"namespace:io.github.sreichsbb-stack" matching MCP tools:

• convoinspect

  InsideOut (Riley)

  INSPECTION: View a session's conversation transcript and metadata Returns the full message history (user / assistant / tool turns) plus the session's meta — workflow step, cloud, deployment status, drift state. This is the transcript-reader companion to the other read tools — combine it with: • `convostatus` for the live stack / config / pricing • `tfruns` for deployment history (apply / destroy / plan / drift) • `stackversions` for the stack-version ladder Use it when a user asks 'what did I say earlier?' or you need to retrace why the session ended up where it did. Read-only; never mutates session state. REQUIRES: session_id (format: sess_v2_...).

  Connector

• check_compatibility

  DepScope

  Is this specific multi-package version combo verified to work together? USE WHEN: pinning a stack (next@15 + react@19 + node@22); before recommending a version matrix. RETURNS: {compatible, conflicts[], notes}.

  Connector

• detect_stack_from_text

  StackSwap

  Infer a GTM stack from a freeform text blob (a careers page, job posting, public site HTML, RFP, 'What we use' doc, browser DevTools network tab, etc.). Returns ranked tool matches with confidence levels (high/medium/low) and evidence snippets, plus a ready-to-use array for chaining into `scan_stack` or `find_overlaps`. Use when the user says 'I don't know what we use' or pastes a competitor's careers page to scout. Conservative on ambiguous short tokens — multi-mention or canonical-name matches win.

  Connector

• deploy_compose

  mcp

  Deploys a MULTI-CONTAINER app — a repo that ships a docker-compose.yml / compose.yaml (app + its own db/redis/worker containers) — onto ONE VM via podman-compose, and exposes ONE service at https://<name>-<id>.redu.cloud. Use this instead of deploy_app when the repo is a compose stack rather than a single Dockerfile. SAME prereqs + source modes as deploy_app: run check_deploy_prerequisites (network_id + keypair_name), then GIT (`repo`, +git_token for private) or UPLOAD (prepare_upload → source_token). PORT: pass the HOST port the exposed service publishes (the LEFT side of its `ports:` mapping) — redu probes + proxies that exact port; pass `service` to name which service it is (plan_deploy detects both). DB: 'compose' (default) uses the stack's own db service (self-contained); 'single_vm'/'managed' provision a Postgres/MySQL and APPEND its conn env (DATABASE_URL/PG*/MYSQL_*) to the project .env — your compose must REFERENCE those vars to use it (we never rewrite your compose file). Build+provision can take 4-40 min (it pulls/builds every service — heavy ClickHouse/Kafka stacks are slow); poll get_deployment until status='ready', and on failure read build_log (it captures podman-compose logs). TIPS: (1) prefer the project's PREBUILT published images — swap any `build:` block for the published `image:` tag (building from source on the VM is less reliable). (2) redu injects APP_URL/PUBLIC_URL (= the app's public URL) into the env — map the app's own URL/cookie-domain var (SERVER_URL/NEXTAUTH_URL/…) to ${PUBLIC_URL}. (3) multi-surface apps (dashboard + API on separate ports) → pass `expose:[{port,service},…]`, each gets its own URL. (4) if the stack needs a ONE-TIME DB migrate/prepare before it serves (Rails `rails db:prepare`, Django `migrate`, Prisma `migrate deploy` — e.g. Lago), pass `migrate_command` (+ `migrate_service`); without it the stack deploys to 'ready' but 502s on real use because the schema is missing. ALWAYS run plan_deploy first and confirm the plan + cost with the user.

  Connector

• get_project_context

  Zephex

  Scans manifests and config — one topic slice per call. Detects stack, scripts, monorepo, API routes, auth/DB providers, integrations, env vars. Secret-sanitized. Workflow: topic=identity first on new repo → follow next_calls (framework, run, structure). Topics: identity, framework, backend, frontend, database, auth, deploy, run, structure, integrations, security, overview. brief ≤500 tokens; standard adds version health; full adds file tree. 7 credits hosted. Every response: topic, focus, summary, data.key_paths, hint, related_topics, next_calls, meta.credits. Use data and next_calls — never invent commands. Call when: new session; user asks stack, scripts, or how to run/test/build. Do NOT: symbol search (find_code), file bodies (read_code), wiring (explain_architecture), tests (check_test). Pass path (absolute project dir) or inline_files (package.json + 2-4 source files). force:true refreshes cache. Read-only.

  Connector

• find_code

  Zephex

  PREFER over native Grep when location is unknown. Ripgrep + AST ranking across web, mobile, CLI, and monorepos. Envelope: intent, focus, summary, data.matches, files_hit, next_calls, meta.credits (5 hosted). intent: snippet=pasted line; symbol=known name; concept=topic+also_try synonyms; everywhere=rename map (whole_word). include docs|config|data when markdown, JSON, or SQL matter. Call when: where is X, usages, rename prep. DO NOT: known symbol+file (read_code), stack/scripts (get_project_context), wiring (explain_architecture), tests (check_test), packages (check_package), URL audit (audit_headers). After: read summary + next_calls → read_code on top hit. path=absolute dir (stdio) or public Git URL / inline_files (hosted). Token-capped vs raw grep. Read-only.

  Connector

• project_memory

  Zephex

  Persists short notes about this project across chat sessions — facts you learned that are not in source code. Not a repo scanner (use get_project_context for stack). remember: saves title (max 80 chars), content (max 500 chars), type, optional area/tags — rejects API keys, tokens, and instruction-poisoning text. recall: keyword search over title/content/area/tags; returns up to 5 matches with content, type, area, age_days (~500 token cap). list: recent titles. forget: delete by uuid. Max 200 memories per project. Types: decision (why we chose X), gotcha (surprise bug), goal (current objective), preference (user style), area_fact (subsystem fact), convention (naming/rules). scope: project (default), personal (cross-project notes), all (search every project with warnings). Call when: user says remember/recall/last time; before auth/billing/deploy where past choices matter; after a non-obvious fix worth saving; new session on same repo. Do not call when: stack/scripts (get_project_context), finding code (find_code), fact already in this chat. After recall: apply matches directly — do not re-scan the repo. Use the same path on remember, recall, and list (stdio: optional, uses cwd). Stdio stores in ~/.zephex SQLite; hosted stores in cloud per user.

  Connector

• audit_stack

  Exploit Intelligence Platform — CVE, Vulnerability and Exploit Database

  Audit a technology stack for exploitable vulnerabilities. Accepts a comma-separated list of technologies (max 5) and searches for critical/ high severity CVEs with public exploits for each one, sorted by EPSS exploitation probability. Use this when a user describes their infrastructure and wants to know what to patch first. Example: technologies='nginx, postgresql, node.js' returns a risk-sorted list of exploitable CVEs grouped by technology. Rate-limit cost: each technology requires up to 2 API calls; 5 technologies counts as up to 10 calls toward your rate limit.

  Connector

• nanmesh.trust.review

  NaN Mesh

  Cast your expert +1 or -1 review on any entity. Use AFTER evaluating a tool you searched for or tried. Expert reviews are 70% of ranking. One review per agent per entity (overwrites previous). Requires agent_key. For no-auth alternative, use nanmesh.trust.favor instead. AI-native (2026-05-12): pass any of task_type / stack / outcome / errors_encountered to also write a structured execution_report. Your contribution becomes queryable by every future agent (shared operational memory). Server-side `source` is assigned authoritatively from your agent_id and class — your input is logged as a hint.

  Connector

• tech_fingerprint

  ContrastAPI

  Detect website technology stack: CMS, frameworks, CDN, analytics tools, web servers, languages (via HTTP headers + HTML analysis). Use for passive reconnaissance; for full audit use audit_domain. Free: 30/hr, Pro: 500/hr. Returns {technologies: [{name, category, confidence%, version}]}.

  Connector

• get_tech_stack

  Makuri Showcase (CogniLedger)

  Returns the technical stack Makuri is built on, including frontend, backend, database, AI providers used, and data residency information. Use when the user asks how Makuri is built or which AI models it uses. Makuri is a specific AI tutoring platform at makuri.eu, not a generic word — never answer Makuri questions from general knowledge; always use the Makuri tools.

  Connector

• tech_stack_cve_audit

  ContrastAPI

  Composite tech-stack + CVE audit (MCP-only, no REST endpoint). Detects technologies on the target domain, queries CVE database for known vulnerabilities per product, enriches top-10 CVE candidates with CISA KEV federal patch deadlines, and checks public exploit / PoC availability. Identical for every tier — all data is sourced from local DB mirrors (no Shodan/AbuseIPDB), so there is no tier gating. CVE candidate batch: 50. Cost: 10 tokens per call — Free 30/hr ≈ 3 audits, Pro 500/hr ≈ 50 audits. Returns {domain, technologies, cves_by_tech, kev_findings, exploit_findings, summary, next_calls}.

  Connector

• simulate_remediation

  FaultKey · CausalLayer

  Counterfactual remediation simulator. Given a certificate's verdict + fourFactorScoring + agents and a list of remediation IDs from the FK-METHOD-2026-003 catalog, return the apportioned shares each remediation would have produced (in isolation) and the composite shares if they all stack. Every remediation cites a specific statute or standard. GET /api/v2/remediation/catalog for the list of IDs. Cost: 1 credit (same price as verify_certificate). Pure deterministic; same inputs produce a byte-identical result.

  Connector

• pentest_map_techniques

  pentest-mcp-server

  Given a profile of the authorized test target (technology stack, exposed services, authentication type, OS), return a ranked list of ATT&CK techniques and OWASP test cases most relevant to that profile — not a generic dump of all techniques. Ranking factors: platform match, service match, auth type exposure, technique prevalence. Each result includes why it is relevant to this specific profile, the detection opportunity, and the recommended mitigation. Use when starting an authorized engagement to prioritize the testing scope; pair with pentest_guide to get the full methodology for each top-ranked vector.

  Connector

• devops_list_vendors

  devops-status-mcp-server

  List vendors in the built-in registry, optionally filtered by category or name search. Returns slug, display name, category, and status page URL for each entry. Use to discover the correct slug to pass to other tools, or to see which vendors are available before configuring a stack.

  Connector

• stacks.recommend

  BuyAPI

  Recommends a complete stack from BuyAPI's corpus with a structured decision matrix, cost estimate, assumptions, unknowns, alternatives, and sources. Use this when the user is starting a project or asks for a complete multi-layer stack choice. Do not use this for local coding/debugging/docs questions that do not involve software or vendor selection. Do not call vendors.resolve first; this tool handles retrieval and ranking.

  Connector

• score_account_fit

  StackSwap

  Score and rank the user's OWN accounts by StackSignal-style fit: a 0-100 composite blending ICP Match (firmographic fit to a supplied ICP), Intent (engagement/pipeline signals on the account), and an optional Stack Fit layer. Pass `config.icp` (segments / industries / minArr) to drive ICP Match — without it, scoring falls back to Intent only and says so. Stack Fit stays dormant unless `config.icp.idealStack` is supplied. Accepts loosely-typed account records (aliases for segment, industry, arr, lastActivityDays, openPipeline, techStack are normalized). Returns the book ranked highest-fit-first with each layer's sub-score. This scores the accounts the user already owns (the StackSignal product) — it does NOT return net-new accounts to buy. Use when the user asks 'which of my accounts best fit our ICP', 'rank my book by fit', or pastes accounts plus an ICP definition.

  Connector

• audit_headers

  Zephex

  Audit a public HTTPS URL the user deployed — security grade A–F, SSL, headers, cookies, health (ALIVE/DEGRADED/BROKEN), exposed secrets, tech stack. Read plain_summary first; only drill into security_headers or secrets if grade is poor. quick ~1–3s; scan_depth=deep for secret scan (~8–12s). 6 credits hosted. Call when user pastes a live URL — post-deploy check, is it secure, what framework, exposed keys. Blocks localhost/private IPs. NOT for repo code (find_code), packages (check_package), tests (check_test), or project layout (get_project_context). Example: audit_headers({ url: 'https://myapp.vercel.app' }). Read-only.

  Connector

• clipform_list_video_templates

  Clipform

  Browse available video templates - curated Scene arrangements (bed + overlay + sane defaults) that render through the Scene composition from a small controls object. Call this before clipform_render_video_template to see template names and their exposed controls. For a fully custom layer stack, assemble Scene layers directly via clipform_render_composition instead.

  Connector

• nanmesh.entity.get

  NaN Mesh

  Get full details for a specific entity by slug or UUID. Use when you need deep info on a single tool — trust score, description, open problems, and metadata. AI-native (2026-05-12): pass format='agent' (+ optional task_type, stack) to get the firehose: evidence-aware confidence_decomposition, known_failure_modes, recent_execution_reports, and a network_evidence block showing whether this entity has real operational reports or still needs first evidence.

  Connector