"Securely Upload Local Files to Hosting Server via FTP Using WinSCP" matching MCP tools:

• upload_dataset

  GoldenMatch

  Upload a local file's bytes to the server and get back a server-side path to reuse across other tools (analyze_data, auto_configure, agent_deduplicate, ...). No hosting needed. Send base64 (default) or raw text via `encoding`. Uploaded files are ephemeral scratch, reaped after GOLDENMATCH_MCP_UPLOAD_TTL (default 24h); re-upload if you need a path older than that. Max size GOLDENMATCH_MCP_MAX_UPLOAD_BYTES (default 64MB) -- above it, pass a public http(s) URL as file_path instead.

  Connector

• upload_file

  BorealHost

  Upload a base64-encoded file to a site's container. Use this for binary files (images, archives, fonts, etc.). For text files, prefer write_file(). Requires: API key with write scope. Args: slug: Site identifier path: Relative path including filename (e.g. "images/logo.png") content_b64: Base64-encoded file content Returns: {"success": true, "path": "images/logo.png", "size": 45678} Errors: VALIDATION_ERROR: Invalid base64 encoding FORBIDDEN: Protected system path

  Connector

• create_upload_url

  ibo

  Get a short-lived presigned URL to upload one brand-asset file to IBO's private storage. Requires order_token from get_order; the storage location is bound to the order server-side. PUT the raw file bytes to url, then reference key in submit_brief files[]. Allowed: jpg png webp pdf svg mp4 mov zip ai psd; 250MB/file, 1GB per order.

  Connector

• check_upload_link

  Orivox AI Website Builder

  Return the EXACT images the user chose on their upload link. Pass the token_id that request_image_upload_link returned. Call this after the user says they uploaded or picked their images: it returns files[], each with a hosted url and a source ("upload", "gallery", or "shared"), so you place PRECISELY the images they selected instead of guessing from the whole gallery. An empty files list means they have not chosen anything yet -- ask them to open the link and add images, or wait and check again. Read-only; changes nothing.

  Connector

• upload_design_file

  a2a2p — Agent-to-Agent-to-Physical

  Turn local manufacturing file bytes into the temporary HTTPS reference used by specification.design_files. This is a bounded intake operation, not a request, provider call, quote, order, payment, or fabrication action. Common RFC 4648 transport forms are normalized, then decoded bytes are recognized by signature, checked against the declared format, screened before storage, retained for one hour, and never included in telemetry. Supported roles include geometry (STL/STEP) and drawings (DXF/PDF). The 2 MiB MCP ceiling is transport-specific; use POST /api/upload with purpose=manufacturing_design_file for files up to 8 MiB. Pass the returned file_reference object unchanged in specification.design_files on the next call.

  Connector

• generate_runner_profile

  CourseProfiler

  Generate a segment-evidence USRProf runner profile artifact from uploaded runner evidence or an existing .usrprof source. Before using this tool, ask what profile the user wants: target race/course, target distance/elevation range, general trail profile, or insights-only profile. Do not silently use every local file or arbitrary folders; if many evidence files are available, summarize candidates and ask the user to approve a selection strategy. A USRProf is not just average pace: CourseProfiler uses segment evidence to estimate climbs, descents, runnable grades, fatigue/durability, terrain fit, uphill running limits, and pacing confidence. Evidence choice affects race-plan times and standalone athlete insights. Use this when the user does not already have an already-converted usrprof_artifact_id. Accepted evidence includes GPX/FIT/CRSProf activity files, ZIP/TAR/TAR.GZ/TGZ/TAR.XZ/TXZ archives containing those files, and .usrprof files passed as source_file artifacts from POST /api/artifact-uploads, raw_file inline content/base64, or fetchable HTTPS URLs. Archives must use purpose runner_evidence, are expanded server-side, and report skipped nested archives, duplicate contents, unsupported entries, and parse failures by filename/path. For Strava, ask the user to authenticate in the CourseProfiler browser app, use its activity filters (date, distance, elevation gain, and elapsed time) to fetch relevant Run/TrailRun activities, select activities matching the profile intent, and export/download the .usrprof; do not ask for Strava credentials in MCP. Once the browser Strava flow has produced a downloaded .usrprof, the profile is already created: do not call generate_runner_profile merely to recreate/repackage it. If the user only asked to create/download a profile, stop there. If the user wants to use that .usrprof for a race plan through MCP, upload/pass it as runner input. After this tool succeeds, pass the returned usrprof artifact ID to create_race_plan as runner.usrprof_artifact_id.

  Connector

• axint.agent.claim

  Axint

  Claim files before an agent edits them so other agents do not patch the same SwiftUI/App files concurrently. Claims are local, short-lived, and stored in .axint/coordination/claims.json. Use: use before editing shared files in parallel-agent work; release claims when done. Inputs: agentId and files identify the claim; ttlMinutes bounds ownership and force overrides stale claims. Effects: writes local coordination claims under .axint/coordination; no network.

  Connector

• axint.agent.release

  Axint

  Release active local Axint file claims for this agent after finishing or abandoning a task. This keeps parallel agents and Xcode from blocking each other on stale claims. Use: use after finishing or abandoning claimed files; use agent.claim before edits and agent.advice for next steps. Inputs: agentId releases only its matching claims unless files narrow the release set. Effects: updates local coordination claims under .axint/coordination; no network.

  Connector

• confirm_datasheet_upload

  sheetsdata-mcp

  Confirm a datasheet upload started via request_datasheet_upload. Pass the upload_token you got back from the request step. The server downloads the uploaded bytes, re-hashes to verify integrity, validates that it's a real PDF with the MPN on the first page, creates the private Document + Component records, charges the upload fee (50¢), and queues extraction. Success response: document_id, mpn, sha256, file_size_bytes, status='pending'. Poll check_extraction_status with the MPN to wait for extraction to finish (30s-2min typically). Failure modes: - 'upload_not_found' — no bytes at the upload URL yet. Retry your curl upload. - 'sha256_mismatch' — uploaded bytes hash differs from expected_sha256. Re-compute the hash and re-request. - 'invalid_pdf' — bytes aren't a parseable PDF. No charge. - 'mpn_not_in_pdf' — MPN (or its stem) isn't on the first page. Either you uploaded the wrong file or it's a scanned image-only PDF. No charge. - 'token_expired' — upload token is older than 15 minutes. Restart via request_datasheet_upload.

  Connector

• check_text

  WSC - Writing Style Checker

  Analyze text for writing style issues: weasel words, passive voice, duplicate words, long sentences, nominalizations, hedging, filler adverbs, and research-cited AI tells. Read-only and stateless — text is analyzed in memory on the hosted server and never stored. Returns a plain-text report with each issue's line and column, the matched text, surrounding context, and the reason for AI tells; texts over 100,000 characters return an error message. This hosted server has no filesystem access — the wsc-mcp npm package adds a check_file tool for local files. It only reports issues — to auto-remove duplicate words, follow up with fix_duplicates.

  Connector

• ir_get_brief_template

  website-search

  Get Lenny Zeltser's IR one-page executive brief template. Standalone variant of `ir_get_template` for callers that only want the brief without the long-form report. This server never requests your incident notes and instructs your AI to keep them local—guidelines flow to your AI for local analysis.

  Connector

• cti_get_cross_server_routes

  website-search

  Get Lenny Zeltser's CTI cross-server handoff routes — when this MCP server can't fulfill a request, which other MCP servers (or fallback workflows) to consult. Surfaces a compact subset of `cti_load_context`. This server never requests your campaign or threat-intel notes and instructs your AI to keep them local—templates and guidelines flow to your AI for local analysis.

  Connector

• vuln_get_brief_template

  website-search

  Get Lenny Zeltser's Vuln one-page executive brief template. Standalone variant of `vuln_get_template` for callers that only want the brief without the long-form report. This server never requests your vulnerability notes and instructs your AI to keep them local—the brief template and guidelines flow to your AI for local analysis.

  Connector

• assessment_get_brief_template

  website-search

  Get Lenny Zeltser's Security Assessment one-page executive brief template. Standalone variant of `assessment_get_template` for callers that only want the brief without the long-form report. This server never requests your assessment notes or report and instructs your AI to keep them local—the templates and guidelines flow to your AI for local analysis.

  Connector

• acc_upload_file

  ACC MCP

  Upload a file from a public source URL into an ACC project folder. Runs the full four-step APS Data Management flow: top-folder discovery → storage object creation → OSS PUT of bytes → first-version item creation. When to use: The user wants to push a document/photo/model into ACC Docs — e.g. 'upload this site photo to the Tower project Photos folder' or an automation needs to archive an exported report into Project Files. When NOT to use: Do not use for files already in ACC; do not use for files behind auth-gated URLs (fetch step is an unauthenticated GET). For very large files (>100MB), prefer the chunked/signed-S3 upload flow, not this single-PUT implementation. APS scopes: data:read data:write data:create account:read. Rate limits: APS Data Management ~50 req/min per endpoint; OSS upload bandwidth typically 100 MB/min per app. This tool issues 3–5 APS calls per upload, so budget accordingly. Errors: 401 (APS token expired — refresh); 403 (user lacks folder write permission — ask account admin to grant 'Edit' on folder); 404 (project_id not found or folder_path does not match any top folder — verify 'b.' prefix, hub membership, and folder name); 422 (invalid file_name or conflicting version); 429 (rate limit — back off 60s); 5xx (ACC/OSS upstream — retry with jitter BUT be cautious: storage object may already be created so reuse, do not re-create). Also: if source file_url returns non-2xx, the tool throws before touching ACC. Side effects: Creates a storage object, uploads bytes, and creates a versioned item in the target folder. NOT idempotent — a retry may create a duplicate item with a new version. Surface the returned item_id to the user to avoid re-uploads.

  Connector

• upload

  Fast.io

  File upload: stream-upload (one-shot — auto-finalizes, no filesize needed), chunked (create-session → chunk → finalize, for exact-known-size or files split across blobs), web URL import, and batch (many small files). Call action='describe' for the full action/param reference. Side effects: finalize/stream/stream-upload/web-import/batch create files and consume storage credits. Same-name uploads to a folder OVERWRITE the existing node in place (preserved as a recoverable version). BYTES → SERVER: the **DEFAULT for every file/binary is the `POST /blob` sidecar** — a plain HTTP POST outside the MCP pipe (the create-session/blob-info response hands you a ready-to-run curl command) that returns a `blob_id` you pass to stream-upload/chunk/batch: no base64, no MCP size limit, up to 100 MB. Use `content_base64` (inline base64, capped a few MB by the MCP transport) ONLY when your client cannot make the POST /blob call. `content` is small text only (verbatim UTF-8). UPLOAD STRATEGY (read top-to-bottom, pick the FIRST that matches): (1) Have a URL? → `web-import` (single call). (2) DEFAULT for a file/binary → `POST /blob`, then `stream-upload` with `blob_id` (single call, auto-finalizes, NO filesize required). Unknown/generated size and no way to reach /blob → `stream-upload` with `content_base64`. (3) Known exact byte count, or a large file split across blobs → `create-session` + `chunk`(`blob_id`) + `finalize`. **filesize must match the bytes you actually upload — mismatch causes finalize to fail with code 10522 and you must cancel the session.** (4) Multiple small files (≤4 MB each, ≤200 total) into one folder? → `batch`. Prefer `blob_id` (POST /blob) for every file/binary upload; fall back to `content_base64` only when you cannot reach /blob. Do NOT guess `filesize` for generated content — use `stream-upload`. max_size is a hard ceiling that aborts mid-transfer — always overestimate or omit (server uses plan limit).

  Connector

• request_image_upload_link

  Orivox AI Website Builder

  Get a browser link the user opens to upload real image FILES to their site -- the reliable way to add actual photos, drawings, logos, or several images at once, and the tool to reach for the INSTANT a user pastes, attaches, uploads, or mentions an image they want used. Call this and hand the user the link ANY time they have an image -- they have no other way to know the upload option exists, so always surface it; do not try to ingest a pasted/attached image yourself. You cannot carry image bytes yourself -- a tool call is text you have to type out, so a real photo either will not fit or arrives corrupted. This returns an upload_url instead: give that link to the user, tell them it works from their phone too and is valid for about an hour. On that page they can upload their own files, pick from images they already uploaded, or search a free stock photo gallery -- all without leaving the browser. KEEP the returned token_id. When the user says they are done, call check_upload_link(token_id) to get back the EXACT images they chose and place those hosted URLs on the site with apply_dom_ops. role="logo" tags the link for a logo upload; "content" (default) for any other image. Requires an existing project_id -- create_project first if there is no project yet.

  Connector

• convert_content

  Botverse

  Convert a document inline — pass the content directly as a string (or base64 for binary inputs like .docx). PREFERRED route for documents, and the one to use in sandboxed agent environments (claude.ai, Claude Desktop, Cursor): it runs entirely server-side, so it never needs the S3 upload those sandboxes block. Limit: up to 4 MB of content — already huge (a 500-page book is ~1 MB of text). For anything larger, use convert_from_url with a public URL. Supported inputs: md, html, rst, txt (plain text), docx (base64). Supported outputs: docx (Word), pdf, html, txt, md, rst, xlsx. Returns a job_id — poll get_job_status until 'complete', then get_output_content (inline bytes, sandbox-safe) or get_download_url (S3 link). Flat fee $0.05 per file. TIP: if you have shell access and are NOT sandboxed (e.g. a local coding agent), the `botverse` CLI (`npx botverse convert <file> --to <fmt>`) is faster for local files — it streams from disk instead of re-emitting the content through the model.

  Connector

• files.upload_file

  Vee3

  Reserve a direct upload slot for a local file. Pass the desired file_name. To place a file in folders, use a path in file_name (folder/subfolder/.../name). Optionally pass retention_days (default 7, minimum 1). The name may omit an extension. Vee3 returns an upload_code. Install the Vee3 CLI once with `npm install -g @vee3/cli` (requires Node 18+), then run `vee3-upload {upload_code} {file_path}` in the terminal. The CLI resolves the code to a signed upload URL, streams the local file to Vee3 storage, and prints the stored file_name after the upload finishes. Use that file_name in files.list_uploaded_files and other capabilities. The CLI does not need an API key. If installation fails with a TLS or certificate error (common on networks that inspect HTTPS traffic), use Node 22.15 or newer and run with NODE_OPTIONS=--use-system-ca, or configure npm to trust your network's root certificate. Files can be up to 2 GB. Retention is chosen at reserve time (default 7 days). After the upload is detected, Vee3 bills `max(1, ceil(size_gibibytes * retention_days * 2))` tokens. Upload codes can be resolved within 60 minutes of reserve. Use `files.list_uploaded_files` to list stored uploads for follow-up work. Cost = 0 tokens to reserve. After upload completes, billing is max(1, ceil(size_gibibytes * retention_days * 2)) tokens.

  Connector

• publish_site

  mcp

  Deploy files to a live URL. No slug → create a NEW site (works without auth; anonymous sites expire in 24h — always show the user the claimUrl). With slug → UPDATE that site (complete snapshot: send ALL files). A Dockerfile in the files makes it a server-side app (auth required; listen on process.env.PORT; persist under /data; poll app_status). Total payload ≤ 8 MB — for bigger sites use the dataecho skill scripts.

  Connector