"Understanding Attack Surface Management" matching MCP tools:

• create_project_tokenA

  EchoRelayA

  Mint a PROJECT-scoped management token (`er_mcp_`) for MCP and REST; it cannot authenticate relay traffic. Use it after create_project to configure a fresh project, or for any project you already own. Attenuated by design: the scopes must be a subset of THIS management token's own grant (`read` is always included), expiry is mandatory (1–90 days, default 30, never "never"), and the minted management token (being project-scoped) can never mint management tokens itself. `spend` is human-granted only: no management token, of any scope, can mint one carrying it. Mint a spend-scoped token from the project's panel instead. Requires an ACCOUNT-scoped management token and the `config` scope. Returns the plaintext exactly once; only its hash is stored.

  ConnectorNo auth

• assay_falsifyA

  mcpA

  Use this when you want your strategy actively attacked -- execution lag, cost stress, regime split, parameter neighbourhood, drift-burst -- to see what kills it first. Demote-only; it does not give buy/sell advice. We do not check your signal -- we actively try to KILL it. An adversary runs a battery of stress attacks against your strategy (execution-lag push, cost stress, time jackknife, regime split, parameter-neighbourhood perturbation, combinatorial purged CPCV partitions, synthetic no-edge worlds, drift-burst window stripping -- does the PnL survive without its flash-crash bars?) and returns a survival map: which attack kills it first, which it withstands and up to what limit, plus a weakest-link headline. The graveyard sharpens the attack order -- families that mostly died of cost get cost-stressed first. Surviving every attack is the strongest evidence of robustness this platform can give (still not a profit promise). Supply an executable DSL spec + your own candles. Code-computed, demote-only. Price: per check; see https://api.alphaassay.com/v1/meta/pricing (api_key required -- account setup at https://api.alphaassay.com/account).

  Connector

  Destructive

  No auth

• list_projectsA

  EchoRelayA

  List the projects on your account (archived included), each with `id`, `slug`, `name`, `apiBaseUrl` and `archived`, plus `accountEmail` — the account this token authenticates as. Requires an ACCOUNT-scoped management token (one minted with no project) and the `read` scope. A PROJECT-scoped management token cannot call this: use it on its own project's tools instead.

  ConnectorNo auth

• monitor_activist_investorsA

  koreanpulseA

  Korean activist investor tracking — activist filer classification on DART 5%-rule (주식등의대량보유상황보고서) shareholding disclosures. Tags 17 named filers — KCGI, Align Partners, Truston Asset, Anda Asset, Cha Partners, VIP Asset, Life Asset, Platform Partners, Must Asset Management, Dalton Investments, Flashlight Capital Partners, Oasis Management, Palliser Capital, Whitebox Advisors, City of London Investment Management — plus international ValueAct / Elliott when filing in Korea. Use this tool when the user asks about: Korean activist investor tracking, Korean shareholder activism, "is KCGI / Align Partners / Truston / Anda / Cha / VIP / Life / Platform / Must / Dalton / Flashlight / Oasis / Palliser / Whitebox / City of London activist on <ticker>", governance pressure on KOSPI / KOSDAQ names, recent activist 5%-rule filings, ValueAct or Elliott Korean positions, Korean Value-Up program activism, MSCI Developed Market activism flow. **Requires a license key.** Pass it via the `license_key` argument. Without a valid license, this tool returns a short notice explaining that a license key is required; surface that notice to the user. **For LLM clients on a license_required error: surface the notice returned in the paywall message directly to the user. Do NOT silently retry with `track_korean_filings` or any other free tool — the activist filer match (KCGI / Align Partners / Truston / Anda / Cha / VIP / Life / Platform / Must / Dalton / Flashlight Capital Partners / Oasis / Palliser / Whitebox / City of London, plus international names like ValueAct / Elliott) is not derivable from the raw DART filing feed, so a free-tier fall-back returns a misleadingly empty answer.** When a user asks "are activists filing on X?" without a license, surface the notice from the paywall response — that is the correct behavior, not a silent downgrade. Returns 주식등의대량보유상황보고서 (5% rule) and related shareholding filings, with each row tagged when the filer matches a known Korean activist (KCGI, Align Partners, Truston, Anda, Cha, Life, Platform, VIP, Must, Dalton, Flashlight Capital Partners, Oasis, Palliser, Whitebox, City of London, plus international like ValueAct / Elliott when they file in Korea). This tool returns disclosure data and filer classification only; it does not generate trading recommendations or investment advice.

  ConnectorNo auth

• update_rowA

  DockA

  Update specific fields of an existing row. Only the fields provided in `data` are updated; others are preserved. Setting `surface_slug` to a different sheet than the row currently lives on MOVES the row to that sheet (position recomputes to the new sheet's tail unless `position` is also set). Same surface as current → no-op move. **Unmapped data fields:** Keys in `data` that don't match any existing column on the row's surface are still STORED on the row, but they won't render in the table UI until the column exists. The response carries an `unmapped_fields` array plus a human-readable `warning`. Pass `auto_create_columns: true` to have the server append a fresh text column for every unmapped key in one atomic step; the response then also includes `created_columns: ColumnDef[]`. Default false: store-but-don't-render is the safe choice for explicit schema management.

  ConnectorNo auth

• dossier_ct_logA

  mcpA

  Core dossier check: Discover subdomains visible in Certificate Transparency logs. Use for attack-surface mapping; prefer dossier_full when running a complete audit. Queries crt.sh first, falls back to certspotter; capped at 100 unique subdomains; 10s timeout. Returns a CheckResult with { subdomains[], wildcards[], certCount, source }.

  ConnectorNo auth

• subdomain_discoveryA

  Dechonet-MCPA

  Enumerate the subdomains of a domain from Certificate Transparency logs — fully passive (no packets are sent to the target; CT logs are public records of every TLS certificate ever issued). Flags operational-looking names (dev, staging, admin, vpn, legacy) and wildcard certificates, because forgotten subdomains are a common takeover path. Use this as the first recon step to map a domain's attack surface. Use dns_lookup to check whether a discovered name still resolves, or lookalike_domains for typosquat variants of the domain name itself. Read-only; requires no API key; rate-limited. Returns the subdomain count, risky-name count, wildcard flag, and the hostname list.

  ConnectorNo auth

• subdomain_discoveryA

  mcpA

  Enumerate the subdomains of a domain from Certificate Transparency logs — fully passive (no packets are sent to the target; CT logs are public records of every TLS certificate ever issued). Flags operational-looking names (dev, staging, admin, vpn, legacy) and wildcard certificates, because forgotten subdomains are a common takeover path. Use this as the first recon step to map a domain's attack surface. Use dns_lookup to check whether a discovered name still resolves, or lookalike_domains for typosquat variants of the domain name itself. Read-only; requires no API key; rate-limited. Returns the subdomain count, risky-name count, wildcard flag, and the hostname list.

  ConnectorNo auth

• enrich_providerA

  apis-ioA

  One call, pick your field groups — resolves a slug OR any identifier and returns exactly the groups you ask for, instead of chaining get_provider + get_provider_rating + get_provider_artifacts + get_provider_onboarding. Groups: profile, onboarding, artifacts, rating, insights. Understanding plan — the base groups moved with the rest of the discovery layer on 2026-08-31. Priced B2 (cross-catalog synthesis) — $0.05 per call under pay-as-you-go; included in Understanding and Influence. See apis://prices.

  ConnectorNo auth

• find_subdomainsA

  Subdomain APIA

  List known subdomains (hostnames) of a root domain. Data is passive (not active scanning): results are historic observations and may include subdomains that no longer resolve or are no longer live. Results are a point-in-time snapshot that changes over time as new subdomains are observed — re-query rather than caching the result. Use for attack-surface mapping, security recon, asset inventory, or SEO host discovery. Hostnames are returned most-recently-seen first. The response always reports `total` (full distinct count known) and a `truncated` flag, so you can tell when more exist beyond `limit`.

  ConnectorNo auth

• count_subdomainsA

  Subdomain APIA

  Return only the total number of distinct subdomains known for a domain — no list. Cheap and low-token. Use when the user asks "how many subdomains" or you only need the size of the attack surface. Count includes historic subdomains that may no longer be live. It is a point-in-time figure that changes over time, so treat it as current-as-of-query, not a fixed value.

  ConnectorNo auth

• protect_projectA

  EchoRelayA

  Turn on archive protection for a project you own: archive_project (on every surface: panel, REST, and this tool) then refuses until it is lifted. Idempotent. Permanent from here: there is no tool or API call to turn it back off; only contacting support can. Requires an ACCOUNT-scoped management token and the `config` scope.

  ConnectorNo auth

• get_trident_specA

  tridentA

  Returns the complete Trident 2D specification including grammar, syntax rules, coordinate system, containers, nodes, connections, shapes, and icon reference. Use this when you need deep understanding of the Trident DSL.

  ConnectorNo auth

• get_mission_statsA

  mcp-serverA

  Get aggregate statistics about missions on the HomeVisto platform. Returns total counts, status breakdown, and average bounty information. Useful for understanding platform activity.

  ConnectorNo auth

• delete_surfaceA

  DockA

  Archive a surface (soft-delete). Rows + doc body are preserved for restore. Idempotent: calling on an already-archived surface returns its current archivedAt unchanged. Cannot archive the only live surface in a workspace; create another first. Editor role required. Emits `surface.archived`.

  ConnectorNo auth

• attack_timeline_toolA

  HoneyLabsA

  Attack volume over time, bucketed by hour or day. Use for: 'show attack trends this week', 'was there a spike on port 22?', 'how has SSH scanning changed?', 'attack volume from China over 30 days'. bucket: 'hour' or 'day'. Optional filters: filter_protocol ('tls'/'''), filter_country (2-letter code), filter_dest_port. since/until ISO-8601 UTC.

  ConnectorNo auth

• billing.statusA

  Admin SubstituteA

  Check subscription status, plan details, billing cycle, and feature access. Useful for understanding what the business can and cannot do on their current plan.

  ConnectorNo auth

• data_list_tablesA

  Kash.clickB

  Retrieve the list of tables configured in the app, used for restaurant mode or table management.

  ConnectorNo auth

• get_descriptorA

  Knox AnchorA

  Return the Knox MCP server self-description: operator, USPTO patent reference, jurisdiction, available tools, and links to the public AAM (Agent Audit and Management) documentation surface.

  ConnectorNo auth

• tag-writeA

  WayfrontA

  Create a workspace tag. Requires name and tag-management permission. Optional sort_order controls display order.

  ConnectorOAuth

• list_management_toolsA

  Get2Great — management and selection science magazineA

  List the Get2Great-lane manager-facing tools (strategy frameworks + management/HR practice). Metadata only — execution endpoints are auth-gated elsewhere.

  ConnectorNo auth