Skip to main content
Glama
569,502 tools. Updated 2026-09-15 01:17

"Travis CI" matching MCP tools:

  • Recherche pondérée par pertinence BM25 sur la jurisprudence administrative complète (Conseil d'État + Tribunal des conflits + 9 CAA + 40 TA — pour le TC, filtrer avec juridiction="conflits"). Source : bulk JADE DILA (~550 k décisions full text). Contrairement aux outils `search_admin_recent*` qui trient par date, celui-ci classe par pertinence sémantique des mots-clés. Indispensable pour trouver LES bonnes décisions sur un sujet sans dépendre de l'ancienneté. ⚠️ **Si tu cherches par numéro de requête (7 chiffres ex: 2200433)**, utilise plutôt `get_admin_decision(numero, juridiction=...)` qui fait un lookup SQL exact. La recherche FTS5 d'un numéro court ne le trouve que dans les décisions qui le **citent** dans leur texte (ex: décision de cassation), pas la décision identifiée par ce numéro. Args: query: mots-clés (opérateurs FTS5 : AND/OR/NOT, "phrase exacte", mot*) juridiction: filtre d'ORIGINE (depuis le 8 septembre 2026). Accepte un code (`CE`, `CAA59`, `TA69`, `TC`), un nom complet (« Tribunal administratif de Lille ») ou une forme courte (« TA Lille », « CAA Douai »). La base écrit la même cour de plusieurs façons (« CAA de LYON », « Cour administrative d'appel de Lyon »…) : le filtre les couvre toutes, et ne renvoie QUE des décisions rendues par cette juridiction. La réponse porte `juridiction_filtre` quand le filtre est actif. ⚠️ Valeur NON reconnue (une ville nue « Lyon », une faute de frappe) : elle est alors ajoutée comme mot-clé à la requête — les décisions qui la CITENT remontent aussi — et la réponse le dit dans `note`. Codes : `list_juridictions`. sort: "relevance" (défaut, BM25) ou "date_desc" / "date_asc" date_min: limite inférieure ISO YYYY-MM-DD (optionnel) date_max: limite supérieure ISO YYYY-MM-DD (optionnel) limit: nombre de résultats (défaut 20, max 50) offset: pagination Returns: {"total", "returned", "decisions": [...]} avec extracts BM25.
    ConnectorNo auth
  • Bootstrap confidence intervals for the numeric constants of a frozen expression, plus optional prediction bands on an x-grid. Typical flow: call pysr_run, pick an expression from the response (best_expression or a pareto_front entry), pass it back here with the same dataset to get CIs on its fit constants. Returns frequentist bootstrap confidence intervals, not Bayesian credible intervals — posterior inference over expression structures is an open research problem. This tool freezes the expression chosen by the caller and bootstraps only its numeric constants; uncertainty about *which* expression is correct is not quantified. Bootstrap semantics: - If y_sigma is supplied, uses parametric bootstrap (y_b = y + Normal(0, y_sigma)). CI reflects user-stated measurement noise. - Otherwise uses residual bootstrap: fit once, resample residuals. CI reflects estimated-from-residuals noise. Only Float constants in the expression become free parameters. Integers stay structural (the 2 in x**2 is a function-class choice, not a fit constant). Expressions with no Float constants (e.g. "x + y") will be rejected with a validation error. Expression grammar: the `expression` string is parsed by sympy. Accepted operators are the same set pysr_run emits: unary `sin`, `cos`, `tan`, `exp`, `log`, `log2`, `log10`, `sqrt`, `abs`, `sinh`, `cosh`, `tanh`; binary `+`, `-`, `*`, `/`, `^` (or `**`). Whitespace and parenthesization are free. Every free symbol in the expression must correspond to an entry in `feature_names` — an unrecognised symbol is silently treated as a fresh sympy Symbol and the fit will fail downstream rather than reject early. Parse failures (syntax errors, malformed operators) surface as tool errors. If `feature_names` is supplied, its length must equal the number of columns in `X`; a mismatch is rejected with a validation error. Pricing: always free, regardless of dataset size. This tool has no `payment` parameter and is never subject to the x402/Stripe gate. Large bootstrap jobs still count against the shared rate limit below, so budget `n_resamples` accordingly. Rate limit: 10 requests/hour per IP, 200/hour global, max queue depth 20 (shared with sindy_run and pysr_run).
    ConnectorNo auth
  • Composite: audit a chain artifact (block topoheight, block hash, TX hash, and/or proof string) end-to-end. Returns a verdict (`cited_in_false_claim` | `clean`), the actual on-chain facts (block reward, TX acceptance status), an optional proof-string decode, a relayable narrative, and curated rebuttal docs citations. When to call: when the user asks "what's going on with DERO block X?" / "is this transaction the inflation-claim TX?" / "does this proof string come from a known false claim?" PREFER this over chaining `dero_get_block_header_by_topo_height` + `dero_get_transaction` + `dero_decode_proof_string` yourself: the composite already runs them in parallel, joins them against the flagged false-claim registry, and emits a single `verdict` field plus a narrative so the agent does not need to compose the rebuttal arc from scratch each time. Input Requirements (CRITICAL): - At least ONE of `topoheight`, `block_hash`, `tx_hash`, or `proof_string` MUST be provided. The composite throws `INVALID_INPUT` otherwise. - `topoheight` is OPTIONAL. Non-negative integer. - `block_hash` is OPTIONAL. 64 hex characters. - `tx_hash` is OPTIONAL. 64 hex characters. - `proof_string` is OPTIONAL. Full `deroproof…` / DERO bech32 string with HRP. - `include_forge_demo` is OPTIONAL (default false). When true AND `tx_hash` is provided, also forges a fresh demo proof for the same TX (via `dero_forge_demo_proof`) and embeds it under `forge_demo`. The demo amount auto-selects: a flagged artifact's pinned amount (e.g. -2.2M for the 2022 claim) > the cited `proof_string` V > -1 DERO. PREFER setting this true when the agent is fielding a "Verified ✓ means the chain minted coins, right?" question — the embedded forge IS the refutation. Output: `{ verdict, inputs, matched_artifacts[], context_note, chain_facts, proof_decode, forge_demo, narrative, related_docs, _diagnostics }`. `verdict` is `cited_in_false_claim` when any input matches the flagged-artifact registry, else `clean`. `chain_facts` is null when no chain-querying input was provided or all daemon calls failed; `proof_decode` is null when no `proof_string` was provided. `forge_demo` is null unless `include_forge_demo: true` was passed; on success it carries `{ skipped: false, forged_proof_string, target_amount, ring_slot, ring_size, ring_receiver_address, math, self_check, explorer_display_amount, demo_amount_source }` (the slim form — full citations stay at the top level). PREFER citing the returned `related_docs` verbatim in the agent response — they are the canonical rebuttal pages and have been validated against the bundled docs index by CI. Quote the `context_note` when verdict is `cited_in_false_claim` so the user understands why the artifact matters.
    ConnectorNo auth
  • Scan US stocks, ETFs, and crypto for tickers currently in a given regime or showing a chart/candlestick pattern, RANKED by the honest backtested base rate + 95% CI — discovery, NOT lookup. This is the screener: instead of asking about one ticker you already know, ask "which tickers right now are in an uptrend / printing a double_bottom, and which of those has the strongest historical base rate?" and get a ranked shortlist back. Precomputed daily over a curated universe (liquid US large-caps + core/sector ETFs + major crypto pairs) so it is fast and cheap. Filters (all optional): assetClass ("stock"|"crypto"|"all"), regime ("up"|"down"|"range"), pattern (e.g. "double_bottom","double_top","head_and_shoulders","bullish_engulfing","bearish_engulfing","hammer"), minLift (-1..1 in rate points, e.g. 0.02 = keep only patterns beating their OWN pattern-free baseline by >= 2pp; 0 = at or above baseline), minBaseRate (0..1, drop tickers whose top pattern base rate is below this), tf, limit. PREFER minLift over minBaseRate: a raw base rate is not comparable across bullish and bearish rows, so minBaseRate:0.55 mostly returns bullish patterns in a rising universe before any of them carries information, whereas minLift returns the ones that measurably add something. Rows with no baseline in the evidence table are excluded by any minLift (absence of a lift is not a lift of 0). Each row: {sym, tf, assetClass, regime, pattern, baseRate, ci95, n, scope, confidence, asOf} PLUS the drift-free comparison {baseline, lift, liftCi95, liftReading} — baseline is the direction-matched rate with no pattern present, lift is baseRate minus that baseline, and liftReading says whether the difference is distinguishable from zero at all ("above-baseline" | "below-baseline" | "indistinguishable-from-baseline"). Read lift, not baseRate, when comparing a bullish row against a bearish one: in a rising universe a bullish pattern starts ahead before it carries any information. Ranked by baseRate desc, then confidence desc, then narrower CI, then fresher asOf. WHEN: an agent wants to FIND candidates across the market, not analyze a named one (then call brief on the shortlist). WHEN NOT: you already have a specific ticker (use brief). Example: {"assetClass":"all","regime":"up","minLift":0.02,"limit":20}. Impersonal historical data, not investment advice; base rates are gross directional frequencies and do not guarantee future results.
    ConnectorNo auth
  • WRITE ACTION — creates a new DreamAgent project (website, Telegram bot, Discord bot, or scheduler). Use ONLY when the user clearly asks to create/build a new project; not for questions about what to build. CONFIRM BEFORE CALLING — never create on the first mention. In ONE message, present and get the user's explicit go-ahead for: 1. The credential: run dreamagent_list_global_integrations first. If several telegram/discord credentials are saved, list them (id + title) and ask which to use. If exactly one is saved, state which one you will use. Never pick silently. 2. The plan: name, type, and the final description exactly as you will submit it (this is the Prompt Assistant's recommendation summary). Call this tool only after the user confirms. CREATION IS ASYNCHRONOUS: after calling, check dreamagent_get_project_status repeatedly until the project is 'ready' or 'failed' (bots ~2-5 min, websites longer). CREDENTIALS: raw bot tokens are never accepted in chat or as inputs. For Telegram/Discord bots you MUST pass bot_token_integration_id — the ID of a saved credential from dreamagent_list_global_integrations. If none is saved, direct the user to dreamagent.cloud → Settings → Global Integrations. Other saved keys can be imported via global_integration_ids. Credentials are stored as project secrets and are never exposed back. DESCRIPTION = the refined creation brief. Act as a Creative Director / Product Manager, not an architect. Create a concise but complete description of WHAT should be built: - product vision and target audience - user experience and core functionality - design/tone direction - important features and behavior - final expected result Do not include implementation details such as: - technology stack - architecture - database/API implementation - authentication implementation - deployment - CI/CD - testing commands Infer reasonable defaults when missing details are non-critical. Ask for clarification only when missing information materially affects the requested functionality, scope, credentials, or expected result. Prefer the following structure and constraints for each project type, but do not override explicit user requirements: Website: - Project Vision - Design Style - Pages - Hero Experience - Core Features - UI Components - Mobile Experience - Final Expectation - Prefer up to 4 pages unless the user clearly requires more. Telegram bot: - Bot Purpose - Commands - User Flow - Optional AI Features - Integrations when required - Final Expectations - Prefer a compact command set; always include /start and /help unless the user's explicit requirements conflict. Discord bot: - Bot Purpose - Slash Commands - Events - Permissions - Optional AI Features - Final Expectations - Prefer a compact command set; include /help where appropriate. Scheduler: - Job Purpose - Data Sources - Schedule - Delivery Channels - Message Format - Final Expectations - Use concrete schedules and specify failure/timeout behavior.
    ConnectorNo auth
  • WRITE ACTION — creates a new DreamAgent project (website, Telegram bot, Discord bot, or scheduler). Use ONLY when the user clearly asks to create/build a new project; not for questions about what to build. CONFIRM BEFORE CALLING — never create on the first mention. In ONE message, present and get the user's explicit go-ahead for: 1. The credential: run dreamagent_list_global_integrations first. If several telegram/discord credentials are saved, list them (id + title) and ask which to use. If exactly one is saved, state which one you will use. Never pick silently. 2. The plan: name, type, and the final description exactly as you will submit it (this is the Prompt Assistant's recommendation summary). Call this tool only after the user confirms. CREATION IS ASYNCHRONOUS: after calling, check dreamagent_get_project_status repeatedly until the project is 'ready' or 'failed' (bots ~2-5 min, websites longer). CREDENTIALS: raw bot tokens are never accepted in chat or as inputs. For Telegram/Discord bots you MUST pass bot_token_integration_id — the ID of a saved credential from dreamagent_list_global_integrations. If none is saved, direct the user to dreamagent.cloud → Settings → Global Integrations. Other saved keys can be imported via global_integration_ids. Credentials are stored as project secrets and are never exposed back. DESCRIPTION = the refined creation brief. Act as a Creative Director / Product Manager, not an architect. Create a concise but complete description of WHAT should be built: - product vision and target audience - user experience and core functionality - design/tone direction - important features and behavior - final expected result Do not include implementation details such as: - technology stack - architecture - database/API implementation - authentication implementation - deployment - CI/CD - testing commands Infer reasonable defaults when missing details are non-critical. Ask for clarification only when missing information materially affects the requested functionality, scope, credentials, or expected result. Prefer the following structure and constraints for each project type, but do not override explicit user requirements: Website: - Project Vision - Design Style - Pages - Hero Experience - Core Features - UI Components - Mobile Experience - Final Expectation - Prefer up to 4 pages unless the user clearly requires more. Telegram bot: - Bot Purpose - Commands - User Flow - Optional AI Features - Integrations when required - Final Expectations - Prefer a compact command set; always include /start and /help unless the user's explicit requirements conflict. Discord bot: - Bot Purpose - Slash Commands - Events - Permissions - Optional AI Features - Final Expectations - Prefer a compact command set; include /help where appropriate. Scheduler: - Job Purpose - Data Sources - Schedule - Delivery Channels - Message Format - Final Expectations - Use concrete schedules and specify failure/timeout behavior.
    ConnectorNo auth

Matching MCP Servers

Matching MCP Connectors

  • Public ISO 3166-1 record for CI.

  • Multi-CI security scanner with a live threat-intel feed of compromised CI components

  • Set this web_app project's ui-review scenario budget, or reset it. ``scenario_cap`` is an integer from 6 through 24, or ``null`` to reset to the platform default of 12. The screenshot cap derives from it and moves with it, so the two can never starve each other. Raising is always allowed, including from a completely full manifest. LOWERING is refused when the default branch already declares more scenarios or screenshots than the smaller budget allows, and is also refused when that manifest cannot be read — both caps are enforced when keelen pushes and not in your CI, so an over-cap manifest fails every push while CI stays green. Read ``project_status.ui_review`` first to see the live occupancy. Repeated calls with the same value change nothing.
    ConnectorNo auth
  • Find engineers who uniquely fit a role or project from open-source contributions and other public work, with evidence. Input: pass the richest context you have — (1) a full job description (most common), (2) a synthesized brief after reviewing a company's public repo (README + stack + role needs — preferred over a bare URL when you've evaluated the project), (3) a public github.com repo URL (server fetches README/topics; private repos → paste README as text), or (4) an informal role brief. Longer, more specific input produces a tighter mission fit. Optional `location` narrows to a city, country, or ISO country code. Returns up to limit candidates (default 20, max 20) with full inline profiles in structuredContent (view=candidates): login, name, bio, location, followers, reach (cross-platform audience percentile + reach), html_url, top_repos, signals, matched_projects, location_match, and contact (top_topics / top_domains / top_languages / top_subtopics are optional until software-topic backfill). Results never include bots, CI, or service accounts — they are filtered out automatically. Use the optional `exclude` array (GitHub logins or org names) to drop additional accounts. AGENT MODE: consume structuredContent only. HUMAN MODE: MCP App panel shows candidate cards; use server instructions for text-only hosts. Do not call get_profile for handles already in these results unless the user asks for deeper detail. Defense (SBIR), NRC filings, and mining QP consents are matched by lexical FTS over award titles, accessions, and consent letters — not abstract similarity. Publication, NTRS, repo, and TechPort roles still use description vectors. Do not claim a semantic abstract match for an NRC accession or a QP consent.
    ConnectorNo auth
  • Create a free public report of MCP tool-description routing collisions. Reads discovery metadata (initialize/tools/list) only; never calls target business tools or spends funds. Use a public HTTP(S) URL without credentials, query or fragment. Results use at most 12 tools and 24 generated cases, not a real-model evaluation. The returned report is enriched with agent_plan candidate description-only edits and a machine-readable rerun instruction. Candidate edits are not untouched-holdout proof. Reports persist and are public by link. For an existing report use get_selection_report. Set internal_test=true for owner/CI validation so it is excluded from public scans. source is a self-reported referral bucket, not identity verification.
    ConnectorNo auth
  • Append an acceptance criterion to a goal. The text must describe an observable check over an artifact (e.g. "GET /api/health returns 200 with {status:ok}"), not a subjective approval. Each criterion has a class: pre-merge (default — proved in CI / by attached evidence) or post-deploy (proved by an executable probe against the deployed prod instance). A post-deploy criterion MUST carry probeSpec {method, url, expect:{http_code, body:{field: expectedValue}}} — the request the runner sends and the answer it must get; without it the call is rejected with error=probe_required. Passing probeSpec alone implies probeClass=post-deploy. Set visualEvidenceSuggested=true only when adopting visualAcSuggestion from goal-create, goal-get, or the ready_for_work advisory returned by goal-update; it remains an ordinary AC. Grove mode: AC (class and probe included) can only be added while goal is in backlog, except accepting a visual advisory in ready_for_work: that starts a direct checking_ac recheck, without intermediate backlog. Other edits are frozen once started; quality linter blocks high-severity issues. Standard mode: AC editable until goal is closed, linter is advisory. Returns criterion id, position, text, probeClass, probeSpec and any quality findings.
    ConnectorNo auth
  • Evaluate RAG retrieval quality: rank passages against a query and compute Precision@k / Recall@k plus a PASS/FAIL CI verdict from ground-truth relevance labels. Three modes, all keyless except the last. (1) BYO scores — give each passage the `score` your own reranker produced (Cohere, Jina, a self-hosted NIM, a cross-encoder): deterministic, offline, and it evaluates YOUR reranker rather than someone else's. This is the mode to gate CI on. (2) Default, no scores and no key — ranks with local BM25, a lexical keyword baseline: it answers "does a keyword floor already surface my relevant passages?", never "is my neural reranker good". (3) Live NVIDIA reranker — supply `api_key` for an NVIDIA account that still has reranking entitlement; NVIDIA retired its hosted reranking endpoints on 2026-05-18, so this one is for accounts that were grandfathered in.
    ConnectorNo auth
  • Panorama santé d'une commune française en 1 appel (V0.9). Agrège en parallèle : population (INSEE Melodi), densités médecins + infirmiers + pharmaciens avec comparaison nationale (méthodo DREES), nombre d'établissements FINESS par famille (default ["labo","pharmacie","ehpad","mco","msp_cpts"]), et un bloc DEMANDE (V0.22.0 — profil démographique de la commune agrégé depuis ses IRIS : âge, CSP, familles, revenu pondéré, à CROISER avec l'OFFRE ci-dessus pour l'aide à l'implantation ; `demande: null` si commune hors couverture IRIS (DOM non ingéré) — pour le détail au quartier ou un bassin par rayon, utiliser `profil_iris`). Remplace 7-10 appels MCP individuels par 1 seul. Ne renvoie AUCUNE interprétation métier (pas de qualification automatique 'désert médical') — le caller LLM applique sa grille. V0.19.0 : accepte `nom_commune` (string) comme alternative à `code_insee`. `departement` (V0.19) = hint resolver UNIQUEMENT (panorama ne calcule pas par dept ; un `departement` seul lève une erreur explicite). **Granularité mixte** : les densités professionnels et la population sont calculées au niveau **commune** ; le décompte FINESS est agrégé au niveau **département** dérivé du code INSEE (limitation V0.9 — pas de RPC count_finess_by_commune encore). Le champ `niveauEtablissements` du résultat indique `"departement"` (succès), `"indisponible"` (dept indérivable, ex code DOM tronqué) — utiliser cette information pour ne pas confondre ratios commune et dept. Paris/Marseille/Lyon NON supporté : le panorama par commune dépend de la densité par commune, indisponible pour ces villes (INSEE n'expose la population qu'à la commune entière, les praticiens RPPS aux arrondissements). Un code PLM (commune-mère 75056 ou arrondissement) lève une RangeError. Pour ces villes, interroger les tools individuels au niveau `code_dept` (75/69/13). Alias acceptés : `codeInsee`/`insee`/`code` → `code_insee`. Sources : RPPS / Annuaire Santé ANS (mensuel), FINESS DREES (bimensuel), INSEE Melodi (PMUN 2023).
    ConnectorNo auth
  • Return the exact object schema and REST API endpoints for a Control Plane resource kind, so you can author an accurate manifest for `cpln apply` or call the API directly. ALWAYS call this FIRST whenever you are about to write a cpln apply YAML/JSON file, set up CI/CD that applies Control Plane resources, or build a request body for the REST API — do not hand-write a manifest or guess field names from memory. Pick a `kind` and pass `org` (and `gvc` for workload/identity/volumeset). Large schemas come back as a shallow map with deep sections collapsed to {"_expand":"<path>"} stubs; pass `path` (e.g. "spec.containers") to expand a section on demand. Server-managed fields (id/status/version/etc.) are already removed; `name` and `kind` are required at create.
    ConnectorOAuth
  • Start building something new: creates a GitHub repo and begins work on it. Use this ONLY when the user wants a NEW repo scaffolded. If they already have a repo, use import_project(repo_full_name) instead — this tool would create a second, empty one beside theirs (list_github_repos() browses what the workspace can see). Scaffolds a new GitHub repo, a bootstrap-mode project, and submits `build_description` as the project's first Roadmap Request. `name` is a concise GitHub short repo slug (no owner); `project_kind` is REQUIRED and one of library | node_library | python_library | service | cli | web_app | godot_game | roblox_game; `preview_command` is required iff `project_kind == 'web_app'`. `engine` is OPTIONAL — one of claude_code | codex | glm | kimi | grok (defaults to claude_code); codex, glm, kimi, and grok require the workspace to have a matching connected credential. `org` is OPTIONAL — a GitHub organization login to create the repo inside (e.g. your company org); omit it to land the repo on a member's personal account. `private` defaults to True. `ci_runs_on` is OPTIONAL — the CI runner labels for the scaffolded workflow, e.g. ["self-hosted", "linux", "x64", "my-fleet"]. Omit it to inherit the workspace default (ubuntu-latest if unset). Labels no registered org runner carries are rejected, because GitHub would queue such a job forever rather than fail it. `framework` is OPTIONAL and `web_app`-only — one of vite | next (defaults to vite). It picks the scaffolded frontend rails: `vite` a vanilla-TypeScript SPA, `next` a Next.js app-router app. Passing it with any other `project_kind` is an error. The repo is created on the GitHub account of a workspace member with repo-create OAuth access (this path has no specific caller user), so the returned `repo` owner is whichever member's token resolved (or the chosen `org`). If no member has repo-create access — or the resolving member can't create in `org` — the call returns an actionable error. Returns {project_id, repo, thread_id, next_action, poll_after_seconds, next_step}; follow next_step (poll get_request_status with the returned thread_id). On the rare arm where the first Request failed to submit, next_action is "call_tool" with next_tool="submit_request".
    ConnectorNo auth
  • [RETRIEVAL / READ] Fetch one public MisakaNet lesson by repository path or lesson ID. Use after misakanet_search returns a promising result to pull the full fix content. Provide exactly one of id or path (path takes precedence if both are supplied); if neither is supplied the tool returns {error}. Returns: object {path: string, content: string} — lesson markdown body (≤5000 chars); or {error: string}. Example: misakanet_get_lesson(id='auto-merge-ci-pipeline')
    ConnectorNo auth
  • Append an acceptance criterion to a goal. The text must describe an observable check over an artifact (e.g. "GET /api/health returns 200 with {status:ok}"), not a subjective approval. Each criterion has a class: pre-merge (default — proved in CI / by attached evidence) or post-deploy (proved by an executable probe against the deployed prod instance). A post-deploy criterion MUST carry probeSpec {method, url, expect:{http_code, body:{field: expectedValue}}} — the request the runner sends and the answer it must get; without it the call is rejected with error=probe_required. Passing probeSpec alone implies probeClass=post-deploy. Set visualEvidenceSuggested=true only when adopting visualAcSuggestion from goal-create, goal-get, or the ready_for_work advisory returned by goal-update; it remains an ordinary AC. Grove mode: AC (class and probe included) can only be added while goal is in backlog, except accepting a visual advisory in ready_for_work: that starts a direct checking_ac recheck, without intermediate backlog. Other edits are frozen once started; quality linter blocks high-severity issues. Standard mode: AC editable until goal is closed, linter is advisory. Returns criterion id, position, text, probeClass, probeSpec and any quality findings.
    ConnectorNo auth
  • Supply-chain GUARDRAIL for AI coding agents and CI pipelines: check whether a dependency (npm or PyPI) is on the DugganUSA malicious-package deny-list BEFORE you install it. This is the runtime defense against slopsquatting / HalluSquatting / hijacked-package attacks — an AI agent about to run `npm install` or `pip install`, or a CI pre-install hook, calls this FIRST and blocks on a hit. Returns a crisp, machine-actionable verdict: {ecosystem, package, version, malicious, verdict:"block"|"allow"|"review", reason, advice, source}. `malicious:true` = the exact package is on our OSV-curated deny-list (215k+ named-not-heuristic entries across npm + PyPI). `malicious:false` = not on our known-bad list — absence is NOT proof of safety, so still pin and review new deps. If a `version` is supplied and the entry is version-scoped, the check is version-aware; all-versions-malicious packages block on any version. Designed to be the easiest AI-supply-chain guardrail to wire in: one MCP tool call, no auth, in the agent's pre-install step. Same data is available for CI at /api/v1/stix-feed/packages.json. Examples: {"ecosystem":"npm","name":"cxp-jquery"} → malicious:true, verdict:block. {"ecosystem":"pypi","name":"requests"} → malicious:false, verdict:allow.
    ConnectorNo auth
  • Scan a PUBLIC GitHub repo for GitHub Actions + CI security/maintenance hygiene before launch — ideal for apps built with Lovable, Bolt, Replit, Cursor, or v0 ("is my AI-built app safe to ship?"). Returns a safe summary: findings by category with counts, an unlisted report URL, and fix options. SCOPE, honestly: it checks GitHub Actions workflow + update-automation hygiene only — it does NOT check exposed secrets, auth, payments, webhooks, or runtime behavior, which need a manual review. No API key required. For PRIVATE repos, tell the user to run `npx taskbounty-check .` locally so their source never leaves their machine.
    ConnectorNo auth
  • TIME-CRITICAL + HUMAN-IN-THE-LOOP. The device code returned by this tool expires in 10 minutes (600 seconds). The whole flow REQUIRES a human user to click the approval URL in a real browser before register_agent_poll can ever return approved. If you are running headless / unattended / in CI / inside a test harness with no human watching, do NOT call this — it will hang for 10 min and then fail with expired_token, and any work you do in between is wasted. Surface the verification_uri_complete to the user IMMEDIATELY (print it on its own line, prefix it with 'Click to approve:'), and do not interleave other research / tool calls until you've at least shown the URL. DO NOT CALL THIS BLINDLY. Before calling register_agent, check for an existing identity on disk. The lookup order is: 1. $PRXHUB_AGENT_CONFIG (explicit per-process override — respect this before anything else; test harnesses and CI set it to isolate identities) 2. $XDG_CONFIG_HOME/prx/agent.json 3. $HOME/.config/prx/agent.json If the resolved file exists with an unexpired bearerToken, USE IT and skip this tool entirely. Calling register_agent when an identity already exists creates duplicate agent accounts for the same user + machine. Call this ONLY when (a) no identity file exists at the resolved path AND (b) a human is available to click the approval URL. Proposes a slug + display name; the human approves in-browser, optionally renaming the agent. Returns a device code + a pre-filled approval URL. Then call register_agent_poll to wait for approval. Agents do NOT hold signing keys. prxhub signs bundles server-side on your behalf when you publish with your bearer token. ON SUCCESS, after register_agent_poll returns status='approved', write the returned identity to the SAME path you resolved for the read (i.e. $PRXHUB_AGENT_CONFIG if set, else $XDG_CONFIG_HOME/prx/agent.json, else $HOME/.config/prx/agent.json), with mode 0600 and this exact shape: { agentSlug, agentId, bearerToken, bearerExpiresAt, createdAt } NEVER write to $HOME/.config/prx/agent.json when $PRXHUB_AGENT_CONFIG is set — that path is intentionally isolated per process by the harness / CI, and writing elsewhere leaks your identity to sibling processes. ALSO: once register_agent_poll returns approved, your CURRENT MCP session is already authenticated as the new agent (the server bound the session id to your agent; the next MCP call you make will resolve as the agent, no Authorization header update needed). The agent.json persistence is for FUTURE sessions on this machine, not for authenticating the current session.
    ConnectorNo auth
  • The cross-border rulebook: what money may move across an African market's border, and under what rule - export-proceeds repatriation windows, licensed-channel and approval requirements, cash-declaration thresholds, travel/discretionary allowances, outward-capital restrictions, remittance-operator scope (some markets are inbound-only), investor transfer rights, and domestic-FX-use rules - normalized across 38 markets. RULES, NOT RATES (Rule 1): never an FX rate. Every rule carries source + as-of + (in full) the verbatim quote. Honest states are distinct, never conflated: published_rule | documented_absence (structural = a sourced finding that no such rule exists, e.g. a repealed exchange-control regime; not_published = a rule exists but its figure is not officially published) | located_unverified (located but not yet verified - a state only, never a value). Filter by jurisdiction, topic (repatriation, capital_control, approval_required, documentation, limits), facet (the SENSE, e.g. xborder:EXPORT_PROCEEDS_REPATRIATION), scope (intra_union/extra_union), direction (inward/outward/both) or activity. Jurisdictions: 42 African country markets — GH (Ghana), KE (Kenya), NG (Nigeria), RW (Rwanda), TZ (Tanzania), UG (Uganda), ZA (South Africa), ZM (Zambia), ET (Ethiopia), ZW (Zimbabwe), BJ (Benin), BF (Burkina Faso), CI (Côte d'Ivoire), GW (Guinea-Bissau), ML (Mali), NE (Niger), SN (Senegal), TG (Togo), CM (Cameroon), CF (Central African Republic), CG (Congo-Brazzaville), GA (Gabon), GQ (Equatorial Guinea), TD (Chad), MA (Morocco), CD (DR Congo), MZ (Mozambique), AO (Angola), MU (Mauritius), NA (Namibia), LS (Lesotho), SZ (Eswatini), BW (Botswana), MW (Malawi), TN (Tunisia), SO (Somalia), BI (Burundi), DJ (Djibouti), GM (The Gambia), SC (Seychelles), CV (Cabo Verde), SL (Sierra Leone) (plus "WAEMU"/XW, "CEMAC"/XC as union scopes that expand to their member states). format:'compare' returns one facet/topic across jurisdictions side-by-side (the comparison view); 'full' adds the verbatim quote + components; default 'summary'. Paginated.
    ConnectorNo auth
  • Verify a CodeRifts signed chain-receipt you ALREADY HOLD: cryptographic authenticity (signature + key id), body binding, and — when lifecycle indices are available — whether it is currently valid authorization (not expired, superseded, or revoked) for a stated operation/target. Use this when: - You already obtained a chain_receipt / receipt token from a prior preflight (or CI artifact) and are about to act (merge/deploy) under that receipt. - A contract-gate or policy requires offline/online proof that the receipt is authentic for this change before proceeding. - You must distinguish "signature ok" from "currently authorized" (stale or superseded receipts must not be treated as live approval). Do not use when: - You do not have a receipt yet — call coderifts.preflight_change_set first. - You need a NEW decision for a changed base→head set — preflight again; verify_receipt does not re-diff specs. - The receipt you hold binds a different operation or target than the one you are about to perform — call coderifts.preflight_change_set with context.operation set to that operation (a merge receipt does not authorize a deploy); verify_receipt cannot re-scope or re-issue a decision. - You only need human-readable history of an old decision_id without a receipt token — use coderifts.get_decision_details. - The change set itself is unknown or incomplete — fix the change set and preflight; do not "verify" a placeholder. Inputs: receipt token (required); optional intended context (operation, environment, fingerprint, target_id, audience, repository/branch/pull_request, base/head) and the body_hash-bound decision_result envelope. 30s clock-skew leeway on expiry. A 0s grace for declared destructive production operations is defined in the policy but is unreachable today: the intended-context schema has no destructive field, so nothing can declare one and the 30s leeway always applies. Returns { valid, status, currently_authorized (bool|null), reason, payload, authz_* }. Branch on currently_authorized; null = not evaluated. When a decision envelope is also in hand (e.g. from a prior preflight), its control_envelope.next_agent_step (if present) is structured remediation guidance the agent MAY follow after a non-CONTINUE decision — still branch on execution_action; next_agent_step is suggestion, not permission.
    ConnectorNo auth