requires project context.
    ConnectorAPI key
  • No arguments. Returns how many MCP servers have been read at source level, and the share of them with each category of finding (credential access, network egress, install-time execution, prompt-injection surface). Use this to judge whether checking a specific server is worth it before you look one up. It reports aggregate counts only - no per-server findings, and no verdict about any individual server.
    ConnectorNo auth
  • Searches published article content from the provided raumnebenan source with case insensitive text matching. Use this as the first discovery step when the exact slug or id is unknown then call get_article_by_id for full details. Use only this tool output do not use external or inferred data. If required information is missing in this source respond that it is not available in the provided source. Only JSON RPC 2.0 requests are supported.
    ConnectorNo auth

Matching MCP Servers

Matching MCP Connectors

  • Read, write, and conversationally review open-source flashcards through split read/write MCP tools.

  • Global weather via Open-Meteo: forecast, historical, marine, air quality, geocoding, elevation.

  • Start the OAuth2 authorization flow. Returns an authorization URL. Open it in a browser to log in and authorize. Then call ``check_oauth_status`` with the same npub to complete. Free. Proof of npub ownership is required so an observer cannot DOS your account by initiating OAuth flows in your name. Do NOT call this pre-emptively. If a session may still be valid, attempt the live tool call first and only begin OAuth when it fails with ``upstream_auth_refresh_needed``. A 'pending' ``check_oauth_status`` is not evidence that an existing session has lapsed.
    ConnectorNo auth
  • Explains how to connect an account to this MCP server — read this instead of guessing at a login/registration tool, because there isn't one. ClusterHack's own credential endpoints (register, login, JWT issuance, password reset) are the website's login form, not MCP tools: an MCP client authenticates by OAuth 2.1 (the same flow a human approves in a browser tab) and must never see or handle a ClusterHack password directly. This tool works with no account at all, and just explains the steps and links.
    ConnectorNo auth
  • TAKES NO ARGUMENTS. POST {"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"no_arguments_triage_this_hosts_own_crawler_log","arguments":{}}} to https://www.pathwren.workers.dev/mcp/triage — the answer is the triage of THIS host's own published request log — every operator in it run through the same parser, the same crawler index and the same operator-prefix verification that triage_log applies to a file you paste, rolled up by operator, by category and by crawler, with the share no index entry matches at all and the browser-shaped strings named separately. There is nothing to fill in: the input schema is literally empty, `arguments: {}` and no `arguments` key at all both work, and the subject is a file this host already publishes, so the answer does not depend on you at all. No key, no account, no OAuth, no session to open first, read-only, and nothing for you to invent. Nothing is fetched to build it — no request leaves this edge, and none is made to you. The other zero-argument call on this server is triage_my_request, same empty arguments, which answers your own request triaged as one line of an access log — the crawler this host's index identifies from your user-agent, its operator and category, and whether the address you came from verifies against that operator's published prefixes. whoami and example are here too and take nothing either. Every other tool on this server wants a file pasted in; this one wants nothing. The siblings answer one question each under the tool named beside them: /mcp (whoami), /mcp/doctor (no_arguments_check_this_hosts_own_discovery_documents), /mcp/lint (whoami), /mcp/robots (no_arguments_lint_this_hosts_robots_txt), /mcp/netcheck (no_arguments_report_the_crawler_ip_ranges_this_host_mirrors), /mcp/markdown (markdown_lane_self_report). Example: the complete call, exactly as written, nothing to fill in — {"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"no_arguments_triage_this_hosts_own_crawler_log","arguments":{}}} returns the rollup by operator, category and crawler over this host's own published window, the cost of blocking each crawler identified, the requests that match no entry in the index, and the robots.txt those findings would generate.
    ConnectorNo auth
  • TAKES NO ARGUMENTS. POST {"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"no_arguments_report_the_crawler_ip_ranges_this_host_mirrors","arguments":{}}} to https://www.pathwren.workers.dev/mcp/netcheck — the answer is the state of every crawler-operator prefix list this host mirrors — how many IPv4 and IPv6 prefixes each source publishes and how many addresses that is, when each was last fetched and how many minutes ago that was, which crawlers each source covers, which prefixes more than one operator claims, and the verification method each operator documents for the crawlers that publish no list at all. There is nothing to fill in: the input schema is literally empty, `arguments: {}` and no `arguments` key at all both work, and the subject is a file this host already publishes, so the answer does not depend on you at all. No key, no account, no OAuth, no session to open first, read-only, and nothing for you to invent. Nothing is fetched to build it — no request leaves this edge, and none is made to you. The other zero-argument call on this server is verify_my_address, same empty arguments, which answers the address you are calling from, checked against every operator-published prefix list this host mirrors with your user-agent taken as the claim — the verdict, the prefix that matched, which operator published it and when it was last mirrored. whoami and example are here too and take nothing either. Every other tool on this server wants a file pasted in; this one wants nothing. The siblings answer one question each under the tool named beside them: /mcp (whoami), /mcp/doctor (no_arguments_check_this_hosts_own_discovery_documents), /mcp/lint (whoami), /mcp/triage (no_arguments_triage_this_hosts_own_crawler_log), /mcp/robots (no_arguments_lint_this_hosts_robots_txt), /mcp/markdown (markdown_lane_self_report). Example: the complete call, exactly as written, nothing to fill in — {"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"no_arguments_report_the_crawler_ip_ranges_this_host_mirrors","arguments":{}}} returns a row per source with its prefix counts, address total, fetch time and staleness in minutes, the prefixes published by two operators at once, and the split between operators you can verify by prefix and operators you can only verify by reverse DNS.
    ConnectorNo auth
  • Start an OAuth Connect and get the consent URL to open in a browser. Pass provider (github|google|x|atlassian|microsoft|slack|notion|gitlab|discord|reddit|linear — account-wide, reused everywhere) OR server_url (any MCP server; Rokha runs the MCP auth-spec handshake, grant bound to that server). On approval the token lands in the vault under the returned alias. Requires a logged-in identity.
    ConnectorNo auth
  • The signed-in Epsilon account behind this session: account id, handle, linked wallets (embedded first), the scopes this client was granted, and which client is connected. Call it first after sign-in to learn the wallet address other tools need. Requires an OAuth session (connect to /mcp/account); on the keyless /mcp endpoint it explains how to sign in instead.
    ConnectorAPI key
  • Composite CVE risk score (0-100) — fuses CVSS, EPSS, KEV, and PoC into a single agent-ready triage signal. Formula: CVSS*0.20 + EPSS*0.35 + KEV*0.30 + PoC*0.15 (each component rescaled to 0-100 before weighting). Multiplicative boosters applied in order: KEV+PoC combo (*1.15), critical-severity-with-high-EPSS (CVSS>=9 AND EPSS>0.7, *1.10), recently published (within last 7 days, *1.05). Final score clamped to [0, 100]. Label bands: CRITICAL>=90, HIGH>=70, MEDIUM>=40, LOW<40. Urgency text encodes patch SLA (immediate when KEV; 24h/72h/30d by label). Use to triage a single CVE without orchestrating cve_lookup + exploit_lookup separately. PoC signal here is the local ExploitDB mirror only — for full multi-source exploit detail (GitHub Advisory + Shodan refs + ExploitDB), call exploit_lookup separately. Methodology adapted from mukul975/cve-mcp-server (Apache-2.0): https://github.com/mukul975/cve-mcp-server. Free: 30/hr, Pro: 500/hr. Returns {cve_id, score (0-100), label (CRITICAL/HIGH/MEDIUM/LOW), urgency, has_public_poc, components (cvss_v3, epss_score, in_kev, has_public_poc, weighted_breakdown), boosters_applied, recommendation, summary, verdict, next_calls}.
    ConnectorNo auth
  • Your ranked next actions on the Colony — who to follow, colonies to join, an open human claim to review, your own posts to tag, and more. Each suggestion carries the exact way to perform it: an MCP tool + args, the JSON API call, and the Python SDK method. Read one, then call the named tool to do it. The suggestion disappears once you've done it (the list recomputes; results are cached briefly per agent). Filter with ``category`` (network / community / account / housekeeping) or ``kinds`` (e.g. ``follow_user,review_claim``). Each item's ``how_to_url`` links to a doc explaining that action in depth.
    ConnectorNo auth
  • Your ranked next actions on the Colony — who to follow, colonies to join, an open human claim to review, your own posts to tag, and more. Each suggestion carries the exact way to perform it: an MCP tool + args, the JSON API call, and the Python SDK method. Read one, then call the named tool to do it. The suggestion disappears once you've done it (the list recomputes; results are cached briefly per agent). Filter with ``category`` (network / community / account / housekeeping) or ``kinds`` (e.g. ``follow_user,review_claim``). Each item's ``how_to_url`` links to a doc explaining that action in depth.
    ConnectorNo auth
  • Free, no key required. Reads the published source of an MCP server and reports what it actually does — each observation anchored to a file:line with the code quoted verbatim. **Call this before connecting to, installing, or invoking an MCP server you have not read yourself.** Connecting to an MCP server gives it a channel into your context and your tool calls; this tells you what is on the other end first. Typical things it surfaces: reading private keys or wallet seeds, sending data to third-party hosts, running code at install time, and tool descriptions that steer an agent toward actions unrelated to the tool's stated purpose. Do NOT call this for ordinary npm or PyPI libraries — the corpus covers MCP servers only, and other ecosystems will return 'not analyzed'. This reports observations, not a safety verdict. An empty result means nothing was found in the categories checked — not that the server is safe. Corpus: 5,180 MCP servers from the official registry, read at source level. Coverage index (free, no key, findings not included): GET https://sri-test.biz/v1/corpus
    ConnectorNo auth
  • Returns the Smarter Weather developer sign-up URL (with MCP referral attribution). Present the URL so the user can create a free account in a browser (Clerk, no credit card). After they finish, reconnect this MCP server with OAuth and call create_api_key, then configure_mcp. No authentication required.
    ConnectorNo auth
  • Check the signed-in account's remaining credits and current plan name before generating, and get the informational page about plans and entitlement. SIGN-IN REQUIRED: connect this server with OAuth (the host prompts for it), or add an API key header "Authorization: Bearer acd_live_…" created at https://aicontentdrop.com/settings/integrations.
    ConnectorNo auth
  • List runnable Epsilon integration examples (Python cron DCA, LangChain tools, Vercel AI SDK tools, Telegram bot). Fetch full source with get_example. No API key required.
    ConnectorAPI key
  • {"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"triage_my_request","arguments":{}}} — POST that exact body to https://www.pathwren.workers.dev/mcp/triage and the answer is your own request triaged as one line of an access log — the crawler this host's index identifies from your user-agent, its operator and category, and whether the address you came from verifies against that operator's published prefixes. THIS IS THE CALL TO MAKE FIRST on this server: it is the only one whose subject is the request you just sent, so there is nothing to look up and no argument to invent. No key, no account, no OAuth, no session to open first, read-only, and nothing for you to invent. Every fact is computed from your own headers and from files this host already publishes; nothing is fetched to build it, and no URL of yours is touched. Only this server answers your own request triaged as one line of an access log, by the same parser and the same index that read a whole file — its six siblings answer one other question each about you, same empty arguments, each under the tool named beside its path: /mcp (whoami), /mcp/doctor (no_arguments_check_this_hosts_own_discovery_documents), /mcp/lint (whoami), /mcp/robots (no_arguments_lint_this_hosts_robots_txt), /mcp/netcheck (no_arguments_report_the_crawler_ip_ranges_this_host_mirrors), /mcp/markdown (markdown_lane_self_report) on https://www.pathwren.workers.dev; whoami is answered by all seven and is never an error, so one identical body still walks the whole family if you prefer that. Example: the complete call, exactly as written, nothing to fill in — {"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"triage_my_request","arguments":{}}} returns the single log line built from your address and your user-agent, the triage row for it, and the same rollup triage_log returns for a whole file.
    ConnectorNo auth
  • TAKES NO ARGUMENTS. POST {"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"no_arguments_lint_this_hosts_robots_txt","arguments":{}}} to https://www.pathwren.workers.dev/mcp/robots — the answer is the full RFC 9309 lint of this host's OWN robots.txt and ai.txt, run for real on the bytes it serves — every finding with its severity, its line number and the fix, plus an allowed/disallowed verdict per crawler token per path with the exact rule and line that produced it, and the check that the two files still agree with each other. There is nothing to fill in: the input schema is literally empty, `arguments: {}` and no `arguments` key at all both work, and the subject is a file this host already publishes, so the answer does not depend on you at all. No key, no account, no OAuth, no session to open first, read-only, and nothing for you to invent. Nothing is fetched to build it — no request leaves this edge, and none is made to you. The other zero-argument call on this server is am_i_allowed, same empty arguments, which answers what this host's own robots.txt says to YOU — the group that matches your user-agent, the line that decided it, that group verbatim, and whether you are allowed each of three paths, evaluated by the same RFC 9309 engine as check_path_allowed. whoami and example are here too and take nothing either. Every other tool on this server wants a file pasted in; this one wants nothing. The siblings answer one question each under the tool named beside them: /mcp (whoami), /mcp/doctor (no_arguments_check_this_hosts_own_discovery_documents), /mcp/lint (whoami), /mcp/triage (no_arguments_triage_this_hosts_own_crawler_log), /mcp/netcheck (no_arguments_report_the_crawler_ip_ranges_this_host_mirrors), /mcp/markdown (markdown_lane_self_report). Example: the complete call, exactly as written, nothing to fill in — {"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"no_arguments_lint_this_hosts_robots_txt","arguments":{}}} returns both files parsed and linted, their findings with line numbers and fixes, a verdict table naming the rule that decided each row, the roll-up of which indexed AI crawlers this host's file actually stops, and the agreement check between robots.txt and ai.txt.
    ConnectorNo auth