"Techniques for Analyzing Typescript Code in a Project" matching MCP tools:

• atlas_technique_searchA

  ContrastAPIA

  Search the MITRE ATLAS catalog of AI/ML attack techniques by keyword, tactic, or maturity. Default response is SLIM (description truncated to 240 chars per row); pass include='full' for the verbose record. Pass exclude_id when chaining from atlas_technique_lookup to skip self in sibling-tactic searches. Use this to discover techniques matching a threat-model question, e.g. 'what techniques target LLM serving infrastructure?'. Drill into atlas_technique_lookup with any returned technique_id for the full description, ATT&CK bridge, and pivot hints. For broader cross-referencing: when a result has attack_reference_id, that bridges to D3FEND mitigations via d3fend_defense_for_attack. Free: 30/hr, Pro: 500/hr. Returns {query (echoed filters), total, results [{technique_id, name, description (truncated by default), tactics, inherited_tactics, maturity, attack_reference_id, subtechnique_of}], next_calls}.

  ConnectorNo auth

• getInstagramPostInteractingUsersA

  Social Media Search API — Twitter, Instagram, Reddit, TikTok (XPOZ)A

  Get USER PROFILES of people who interacted with an Instagram post. Returns full user data (bio, followerCount, followingCount, etc.). RETURNS USER PROFILES: id, username, fullName, biography, followerCount, followingCount, isVerified, profilePicUrl. Use for analyzing WHO engaged with a post. NOT FOR COMMENT TEXT: To read the actual comment content (what people wrote), use getInstagramCommentsByPostId instead. INTERACTION TYPES: "commenters" (users who commented), "likers" (users who liked). WHEN TO USE THIS TOOL: Analyzing commenters/likers demographics, finding influencers who engaged, building audience profiles, network analysis of who interacts with posts. WHEN TO USE getInstagramCommentsByPostId: Reading comment text, sentiment analysis of what was said, analyzing discussion content. FAST (default, omit responseType or responseType="fast"): Returns up to 300 results directly (use limit param to reduce, e.g. limit=5). Auto API fallback for commenters when stale. PAGING (responseType="paging"): Async paginated results (1000 users per page with default fields), returns operationId - IMMEDIATELY call checkOperationStatus to get results. CSV export included via dataDumpExportOperationId. Supports pageNumber/tableName for subsequent pages. Optional fields (default: ["id", "username", "fullName"]). Available: biography, isPrivate, isVerified, followerCount, followingCount, mediaCount, profilePicUrl. This is a safe, read-only tool for analyzing searchable information.

  ConnectorOAuth

• get-code-iq-automated-queriesA

  coderegistryA

  Returns trimmed Code IQ automated analyses (architecture, scalability, EOL, AI functionality, etc.) for a project (aggregated) or a single vault. Excludes The Code Score — use get-the-code-score for that, and do not pass analysis_key=code_score here (404). Only cached results are returned; this never triggers a fresh analysis. Provide exactly one of project_id or vault_id. Requires full data access (a paid plan; verification-only plans are not included). Requires X-API-Key (existing users can generate an API key in the web app). If headers aren't supported, pass api_key in arguments.

  ConnectorNo auth

• getInstagramCommentsByPostIdA

  Social Media Search API — Twitter, Instagram, Reddit, TikTok (XPOZ)A

  Get COMMENT CONTENT (text, likes) for an Instagram post. Returns the actual comment objects with text and metadata. RETURNS COMMENT DATA: id, text, username, createdAtDate, likeCount, childCommentCount. Use for reading what people said. NOT FOR USER PROFILES: To get detailed user profiles (bio, followerCount, followingCount) of commenters, use getInstagramPostInteractingUsers with interactionType="commenters" instead. IMPORTANT: postId must be in strong_id format (e.g., "3606450040306139062_4836333238") - use the full "id" value from other Instagram tools, NOT just the media_id. FAST (default, omit responseType or responseType="fast"): Returns up to 300 results directly (use limit param to reduce, e.g. limit=5). Auto API fallback for fresh data. PAGING (responseType="paging"): Async paginated results (100/page), returns operationId for polling via checkOperationStatus. Supports pageNumber/tableName for subsequent pages. CSV (responseType="csv"): Async single CSV download, returns operationId, poll for S3 link. CODE EXECUTION: For csv mode, download CSV and use code execution to analyze full dataset. Ideal for: sentiment analysis, reading discussions, analyzing comment content, engagement patterns. Date filters: OMIT startDate/endDate parameters by default. ONLY pass these if user explicitly requests specific date range (YYYY-MM-DD format). IMPORTANT!!!!!: THE CURRENT YEAR IS 2026. When user requests relative dates (last week, last month), verify the current date from your system context and double-check the calculated dates - models often get the year wrong, searching one year earlier than intended. Optional fields: ["id", "text", "username", "createdAtDate", "likeCount"]. This is a safe, read-only tool for analyzing searchable information.

  ConnectorOAuth

• getTiktokCommentsByPostIdA

  Social Media Search API — Twitter, Instagram, Reddit, TikTok (XPOZ)A

  Get COMMENT CONTENT (text, likes) for a Tiktok post. Returns the actual comment objects with text and metadata. RETURNS COMMENT DATA: id, text, username, createdAtDate, likeCount. Use for reading what people said. FAST (default, omit responseType or responseType="fast"): Returns up to 300 results directly (use limit param to reduce, e.g. limit=5). Auto API fallback for fresh data. PAGING (responseType="paging"): Async paginated results (100/page), returns operationId for polling via checkOperationStatus. Supports pageNumber/tableName for subsequent pages. CSV (responseType="csv"): Async single CSV download, returns operationId, poll for S3 link. CODE EXECUTION: For csv mode, download CSV and use code execution to analyze full dataset. Ideal for: sentiment analysis, reading discussions, analyzing comment content, engagement patterns. Date filters: OMIT startDate/endDate by default. ONLY pass if user explicitly requests date range. IMPORTANT!!!!!: THE CURRENT YEAR IS 2026. When user requests relative dates (last week, last month), verify the current date from your system context and double-check the calculated dates - models often get the year wrong, searching one year earlier than intended. Optional fields: ["id", "text", "username", "createdAtDate", "likeCount"]. This is a safe, read-only tool for analyzing searchable information.

  ConnectorOAuth

• search-music-docsA

  Music StudioA

  Search detailed documentation for Strudel live coding or ABC/ABCJS notation. Returns relevant code examples and explanations from the official docs. Use this when the curated guides (get-strudel-guide, get-music-guide) don't cover what you need — for specific functions, advanced techniques, or when you're unsure about syntax. Powered by semantic search over strudel.cc and ABCJS docs.

  ConnectorNo auth

• delete_profileA

  Proof HoldingsA

  Delete a project (profile). Revokes its API keys, archives the HITL setups and declines the pending requests created with its own keys, keeps its history but unlinks it, deletes its message templates, and retires its username for good. The last project cannot be deleted; deleting the primary project makes the oldest remaining one primary (the response names it). In a start_login session: one code first — start_2fa_for_action with action_type profile_delete and targets [this project id]. With an API key alone only an EMPTY project (no API keys, HITL setups or pending requests) can be deleted; anything else answers owner_session_required. Cannot be undone. ACCESS: needs a Proof account. Authenticate this client (Claude Code: /mcp → Authenticate), or sign in with start_login — a session opens this tool — then call this tool again.

  Connector

  Destructive

  No auth

• axint.validateA

  AxintA

  Validate a TypeScript intent definition without generating Swift. Runs the full Axint validation pipeline (134 diagnostic rules) and returns a JSON array of diagnostics: { severity: 'error'|'warning', code: 'AXnnn', line: number, column: number, message: string, suggestion?: string }. Returns an empty array [] when validation passes. Use: use for TypeScript DSL diagnostics before Swift output; use swift.validate for existing Swift. Inputs: source is TypeScript DSL text; strictness options affect diagnostics only and never emit Swift. Effects: read-only diagnostics; writes no files and uses no network.

  ConnectorNo auth

• axint.schema.compileA

  AxintA

  Compile a minimal JSON schema directly to Swift, bypassing the TypeScript DSL entirely. Supports intents, views, components, widgets, and full apps via the 'type' parameter. Uses ~20 input tokens vs hundreds for TypeScript — ideal for LLM agents optimizing token budgets. Use: use for token-light JSON-to-Swift generation; use compile for full TypeScript DSL control and scaffold for TS starters. Inputs: schema kind selects intent, view, widget, or app output; options add companion metadata. Effects: read-only Swift generation; writes no files and uses no network.

  ConnectorNo auth

• bulk_atlas_technique_lookupA

  ContrastAPIA

  Bulk ATLAS technique lookup — retrieve full records for up to 50 techniques in a single request instead of N separate atlas_technique_lookup calls. Designed as the natural follow-up to atlas_case_study_lookup, whose techniques_used array can be passed directly. Each item is the same shape as atlas_technique_lookup, including parent-tactics inheritance for sub-techniques (inherited_tactics=true flag) and per-item next_calls (D3FEND bridge when attack_reference_id present, sibling-technique search by tactic, parent lookup for sub-techniques). Free: 30/hr (1 per item), Pro: 500/hr. Returns {results [{technique_id, status (ok|not_found|invalid_format), technique, error}], total, successful, failed, partial, summary}.

  ConnectorNo auth

• check_injectionA

  ContrastAPIA

  Scan source code for injection vulnerabilities: SQL injection, command injection, path traversal via unsafe string concatenation/unsanitized input. Supports Python, JavaScript, TypeScript, Java, Go, Ruby, Shell, Bash. Use to detect input-handling bugs; for secrets use check_secrets. Companion code-security tools: check_secrets (hard-coded credential detection), check_dependencies (known-CVE vulnerability audit), check_headers (live HTTP security-header validation), scan_headers (live HTTP scan via domain). Free: 30/hr, Pro: 500/hr. Returns {total, by_severity, findings}. No data stored.

  ConnectorNo auth

• scaffold_route_handlerA

  UploadkitA

  Generate the complete file content for a Next.js App Router upload route handler — typed file router, handler export, correct path comment. When to use: when the user is setting up UploadKit server-side in a Next.js App Router project and needs the `app/api/uploadkit/[...uploadkit]/route.ts` file created. The returned string is a complete, compilable TypeScript file — write it to disk as-is. Returns: a markdown-formatted string containing the target path and the complete TS source inside a fenced code block. You must create the file at the literal path `app/api/uploadkit/[...uploadkit]/route.ts`. Read-only — generates text, never touches the filesystem itself.

  ConnectorNo auth

• classify_intentA

  ContextOverflowA

  Describe what's going wrong — your human's complaint, or a failure you notice in your own behavior — and get the matching techniques. Deterministic matching; if the description fits two problems it returns one clarifying question instead of guessing.

  ConnectorNo auth

• fetchA

  developer-toolkit-mcpA

  Retrieve the complete markdown of one documentation article by the id returned from `search` (for example `en/claude-code/advanced-techniques/hooks-automation`). The text is returned in full; `metadata.gated` only reports whether the article sits behind the paywall on the web. An unknown id is an error — call `search` first.

  ConnectorNo auth

• get_formA

  furrow-formsA

  Use to read a form plus resolved and inherited settings, including resolved.email and resolved.uploads. files_url is the private inbox folder for this form under the project inbox (do not put it in a public snippet). Turnstile always inherits from the project (inherited.turnstile is true). Form webhook_url_override is nullable; null means inherit the project webhook. Forms may override email.subject and email.intro only. Do not use to generate embed code — call get_snippet.

  ConnectorNo auth

• get_resolved_headersA

  RoutebaseA

  Get the headers that actually apply to one endpoint response after the full cascade — organization, project and spec policies, local overrides and exclusions — each with where it came from. get_header_policies does the same for a whole endpoint, grouped by status code. Requires project context.

  ConnectorAPI key

• redeployA

  The DeployerA

  Puts the latest code on a live project's branch online: pulls it and restarts the app, like Pull & Restart in The Deployer. It changes a live app, so confirm with the user first. Only for a project that's already live; a project's first deployment starts in the app. Takes a few minutes; follow it with status or logs. Needs an API key.

  Connector

  Destructive

  No auth

• upgrade_impactA

  VigíaA

  Reports what changes between two versions of an npm package by diffing the public TypeScript API of both releases (only the type declarations are analyzed; package code is never executed): removed exports and import paths, changed function signatures and class or interface members, newly deprecated APIs, changed engines and peerDependencies, and the changelog sections published in between. Returns a summary with counts and a likely_breaking flag, followed by the before/after detail of each change. Read-only and requires no authentication. The first request for a version pair can take up to about 25 seconds while the analysis runs; if it is still running the result has status "pending" and retry_after_s, and you should call again after that delay. Limits: only npm packages that ship TypeScript types (or have @types) can be analyzed, and behavior changes that do not alter types (for example new caching defaults) are invisible, so also read the returned changelog. Use it BEFORE upgrading a dependency across a major version, or when code written for an old version fails on a new one. For one API in one version use symbol_status; for vulnerabilities use version_status; to choose a version that fits an older runtime use find_compatible_version.

  ConnectorNo auth

• executeA

  Cheapest LLM APIA

  Run a JavaScript async function in an isolated sandbox, composing catalog_search, model_detail, offer_compare, benchmark_results, provider_list, benchmark_list, coding_agent_list, coding_agent_detail, coding_agent_releases, coding_agent_upgrade, and price_watch as catalog.* methods. Return a small JSON value. Example: async () => { const page = await catalog.catalog_search({query: 'claude', page_size: 5}); return page.data.models.map(m => ({slug: m.slug, prices: m.bestOffer?.prices})); }. No network, secrets, or database binding is exposed. Shared worldwide execution budgets: 100 per UTC minute and 5000 per UTC day. Limits: 30 executions per client per minute (IPv6 /64), 20 catalog calls and read units (offer_compare and price_watch use 5), at most two concurrent calls, 5 seconds wall time, 50ms sandbox CPU, 32KiB code, 64KiB JSON output. JavaScript only; no imports or TypeScript syntax. Use /mcp?mode=code for only search + execute.

  ConnectorNo auth

• start_projectA

  VinktarA

  Before the person has signed in to Vinktar: start a project for their app now, so setup can run and data can arrive before anyone makes an account. Returns the project's write key (public, safe in browser code) and a claim link that only the person should open: it signs them in, or makes them an account, and keeps the project with its data. Unclaimed, the project takes up to 10,000 events and is deleted with its data after 7 days. Only call it when the person has not signed in and the other tools ask for sign-in; once signed in, use list_projects and get_project_keys instead.

  ConnectorOAuth

• axint.scaffoldA

  AxintA

  Generate a starter TypeScript intent file from a name and description. Returns a complete defineIntent() source string ready to save as a .ts file — no files are written, no network requests made. On invalid domain values, returns an error string. The output compiles directly with axint.compile. Use: use to create a small TypeScript intent starter; use templates.get for richer examples and compile for Swift output. Inputs: name must be PascalCase; params define the starter contract; domain defaults to general. Effects: read-only generated TypeScript; writes no files and uses no network.

  ConnectorNo auth