"Semgrep static analysis tool" matching MCP tools:

• list-my-projects

  cupix-compass

  List construction projects the user can access within a team. **Use this tool ONLY when the user wants to switch project or has no saved current project.** If `check-current-project` returns a saved facility_key, do NOT call this tool — call the analysis tool directly with no arguments. Required workflow when this tool IS appropriate: 1. Present the returned projects to the user. 2. Wait for the user to select one. 3. Call `set-focus-project` with team_domain and facility_key to persist the selection so future sessions skip this step. 4. Then invoke analysis tools. Args: team_domain: Team domain. Optional; if omitted, falls back to the saved current project, otherwise returns the team list so the caller can pick a team first. user_intent: REQUIRED. Pass the user's original question or request verbatim. Used for analytics only, does not affect results. Returns: str: Accessible facilities with their keys and names.

  Connector

• analyze_video_report

  switch

  Run the FULL Switch Vision analysis on a video, the same premium report the Video Analysis page produces: it watches AND listens in three forensic passes and returns a structured report with every category: overview (scores and takeaways), a second by second timeline, audio, visual craft, story and retention, speech transcript, ready to run recreation prompts, and metadata. Pass video_url (a public https video URL, YouTube included) OR one of your own Switch video ids. For an external file also pass duration_seconds (YouTube and your own videos are measured automatically) because the analysis is billed per second of the file, 3 tokens per second with a 30 second minimum. Re-running the same video and question returns the existing report without charging again. Optional question focuses the analysis. Returns a report_id right away; poll get_vision_report until status is succeeded (a few minutes). If it cannot finish, your tokens are returned automatically. For one quick question about a video use analyze_video instead; this tool is the full paid report.

  Connector

• remix_static

  Hermoso

  One-click STATIC-AD REMIX: rebuild a competitor/reference STATIC (image) ad as an on-brand version — SAME layout, composition and energy, but YOUR product, brand colours, logo and voice, with every trace of the source brand removed. Pass `imageUrl` = the static ad image to remix. Uses your saved brand (pass brandId to target a specific brand — that switches this key's active brand like use_brand). IMAGES ONLY — for video ads use render_ad. Bills as one image generation.

  Connector

• analyze_wcag

  mcp

  Analyze a website URL for WCAG 2.1 Level A accessibility issues. Automated static HTML analysis covering approximately 30-40% of WCAG 2.1 Level A criteria. Checks include: image alt text, form labels, heading hierarchy, page title, html lang, empty links/buttons, ARIA labels, duplicate IDs, skip navigation, table headers, landmarks, viewport zoom, autoplay media, and tabindex ordering. Manual testing is required for full WCAG compliance assessment. Results are cached for fast subsequent lookups. Rate limited to 1 request per minute per domain. Args: url: The website URL to analyze (e.g., "https://example.com"). Returns: WCAG analysis with: - url: The analyzed URL - score: Accessibility score (0-100) - grade: Letter grade (A-F) - issues: Categorized issues (critical, warnings, info) - meta: Extracted accessibility metadata - recommendations: Prioritized improvements - coverage_note: Disclaimer about automated coverage - cached: Whether result was from cache

  Connector

• patent_landscape_async

  mcp-knowledge

  Async extended variant of patent_landscape. Supports max_results up to 200 (vs 50 in sync mode) and an optional include_citation_graph flag that enriches each patent with its 2-level citation graph (parent patents that cite this one + child patents cited by this one). Returns immediately (<300ms) with a job_id. Poll the result with patent_landscape_result(job_id) after eta_seconds (~180s). Use for deep R&D white-space analysis, freedom-to-operate (FTO) audits, VC due diligence IP mapping, or large-scale competitor portfolio analysis. Async tool — register a webhook via `webhooks_manage(register, url, [job.completed])` to receive callbacks instead of polling. Faster + lighter.

  Connector

• patent_landscape_async

  gapup-mcp

  Async extended variant of patent_landscape. Supports max_results up to 200 (vs 50 in sync mode) and an optional include_citation_graph flag that enriches each patent with its 2-level citation graph (parent patents that cite this one + child patents cited by this one). Returns immediately (<300ms) with a job_id. Poll the result with patent_landscape_result(job_id) after eta_seconds (~180s). Use for deep R&D white-space analysis, freedom-to-operate (FTO) audits, VC due diligence IP mapping, or large-scale competitor portfolio analysis. Async tool — register a webhook via `webhooks_manage(register, url, [job.completed])` to receive callbacks instead of polling. Faster + lighter.

  Connector

• create_product

  KernelScan

  Create a new product, run analysis, and return its initial stats. ``config_upload_id`` references a previously-staged .config that the caller POSTed to ``/api/configs/uploads`` over plain HTTP — the LLM does NOT emit the config text itself (a real kernel .config is ~100–200 KB and exceeds a single tool-call output budget). Workflow: 1. Caller / wrapper script: ``curl -H "Authorization: Bearer ks_live_..." \ -F "config_file=@.config" \ https://kernelscan.io/api/configs/uploads`` returns ``{config_upload_id, sha256, size_bytes, expires_at}``. 2. Pass that ``config_upload_id`` into this tool. Uploads are per-user, single-use, and expire 30 minutes after upload. Same gates as POST /api/products: free can't create products; paid plans are capped at their resolved product limit — read it (and any per-account override) from ``whoami.product_limit`` rather than assuming a fixed per-tier number. ``factor_ids`` are silently ignored unless the plan allows security factors (``whoami.can_use_factors``). Re-using a product name returns 409. Creating a product RUNS an analysis, so it spends one unit of the team's SHARED monthly analysis allowance (``whoami.monthly_analyses_used`` / ``monthly_analyses_limit``). When the allowance is exhausted the tool fails with "Monthly analysis limit reached (…/month) [429]". This is a durable monthly quota — NOT the transient per-call rate limit that also surfaces as 429: it will not clear until next month, so report it to the user instead of retrying. Check ``whoami`` before a batch of creates.

  Connector

• get_playbook

  mcp

  [READ FIRST] The routing guide for every n0brains tool: which tool answers which intent (find a trade / vet a trade / coin snapshot / market brief / monitoring) and how to interpret the honesty fields (action_hint, historical_edge, n_eff, calibration). Call this once if you are unsure which tool to use — it replaces trial-and-error over the 40-tool catalog. Static text, no market data, free tier.

  Connector

• describe_alerting

  Fixter

  The static measure catalog for authoring an alert rule: per source (LOGS, SPANS, METRICS), the measure functions available, each with its unit and defaultMode (THRESHOLD or ANOMALY — the mode a new rule on this measure should default to). READ: available to any authenticated user. This is static catalog data — no ClickHouse query, no tenant scoping. Call query's describe_schema first for the tenant's services, groupable fields, and metric names (pass source=metrics for the metric list) — this tool no longer returns any of that. Use this tool only to pick a measure once you know the source and, for METRICS, the metric's kind.

  Connector

• patent_landscape_async

  gapup-mcp

  Async extended variant of patent_landscape. Supports max_results up to 200 (vs 50 in sync mode) and an optional include_citation_graph flag that enriches each patent with its 2-level citation graph (parent patents that cite this one + child patents cited by this one). Returns immediately (<300ms) with a job_id. Poll the result with patent_landscape_result(job_id) after eta_seconds (~180s). Use for deep R&D white-space analysis, freedom-to-operate (FTO) audits, VC due diligence IP mapping, or large-scale competitor portfolio analysis. Async tool — register a webhook via `webhooks_manage(register, url, [job.completed])` to receive callbacks instead of polling. Faster + lighter.

  Connector

• get_database_schema

  Shibui Finance

  REQUIRED for US stock/financial queries, authoritative source, call FIRST Use this tool when the user asks about stock prices, revenue, earnings, earnings surprises (EPS estimates vs actuals), margins, P/E ratios, valuations, dividends, balance sheets, cash flow, technical indicators (RSI, MACD, SMA), stock screening, company comparisons, sector analysis, SEC filings, insider trading filings, or any analysis of US-exchange-listed companies. Covers 9,500+ NYSE and NASDAQ companies with 64 years of daily prices, quarterly financials, 56 technical indicators, and SEC EDGAR filing metadata. Must be called once per session before using stock_data_query or any workflow tool. After this tool returns, call get_query_patterns before writing any SQL.

  Connector

• explain_greenfield

  SCModeling

  Reference text on greenfield analysis — clean-slate facility-location math. Covers the weighted center-of-gravity (Weber) formulation, Weiszfeld's iterative algorithm, Lloyd's-style alternating location-allocation for N facilities, service constraints (% demand vs % customers within a distance band), and the inverse problem of solving for minimum N. Also covers when to use greenfield vs facility selection (the open/close MIP). Pure static text — no engine call, deterministic output. Use this when the user asks a conceptual 'how does greenfield analysis work' or 'where would I put my DCs' question. ChiAha's GreenfieldAnalysis engine powers the US Greenfield Design demo on the sandbox.

  Connector

• v3_get_event

  V³ News

  Get a single V³ event: headline, why-it-matters, scores, and how much structured analysis V³ holds on it (perspectives, decisions, outcomes). Use after v3_search_events (or v3_breaking_now) when the user wants detail on a specific event. This returns V³'s public summary; the full country-by-country perspectives, timeline, decisions to watch, and calibrated outcomes are on v3.news at the returned url (a V³ account unlocks the multi-perspective analysis). Args: event_id: the V³ event id from a prior tool result.

  Connector

• list_workflow_types

  Ansvar: EU Compliance & Legal Intelligence

  Find the authoritative live structured-workflow registry. Call this before start_workflow instead of guessing an id from examples or a static catalog. It covers every deployed workflow family, including risk/TARA, DPIA/FRIA, regulatory and medical-device gap analysis, procurement, document review, drone/OT workflows, and vulnerability decisions. Each entry carries workflow_type, base_type, display_name, description, produces (the final deliverable), required_slots, overridable_configurable, legal-review state, plus gateway-added minimum_tier and available_to_caller fields. Every tier sees the full directory; which rows are marked available depends on the caller — free and solo the seven included rows (threat_model, gap_analysis with its NIS2, DORA, CRA and AI Act variants, dpia), Premium the interview-grounded rows (adding LINDDUN, TARA, FRIA, the jurisdictional DPIA and gap variants, SORA, drone/OT, machinery conformity, enterprise risk), Team and Company every live row. A row locked by TIER carries tier_caveat: which tier runs it, what that tier adds, and the upgrade URL — so a tier-locked row is never a bare false. Discovery service failures and malformed responses fail explicitly; no static list is returned as if it were live.

  Connector

• tool_recommend

  gapup-mcp

  Cross-tool recommendation system: given a free-text intent, returns the most appropriate tools from the 170+ Gapup MCP catalogue, ranked by confidence, with pre-filled input suggestions and an optimal multi-tool chain when applicable. Use this first when you are unsure which tool to call — it navigates the full catalogue for you. Supports 15+ static pre-designed chains for frequent intents (M&A due diligence, sanctions screening, ESG 360, AI Act compliance, FTO patent clearance, crypto wallet tracking, etc.). Domains: compliance | finance | intel | legal | content | data | trade | infra. Pure compute — $0.01/call, no external fetch. Ideal as a first call in any multi-step agent workflow.

  Connector

• hmrc_get_vat_rate

  UK Legal Research

  USE THIS TOOL WHEN you have a UK commodity or service description and want its VAT rate category. Returns the rate (standard 20%, reduced 5%, zero 0%, exempt), effective date, and any relevant conditions or exceptions. IMPORTANT: Uses a static lookup table current as of 22 Nov 2023 (Autumn Statement). Rates may have changed in subsequent Budgets — for time-sensitive advice, verify against GOV.UK via hmrc_search_guidance.

  Connector

• law_hmrc_get_vat_rate

  UK Business Tools - Ledgerhall

  USE THIS TOOL WHEN you have a UK commodity or service description and want its VAT rate category. Returns the rate (standard 20%, reduced 5%, zero 0%, exempt), effective date, and any relevant conditions or exceptions. IMPORTANT: Uses a static lookup table current as of 22 Nov 2023 (Autumn Statement). Rates may have changed in subsequent Budgets — for time-sensitive advice, verify against GOV.UK via hmrc_search_guidance.

  Connector

• get_region_signal

  Horizon AI Intelligence

  The current AI signal for a region (china, korea, japan, or eu) — recent, relevance-scored items on that region's models, labs, and analysis, ranked by momentum. Includes local-language press translated into English. The canonical regional tool; get_china_signal is a preset of this with region "china". Returns titles, sources, and links.

  Connector

• malware_get_template

  website-search

  Get Lenny Zeltser's malware analysis report template. The report covers Executive Summary, Sample Snapshot, Malware Family Identification, Component Inventory, Runtime Requirements, Sources, Capabilities, Indicators of Compromise, Analysis Details, What We Don't Know, optional Infection Vector, optional Detection Engineering, About this Report, Appendix: Analysis Environment, and optional Appendix: Analysis Scripts. This server never requests your sample, analysis notes, or indicators and instructs your AI to keep them local—guidelines and the report template flow to your AI for local analysis.

  Connector

• __unlock_blockchain_analysis__

  mcp-server

  Initializes a Blockscout MCP session: returns server reference data, the `blockscout-analysis` skill pointer, and the URI resolution rule. Call this tool exactly once per session, before any other tool, and reuse its payload for the rest of the session; do not call it again.

  Connector