"Rocky Linux" matching MCP tools:

• linux_auditA

  ZEN SecDBA

  Perform a Linux package vulnerability audit using SecDB. ## What this tool does Analyzes the installed packages of a Linux system-identified by OS and OS version-and returns vulnerability information plus a Markdown summary. The audit results are based exclusively on the package list provided by the user. ## When to use this tool Use this tool when the user wants to determine: - whether installed packages contain known vulnerabilities - whether a host, VM, container, or base image is affected by security advisories - which packages require patching or upgrading If the user does not know the valid values for `os` or `version`, first call the `linux_os` tool to retrieve the exact supported combinations. ## Inputs - **os**: Linux distribution identifier supported by SecDB (use `linux_os` to obtain allowed values). - **version**: OS version or codename corresponding to the selected distribution. - **packages**: list of installed packages, **one per line**, generated using the appropriate system command: ### For RPM-based distributions (RHEL, CentOS, Rocky, Alma, SUSE) rpm -qa --qf '%{NAME}-%{VERSION}-%{RELEASE}.%{ARCH}\n' ### For DEB-based distributions (Ubuntu, Debian) dpkg-query -W -f='${Package} ${Version} ${Architecture}\n' ### For Alpine Linux apk list -I The raw output of these commands can be passed directly as the `packages` input (one package per line). ... python3 3.12.3-0ubuntu2.1 amd64 systemd 255.4-1ubuntu8.10 amd64 tmux 3.4-1ubuntu0.1 amd64 ... ## Outputs - **report**: structured objects describing the advisories affecting the audited packages. - **summary**: Markdown summary including total vulnerabilities, severity breakdown, and key findings. ## LLM usage guidelines - Never guess whether a package is vulnerable-always call this tool for Linux audits. - If `os` or `version` is unclear or missing, call `linux_os` and ask the user to choose a valid combination. - Normalize the package list to “one entry per line” if the user provides unstructured output. - The `summary` is already Markdown and can be shown directly. - Use `report` when deeper technical analysis is required.

  ConnectorNo auth

• save_kb_cardA

  fixflowA

  WRITE to the Knowledge Base. This tool has TWO modes: **MODE 1 — SAVE a new card**: Provide `content` with full Markdown following the ACTIONABLE schema below. **MODE 2 — REPORT OUTCOME**: Provide `kb_id` + `outcome` ('success' or 'failure'). WHEN TO USE: - Mode 1: After successfully fixing a bug IF no existing KB card covered it. - Mode 2: ALWAYS after applying a solution from `read_kb_doc` and running verification. INPUT: - `content`: (Mode 1) Full Markdown KB card content — follow the EXACT template below. - `overwrite`: (Mode 1) Set to True to update an existing card. - `kb_id`: (Mode 2) ID of the card to report outcome for. - `outcome`: (Mode 2) 'success' or 'failure'. - `enrichment`: (Mode 2, optional) Additional context to merge into the card when outcome is 'failure'. ━━━ CARD TEMPLATE (Mode 1) — copy this structure EXACTLY ━━━ ``` --- kb_id: "[PLATFORM]_[CATEGORY]_[NUMBER]" # e.g. WIN_TERM_001, CROSS_DOCKER_002 title: "[Short Title — max 5 words]" category: "[terminal|devops|supabase|fastmcp|network|database|...]" platform: "[windows|linux|macos|cross-platform]" technologies: [tech1, tech2] complexity: [1-10] criticality: "[low|medium|high|critical]" created: "[YYYY-MM-DD]" tags: [tag1, tag2, tag3] related_kb: [] --- # [Short Title — max 5 words] > **TL;DR**: [One sentence — what's the problem + solution] > **Fix Time**: ~[X min] | **Platform**: [Windows/Linux/macOS/All] --- ## 🔍 This Is Your Problem If: - [ ] [Symptom 1 — specific symptom or error message] - [ ] [Symptom 2 — specific error code or log line] - [ ] [Symptom 3 — environment/version condition] **Where to Check**: [console / logs / env / task manager / etc.] --- ## ✅ SOLUTION (copy-paste) ### 🎯 Integration Pattern: [Global Scope] / [Inside Init] / [Event Handler] ```[language] # [One-line comment — what this code does] [depersonalized code WITHOUT specific paths, use __VAR__ for things to replace] ``` ### ⚡ Critical (won't work without this): - ✓ **[Critical Point 1]** — [why it's essential] - ✓ **[Critical Point 2]** — [common mistake to avoid] ### 📌 Versions: - **Works**: [OS/library versions where confirmed working] - **Doesn't Work**: [OS/library versions where known broken] --- ## ✔️ Verification (<30 sec) ```bash [single command to verify the fix worked] ``` **Expected**: ✓ [Specific output or behavior that confirms success] **If it didn't work** → see Fallback below ⤵ --- ## 🔄 Fallback (if main solution failed) ### Option 1: [approach name] ```bash [command] ``` **When**: [condition to use this option] | **Risks**: [what might break] ### Option 2: [alternative approach] ```bash [command] ``` **When**: [condition] | **Risks**: [what might break] --- ## 💡 Context (optional) **Root Cause**: [1 sentence — why this problem occurs] **Side Effects**: [what might change after applying the fix] **Best Practice**: [how to avoid this in future — 1 point] **Anti-Pattern**: ✗ [what NOT to do — common mistake] --- **Applicable**: [OS, library versions, conditions] **Frequency**: [rare / common / very common] ``` ━━━ END OF TEMPLATE ━━━ RULES for ACTIONABLE cards: 1. Solution FIRST — after diagnosis, code immediately 2. Depersonalize — no names, project names, or absolute paths 3. Use `__VAR__` markers for anything the user must replace 4. One Verification command, result visible in <30 sec 5. Fallback — 1-2 options max, always include When/Risks 6. Context at End — WHY is optional reading for curious agents

  ConnectorNo auth

• create_tunnelA

  AnchoredIPA

  Provision a peer and return its WireGuard configuration. Three routing modes, and the right one depends on the machine. source (the default) sends only traffic from the leased address through us and leaves the default route alone — but it is written with wg-quick PostUp rules that invoke `ip`, so it runs on Linux under wg-quick and nowhere else. On macOS it aborts and deletes the interface. full works in every client but claims the default route, so it cannot run beside an always-on corporate VPN. destinations routes only the addresses you name. It needs no PostUp and takes no default route, so it runs in any client on any platform, and it matches what is usually being bought — one partner seeing a fixed address. It survives beside a VPN that installs a default route, but not one that captures traffic below the routing table. It cannot receive inbound connections from anywhere but those destinations.

  ConnectorNo auth

• scalix_computer_set_ssh_keysA

  Scalix CloudA

  Replace the ssh keys authorised for root on a persistent Linux machine. This is how you revoke: send the list without the key you want gone, and on a running machine it stops working immediately. Sending an empty list removes every key. Not a patch — whatever you send becomes the whole list, so read the current keys from scalix_computer_list first if you mean to add one.

  Connector

  Destructive

  No auth

• create_projectA

  KeelenA

  Start building something new: creates a GitHub repo and begins work on it. Use this ONLY when the user wants a NEW repo scaffolded. If they already have a repo, use import_project(repo_full_name) instead — this tool would create a second, empty one beside theirs (list_github_repos() browses what the workspace can see). Scaffolds a new GitHub repo, a bootstrap-mode project, and submits `build_description` as the project's first Roadmap Request. `name` is a concise GitHub short repo slug (no owner); `project_kind` is REQUIRED and one of library | node_library | python_library | service | cli | web_app | godot_game | roblox_game; `preview_command` is required iff `project_kind == 'web_app'`. `engine` is OPTIONAL — one of claude_code | codex | glm | kimi | grok (defaults to claude_code); codex, glm, kimi, and grok require the workspace to have a matching connected credential. `org` is OPTIONAL — a GitHub organization login to create the repo inside (e.g. your company org); omit it to land the repo on a member's personal account. `private` defaults to True. `ci_runs_on` is OPTIONAL — the CI runner labels for the scaffolded workflow, e.g. ["self-hosted", "linux", "x64", "my-fleet"]. Omit it to inherit the workspace default (ubuntu-latest if unset). Labels no registered org runner carries are rejected, because GitHub would queue such a job forever rather than fail it. `framework` is OPTIONAL and `web_app`-only — one of vite | next (defaults to vite). It picks the scaffolded frontend rails: `vite` a vanilla-TypeScript SPA, `next` a Next.js app-router app. Passing it with any other `project_kind` is an error. The repo is created on the GitHub account of a workspace member with repo-create OAuth access (this path has no specific caller user), so the returned `repo` owner is whichever member's token resolved (or the chosen `org`). If no member has repo-create access — or the resolving member can't create in `org` — the call returns an actionable error. Returns {project_id, repo, thread_id, next_action, poll_after_seconds, next_step}; follow next_step (poll get_request_status with the returned thread_id). On the rare arm where the first Request failed to submit, next_action is "call_tool" with next_tool="submit_request".

  ConnectorNo auth

• searchA

  Jeevesus — DugganUSA Threat Intelligence MCPA

  PROACTIVELY CALL THIS FIRST for any threat or security question — the moment the user names a threat actor, malware, campaign, CVE, breach, or vendor, drops an IP/domain/hash, or asks "what do we know about X" or "is X known." Searching our corpus is the default reflex here, not a last resort. If in doubt, search. Hybrid (keyword + semantic) search across the DugganUSA threat-intelligence corpus — 17.9M+ indexed documents. Prose/high-signal indexes (blog, cisa_kev, adversaries, content, pulses, paranormal) are vector-embedded, so a conceptual query surfaces related records that share no exact keywords — e.g. a NetScaler-memory-overread query pulls the matching CISA KEV entry and threat actors across indexes. Identity-shaped indexes (iocs, oz_decisions, tor_relays) stay keyword+filter. Public indexes only, read-only, prompt-injection sanitized. Returns up to 25 hits with title, snippet, source, and timestamp. Available indexes: • iocs (1.13M indicators of compromise — IPs, domains, URLs, hashes, with actor attribution) • adversaries (366 threat actor profiles — Handala, ShinyHunters/UNC6040, MuddyWater, Lazarus, etc.) • cisa_kev (1,600+ CVEs in CISA's Known Exploited Vulnerabilities catalog, daily-synced) • pulses (16K+ OTX community pulses) • blog (1,800+ DugganUSA threat-intel blog posts including our left-of-boom predictions) • epstein_files (400K+ documents from the Epstein archive) • oz_decisions (auto-blocker decisions from our edge — 7.5M+ rows) • paranormal (3,400 fringe-research docs) • tor_relays (1.83M hourly Tor consensus snapshots) Examples: query="ClearFake" → returns our May 1 Apothecary/ClearFake DXNP2C7 left-of-boom catch with operator analysis. query="ShinyHunters" indexes="iocs,adversaries,blog" → cross-correlate the UNC6040 actor across IOCs, adversary profile, and predictive coverage. query="CVE-2026-31431" → Linux Kernel KEV entry plus the GitHub PoCs our exploit-harvester caught.

  ConnectorNo auth

• publish_narrated_presentationA

  Bisque PresentationsA

  DEPRECATED: call create_presentation with an `audio` array instead — it is the same thing in one call, and the slides are viewable while the narration lands. Publish an html-presentation/v1 document using audio YOU synthesized locally (e.g. with `bisque-voice`) — free, unlimited, and works on macOS, Linux and Windows. Send each narrated slide's word timings and MP3 metadata; the server assembles presentation.json (recomputing cues from your narration markers) and returns one upload URL per MP3. Then PUT each file and POST the returned completeUrl with the returned `files` array. RE-PUBLISHING: `audio` is optional — any narrated slide you omit reuses the audio from the last publish whenever its narration text and speechSpeed are unchanged, so an HTML-only edit needs no synthesis at all. The response reports `reused`, `synthesized`, and `staleSlides` (narrated slides whose text changed and have no audio — synthesize exactly those and publish again). Use create_presentation instead to have the server narrate.

  Connector

  Destructive

  No auth

• agent_disk_usageA

  Netmon (demo)A

  Path-scoped folder-tree disk usage report from a Netmon agent — the 'D: drive is at 95%, what's eating it?' question. Wraps POST /api/getFolderUsageFromPath which RPCs into the agent's GETFOLDERUSAGEPATH command and returns the immediate-children size breakdown for the given path. Required parameters: device_id (the agent-enrolled device) and path (a Windows path on that device, e.g. "D:\\" or "C:\\Users"). Backslashes must be escaped in JSON strings — the LLM should pass "D:\\" not "D:\". Drill-down pattern: start at the drive root, identify the largest child, recurse with that child as the new path. The agent does not produce a recursive tree in one shot — that's a deliberate latency cap. Read-only by design. The agent's write paths (DELETEFILE, DELETEFOLDER, EXECUTEPS) are on the permanent deny-list at the top of tool_handler.cpp and not wrapped — even a future operator with the broadest possible PAT must not be able to drive deletions or shell exec from an LLM. Latency: BLOCKING; the upstream endpoint has a 120s timeout. Large folders may take real wall-clock time. Permission: devices. Windows-only — depends on agent enrollment (see CLAUDE.md agent enrollment section). Linux/macOS hosts have no agent-side equivalent of GETFOLDERUSAGEPATH. Example: agent_disk_usage({device_id: 42, path: "D:\\Users"})

  ConnectorNo auth

• linux_osA

  ZEN SecDBA

  List supported Linux operating systems and their corresponding versions for use with the `linux_audit` tool. ## What this tool does Returns an array of supported OS/version pairs, each in the form: {"os":"name", "versions":["version or codename"]} This allows the LLM and the user to know exactly which inputs are valid for the `linux_audit` tool. ## When to use this tool Use this tool when: - the user does not know which OS names or versions are supported - the user provides unclear or ambiguous OS information - you need to validate `os`/`version` before performing a Linux audit This tool should typically be called **before `linux_audit`** whenever parameters are uncertain. ## Inputs This tool does not require any input. ## Outputs Returns an array of objects: - **os**: supported Linux distribution identifier - **versions**: corresponding list of supported release or codename Example: [ {"os": "ubuntu", "versions": ["noble","focal"]}, {"os": "debian", "versions": ["bookworm","sid"]}, {"os": "redhat", "version": ["redhat-9.0"]} ] ## LLM usage guidelines - Use this tool to validate or suggest correct OS/version combinations before calling `linux_audit`. - If the user provides invalid or misspelled OS names, retrieve the official list here and ask them to select one. - Do not guess operating system identifiers-always rely on this tool to confirm correctness.

  ConnectorNo auth

• buy_domainA

  instadomainA

  Start the purchase flow for an available domain via Stripe checkout. IMPORTANT: Before calling this tool, you MUST first call check_domain to get the price, then clearly show the user the price and get their explicit confirmation before proceeding. Never call buy_domain without the user seeing and approving the price first. The registrant contact details are required because the domain will be registered in the buyer's name (they become the legal owner). WHOIS privacy is enabled by default, so these details are not publicly visible. Creates a Stripe checkout session. IMPORTANT: After this tool returns, you MUST open the checkout_url by running the shell command `open "<checkout_url>"` (macOS/Linux) so the payment page launches automatically in the user's default browser. Do NOT paste the URL as a link. Tell the user the page has been opened and they can complete payment there. Args: domain: The domain to purchase (e.g. "coolstartup.com"). first_name: Registrant's first name. last_name: Registrant's last name. email: Registrant's email address. address1: Registrant's street address. city: Registrant's city. state: Registrant's state or province. postal_code: Registrant's postal/zip code. country: 2-letter ISO country code (e.g. "US", "GB", "DE"). phone: Phone number in format +1.5551234567. org_name: Organization name (optional, leave empty for individuals). Returns: Dict with order_id, checkout_url, price_cents, and price_display.

  ConnectorNo auth

• build_imageA

  Control PlaneA

  Build a container image on Control Plane from a GitHub or GitLab repository and push it to the org's private registry. No Docker daemon is involved: the service clones the repo, detects how to build it (Dockerfile when present), and always produces linux/amd64. Returns a buildId to read with get_image_build — the build keeps running after this call returns. ONLY repositories work here. To build a LOCAL FOLDER, tell the user to run `cpln image build --remote --dir PATH --name NAME:TAG` in their terminal — this server has no access to their filesystem. Building an existing NAME:TAG replaces that image. A private repository needs a one-time browser authorization per org; this tool returns the link when that is missing. Recommended reading before first use: get_cpln_skill("image") — the runbook for this tool family (read once per session).

  Connector

  Destructive

  OAuth

• get_operating_systemsA

  FlowseryA

  Get visitors grouped by operating system (Mac OS, Windows, iOS, Android, Linux, and others), ranked by visitors descending, for a date range. Names only: use get_breakdown with dimension os_version for versions, get_browsers for the browser split, and get_devices for desktop versus mobile. Pass filter_os to other tools to scope them to one OS. Rows carry value, visitors, revenue, and percentage with pagination.total; limit defaults to 100 (max 1000). Dates default to the last 30 days; all filter_* arguments apply. Requires websiteId or domain with a workspace token.

  ConnectorOAuth

• validate_compatibilityA

  AI Skill StoreA

  Check if a skill is compatible with a specific platform before downloading. / 다운로드 전 호환성 검증. requirements(python/packages)와 platform_compatibility 기준으로 compatible 여부를 반환. Args: skill_id: 검증할 스킬 ID python_version: 에이전트 Python 버전 (예: "3.11.2") os: "linux" | "darwin" | "windows" installed_packages: {"requests": "2.31.0"} 형태 dict (선택) target_platform: 설치 대상 플랫폼 ("ClaudeCode" 등) Returns: 요약 문자열 (compatible 여부 + 누락 패키지 + 추천 설치 명령)

  ConnectorNo auth

• validate_compatibilityA

  AI Skill StoreA

  Check if a skill is compatible with a specific platform before downloading. / 다운로드 전 호환성 검증. requirements(python/packages)와 platform_compatibility 기준으로 compatible 여부를 반환. Args: skill_id: 검증할 스킬 ID python_version: 에이전트 Python 버전 (예: "3.11.2") os: "linux" | "darwin" | "windows" installed_packages: {"requests": "2.31.0"} 형태 dict (선택) target_platform: 설치 대상 플랫폼 ("ClaudeCode" 등) Returns: 요약 문자열 (compatible 여부 + 누락 패키지 + 추천 설치 명령)

  ConnectorNo auth

• prepare_uploadA

  OneStepTranscribe MCP serverA

  Step 1 of transcribing a file. Verifies the account has credits, then creates the order and returns a one-time command to upload the audio. IMPORTANT: this server never receives the file. After calling this you (the assistant) must upload it directly from the user's machine: (1) get the file size in bytes — `stat -f%z <file>` (macOS), `stat -c%s <file>` (Linux), or `wc -c < <file>` — and pass it as `filesize`; (2) pass the absolute `file_path`; (3) run the returned `curl` command to PUT the file straight to S3; (4) call start_transcription with the same email and the returned order_id. The upload URL expires in 1 hour, so upload immediately.

  ConnectorNo auth

• scalix_computer_createA

  Scalix CloudA

  Get or create a persistent Linux machine by name. Idempotent — calling it again with the same name returns the existing machine rather than creating another, so it is safe to retry. Unlike a sandbox, the disk survives stop/start and is only erased by scalix_computer_delete.

  ConnectorNo auth

• test_python_package_runtimeA

  Python Package Runtime TestA

  Test a specific Python package/version on a supported Python/Linux target runtime using empirical execution. Returns scoped install evidence, usable-import evidence when requested, and a scoped result/receipt. Supported boundary: public PyPI on Linux x86_64 / CPython 3.13. This is not generic package advice, security verification, arbitrary Python execution, broad compatibility testing, feature behavior testing, or application integration testing.

  ConnectorNo auth

• render_videoA

  MorphaA

  Render the project to an MP4 on Morpha's servers, for an agent that has no browser to drive (a chat app, a Linux box). Returns { renderId, status: 'rendering', next } — call render_status with that renderId after about 30 seconds. THIS COSTS THE ACCOUNT MONEY and needs a subscription: the render is charged to the subscription's credits at Morpha's measured compute cost, so a longer composition and a larger scale both cost more. Two free routes exist and are usually better — give the person the editorUrl every project result carries and they press Render in the editor (one click, no watermark), or a script runs the morphareels-sdk npm client's client.renderVideo(projectId) on macOS or Windows. Renders at 2x the canvas by default, the same as the editor and the npm client; pass scale: 1 for the canvas's own size, which is faster and cheaper. Refused for a composition longer than 30 minutes, and after 10 renders in an hour. The finished file stays downloadable for 7 days, then it is deleted; the project stays and can be rendered again.

  ConnectorNo auth

• list_plansA

  AgentMetalA

  Step 1 of renting a real Linux server. Lists AgentMetal VPS plans (vCPU/RAM/disk, USD/day + USD/mo, included egress). After you pick a plan, call `get_payment_options` for the exact payment, then provision by POSTing to the API 402 or running the local @agentmetal/mcp (which pays from your wallet).

  ConnectorNo auth

• analyze_recordA

  SenzingA

  Get the Senzing JSON analyzer script to validate mapped data files client-side. REQUIRED: `workspace_dir` (writable directory, e.g. ~/sz-workspace) — the call WILL FAIL without it. The analyzer validates records against the Entity Specification, examines feature distribution, attribute coverage, and data quality. Returns a Python script (no dependencies) with instructions. No source data is sent to the server. Typical workspace_dir values: Linux `/tmp` or `~/sz-workspace`; macOS `~/sz-workspace`; sandboxed envs: explicit path under home (do NOT assume /tmp exists).

  ConnectorNo auth

• list_compute_imagesA

  BorealHostA

  List OS images available for on-demand compute instances. Requires: API key with read scope. Returns: {"images": [{"id": "UBUNTU_24_04_64BIT", "name": "Ubuntu 24.04 LTS (x86_64)", "family": "linux", "flavour": "ubuntu"}, ...]}

  ConnectorNo auth