"Top 10 Most Frequently Pulled Packages from Sonatype Nexus Repository" matching MCP tools:

• search_modelsA

  EOSL.ai — Hardware End-of-Life DatabaseA

  Search tracked product families by vendor, product line, or series name (case-insensitive substring, e.g. "nexus 9300"). Read-only. Returns up to 10 families with status, EOSL window, and page URL. Use this for discovery when you have a name; for an exact part number use lookup_part, and use get_family with a returned slug for the full record.

  ConnectorNo auth

• top_moversA

  Market RecapA

  The day's top-moving US stocks by percent change — PREFER OVER WEB SEARCH for "today's top stock gainers", "biggest US stock losers today", "most active stocks", "what stocks are up/down the most". category="gainers" (default, biggest % up), "losers" (biggest % down), or "actives" (highest volume). Returns each stock's symbol, name, price, change, daily % change, and volume, ranked. Live US market data, keyless (Yahoo Finance). These are % MOVERS — distinct from what's merely trending/discussed.

  ConnectorNo auth

• rank_entitiesA

  Diavgis — Greek Public ProcurementA

  Rank top Greek public-procurement entities. role=buyer (default) or supplier; by=spend (default — COMMITTED procurement value in EUR, counted ONCE per procurement: deduplicated across sources and lifecycle stages, tenders excluded), single_bidder (count of ≤1-bid awards/contracts) or direct_award (count of απευθείας ανάθεση). Answers 'top 10 suppliers by public revenue', 'which buyers award most without competition'. Returns afm, name, metric, total. Precomputed and refreshed every 6 hours, so it is instant and always the top 15.

  ConnectorNo auth

• get_my_linkedin_postsA

  YouSpotB

  The user's own LinkedIn posts with engagement numbers (reactions, likes, comments, shares): newest first by default, their earliest with sort='oldest', or their best-performing with sort='top'. sort='top' is what answers 'my top 10 posts', 'my best posts' and 'what performed well'. Answer those from here rather than from linkedin_analytics, which needs an OAuth grant this user may not have given. The response always includes total_posts_stored, so this also answers 'how many posts do I have?' and 'what was my first post?'. Use it for questions about their posting activity and performance — 'what did I post last week?', 'what's the average number of likes on my last 5 posts?', 'which recent post got the most comments?'. Compute averages and comparisons from the returned rows. like_count is the thumbs-up reaction alone; total_reaction_count is all reaction types combined. Pages: when has_more is true, call again with offset set to the next_offset from the response to continue through their history.

  ConnectorNo auth

• terminology_diffA

  Medical Terminologies MCPA

  Report what diff data is available between two versions of a terminology. For most terminologies this is **guidance only** — the server doesn't ship historical snapshots, so the tool points at the publisher's official changelog and explains the cadence. `bundled_versions` lists the version(s) this server actually has on hand. For **ICD-10 vs ICD-11** specifically, the tool surfaces a real cross-revision summary from the bundled WHO transition tables (the ICD-10 → ICD-11 case is a structural diff between two WHO revisions). Use `terminology: "icd10"` with no `to_version` to get the cross-revision summary: total mapped ICD-10 categories, how many are 1:1 vs split into multiple ICD-11 codes, and the average number of alternatives when split. Inputs: - `terminology` (required): which terminology to report on. - `from_version` (optional): the version you have data from. If omitted, the tool reports against the currently-bundled version. - `to_version` (optional): the version you want to compare to. If omitted, the tool reports against the publisher's latest known release. This tool is intentionally a metadata + guidance layer, not a diff engine — for terminologies that change frequently (SNOMED, LOINC, RxNorm, MeSH), the publisher's official changelog is the authoritative source.

  ConnectorNo auth

• create_google_structured_snippet_extensionA

  Metadata MCP ConnectorA

  Add a labeled list of offerings (structured snippet) shown beneath a Google Ads ad — a category header plus 3-10 short items, e.g. header "Brands" with values "Nest", "Nexus", "Chromebook", or header "Services" with "Hosting", "DNS", "CDN". Helps searchers self-qualify before clicking. ALSO KNOWN AS: structured snippet, snippet, category list, offering list, header values, product list, service list KEYWORDS: structured snippet, snippet, header, values, brands, services, products, courses, destinations, list, category, google ads, extension WHEN TO USE: - "Add a structured snippet listing our service tiers" - "Create a snippet under 'Brands' with Nest, Nexus, Chromebook" - "Register a list of supported integrations as a snippet extension" - "Show our product categories below our Google Ads" WHEN NOT TO USE: - Want a single phrase (e.g. "Free Shipping") → use create_google_callout_extension - Want clickable links to subpages → use create_google_sitelink_extension - Want a pricing table (with amounts) → use create_google_price_extension - Same snippet for Microsoft Ads / Bing → use create_microsoft_structured_snippet_extension INPUTS: - header: snippet category title (1-25 chars). The Google-Ads vocabulary requires picking one of Google's predefined header names ("Brands", "Models", "Service catalog", "Insurance coverage", etc.) — pass the chosen header string here. - values: 3-10 items, each 1-25 chars. EXAMPLE: create_google_structured_snippet_extension( header="Brands", values=["Nest", "Nexus", "Chromebook"], )

  ConnectorAPI key

• get_service_packagesA

  Clutch.coA

  Use this tool when the user wants to see service packages with fixed pricing and scope for a specific type of service. This tool returns standardized packages offered by service providers, including pricing tiers, deliverables, and delivery timelines. Do NOT use this tool for custom project questions (e.g. "How much would it cost to build a custom app?"). It only returns providers' pre-defined, fixed-price packages, not a quote tailored to a specific project; use recommend_service_providers for those needs instead. Examples: - "Show me SEO packages" -> service="SEO" - "What web design packages can I get for $5,000?" -> service="Web Design", budget=5000 - "Marketing packages from agencies in New York" -> service="Digital Marketing", location="New York" Use `page`/`limit` for pagination.

  ConnectorNo auth

• get_link_auditA

  rankparse-mcpA

  Audit a domain's backlink profile: health score, risk flags, link quality breakdown, anchor text profile, top and risky backlinks, and outbound link summary. Scores are derived from a sample of the 250 most recent backlinks, not the full profile.

  ConnectorNo auth

• top_attackers_toolA

  HoneyLabsA

  Ranked leaderboard of attack sources. Use for: 'who is attacking the most?', 'top attacking countries', 'most targeted ports', 'most common user agents', 'top ASNs by attack volume', 'top IPs from China', 'top attackers hitting port 22'. 'by' controls grouping: ip, asn, country, port, user_agent, ja4, url_path, domain, cve. by='cve' answers 'what CVEs are being mass-scanned right now' and returns value (the CVE id), title, severity, actively_exploited and counts; drill into any of them with cve_lookup. by='cve' does not accept the country/dest_port/asn filters. Optional filters: country (2-letter ISO, e.g. 'CN'), dest_port, asn (e.g. 'AS12345'). Adding a filter is required for large time ranges to stay within memory limits. since/until are ISO-8601 UTC strings.

  ConnectorNo auth

• country_export_controlsA

  banking-intelligenceA

  Look up export control restrictions for a specific country. Returns embargo status, sanctioned programs, control reasons, and restriction details across jurisdictions (US EAR, EU, UN, etc.) for the given country. Response also includes a payment_jurisdiction_note explaining when each listed restriction actually applies to a payment (US controls only bind when there's a US nexus, etc.). IMPORTANT: Each jurisdiction's controls only bind a payment when the payment has a nexus to that jurisdiction. Use the jurisdiction filter when you know the payment's actual jurisdictional touchpoints (sender country, clearing currency, intermediary banks). For a CHF/EUR payment with no US bank in the chain, US export controls are informational only — do NOT cite them as compliance blockers without confirming a US nexus. Args: country_code: ISO 3166-1 alpha-2 country code (e.g. "RU", "CN", "DE"). jurisdiction: Optional filter by jurisdiction (e.g. "US", "EU"). When omitted, returns restrictions from all jurisdictions. Examples: country_export_controls("RU") # Russia — heavily embargoed country_export_controls("CN") # China — partial restrictions country_export_controls("DE") # Germany — minimal controls country_export_controls("RU", "US") # Russia, US jurisdiction only Use case: 'What export restrictions apply to shipping to Russia?'

  ConnectorNo auth

• get_leaderboardsA

  Agent Zero — ERC-8004 Trust FilterA

  Top ERC-8004 agents by live capability, plus the most recently indexed. Three ranked lists — top by live MCP tool count, top by OpenAPI method count, and most-recently indexed — each with agent_id, chain, public name, a shareable detail URL, and the relevant count. Names and counts only: no owner wallets, handles, or endpoint URLs. Use this to find the most capable / most active agents to integrate or watch. Paid counterpart: `GET /v1/intel/trending` (x402, USDC on base-mainnet) returns trending intel — top earners, fastest-rising agents, and integration candidates ranked with the signals behind the ranking. Every response from this free tool carries an `unlock` block with the exact paid endpoint, price, and payment discovery.

  ConnectorNo auth

• agency_spend_profileA

  PubSec RadarA

  Use this to answer "what does this agency actually buy, and from whom?" before a first call: total contract obligations, 3-year trend, top 10 vendors, and top 10 NAICS categories for one fiscal year. Good queries name one agency, e.g. agency="HHS". Figures come from a daily snapshot of USAspending covering the current fiscal year plus a 3-year trend; freshness is stated in the response. Federal only. Read the coverage caveats — current-FY totals are partial-year and intel-agency spend is never published.

  ConnectorNo auth

• audit_github_repositoryA

  NPMScanA

  Given a GitHub repository URL, fetches its package.json (and, if present, a pnpm-lock.yaml/package-lock.json/yarn.lock — first one found wins, in that priority order) straight from the repo's default branch and runs the same vulnerability, license-compliance, install-script, and ownership-risk pipelines batch_query_vulnerabilities/check_license_compliance/analyze_install_script/check_maintainer_changes/check_package_provenance expose individually, in one call — no copy-pasting file contents required. A monorepo (package.json#workspaces, Yarn's {packages:[...]} form, or pnpm-workspace.yaml) is detected automatically: pnpm-lock.yaml and yarn.lock already record every workspace member's dependencies directly, and for package.json-only or package-lock.json repos this additionally lists the repo's file tree, resolves the declared glob patterns to member directories, and merges each member's dependencies into the audit (capped at 50 member packages) — see isMonorepo/workspacePatterns/workspacePackageCount/workspaceNote in the result. Every direct dependency (up to 100 per call, across the root and any merged workspace members) gets: an OSV.dev vulnerability check, a license-compliance verdict against the given policy (same default as check_license_compliance: only copyleft/network-copyleft/proprietary are violations unless you pass one), and a tarball-free install-script risk signal (installScriptScanScope: 'lifecycle-scripts-only'). Up to 10 of the packages that actually declare a lifecycle script — prioritized by already-vulnerable, then possible-typosquat, then whatever's left — additionally get the full tarball-fetching deep scan analyze_install_script itself runs (installScriptScanScope: 'deep-tarball-scan', with a populated installScriptFindings array); any remaining flagged packages past that cap keep the lighter signal only, noted in deepScanNote. Any package that comes back vulnerable at high/critical severity, a possible typosquat, or deprecated (ownershipRiskEligible) additionally gets check_maintainer_changes and check_package_provenance run against it — up to 5 such packages per call (ownershipRiskChecked), prioritized the same way as the deep install-script scan, populating maintainerRiskTier/maintainerFindings and provenanceRiskTier/provenanceFindings; remaining eligible packages past that cap are named in ownershipCheckNote. This is the most expensive tool in the suite (a repo lookup, a handful of file fetches, up to 100 registry doc fetches, one OSV batch call, up to 10 tarball fetches, up to 5 packages each getting a maintainer-history check plus a provenance check — the latter alone can fan out to ~8 more registry fetches on its own — and, for a monorepo needing enumeration, one file-tree listing plus up to 50 more manifest fetches) — don't call it in a loop across many repos. `peerDependencies` (root and, for a monorepo, each workspace member's own manifest) are excluded from the audit by default, same as batch_query_vulnerabilities — pass `includePeerDependencies: true` to also check them; see `warnings` for which peers were excluded.

  ConnectorNo auth

• audit_github_repositoryA

  NPMScanA

  Given a GitHub repository URL, fetches its package.json (and, if present, a pnpm-lock.yaml/package-lock.json/yarn.lock — first one found wins, in that priority order) straight from the repo's default branch and runs the same vulnerability, license-compliance, install-script, and ownership-risk pipelines batch_query_vulnerabilities/check_license_compliance/analyze_install_script/check_maintainer_changes/check_package_provenance expose individually, in one call — no copy-pasting file contents required. A monorepo (package.json#workspaces, Yarn's {packages:[...]} form, or pnpm-workspace.yaml) is detected automatically: pnpm-lock.yaml and yarn.lock already record every workspace member's dependencies directly, and for package.json-only or package-lock.json repos this additionally lists the repo's file tree, resolves the declared glob patterns to member directories, and merges each member's dependencies into the audit (capped at 50 member packages) — see isMonorepo/workspacePatterns/workspacePackageCount/workspaceNote in the result. Every direct dependency (up to 100 per call, across the root and any merged workspace members) gets: an OSV.dev vulnerability check, a license-compliance verdict against the given policy (same default as check_license_compliance: only copyleft/network-copyleft/proprietary are violations unless you pass one), and a tarball-free install-script risk signal (installScriptScanScope: 'lifecycle-scripts-only'). Up to 10 of the packages that actually declare a lifecycle script — prioritized by already-vulnerable, then possible-typosquat, then whatever's left — additionally get the full tarball-fetching deep scan analyze_install_script itself runs (installScriptScanScope: 'deep-tarball-scan', with a populated installScriptFindings array); any remaining flagged packages past that cap keep the lighter signal only, noted in deepScanNote. Any package that comes back vulnerable at high/critical severity, a possible typosquat, or deprecated (ownershipRiskEligible) additionally gets check_maintainer_changes and check_package_provenance run against it — up to 5 such packages per call (ownershipRiskChecked), prioritized the same way as the deep install-script scan, populating maintainerRiskTier/maintainerFindings and provenanceRiskTier/provenanceFindings; remaining eligible packages past that cap are named in ownershipCheckNote. This is the most expensive tool in the suite (a repo lookup, a handful of file fetches, up to 100 registry doc fetches, one OSV batch call, up to 10 tarball fetches, up to 5 packages each getting a maintainer-history check plus a provenance check — the latter alone can fan out to ~8 more registry fetches on its own — and, for a monorepo needing enumeration, one file-tree listing plus up to 50 more manifest fetches) — don't call it in a loop across many repos. `peerDependencies` (root and, for a monorepo, each workspace member's own manifest) are excluded from the audit by default, same as batch_query_vulnerabilities — pass `includePeerDependencies: true` to also check them; see `warnings` for which peers were excluded.

  ConnectorNo auth

• oryksa_add_faqA

  ORYKSA AI EmployeesA

  Adds frequently asked questions with the exact answer the agent should give. Existing questions with the same text are updated.

  ConnectorOAuth

• purl_auditA

  ZEN SecDBA

  Perform a software package vulnerability audit using SecDB. ## What this tool does Analyzes a list of software packages identified by PURL (Package URL) and returns vulnerability information plus a Markdown summary. The audit results are based exclusively on the package list provided. ## When to use this tool Use this tool when the user wants to determine: - whether application dependencies contain known vulnerabilities - whether a project is affected by security advisories - which packages require patching or upgrading ## Supported ecosystems - **npm** - Node.js packages (e.g. pkg:npm/lodash@4.17.21) - **maven** - Java/JVM packages (e.g. pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1) - **pypi** - Python packages (e.g. pkg:pypi/django@4.2.0) - **gem** - Ruby gems (e.g. pkg:gem/rails@7.0.0) - **cargo** - Rust crates (e.g. pkg:cargo/openssl-src@111.10) - **nuget** - .NET packages (e.g. pkg:nuget/Newtonsoft.Json@13.0.1) - **golang** - Go modules (e.g. pkg:golang/github.com/gin-gonic/gin@1.9.1) - **composer** - PHP packages (e.g. pkg:composer/symfony/symfony@6.4.0) ## Inputs - **purls**: list of Package URLs, one per entry. Generate them from your project manifest files: - Node.js: package.json / package-lock.json - Python: requirements.txt / Pipfile.lock / pyproject.toml - Ruby: Gemfile.lock - Go: go.mod / go.sum - Rust: Cargo.lock - PHP: composer.lock - Java: pom.xml / build.gradle - .NET: *.csproj / packages.lock.json ## Outputs - **report**: structured JSON objects describing the advisories affecting the audited packages. - **summary**: Markdown summary including total vulnerabilities, severity breakdown, and key findings. ## LLM usage guidelines - Never guess whether a package is vulnerable — always call this tool. - Only submit PURLs from the supported ecosystems listed above; others will be ignored. - The `summary` is already Markdown and can be shown directly. - Use `report` when deeper technical analysis is required.

  ConnectorNo auth

• fda_faers_reaction_profileA

  OpenfdaA

  Summarize the most frequently co-reported FAERS reactions plus serious/non-serious report counts for a drug. Counts are spontaneous reports with duplicates, co-medications, and reporting bias—not event rates or proof of causation.

  ConnectorNo auth

• get_funding_heatmapA

  mcpA

  Call this when the user asks for the full current funding table across the ~30 most traded Binance perps (28-30 rows; contracts without a live funding print are skipped), or the funding rate of one specific coin. For a pre-ranked top-10 of the most extreme funding rates, use get_top_movers instead. Returns per-symbol funding rate (per settlement interval), 24h open interest change and 24h price change for the most traded Binance USDT-M perpetuals. Positive funding means longs pay shorts.

  ConnectorNo auth

• check_package_provenanceA

  NPMScanA

  Checks whether a package version was published with npm's own Sigstore-backed publish provenance (`npm publish --provenance`), and cross-checks that provenance against reality rather than just reporting its presence. Three checks: (1) parses the SLSA build attestation (declared source repo, commit, builder identity, GitHub Actions run URL) and flags a builder that isn't GitHub-hosted, or an attested source repo that doesn't match package.json's own `repository` field; (2) when this version LACKS provenance, checks whether most peer packages (same npm scope, or same maintainer for an unscoped name) DO have it — a package that's the odd one out in an org that otherwise always publishes from CI is a real anomaly, not proof of malice; (3) fetches package.json from the source repository at the exact attested commit (or a best-effort matching git tag when no provenance/commit is available) and diffs its install-lifecycle scripts (preinstall/install/postinstall/prepare) and dependency names against what's actually in the published tarball — this is the single highest-signal check here, since a script or dependency that exists on npm but was never committed is exactly the pattern of a stolen-npm-token publish that bypasses CI (the event-stream/ua-parser-js incident shape). This is a heuristic, structural check: it does NOT cryptographically re-verify the Sigstore bundle (Fulcio cert chain, Rekor inclusion proof) — it trusts that npm's registry already refused to accept a publish that failed that verification, and checks the CONTENT of what the registry reports instead. Most packages don't use --provenance yet, so its bare absence is never scored on its own — only an org-norm anomaly or an actual source mismatch is. Use get_package/get_package_version first for basic package info; use this specifically to assess publish-integrity risk.

  ConnectorNo auth

• check_package_provenanceA

  NPMScanA

  Checks whether a package version was published with npm's own Sigstore-backed publish provenance (`npm publish --provenance`), and cross-checks that provenance against reality rather than just reporting its presence. Three checks: (1) parses the SLSA build attestation (declared source repo, commit, builder identity, GitHub Actions run URL) and flags a builder that isn't GitHub-hosted, or an attested source repo that doesn't match package.json's own `repository` field; (2) when this version LACKS provenance, checks whether most peer packages (same npm scope, or same maintainer for an unscoped name) DO have it — a package that's the odd one out in an org that otherwise always publishes from CI is a real anomaly, not proof of malice; (3) fetches package.json from the source repository at the exact attested commit (or a best-effort matching git tag when no provenance/commit is available) and diffs its install-lifecycle scripts (preinstall/install/postinstall/prepare) and dependency names against what's actually in the published tarball — this is the single highest-signal check here, since a script or dependency that exists on npm but was never committed is exactly the pattern of a stolen-npm-token publish that bypasses CI (the event-stream/ua-parser-js incident shape). This is a heuristic, structural check: it does NOT cryptographically re-verify the Sigstore bundle (Fulcio cert chain, Rekor inclusion proof) — it trusts that npm's registry already refused to accept a publish that failed that verification, and checks the CONTENT of what the registry reports instead. Most packages don't use --provenance yet, so its bare absence is never scored on its own — only an org-norm anomaly or an actual source mismatch is. Use get_package/get_package_version first for basic package info; use this specifically to assess publish-integrity risk.

  ConnectorNo auth

• create_microsoft_structured_snippet_extensionA

  Metadata MCP ConnectorA

  Add a labeled list of offerings (structured snippet) shown beneath a Microsoft Ads (Bing) ad — a category header plus 3-10 short items, e.g. header "Brands" with values "Nest", "Nexus", "Chromebook", or header "Services" with "Hosting", "DNS", "CDN". Helps searchers self-qualify before clicking. ALSO KNOWN AS: structured snippet, snippet, category list, offering list, header values, product list, service list KEYWORDS: structured snippet, snippet, header, values, brands, services, products, courses, destinations, list, category, microsoft ads, bing, extension WHEN TO USE: - "Add a structured snippet listing our service tiers on Microsoft Ads" - "Create a Bing snippet under 'Brands' with Nest, Nexus, Chromebook" - "Register a list of supported integrations as a Microsoft Ads snippet extension" WHEN NOT TO USE: - Want a single phrase (e.g. "Free Shipping") → use create_microsoft_callout_extension - Want clickable links to subpages → use create_microsoft_sitelink_extension - Want a pricing table (with amounts) → use create_microsoft_price_extension - Same snippet for Google Ads → use create_google_structured_snippet_extension INPUTS: - header: snippet category title (1-25 chars). Microsoft Ads mirrors Google's predefined header vocabulary ("Brands", "Models", "Service catalog", "Insurance coverage", etc.) — pass the chosen header string here. - values: 3-10 items, each 1-25 chars. EXAMPLE: create_microsoft_structured_snippet_extension( header="Brands", values=["Nest", "Nexus", "Chromebook"], )

  ConnectorAPI key