"Understanding Code Relationships or Dependencies" matching MCP tools:

• audit_dependency_treeA

  Commit — Supply Chain Risk ScoringA

  Map the full dependency tree of an npm package and identify CRITICAL supply chain risks at every level. Unlike auditing a flat list of packages, this tool traverses the dependency graph — showing not just your direct dependencies but also what your dependencies depend on. Hidden CRITICAL packages (sole publisher + >10M weekly downloads) often lurk 1-2 levels deep. Risk flags: - CRITICAL: single npm publisher + >10M weekly downloads — sole point of failure for a massive attack surface - HIGH: sole publisher + >1M/wk, OR new package (<1yr) with high adoption - WARN: no release in 12+ months (potential abandonware) depth=1 (default): root package + all direct dependencies depth=2: also traverses one more level for any CRITICAL/HIGH direct deps (reveals hidden exposure) Examples: - audit_dependency_tree("express") — see all of Express's deps and their risk scores - audit_dependency_tree("langchain", 2) — reveal transitive CRITICAL deps 2 levels deep - audit_dependency_tree("@anthropic-ai/sdk") — audit Anthropic SDK full tree Use this when someone asks: - "What am I really depending on?" - "Are my dependencies' dependencies safe?" - "Show me the full supply chain risk for package X"

  ConnectorNo auth

• enrich_providerA

  apis-ioB

  One call, pick your field groups — resolves a slug OR any identifier and returns exactly the groups you ask for, instead of chaining get_provider + get_provider_rating + get_provider_artifacts + get_provider_onboarding. Groups: profile, onboarding, artifacts, rating, insights. Understanding plan — the base groups moved with the rest of the discovery layer on 2026-08-31. Priced B2 (cross-catalog synthesis) — $0.05 per call under pay-as-you-go; included in Understanding and Influence. See apis://prices.

  ConnectorNo auth

• check_dependenciesA

  DepScoutA

  Check up to 50 packages at exact versions (for example from package.json, package-lock.json, requirements.txt, go.mod, pom.xml, Cargo.toml or a .csproj) against OSV.dev in one batch. Returns a summary count and only the packages with problems: malicious-package flags first, then vulnerabilities by severity with the version that fixes each and the minimum upgrade target. Use when the user pastes a dependency file or list, or asks to "audit my dependencies" or "check my package.json / requirements.txt", or which dependencies are vulnerable or outdated. Entries without an exact version are skipped and listed; transitive dependencies are only checked if included in the list.

  ConnectorNo auth

• cross_signal_correlateA

  Trillboards DOOH AdvertisingA

  Discover correlations between different signal types. Example: relationship between ad fill rate and audience attention for QSR venues. Queries the cross_signal_insights table for pre-computed correlations, or computes ad-hoc correlations from the observation_stream when no pre-computed insight exists. WHEN TO USE: - Understanding relationships between different sensing signals - Finding which audience behaviors correlate with business outcomes - Discovering hidden patterns (e.g., crowd_energy vs purchase_intent) - Validating hypotheses about audience-venue-time relationships RETURNS: - data: Correlation analysis with: - signal_a, signal_b: The two signals being correlated - correlation_r: Pearson correlation coefficient (-1 to +1) - correlation_r2: R-squared (proportion of variance explained) - p_value: Statistical significance - sample_count: Number of data points used - effect_size: Cohen's d effect size - confidence_interval_lower, confidence_interval_upper: 95% CI bounds - insight_summary: Human-readable interpretation - metadata: { computation_method, window, filters_applied } - suggested_next_queries: Related correlation analyses to explore EXAMPLE: User: "Is there a correlation between audience attention and ad fill rate at QSR venues?" cross_signal_correlate({ signal_a: "attention_score", signal_b: "ad_fill_rate", filters: { venue_type: "restaurant_qsr" } }) User: "How does crowd energy relate to purchase intent during lunch hours?" cross_signal_correlate({ signal_a: "crowd_energy", signal_b: "purchase_intent", filters: { daypart: "lunch" } })

  ConnectorNo auth

• list_error_codesA

  Trillboards DOOH AdvertisingA

  List every error code in the Trillboards API error catalog. WHEN TO USE: - Understanding what error codes the API can return. - Building a client-side error handler that covers all cases. - Looking up error types, HTTP statuses, and documentation URLs. RETURNS: - object: "list" - data: Array of { code, type, http_status, description, doc_url } - total: Total number of error codes. Equivalent to GET /v1/errors but executed in-process (no HTTP round-trip). EXAMPLE: Agent: "What error codes can the API return?" list_error_codes()

  ConnectorNo auth

• vector_quantizeA

  IA-QA — 130+ QA & Dev Tools for AI AgentsB

  Simulate int8 or int4 quantization of float32 embedding vectors. Reduces storage by 4x (int8) or 8x (int4). Returns quantized values, scale factor, and precision loss (MSE). Useful for understanding vector DB compression trade-offs.

  ConnectorNo auth

• forcedream_security_scanA

  mcp-serverA

  Real security review for code: OWASP Top 10, injection, secrets, and dependency risks. Cross-references imported dependencies against OSV.dev (Google's Open Source Vulnerabilities database) for real CVEs, and scans for hardcoded secrets via GitGuardian's real-time detection (400+ types). SPENDS your balance -- requires authentication (OAuth). Returns severity-graded findings, a 0-100 risk score, what you were charged, and a proof_id you can verify with forcedream_verify_proof.

  ConnectorNo auth

• cwe_lookupA

  LiveDataLinkB

  MITRE CWE detail by ID (format CWE-NNN or NNN). Returns name, abstraction, status, description, and parent/child CWE relationships.

  ConnectorNo auth

• get_install_commandA

  Cronus UIA

  Build the `npx cronus-ui add ...` command for one or more components/blocks. The CLI resolves and installs each item's registry dependencies automatically. This only returns the command string — to actually install, use `install_component`.

  ConnectorNo auth

• get_renderer_sourceA

  RhylthymeA

  Return the open-source timeline renderer's JavaScript (Apache-2.0, about 90 KB, no dependencies) for an HTML page or artifact that cannot load external scripts; it defines Rhylthyme.renderTimeline(container, program).

  ConnectorNo auth

• get_python_reportA

  Saylor Innovations: pay-per-call dataA

  Inspect a Python package’s latest release, Python compatibility, declared dependencies, license metadata and PyPI-reported advisories. No code execution. Costs $0.003. Returns payment instructions for the Saylor endpoint; no provider account required.

  ConnectorNo auth

• describe_projectA

  AALYA

  Return a single builder-facing overview of a project's capabilities: its tenant/data-sharing model (and what multiTenant enforces), every entity with its fields, the entity-to-entity relationships (reference fields), and which query parameters actually filter today. Call this to understand a project at a glance before writing app code, instead of piecing it together from list_entities + list_fields. For the full machine-readable REST contract, use generate_openapi_spec.

  ConnectorAPI key

• get-the-code-scoreA

  coderegistryA

  Returns The Code Score (security/code-quality/dependencies, 1000 points) for a project (aggregated) or a single vault. Provide exactly one of project_id or vault_id. Requires full data access (a paid plan; verification-only plans are not included). If the plan doesn't include Code Score access, or it hasn't been generated yet, returns the same response shape with empty sections/priorities rather than an error. Requires X-API-Key (existing users can generate an API key in the web app). If headers aren't supported, pass api_key in arguments.

  ConnectorNo auth

• homologyA

  String DbB

  Retrieve STRING-DB homology mappings for a list of protein identifiers (gene symbols or accessions) within a given NCBI taxonomy species (default 9606=human), returning cross-species homolog relationships.

  ConnectorNo auth

• map_supply_chainA

  BlackVeil DNS & Email Security ScannerA

  Map DNS-visible third-party service dependencies for a domain. Correlates SPF, NS, TXT verifications, SRV services, and CAA records to reveal which third-party vendors can send email as the domain, control DNS, or access integrated services. Use when asked to map third-party or supply-chain dependencies — not for listing who can send email (use check_spf for that).

  ConnectorNo auth

• get_company_insightA

  apis-ioB

  UNDERSTANDING — Full demand-side profile for one company: 40-dimension readiness scores, adopted stack, and per-quarter history. Priced B2 (cross-catalog synthesis) — $0.05 per call under pay-as-you-go; included in Understanding and Influence. See apis://prices.

  ConnectorNo auth

• ingest_textA

  finance-foundationA

  Extract financial entities and relationships from unstructured text into Finance Foundation Schema v0.1 JSON (companies, markets, assets, funds, banks, countries, indicators + typed relationships + unresolved_identifiers). LLM-powered, validated (taxonomy, ISIN checksums, LEI/MIC formats). Read-only transform: output goes to the caller only and is NEVER added to the Finance Foundation dataset. Limit 6000 chars.

  ConnectorNo auth

• web_snapshotA

  Robot Actions — Remote Device ControlB

  Accessibility tree of the DESKTOP grid browser page (by pageId), as text — for finding elements and understanding layout. Not a device: the equivalent for a phone or tablet is webpage_snapshot (by udid).

  ConnectorOAuth

• validate_component_usageA

  DigitaltableteurA

  Check proposed @dt JSX against the component contracts: prop relationships, forbidden prop combinations, deprecated props, and raw-UI replacements. Pass a TSX snippet, or a component name with props.

  ConnectorNo auth

• market_npm_package_riskA

  Crypto Bot Audit + Market Data (x402 paid)A

  One keyless read of the public npm registry for a package: does it ship an install-time script (the way malicious packages run code at install), is the released version deprecated, how old is the last publish, how many maintainers and dependencies, is there signed provenance, and what flags come out of those facts. Static metadata only: it does NOT execute the package, scan its source, or claim it is safe. Costs $0.001 USDC per call. Byte-identical to GET /market/npm-package-risk?name=left-pad.

  ConnectorNo auth

• market_npm_tree_riskA

  Crypto Bot Audit + Market Data (x402 paid)A

  One paid call that reads the package AND each of its direct dependencies (bounded, in published order) from the public npm registry, then rolls up what actually gets executed on install: which dependencies carry pre/postinstall scripts, which are deprecated, which ship without signed provenance, which are single-maintainer or unpublished-for-two-years. Returns the per-dependency rows, the counts, a verdict line, and an explicit list of what this cannot see. Static registry metadata only — it does not resolve a lockfile, walk the transitive tree beyond direct dependencies, download or execute any package, or compare against the name you meant to type. Costs $0.001 USDC per call. Byte-identical to GET /market/npm-tree-risk?name=left-pad.

  ConnectorNo auth