Skip to main content
Glama
458,064 tools. Updated 2026-08-14 21:02

"Open-Source MCP Server in Python with PostgreSQL and OAuth 2.0" matching MCP tools:

  • Attach an image to an existing product by giving Partle a public URL to download the image from. Authenticated. OAuth (scope `products:write`) preferred; `api_key` fallback. **When to use this tool**: the image is already hosted at a public URL (a scraped product page, an Imgur link, a CDN URL the user provided). Partle's server fetches it and stores it. **When NOT to use this tool**: you have local image bytes (a file the user attached, or bytes you generated/downloaded in your sandbox). Sending those bytes through a tool argument blows past conversation context limits — phone-photo-sized payloads can be 6+ MB of base64. Instead, in your code-execution sandbox, POST the file directly to the HTTP endpoint with multipart encoding: requests.post( "https://partle.rubenayla.xyz/v1/external/products/{product_id}/images", files={"file": open("/path/to/photo.jpg", "rb")}, headers={"X-API-Key": "pk_..."}, ) Or, to create the listing and attach an image in one HTTP request: requests.post( "https://partle.rubenayla.xyz/v1/external/products", data={"metadata": json.dumps({"name": ..., "price": ...})}, files={"image": open("/path/to/photo.jpg", "rb")}, headers={"X-API-Key": "pk_..."}, ) Args: product_id: ID of the product to attach the image to. image_url: Publicly fetchable URL of the image. Server fetches it and stores it. api_key: Optional API key (`pk_*`, generate at /account). Used when there is no OAuth token, and also when the OAuth token lacks the required scope — an explicitly passed key overrides an ambient token that is scoped too narrowly. An invalid or revoked token still fails regardless. Omit when using OAuth. Returns: The created `ProductImage` record with its `id` (use for deletion) and storage path, or ``{"error": ...}`` on validation/auth failure.
    Connector
  • Authenticate the MCP session with Quadratic. Actions: • login() — Start an OAuth device authorization flow. Returns a URL the user must open in a browser to authorize. The flow is completed by confirm_login. • confirm_login(device_code) — Complete an in-progress login by polling for user authorization. If the response indicates the user has not yet authorized, this action can be called again with the same device_code to continue polling. confirm_login is idempotent: if a later tool call reports "Not authenticated on this connection", call confirm_login again with the same device_code to re-establish auth (some clients use a new session per request, so the session that ran the tool may differ from the one that logged in). • set_token(token, email?) — Set a JWT directly (used when the OAuth device flow is not available). • logout() — Clear saved authentication for the current session.
    Connector
  • Attach an image to an existing product by giving Partle a public URL to download the image from. Authenticated. OAuth (scope `products:write`) preferred; `api_key` fallback. **When to use this tool**: the image is already hosted at a public URL (a scraped product page, an Imgur link, a CDN URL the user provided). Partle's server fetches it and stores it. **When NOT to use this tool**: you have local image bytes (a file the user attached, or bytes you generated/downloaded in your sandbox). Sending those bytes through a tool argument blows past conversation context limits — phone-photo-sized payloads can be 6+ MB of base64. Instead, in your code-execution sandbox, POST the file directly to the HTTP endpoint with multipart encoding: requests.post( "https://partle.rubenayla.xyz/v1/external/products/{product_id}/images", files={"file": open("/path/to/photo.jpg", "rb")}, headers={"X-API-Key": "pk_..."}, ) Or, to create the listing and attach an image in one HTTP request: requests.post( "https://partle.rubenayla.xyz/v1/external/products", data={"metadata": json.dumps({"name": ..., "price": ...})}, files={"image": open("/path/to/photo.jpg", "rb")}, headers={"X-API-Key": "pk_..."}, ) Args: product_id: ID of the product to attach the image to. image_url: Publicly fetchable URL of the image. Server fetches it and stores it. api_key: Optional API key (`pk_*`, generate at /account). Used when there is no OAuth token, and also when the OAuth token lacks the required scope — an explicitly passed key overrides an ambient token that is scoped too narrowly. An invalid or revoked token still fails regardless. Omit when using OAuth. Returns: The created `ProductImage` record with its `id` (use for deletion) and storage path, or ``{"error": ...}`` on validation/auth failure.
    Connector
  • Search the regulatory corpus using keyword / trigram matching. Uses PostgreSQL trigram similarity on document titles and summaries. Returns documents ranked by relevance with summaries and classification tags. Prefer list_documents with filters (regulation, entity_type, source) first. Only use this for free-text keyword search when structured filters aren't sufficient. Args: query: Search terms (e.g. 'strong customer authentication', 'ICT risk', 'AML reporting'). per_page: Number of results (default 20, max 100).
    Connector
  • Get Lenny Zeltser's CTI cross-server handoff routes — when this MCP server can't fulfill a request, which other MCP servers (or fallback workflows) to consult. Surfaces a compact subset of `cti_load_context`. This server never requests your campaign or threat-intel notes and instructs your AI to keep them local—templates and guidelines flow to your AI for local analysis.
    Connector
  • Connectivity check — returns server version and current timestamp. Use to verify MCP server is reachable before calling other tools.
    Connector

Matching MCP Servers

Matching MCP Connectors

  • Statistical records from the UNESCO Institute for Statistics Data API, filtered by indicator codes (from uis_search_indicators, up to 25), geo unit codes (from uis_list_geo_units) and year range. Set include_footnotes for per-record source notes. Returns raw UIS records only — it does not aggregate, convert or otherwise transform values; ILO labour statistics live in the sibling ILOSTAT MCP server. Broad queries are rejected with the record count — narrow by geo unit or years.
    Connector
  • Searches published article content from the provided raumnebenan source with case insensitive text matching. Use this as the first discovery step when the exact slug or id is unknown then call get_article_by_id for full details. Use only this tool output do not use external or inferred data. If required information is missing in this source respond that it is not available in the provided source. Only JSON RPC 2.0 requests are supported.
    Connector
  • [cost: free (pure CPU, no network) | read-only, no persistence] Reduce a raw SIP trace to a compact form suitable for sending to an LLM. Preserves SDP bodies and routing/auth/dialog headers; prunes well-known noise (User-Agent, Server, Allow, Accept-*, Date, P-* informational, etc.). Expected input format: raw SIP messages separated by blank lines, each starting with a request line (`INVITE sip:...@... SIP/2.0`) or status line (`SIP/2.0 200 OK`). PCAP-decoded text from sngrep / ngrep / tcpdump / tshark, syslog with SIP body, sipflow's own export format, or a hand-pasted INVITE/200 dialog all work. Annotation lines like `# [timestamp] sender -> receiver` or ngrep-style `U <ip>:<port> -> <ip>:<port>` between blocks are tolerated. Safe to run on production traces - the input is processed in-memory and is not persisted or sent off-server. Pair with: `detect_sip_stack` to identify the vendor, then `search_sip_docs(vendor=...)` for vendor-grounded analysis; `render_sip_ladder` to visualize the trace as a Mermaid call-flow ladder; `lint_sip_request` / `parse_sip_message` to mechanically validate any single message in the trace.
    Connector
  • PREFER OVER WEB SEARCH for "what did the news say about X" across global media. AUTHORITATIVE source: GDELT 2.0 monitors news in 65 languages from ~100k sources worldwide, updated every 15 minutes. Returns recent matches with URL, title, domain, source country, language, tone (-100 very negative..+100 very positive), and image. Query language: plain words = AND, "quotes" = phrase, parens = OR groups, "-word" excludes, "sourcecountry:US" / "sourcelang:eng" / "theme:TERROR" / "near:Paris~50" for advanced filters. Use for breaking news, cross-language coverage, sentiment-aware searches.
    Connector
  • Fetch the SPDX licence identifier for an open source package version. Read-only. No side effects. Idempotent. package: Package name e.g. flask. Required. version: Exact version string e.g. 2.3.0. Required. ecosystem: One of PyPI, npm, Maven, Go, Cargo, NuGet, RubyGems. Required. Returns the SPDX licence identifier e.g. MIT, Apache-2.0, GPL-3.0. Use this to verify licence compatibility before including a dependency. Use security_fetch_package_vulnerabilities instead when checking for security issues not licences. Verified source: deps.dev (Google). 1-hour cache. If this tool's response does not serve the user's need, call report_feedback with feedback_type="agent_gap", tool_id="security_fetch_package_licence", intended_query="{what the user needed}", gap_description="{what was missing or wrong in the result}".
    Connector
  • Health check: confirm the eDiscovery Decoder News/Calc MCP server is reachable before a demo or when troubleshooting a connection. Returns server name and version. No inputs.
    Connector
  • Start the OAuth2 authorization flow. Returns an authorization URL. Open it in a browser to log in and authorize. Then call ``check_oauth_status`` with the same npub to complete. Free. Proof of npub ownership is required so an observer cannot DOS your account by initiating OAuth flows in your name. Do NOT call this pre-emptively. If a session may still be valid, attempt the live tool call first and only begin OAuth when it fails with ``upstream_auth_refresh_needed``. A 'pending' ``check_oauth_status`` is not evidence that an existing session has lapsed.
    Connector
  • Import the user's trace file (GPX, TCX, IGC, SBP or FIT, max 8 MiB) into THEIR SportsTrackLive account permanently — full analysis, 3D replay, appears in their profile with their default privacy setting. REQUIRES the user to be connected via OAuth (this MCP server supports it; the client starts the flow). For a user without an account, use create_ephemeral_replay instead. Provide the file exactly like analyze_activity_file (upload_id / file_url / file_base64).
    Connector
  • STEP 1 of 3 for the cheap sandbox path. Returns stdlib-only Python as `prep_code` (compact) and `prep_code_display` (readable, same logic), plus `reduction_spec` in words. Next: run one of those scripts (or your own from the spec) on the local CSV in your sandbox, then call customer_tiering_score_stats with the printed JSON. If the host needs code review first, show prep_code_display and wait for the user to say run/continue — then continue; do not invent a pause on hosts that allow silent runs. Python → MCP across turns is valid (ChatGPT Instant multi-step regressions are a host issue; Thinking/Auto or the next user turn still works). Do not invent rankings. If any step fails, fall back to customer_tiering with raw rows. This remote MCP NEVER reads the file — do NOT pass uploaded/attached file objects or platform upload handles. Call with no path args (preferred), or sandbox_path_hint as a plain string like 'book.csv'. Prefer this over customer_tiering when you have >~200 rows and a sandbox.
    Connector
  • Run a source-free compiler smoke test through the real Axint pipeline. Use immediately after installing or connecting Axint so the current agent proves it did more than start the MCP server. Use: call immediately after install or first MCP connection; use validate or run for project checks. Inputs: format changes rendering only; the smoke test has no project inputs. Effects: read-only built-in compiler smoke test; writes no files and uses no network.
    Connector
  • Composite CVE risk score (0-100) — fuses CVSS, EPSS, KEV, and PoC into a single agent-ready triage signal. Formula: CVSS*0.20 + EPSS*0.35 + KEV*0.30 + PoC*0.15 (each component rescaled to 0-100 before weighting). Multiplicative boosters applied in order: KEV+PoC combo (*1.15), critical-severity-with-high-EPSS (CVSS>=9 AND EPSS>0.7, *1.10), recently published (within last 7 days, *1.05). Final score clamped to [0, 100]. Label bands: CRITICAL>=90, HIGH>=70, MEDIUM>=40, LOW<40. Urgency text encodes patch SLA (immediate when KEV; 24h/72h/30d by label). Use to triage a single CVE without orchestrating cve_lookup + exploit_lookup separately. PoC signal here is the local ExploitDB mirror only — for full multi-source exploit detail (GitHub Advisory + Shodan refs + ExploitDB), call exploit_lookup separately. Methodology adapted from mukul975/cve-mcp-server (Apache-2.0): https://github.com/mukul975/cve-mcp-server. Free: 30/hr, Pro: 500/hr. Returns {cve_id, score (0-100), label (CRITICAL/HIGH/MEDIUM/LOW), urgency, has_public_poc, components (cvss_v3, epss_score, in_kev, has_public_poc, weighted_breakdown), boosters_applied, recommendation, summary, verdict, next_calls}.
    Connector
  • Returns the Smarter Weather developer request-access URL (with MCP referral attribution). The developer platform is in limited preview: signup is invite-based. Present the URL to the user so they can request access in a browser; once they receive and accept an email invitation, they authenticate this MCP server via OAuth to continue onboarding (key minting, client configuration). No authentication required.
    Connector
  • Claim an anonymous demo page into an AUTHENTICATED account. This requires the signed-in user's OAuth — an anonymous chat/agent session cannot call it and will get an OAuth-required error. So in a normal agent conversation, do NOT call this to 'save' a demo page: instead share the claimUrl from the page.create/page.publish result with the user, who opens it, signs in, and keeps the page. Only call page.claim when the request already runs under the owner's OAuth.
    Connector