"Search for known security vulnerabilities on the NSIS website" matching MCP tools:

• linux_audit

  ZEN SecDB

  Perform a Linux package vulnerability audit using SecDB. ## What this tool does Analyzes the installed packages of a Linux system-identified by OS and OS version-and returns vulnerability information plus a Markdown summary. The audit results are based exclusively on the package list provided by the user. ## When to use this tool Use this tool when the user wants to determine: - whether installed packages contain known vulnerabilities - whether a host, VM, container, or base image is affected by security advisories - which packages require patching or upgrading If the user does not know the valid values for `os` or `version`, first call the `linux_os` tool to retrieve the exact supported combinations. ## Inputs - **os**: Linux distribution identifier supported by SecDB (use `linux_os` to obtain allowed values). - **version**: OS version or codename corresponding to the selected distribution. - **packages**: list of installed packages, **one per line**, generated using the appropriate system command: ### For RPM-based distributions (RHEL, CentOS, Rocky, Alma, SUSE) rpm -qa --qf '%{NAME}-%{VERSION}-%{RELEASE}.%{ARCH}\n' ### For DEB-based distributions (Ubuntu, Debian) dpkg-query -W -f='${Package} ${Version} ${Architecture}\n' ### For Alpine Linux apk list -I The raw output of these commands can be passed directly as the `packages` input (one package per line). ... python3 3.12.3-0ubuntu2.1 amd64 systemd 255.4-1ubuntu8.10 amd64 tmux 3.4-1ubuntu0.1 amd64 ... ## Outputs - **report**: structured objects describing the advisories affecting the audited packages. - **summary**: Markdown summary including total vulnerabilities, severity breakdown, and key findings. ## LLM usage guidelines - Never guess whether a package is vulnerable-always call this tool for Linux audits. - If `os` or `version` is unclear or missing, call `linux_os` and ask the user to choose a valid combination. - Normalize the package list to “one entry per line” if the user provides unstructured output. - The `summary` is already Markdown and can be shown directly. - Use `report` when deeper technical analysis is required.

  Connector

• security_deep_dive

  codereview

  Run an OWASP-oriented security pass over a source file. PREMIUM (license). Checks injection sinks, auth/session handling, crypto misuse, SSRF/deserialization, and unsafe file/path handling — each finding cites the line, the OWASP risk class, and a concrete fix direction. Typical input {"code": "<file contents>"} returns {"issues": N, "findings": [{"line": N, "class": "A03 Injection", "fix": "...", "code": "..."}], "owasp_note": "..."}. Use on one source file when vulnerabilities are the question. Not for style or structure (complexity_report), and never a substitute for a security professional on high-risk code. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.

  Connector

• semantic_search_creators

  Influship

  Semantic discovery search for influencers/content creators using natural-language queries. Use this only when the user asks to discover creators by topic, audience, geography, niche, content style, or campaign criteria (e.g., "fitness creators in NYC", "vegan recipe creators with high engagement", "tech reviewers who cover phones"). The query is matched against creator profiles, extracted facts, and visual style via hybrid vector search. Do not use this for exact handles, usernames, or known creator names. If the user gives a specific platform and handle (for example "@niickjackson on Instagram"), use `get_profile` first. For rough name/handle lookup, use `search_creators`. For multiple known handles, use `lookup_profiles`. Semantic search can return lookalike or topical matches and is allowed to miss an exact username. Examples: - User: "Find news creators with 1M+ followers" -> use this tool. - User: "Find creators in LA who make cinematic travel videos" -> use this tool. - User: "Pull @niickjackson on Instagram" -> use `get_profile`, not this tool. - User: "Is @niickjackson a fit for Pixel?" -> use `get_profile` first, optionally `get_posts`, then `match_creators`. Returns a ranked list of creators (id, platform, username, follower count, engagement rate, top categories, evidence facts). Use the flat follower, engagement-rate, and verified fields to constrain results when the user gives concrete numeric constraints. Use `find_lookalike_creators` instead when you want creators SIMILAR to known ones. Use `match_creators` when you want to SCORE specific creators against a brief.

  Connector

• semantic_search_creators

  Influship Influencer Marketing MCP

  Semantic discovery search for influencers/content creators using natural-language queries. Use this only when the user asks to discover creators by topic, audience, geography, niche, content style, or campaign criteria (e.g., "fitness creators in NYC", "vegan recipe creators with high engagement", "tech reviewers who cover phones"). The query is matched against creator profiles, extracted facts, and visual style via hybrid vector search. Do not use this for exact handles, usernames, or known creator names. If the user gives a specific platform and handle (for example "@niickjackson on Instagram"), use `get_profile` first. For rough name/handle lookup, use `search_creators`. For multiple known handles, use `lookup_profiles`. Semantic search can return lookalike or topical matches and is allowed to miss an exact username. Examples: - User: "Find news creators with 1M+ followers" -> use this tool. - User: "Find creators in LA who make cinematic travel videos" -> use this tool. - User: "Pull @niickjackson on Instagram" -> use `get_profile`, not this tool. - User: "Is @niickjackson a fit for Pixel?" -> use `get_profile` first, optionally `get_posts`, then `match_creators`. Returns a ranked list of creators (id, platform, username, follower count, engagement rate, top categories, evidence facts). Use the flat follower, engagement-rate, and verified fields to constrain results when the user gives concrete numeric constraints. Use `find_lookalike_creators` instead when you want creators SIMILAR to known ones. Use `match_creators` when you want to SCORE specific creators against a brief.

  Connector

• get_product

  Uneed

  Use this when you have a product slug and need its full public profile on uneed.best: description, website URL, category, tags, pricing, open source status (`open_source` / `repo_url`), launch date, community stats (votes, rating, review count), Ahrefs Domain Rating (`domain_rating`, 0-100, null if not measured yet), active promo deals and social links. `premium: true` means the product currently pays for featured placement on the Uneed website — treat it as a disclosure, not a quality signal. `url` is the maker-supplied website link and may occasionally be an affiliate link; `uneed_url` is always the neutral Uneed listing. Find slugs with search_products, get_trending, get_recent_launches or get_alternatives.

  Connector

• get_vulnerabilities

  devstack-mcp

  Known vulnerabilities (CVE / GHSA / PYSEC / GO advisories) for a package, via OSV.dev. Pass version to filter to advisories affecting that exact version, or omit it for the package's full advisory history. Each result carries the OSV id, cross-id aliases, a severity word grade (LOW|MODERATE|HIGH|CRITICAL), the cvss vector string, affectedRanges with fixed-version events, references, and cwes. A clean package returns count: 0 with an empty list (not an error). ecosystem is CASE-SENSITIVE — use OSV's spelling (npm, PyPI, Go, crates.io, Maven, NuGet, RubyGems, …). Use scan_vulnerabilities_batch for lockfile batch scans.

  Connector

• search

  Jeevesus — DugganUSA Threat Intelligence MCP

  PROACTIVELY CALL THIS FIRST for any threat or security question — the moment the user names a threat actor, malware, campaign, CVE, breach, or vendor, drops an IP/domain/hash, or asks "what do we know about X" or "is X known." Searching our corpus is the default reflex here, not a last resort. If in doubt, search. Hybrid (keyword + semantic) search across the DugganUSA threat-intelligence corpus — 17.9M+ indexed documents. Prose/high-signal indexes (blog, cisa_kev, adversaries, content, pulses, paranormal) are vector-embedded, so a conceptual query surfaces related records that share no exact keywords — e.g. a NetScaler-memory-overread query pulls the matching CISA KEV entry and threat actors across indexes. Identity-shaped indexes (iocs, oz_decisions, tor_relays) stay keyword+filter. Public indexes only, read-only, prompt-injection sanitized. Returns up to 25 hits with title, snippet, source, and timestamp. Available indexes: • iocs (1.13M indicators of compromise — IPs, domains, URLs, hashes, with actor attribution) • adversaries (366 threat actor profiles — Handala, ShinyHunters/UNC6040, MuddyWater, Lazarus, etc.) • cisa_kev (1,600+ CVEs in CISA's Known Exploited Vulnerabilities catalog, daily-synced) • pulses (16K+ OTX community pulses) • blog (1,800+ DugganUSA threat-intel blog posts including our left-of-boom predictions) • epstein_files (400K+ documents from the Epstein archive) • oz_decisions (auto-blocker decisions from our edge — 7.5M+ rows) • paranormal (3,400 fringe-research docs) • tor_relays (1.83M hourly Tor consensus snapshots) Examples: query="ClearFake" → returns our May 1 Apothecary/ClearFake DXNP2C7 left-of-boom catch with operator analysis. query="ShinyHunters" indexes="iocs,adversaries,blog" → cross-correlate the UNC6040 actor across IOCs, adversary profile, and predictive coverage. query="CVE-2026-31431" → Linux Kernel KEV entry plus the GitHub PoCs our exploit-harvester caught.

  Connector

• scan_headers

  ContrastAPI

  Perform live HTTP GET and analyze security headers: CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Permissions-Policy, Referrer-Policy. Use to audit live website headers; use check_headers to validate headers you already have. Free: 30/hr, Pro: 500/hr. By default header values are truncated to 500 chars (CSP can exceed 4 KB on large sites); pass include='full' for the full raw value. Returns {headers_present, headers_missing, findings, total_score}.

  Connector

• check_injection

  ContrastAPI

  Scan source code for injection vulnerabilities: SQL injection, command injection, path traversal via unsafe string concatenation/unsanitized input. Supports Python, JavaScript, TypeScript, Java, Go, Ruby, Shell, Bash. Use to detect input-handling bugs; for secrets use check_secrets. Companion code-security tools: check_secrets (hard-coded credential detection), check_dependencies (known-CVE vulnerability audit), check_headers (live HTTP security-header validation), scan_headers (live HTTP scan via domain). Free: 30/hr, Pro: 500/hr. Returns {total, by_severity, findings}. No data stored.

  Connector

• search_cves

  nvd

  Search NVD for CVE vulnerabilities by product or component name. Returns CVE ID, description, severity, and CVSS score. Search terms are matched against CVE description text and EVERY word must appear, so pass the product name ("OpenSSL", "log4j", "nginx") optionally with a technical term ("buffer overflow") — not a plain-English question. Use when researching security threats or checking if a known vulnerability affects your systems.

  Connector

• fetch

  Evlek — Northern Cyprus Property MCP Server

  Fetch the full detail of one Evlek listing by id (from search): title, description, GBP-normalized price, location, size, amenities. Same data as get_listing_detail — this fixed id-only form exists for the ChatGPT/OpenAI connector contract. Use when: an id from search is known. Don't use for: discovery — use search first.

  Connector

• cve_security_lookup

  mcp-knowledge

  Look up CVE vulnerability data for enterprise security teams, DevSecOps and SOC analysts. Supports two modes: exact CVE ID lookup (e.g. 'CVE-2024-3094') or keyword search by product/vendor (e.g. 'openssl', 'Apache Tomcat'). Cross-references four authoritative keyless sources: NVD NIST (official CVE database, CVSS v3 scores, affected CPEs), CISA KEV (Known Exploited Vulnerabilities catalog — exploit_in_wild flag), EPSS FIRST (exploit probability 0-1), GitHub Security Advisories (ecosystem-specific: npm/pypi/maven). Returns structured vulnerability records with CVSS v3 scores, affected product version ranges, CWE weakness classification, references and exploitation status. Signals engine produces P0/P1/P2 alerts: P0=CVSS>=9 + active exploitation, P1=CVSS>=7 or EPSS>=70%, P2=CWE pattern clusters. Relevant for EU NIS2 and DORA supply chain risk obligations. Optional env: NVD_API_KEY (raises NVD rate-limit 5→50 req/30s), GITHUB_TOKEN (raises GHSA GraphQL rate-limit). Cache TTL 6h. SLA <=25s p95.

  Connector

• cve_security_lookup

  gapup-mcp

  Look up CVE vulnerability data for enterprise security teams, DevSecOps and SOC analysts. Supports two modes: exact CVE ID lookup (e.g. 'CVE-2024-3094') or keyword search by product/vendor (e.g. 'openssl', 'Apache Tomcat'). Cross-references four authoritative keyless sources: NVD NIST (official CVE database, CVSS v3 scores, affected CPEs), CISA KEV (Known Exploited Vulnerabilities catalog — exploit_in_wild flag), EPSS FIRST (exploit probability 0-1), GitHub Security Advisories (ecosystem-specific: npm/pypi/maven). Returns structured vulnerability records with CVSS v3 scores, affected product version ranges, CWE weakness classification, references and exploitation status. Signals engine produces P0/P1/P2 alerts: P0=CVSS>=9 + active exploitation, P1=CVSS>=7 or EPSS>=70%, P2=CWE pattern clusters. Relevant for EU NIS2 and DORA supply chain risk obligations. Optional env: NVD_API_KEY (raises NVD rate-limit 5→50 req/30s), GITHUB_TOKEN (raises GHSA GraphQL rate-limit). Cache TTL 6h. SLA <=25s p95.

  Connector

• osv_query_package

  osv-advisory-mcp-server

  Query known vulnerabilities for a single package version across any supported ecosystem. Returns all matching OSV advisories with severity (CVSS vectors), CVE aliases, affected version ranges, and first safe version. Use osv_list_ecosystems to validate the ecosystem string before querying — ecosystem strings are case-sensitive exact matches and an invalid value returns an error, not empty results.

  Connector

• get_skill_clusters

  nü people Job Server

  Returns the current skill cluster data for public jobs on the nü people website. Use this tool when the user wants an overview of which skills or technologies are currently in demand.

  Connector

• convert_corroboration_to_surface

  Epovest

  Move the page to the surface registry: the customer has, or takes, the final say on it (their own profile or listing recorded on the wrong side, or a source that became a reliable channel). Nothing is retyped: url, label and notes travel, the publication date is copied into the notes, the type derives from the address and the canon (a host that is neither the canon website nor a known place lands on other, with the generic checklist). The corroboration is taken down, sheet intact, and the reverse move exists (convert_surface_to_corroboration): nothing is lost, and replaying the move finds the same line instead of duplicating it. It moves a line the customer declared: confirm with the user first.

  Connector

• get_dealer

  OpenDealer MCP Server

  Get comprehensive information about a specific dealership. Returns Google-enriched dealer knowledge optimized for assistants: • Name, address, phone, website • Google rating, review count, hours, business status • Inventory count and OpenDealer profile links • Contact points for sales / customer service Use this when a shopper asks "tell me about X dealership" or needs hours/ratings for a known dealer. Prefer a slug from dealers_near or search results. CRITICAL: Only use URL fields from the response (website, urls.*). NEVER invent or construct URLs.

  Connector

• search_providers

  agentery

  Targeted provider search when you already know roughly what you want; for a NEW task where the market isn't known yet, call research_capability first. Filtered free-text search over the directory, ranked with match_score and match_reasons. Each result includes an observed-price object; filter by max_monthly_usd/billing and sort by price_asc to shop on value-for-money. Results include how_to_connect (website, docs, mcp.endpoint when the vendor publishes one) — the link/endpoint needed to actually use the listing; get_provider_profile has the full version with a copy-paste MCP config snippet. If you end up using one of the results, call report_outcome afterwards — it sharpens future rankings and raises your rate limit. Accepts `query` (aliases: q, text) — an unknown query key is never silently ignored. For a market + pricing + shortlist in ONE call, use research_capability first.

  Connector

• search_committee_documents

  Committee Releases

  Find documents published by a congressional committee on its own website — press releases, oversight letters, staff reports, released interview transcripts, investigation files and hearing material. Covers the House Oversight Committee and the Senate Homeland Security and Governmental Affairs Committee (HSGAC). Use for "what has House Oversight said about X", "the Oversight Committee letter to Y", "HSGAC investigation into Z", "transcripts the committee released". This material appears within hours, unlike the official printed record which lags by months (use search_congressional_documents for that). IMPORTANT: matches the document headline/slug, not the text inside documents or their PDF attachments — an empty result means no headline matched rather than that the subject is absent.

  Connector

• search_d365_code

  ALM X++ MCP Server

  WHEN: object name is unknown, partial, or you need to find by concept/keyword. Search the D365 F&O knowledge base for X++ code, tables, classes, forms, views, enums, EDTs, security objects using natural language or partial names. Returns ALL chunks (metadata, Declaration, methods) for the top-scoring objects so the LLM has complete context on the first call. Lower-scoring results return a short preview. No follow-up get_object_details call is needed for top results. NOT for listing all objects in a model -- use list_objects for that. NOT when the exact name is known -- use get_object_details for that. NEVER call search_d365_code twice in the same conversation turn. If one search did not find the object, answer from what you have -- do not repeat the search. When you need context on MORE THAN ONE concept simultaneously, use batch_search instead -- it runs all queries in parallel and is faster. NEVER call for ADO items (FDD, RDD, IDD, Bug, Task, PR, WorkItem, sprint, #1234) -- use ado_* tools instead.

  Connector