"Semgrep static analysis tool" matching MCP tools:

• analyze_wcagA

  mcpA

  Analyze a website URL for WCAG 2.1 Level A accessibility issues. Automated static HTML analysis covering approximately 30-40% of WCAG 2.1 Level A criteria. Checks include: image alt text, form labels, heading hierarchy, page title, html lang, empty links/buttons, ARIA labels, duplicate IDs, skip navigation, table headers, landmarks, viewport zoom, autoplay media, and tabindex ordering. Manual testing is required for full WCAG compliance assessment. Results are cached for fast subsequent lookups. Rate limited to 1 request per minute per domain. Args: url: The website URL to analyze (e.g., "https://example.com"). Returns: WCAG analysis with: - url: The analyzed URL - score: Accessibility score (0-100) - grade: Letter grade (A-F) - issues: Categorized issues (critical, warnings, info) - meta: Extracted accessibility metadata - recommendations: Prioritized improvements - coverage_note: Disclaimer about automated coverage - cached: Whether result was from cache

  ConnectorNo auth

• describe_alertingA

  FixterA

  The static measure catalog for authoring an alert rule: per source (LOGS, SPANS, METRICS), the measure functions available, each with its unit and defaultMode (THRESHOLD or ANOMALY — the mode a new rule on this measure should default to). READ: available to any authenticated user. This is a static catalog: it reads no telemetry and returns the same answer for every caller. Call query's describe_schema first for the tenant's services, groupable fields, and metric names (pass source=metrics for the metric list) — this tool no longer returns any of that. Use this tool only to pick a measure once you know the source and, for METRICS, the metric's kind.

  ConnectorAPI key

• explain_greenfieldA

  SCModelingA

  Reference text on greenfield analysis — clean-slate facility-location math. Covers the weighted center-of-gravity (Weber) formulation, Weiszfeld's iterative algorithm, Lloyd's-style alternating location-allocation for N facilities, service constraints (% demand vs % customers within a distance band), and the inverse problem of solving for minimum N. Also covers when to use greenfield vs facility selection (the open/close MIP). Pure static text — no engine call, deterministic output. Use this when the user asks a conceptual 'how does greenfield analysis work' or 'where would I put my DCs' question. ChiAha's GreenfieldAnalysis engine powers the US Greenfield Design demo on the sandbox.

  ConnectorNo auth

• calculate_loan_payoffA

  Senaro Personal FinanceA

  Calculation, not advice. Verify with a professional before acting. Standard amortizing loan calculator. Pick this for a single fixed-rate installment loan (mortgage, auto, student, personal) with one amortization schedule; pick `calculate_cc_payoff` for a credit card, which carries revolving balances, multiple APR segments, and a snowball or avalanche strategy this tool does not model. Returns: - monthly payment, total interest, and a payoff date (null when the loan does not clear within its term) - a bucketed Analysis suitable for chart rendering. The Analysis includes KPIs, annotations (e.g. crossover month), and summary strings When extra_monthly_payment is supplied, every computed figure in the response outside with_extra describes this loan without the extra payment, including monthly_payment, payoff_months, total_paid, total_interest, remaining_balance_at_term, payoff_date, months_to_halfway_principal, months_to_interest_flip, and every value under analysis; a warnings[] entry names this. The response includes `chart_hints` with rendering directives any client can use. This tool does not support output: 'inline' on any transport.

  ConnectorNo auth

• __unlock_blockchain_analysis__A

  blockscout-mcp-serverA

  Initializes a Blockscout MCP session: returns server reference data, the `blockscout-analysis` skill pointer, and the URI resolution rule. Call this tool exactly once per session, before any other tool, and reuse its payload for the rest of the session; do not call it again.

  ConnectorOAuth

• atlas_get_analysisA

  CareerProof MCPA

  Retrieve a completed analysis result by analysis ID. Returns scores, competency breakdown, and recommendations. analysis_id comes from atlas_start_gem_analysis response or atlas_list_analyses. Only works after analysis is completed -- check with careerproof_task_status first. Free.

  ConnectorOAuth

• malware_get_templateA

  website-searchA

  Get Lenny Zeltser's malware analysis report template. The report covers Executive Summary, Sample Snapshot, Malware Family Identification, Component Inventory, Runtime Requirements, Sources, Capabilities, Indicators of Compromise, Analysis Details, What We Don't Know, optional Infection Vector, optional Detection Engineering, About this Report, Appendix: Analysis Environment, and optional Appendix: Analysis Scripts. This server never requests your sample, analysis notes, or indicators and instructs your AI to keep them local—guidelines and the report template flow to your AI for local analysis.

  ConnectorNo auth

• __unlock_blockchain_analysis__A

  mcp-serverA

  Initializes a Blockscout MCP session: returns server reference data, the `blockscout-analysis` skill pointer, and the URI resolution rule. Call this tool exactly once per session, before any other tool, and reuse its payload for the rest of the session; do not call it again.

  ConnectorNo auth

• get_playbookA

  mcpA

  [READ FIRST] The routing guide for every n0brains tool: which tool answers which intent (find a trade / vet a trade / coin snapshot / market brief / monitoring) and how to interpret the honesty fields (action_hint, historical_edge, n_eff, calibration). Call this once if you are unsure which tool to use — it replaces trial-and-error over the 40-tool catalog. Static text, no market data, free tier.

  ConnectorNo auth

• get_playbookA

  n0brainsA

  [READ FIRST] The routing guide for every n0brains tool: which tool answers which intent (find a trade / vet a trade / coin snapshot / market brief / monitoring) and how to interpret the honesty fields (action_hint, historical_edge, n_eff, calibration). Call this once if you are unsure which tool to use — it replaces trial-and-error over the 40-tool catalog. Static text, no market data, free tier.

  ConnectorNo auth

• preview_synthetic_breach_reportA

  Breach402 — Email Data-Breach CheckA

  Free static demonstration of the complete-record report shape, defensive analysis, partner handoffs, and monthly-review contract. Contains no real owner or breach data and performs no lookup.

  ConnectorNo auth

• sonar_generate_review_insightsA

  sonarA

  WRITE tool — generates a fresh AI review analysis for a tracked app from its recent reviews (praise/complaint themes, sentiment, feature requests, trend vs the previous run). At most one analysis per app+country every 90 days (429 with the next available time while in cooldown — use sonar_review_insights to read the current one); needs at least 5 recent reviews. Requires a paid (non-trial) Indie plan and an authorized Sonar account or an API key with the write scope.

  ConnectorNo auth

• ado_post_commentA

  ALM X++ MCP ServerA

  WHEN: user explicitly asks to post, add, or save a comment to an ADO Work Item. [~] PRIORITY TRIGGER: call AFTER `ado_analyze_workitem` when user says 'post the analysis', 'save it to the ticket', 'ajoute en commentaire'. WARNING: ALWAYS ask for explicit user confirmation before calling this tool. Recommended workflow: (1) call `ado_analyze_workitem`, (2) show analysis to the user, (3) ask 'Shall I post this comment to Work Item #X?', (4) only then call this tool. Requires DEVOPS_ORG_URL + DEVOPS_PAT with Work Items: Write permission.

  ConnectorNo auth

• modes.listA

  SwarmIOA

  The launchable modes with a one-line contract for each. Static; never charged, no credentials needed.

  ConnectorNo auth

• search_howto_pagesA

  stepcodeA

  Filter the how-to index by analysis family, tool, vertical, and/or a case-insensitive text query against title, analysis name, intro, problem statement, and step operations (with practitioner-synonym coverage, e.g. attrition/turnover/churn, logistic regression/classifier, power bi/dax, diversity/simpson/blau). All filters are optional and combine with AND; call with no arguments to get every page (same as list_howto_pages).

  ConnectorNo auth

• list_local_clisA

  Gabriel S. Gusmao: Research and Scientific CLIsA

  Discover Gabriel's catalog of locally run command-line tools. Returns stable tool IDs, descriptions, source links, versions, requirements, installation instructions, usage examples, software/paper citations and optional follow/star/fork/share links and guidance. All computation runs on the user's own computer. This tool only returns curated static metadata; it never installs packages, loads plugins, fetches remote instructions, or executes code. Check each entry's release and verification status before recommending it.

  ConnectorNo auth

• analyze_diff_bugsA

  IA-QA — 130+ QA & Dev Tools for AI AgentsB

  Pattern-based diff linter: flags a fixed set of risky shapes in changed code — query-string interpolation (SQL/Cypher/Mongo injection shape), shell interpolation, eval/new Function, empty catch blocks, regex built from a variable, fewer catch blocks than before, and named authorization guards that disappeared. Every finding cites the line that produced it. It does NOT do data-flow analysis: it cannot follow a value to a sink, across functions or files, and an empty result is not a safety verdict (the response lists what it did not analyse). Advisory triage — use a static analyser for a real security gate.

  ConnectorNo auth

• post_lint_phpA

  webbersites-x402-data-apiA

  PHP lint: POST {code}, get the bugs back with line numbers. Deterministic static analysis — code is never executed, no AI. Catches SQL injection (request data interpolated into query strings), the removed mysql_* API, unbalanced braces, '+' string concat, = vs == in conditions, type-juggling loose comparisons, eval/extract on request data, unused variables, leftover var_dump. Understands PHP tags, heredocs, interpolation. Max 128 KB. ($0.002 per call, paid via x402)

  ConnectorNo auth

• calendar.macro_ddayA

  AlphaPipeline Agent MCPA

  Use this tool when an agent plans trading schedules around major US macroeconomic volatility, specifically days remaining until FOMC rate decisions, CPI prints, or NFP jobs reports. Zero-dependency static 2026 macro calendar with 100% uptime and no upstream failure risk. Do not use for real-time market price data or economic forecast consensus figures. No input parameters. Paid in USDC on Base.

  ConnectorNo auth

• calendar.macro_ddayA

  alphapipelineA

  Use this tool when an agent plans trading schedules around major US macroeconomic volatility, specifically days remaining until FOMC rate decisions, CPI prints, or NFP jobs reports. Zero-dependency static 2026 macro calendar with 100% uptime and no upstream failure risk. Do not use for real-time market price data or economic forecast consensus figures. No input parameters. Paid in USDC on Base.

  ConnectorNo auth

• get_content_profileA

  SocialGPTA

  Get the caller's OWN content profile / DNA (topics, pillars, voice) synthesized from their content. Scoped per account group (brand): pass a group_id from list_accounts, or omit it for the default group. There is no per-creator content-profile tool — for competitor analysis use get_creator + list_creator_videos.

  ConnectorOAuth