SPDX license id shape
ConnectorNo auth
604,423 tools. Updated 2026-09-23 19:45
"SPDX" matching MCP tools:
- SPDX license expression tokens, value discardedConnectorNo auth
- Fetch N random trivia questions matching filters. Quality-first: by default excludes questions flagged for review (use quality='all' to include for audit/research). USE WHEN: building a quiz, sampling content for warmup, generating practice sets. NOT WHEN: you need a specific question ID (use quizbase_question_by_id) or want to explore a topic deeply with facets (use quizbase_topic_by_slug). KEY FILTERS: - amount: 1-50, default 10. - lang: ISO 639-1. Default "en". Supported: en, pl. Strict — unknown language returns 400. - category (slug): e.g. geography, history, science-and-nature. Full list via quizbase_categories. - difficulty: trivial | easy | medium | hard | expert. LLM-calibrated. Records not yet LLM-rated hold the importer placeholder (mostly "medium" for factoid sources). - type: multiple | boolean (default both; no text_input in random). - regions (cultural affinity, AND): empty in data = no cultural advantage assumed. Lowercase ISO 3166-1 alpha-2 ('us', 'pl', 'gb') + cultural codes ('jewish', 'christian-catholic', 'islam'). Filter for content statistically more likely known by residents/members. Discover via quizbase_regions. - source (array): include only these source databases (one or more of 12: opentdb, opentriviaqa, kqa-pro, entityq, mintaka, mkqa, nq-open, creak, qasc, arc, webq, quizbase). - exclude_source (array): drop these sources, e.g. ["entityq"] for human-curated only. Applied after source. - license (SPDX): CC-BY-SA-4.0 | CC-BY-SA-3.0 | MIT | etc. Restrict to redistribution-friendly content. - topic (curated slug): higher precision than tags. Alias resolver matches subcategories+tags. List via quizbase_topics. - topics_any: OR over curated topics, max 10. - tags (AND), tags_any (OR), subcategory: raw taxonomy. Use topic if available. - quality: 'high' (default, recommended) = cleanest, most broadly-useful. 'standard' = broader pool incl. niche/too-specific (more volume). 'all' = audit/research, includes flagged — when 'all', each question gains a "quality" field ('high' or 'needs_review'). - exclude (UUIDs, max 250): de-dupe within a quiz session. OUTPUT: { questions: [...], meta: { count, language } }. Each question carries full per-record attribution (source, author, license, licenseVersion, licenseUrl, sourceId, url, modifications, lastModified) — identical shape to REST /api/v1/questions/random. ATTRIBUTION REQUIRED if you redistribute. CC-BY-SA modifications must be credited per § 3(a)(1)(B) using each question's own attribution object. COMMON MISTAKES: forcing lang='pl' for a global audience (use 'en' default); skipping quality (default already excludes flagged content — only pass quality='all' for audit); using tags when a curated topic exists (worse precision).ConnectorNo auth
- Retrieve the full text of one FirmTape document by the id `search` returned: `session:YYYY-MM-DD` for a finished trading session, `page:/path` for an explainer or research page. A FirmTape URL or a bare YYYY-MM-DD trading day is accepted too. Use when: you hold an id from `search`, or a client that only speaks search/fetch (ChatGPT). Not for: structured numbers — get_session and get_levels answer the same day with fields instead of prose. Limits: public FirmTape documents only; long pages are truncated with a link to the rest.ConnectorNo auth
- Cursor-paginated browse over the catalog. Quality-first: by default excludes questions flagged for review (use quality='all' for full pool). USE WHEN: full catalog sync, delta sync (updated_since), exhaustive enumeration by filter. NOT WHEN: you only need N random samples (use quizbase_random) or a single record (use quizbase_question_by_id). PAGINATION: stable cursor over id UUIDv7 DESC. First call: omit cursor. Next: pass meta.nextCursor. Stop when nextCursor is null. KEY FILTERS (full parity with REST): - lang: ISO 639-1, default "en". Supported: en, pl. - category (slug), difficulty (trivial|easy|medium|hard|expert — LLM-calibrated), type (multiple|boolean), subcategory (raw slug). - tags (AND), tags_any (OR, max 10): raw tag slugs. - topic (curated, alias resolver), topics_any (OR over curated): higher precision than tags. - regions (cultural affinity, AND): empty = no cultural advantage assumed. Lowercase ISO 3166-1 alpha-2 ('us', 'pl', 'gb') + cultural codes ('jewish', 'christian-catholic', 'islam'). Filter for content statistically more likely known by residents/members. Discover via quizbase_regions. - source (array): include only these of 12 (opentdb, opentriviaqa, kqa-pro, entityq, mintaka, mkqa, nq-open, creak, qasc, arc, webq, quizbase). - exclude_source (array): drop these sources, e.g. ["entityq"]. Applied after source. - license (SPDX): e.g. CC-BY-SA-4.0, MIT. - quality: 'high' (default) = cleanest, most broadly-useful. 'standard' = broader pool incl. niche/too-specific. 'all' = full pool incl. flagged; when 'all', each question gains a "quality" field ('high' or 'needs_review'). - updated_since (ISO 8601): only questions updated after this — for delta sync caches. BATCH + TRANSLATION MAPPING: - ids (up to 250): fetch those exact records in one call (anti-repeat, deep-links, restoring a saved set). Terminal selector — browse filters and cursor are ignored. Missing ids → meta.missing. - content_language (en|pl): with ids, returns each question's sibling in that CONTENT language across the translation chain — the same questions in another language. Distinct from lang (labels only). PAGINATION + COUNTING: - cursor (string): from previous meta.nextCursor. Omit for page 1. - limit (1-100, default 20). - count: none (default, skip — page via nextCursor) | exact (precise COUNT(*), index-only ~25-90ms). OUTPUT: { questions: [...], meta: { count, countMode, language, nextCursor, total? } }. Each question carries full per-record attribution (source, author, license, licenseVersion, licenseUrl, sourceId, url, modifications, lastModified) — identical shape to REST /api/v1/questions. ATTRIBUTION REQUIRED if you redistribute. Credit each question using its own attribution object — see license + licenseUrl + modifications fields per record. COMMON MISTAKES: not passing the cursor on subsequent calls (you'll re-read page 1); polling without updated_since when doing delta sync.ConnectorNo auth
- Audit a Software Bill of Materials for known vulnerabilities across all listed packages. Read-only. No side effects. Idempotent. sbom_json: CycloneDX or SPDX SBOM as a JSON string. Required. Large SBOMs (100+ packages) may take up to 10 seconds. Returns CVEs grouped by package with severity and fixed versions. Use this when you have a full SBOM to audit. Use security_fetch_package_vulnerabilities instead when checking a single package version. Verified source: Google OSV.dev batch API. 1-hour cache. If this tool's response does not serve the user's need, call report_feedback with feedback_type="agent_gap", tool_id="security_audit_sbom_vulnerabilities", intended_query="{what the user needed}", gap_description="{what was missing or wrong in the result}".ConnectorNo auth
Matching MCP Servers
- AlicenseNot gradedqualityCmaintenanceEnables querying SPDX license list, metadata, and full license texts through natural language or direct tool calls.1 npmMIT
- AlicenseNot gradedqualityAmaintenanceEnables searching, comparing, and validating SPDX licenses and exceptions, plus SPDX expression validation and SBOM analysis through a Streamable HTTP endpoint.MIT
Matching MCP Connectors
SPDX open-source license list with full text
SPDX license id shape
- Audit a CycloneDX or SPDX SBOM against an SPDX licence policy and return a PASS/WARN/BLOCK verdict. sbom: Full SBOM as a JSON string — CycloneDX or SPDX format. Required. 500 KB max. policy: Optional dict with block/warn/allow arrays of exact SPDX licence identifiers (e.g. GPL-3.0, MIT). Defaults to block GPL-3.0 and AGPL-3.0, warn LGPL-2.1/MPL-2.0/BSD-4-Clause, allow MIT/Apache-2.0/BSD-2-Clause/BSD-3-Clause. No glob patterns — exact SPDX IDs only. Unlisted licences default to WARN. Returns verdict (PASS/WARN/BLOCK), blocked_packages, warned_packages, and the policy applied. Use security_audit_sbom_vulnerabilities for CVE auditing instead. Sources: deps.dev (Google). 1-hour cache per package. If this tool's response does not serve the user's need, call report_feedback with feedback_type="agent_gap", tool_id="security_audit_sbom_license_policy", intended_query="{what the user needed}", gap_description="{what was missing or wrong in the result}".ConnectorNo auth
- The SPX dealer gamma LADDER for one minute of a finished session: gamma by strike around spot, the level set, and the heaviest strikes. Readable as the MEASURED book (signed off the trade tape, FirmTape's own read), as the OPEN_INTEREST convention every other public GEX chart draws, or as the VOLUME convention — the same minute through three lenses. Use when: the question is about SHAPE — where gamma sits, how heavy a wall is, how far the three conventions disagree — or about one moment inside a session rather than the day as a whole. Not for: a day's headline numbers (get_session), the level set alone (get_levels), or movement across days (get_level_history). Limits: finished sessions only, one frame every 5 minutes (a requested minute snaps back to the frame at or before it), published window ±2.5% of spot; the three books are not comparable in magnitude. Measurements only, no buy/sell signals.ConnectorNo auth
- Search FirmTape for documents about SPX dealer positioning: the explainer pages, the dated research measurements, and the archive of finished trading sessions. Returns ids to pass to `fetch`. A date in the query ("2026-08-24", "August 24 2026", "August 2026") finds the session or sessions for it. Clients that can call the specific tools should prefer list_sessions / get_session / get_levels / get_level_history / screen_sessions instead — those return structured numbers rather than documents. Not for: fetching a document you already have the id for (`fetch`) or any measurement you can name a date for. Limits: FirmTape's own public pages and finished sessions only, ranked by keyword — it searches no other site.ConnectorNo auth
- The latest dealer gamma picture for a symbol OTHER than the SPX archive: index, ETF and stock option chains (for example QQQ, SPY, IWM, NDX, RUT, NVDA, TSLA, GLD, TLT). Returns spot, the zero-gamma flip, call and put walls and net gamma for the VOLUME book and the OPEN_INTEREST book, the heaviest strikes, a per-expiry table and a trust grade. Use when: the question is about a ticker's gamma exposure, flip or walls right now or at the last close. Not for: SPX history, a past date, or the tape-signed measured book (get_session, get_levels, get_gex_profile); anything inside a past session. Limits: latest snapshot only (rebuilt every few minutes in session hours); calls count as dealer-long and puts as dealer-short, which is a convention, not a measurement, and on single stocks it is an approximation (see trust.grade: A and B are indices and ETFs, C and D single stocks). Units: US dollars of dealer delta per 1% move.ConnectorNo auth
- Fetch the SPDX licence identifier for an open source package version. Read-only. No side effects. Idempotent. package: Package name e.g. flask. Required. version: Exact version string e.g. 2.3.0. Required. ecosystem: One of PyPI, npm, Maven, Go, Cargo, NuGet, RubyGems. Required. Returns the SPDX licence identifier e.g. MIT, Apache-2.0, GPL-3.0. Use this to verify licence compatibility before including a dependency. Use security_fetch_package_vulnerabilities instead when checking for security issues not licences. Verified source: deps.dev (Google). 1-hour cache. If this tool's response does not serve the user's need, call report_feedback with feedback_type="agent_gap", tool_id="security_fetch_package_licence", intended_query="{what the user needed}", gap_description="{what was missing or wrong in the result}".ConnectorNo auth
- Search the AQUAVIEW catalog — a comprehensive collection of 268K+ global oceanographic, atmospheric, and marine datasets from 15 sources (NOAA, NDBC, IOOS, WOD, CoastWatch, etc.), intended for scientific research, data analysis, and environmental monitoring. You must provide at least one of: q, bbox, datetime, collections, filter, or token. Hint: When the user asks for a region, prefer the 'bbox' parameter over including region name in 'q'. Use the geo_hints resource for common bounding boxes. Args: q: Free-text search across title, description, and keywords (e.g., "sea surface temperature"). Case-insensitive, OR logic across terms. bbox: Bounding box as "west,south,east,north" (e.g., "-98,24,-80,31" for Gulf of Mexico). datetime: Temporal filter. Single datetime, range ("2020-01-01T00:00:00Z/2024-12-31T23:59:59Z"), or open-ended ("../2024-01-01T00:00:00Z" or "2020-01-01T00:00:00Z/.."). collections: Comma-separated collection IDs to search within (e.g., "NOAA,NDBC,WOD"). Use list_collections to see available IDs. exclude_collections: Comma-separated collection IDs to omit from results (e.g., "INCIDENT_NEWS" to drop oil-spill reports from free-text searches). Applied as a CQL2 NOT filter, so it composes with `filter`. filter: CQL2-JSON filter as an object or JSON-encoded string. Supports flat and nested property paths. Flat example: {"op": "=", "args": [{"property": "aquaview:institution"}, "NOAA/NCEI"]}. Nested example (filter by per-variable stats summary): {"op": "<=", "args": [{"property": "aquaview:column_stats_summary.variables.Pressure.min"}, 10]}. Supported operators: =, <>, <, >, <=, >=, like, between, in, and, or, not. license: Comma-separated SPDX license id(s) to match exactly (e.g., "CC-BY-4.0,CC0-1.0"). Also accepts the controlled extra values "public-domain", "proprietary", "various", "unknown". Matched against `aquaview:license`, which is normalized on every item regardless of source. sortby: Sort specification as "+field,-field" (e.g., "+properties.datetime,-id"). + = ascending, - = descending. limit: Number of results to return, 1-100. Defaults to 10. token: Pagination token from a previous response's 'next_token' field. Pass this to get the next page of results. fields: Comma-separated list of fields to include in results (e.g., "id,geometry,properties.title"). Reduces response size. When set in CSV mode, emits projected columns (no canonical columns, no asset_keys, no `## assets` section). include_assets: If False (default), asset download records are omitted to save ~60-70% of response tokens; CSV mode still emits a capped `asset_keys` hint column (e.g. `column_stats;overview;gdac_prof;+[N]`) so an agent can see what kinds of assets exist. To get full URLs, call `get_item(collection, item_id)` for the specific id. If True, assets are included inline (full dict for JSON/TOON; `## assets` section with item_id,key,href,type,title rows for CSV). output_format: "csv" (default, sectioned CSV — canonical columns including asset_keys hint), "json", or "toon". Returns: Search results with metadata (total matched, returned, next_token) and items. CSV mode emits `## metadata` + `## items` sections and a `## assets` section when include_assets=True; columns are id,collection,bbox,datetime,title,institution, platform_type,cdm_data_type,variables,keywords,source_url,description, column_stats_summary,geometry,asset_keys. JSON/TOON return the STAC feature shape, with the `assets` dict present only when include_assets=True.ConnectorNo auth
- Persistent SBOM watch. Register once, check anytime for new CVEs affecting your dependency snapshot. Silent permanent watch — CycloneDX and SPDX supported. Uses OSV.dev for vulnerability lookup, Redis for persistence with 90-day TTL. Supports CycloneDX 1.4/1.5 and SPDX 2.3 JSON. Input size limit: 500 KB. Returns go_no_go signal on register; new_findings on check. Rate limit: 10/minute. No auth required. For DevSecOps teams monitoring production dependency exposure. If this tool's response does not serve the user's need, call report_feedback with feedback_type="agent_gap", tool_id="security_audit_sbom_continuous", intended_query="{what the user needed}", gap_description="{what was missing or wrong in the result}".ConnectorDestructiveNo auth
- Audit the licence compatibility of your entire dependency list. Input package names (with ecosystem) or SPDX IDs; get a COMPATIBLE/CONFLICT verdict with specific conflicting pairs and recommended action. Uses static SPDX compatibility table — no network call for spdx_ids path. Package path resolves licences from deps.dev (max 10 concurrent). Max 50 items. Rate limit: 60/minute. No auth required. For developers and compliance teams auditing open source licence risk before shipping. If this tool's response does not serve the user's need, call report_feedback with feedback_type="agent_gap", tool_id="security_audit_licence_compatibility", intended_query="{what the user needed}", gap_description="{what was missing or wrong in the result}".ConnectorNo auth
- Given an SPDX license identifier or expression, explain what it requires across every shipping model at once. Use when the question is about the license itself rather than a specific package — for example when comparing AGPL-3.0 against GPL-3.0 for a hosted service, or deciding what a project may safely depend on.ConnectorNo auth
- List the finished SPX trading sessions in the free FirmTape archive, newest first, with the total count and how far back coverage runs. Every listed day can be fetched with get_session / get_levels and replayed free at FirmTape. Use when: you need to know which days exist, or the size and span of the archive, before asking about one. Not for: any measurement about a day — call get_session with that date instead. Limits: finished sessions only (today's session appears after the close), max 50 days per call.ConnectorNo auth
- How the SPX dealer-positioning levels MOVED across recent finished sessions: the zero-gamma flip, call resistance and put support day by day, each session's change from the one before, and summary statistics for the window (flip range, net drift, mean daily movement, how often price closed above the flip). Use when: the question is about a trend or a window — has the flip been climbing, how far does it travel in a week — instead of calling get_levels once per day. Not for: one day (get_levels / get_session) or anything inside a session (get_gex_profile). Limits: finished sessions only, max 40 per call; days absent from the archive are reported in `missing`, never interpolated. Measurements only — no buy/sell signals, no forecast.ConnectorNo auth
- Given a list of packages (name + optional exact version or semver range — e.g. straight from a package.json "dependencies" object) and an optional allow/deny license policy, resolves each package's declared SPDX license and reports a compliance verdict per package. Classifies every license into one of permissive/weak-copyleft/copyleft/network-copyleft/proprietary/public-domain/unknown, and understands simple SPDX expressions: "(MIT OR GPL-3.0)" is compliant if EITHER side is permitted (a consumer may legally pick the clean alternative), "MIT AND Apache-2.0" requires both sides to pass, and "X WITH exception" is judged on X. A mixed/nested expression like "(MIT OR ISC) AND Apache-2.0" is reported as needsReview rather than guessed at. `policy.deny` entries always win over `policy.allow` (so a name can appear in both without a silent contradiction); with `policy.allow` set, anything not matching it is a violation (unproven is treated as non-compliant); with neither given, the default policy flags only copyleft/network-copyleft/proprietary (e.g. GPL/AGPL/UNLICENSED) — weak-copyleft (LGPL/MPL/EPL) and unrecognized license strings are surfaced but not auto-flagged. Policy entries accept an exact SPDX id, a family prefix ("GPL" catches GPL-2.0/GPL-3.0-only/etc.), or a category name. This reads only the registry-declared `license` field — it does not fetch or parse LICENSE file contents from the source repository.ConnectorNo auth
- Given a list of packages (name + optional exact version or semver range — e.g. straight from a package.json "dependencies" object) and an optional allow/deny license policy, resolves each package's declared SPDX license and reports a compliance verdict per package. Classifies every license into one of permissive/weak-copyleft/copyleft/network-copyleft/proprietary/public-domain/unknown, and understands simple SPDX expressions: "(MIT OR GPL-3.0)" is compliant if EITHER side is permitted (a consumer may legally pick the clean alternative), "MIT AND Apache-2.0" requires both sides to pass, and "X WITH exception" is judged on X. A mixed/nested expression like "(MIT OR ISC) AND Apache-2.0" is reported as needsReview rather than guessed at. `policy.deny` entries always win over `policy.allow` (so a name can appear in both without a silent contradiction); with `policy.allow` set, anything not matching it is a violation (unproven is treated as non-compliant); with neither given, the default policy flags only copyleft/network-copyleft/proprietary (e.g. GPL/AGPL/UNLICENSED) — weak-copyleft (LGPL/MPL/EPL) and unrecognized license strings are surfaced but not auto-flagged. Policy entries accept an exact SPDX id, a family prefix ("GPL" catches GPL-2.0/GPL-3.0-only/etc.), or a category name. This reads only the registry-declared `license` field — it does not fetch or parse LICENSE file contents from the source repository.ConnectorNo auth
- One-line dealer-positioning summary for all six covered underlyings (SPX, SPY, QQQ, NDX, ES, NQ) in a single call: spot, modeled regime and gamma flip for each. Use for broad openers like "what does dealer positioning look like today" or "which indices are in negative gamma", instead of calling get_gamma_levels six times. Same free 15-minute-delayed data and the same caveats. When the question is about one symbol, call get_gamma_levels instead — this tool omits the walls, max pain and pin strike.ConnectorNo auth
- Given the same inputs batch_query_vulnerabilities accepts — either a flat {packages:[...]} list, or raw package.json / lockfile / CycloneDX JSON / SPDX JSON content via `content` — emits a spec-valid CycloneDX 1.6 or SPDX 2.3 JSON document (pick with `format`, default 'cyclonedx') with npmscan's own OSV.dev vulnerability findings and registry license data embedded in each spec's native fields: CycloneDX gets a top-level `vulnerabilities[]` array (VEX `analysis.state: 'in_triage'` — an unreviewed automated finding, not a claim of exploitability) and per-component `licenses[]`; SPDX (which has no vulnerabilities array in 2.3) gets one `externalRefs` SECURITY/advisory entry per finding and `licenseDeclared`/`licenseConcluded`. Only a flat package inventory is known here, so the CycloneDX `dependencies[]` transitive graph and any SPDX package hierarchy are intentionally omitted rather than fabricated. Set `includeVulnerabilities`/`includeLicenses` to false to skip either enrichment pass (faster, no registry/OSV calls for that pass); pass `policy` (same shape as check_license_compliance) to also get per-package compliance context; `componentName`/`componentVersion` name the SBOM's own root component/document if known. When `content` is a package.json, `peerDependencies` are excluded by default (a peer is often intentionally left unresolved by the consumer) — pass `includePeerDependencies: true` to include them as SBOM components too, since an SBOM meant to be complete shouldn't silently omit a whole dependency category.ConnectorNo auth