"python" matching MCP tools:

• purl_auditA

  ZEN SecDBA

  Perform a software package vulnerability audit using SecDB. ## What this tool does Analyzes a list of software packages identified by PURL (Package URL) and returns vulnerability information plus a Markdown summary. The audit results are based exclusively on the package list provided. ## When to use this tool Use this tool when the user wants to determine: - whether application dependencies contain known vulnerabilities - whether a project is affected by security advisories - which packages require patching or upgrading ## Supported ecosystems - **npm** - Node.js packages (e.g. pkg:npm/lodash@4.17.21) - **maven** - Java/JVM packages (e.g. pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1) - **pypi** - Python packages (e.g. pkg:pypi/django@4.2.0) - **gem** - Ruby gems (e.g. pkg:gem/rails@7.0.0) - **cargo** - Rust crates (e.g. pkg:cargo/openssl-src@111.10) - **nuget** - .NET packages (e.g. pkg:nuget/Newtonsoft.Json@13.0.1) - **golang** - Go modules (e.g. pkg:golang/github.com/gin-gonic/gin@1.9.1) - **composer** - PHP packages (e.g. pkg:composer/symfony/symfony@6.4.0) ## Inputs - **purls**: list of Package URLs, one per entry. Generate them from your project manifest files: - Node.js: package.json / package-lock.json - Python: requirements.txt / Pipfile.lock / pyproject.toml - Ruby: Gemfile.lock - Go: go.mod / go.sum - Rust: Cargo.lock - PHP: composer.lock - Java: pom.xml / build.gradle - .NET: *.csproj / packages.lock.json ## Outputs - **report**: structured JSON objects describing the advisories affecting the audited packages. - **summary**: Markdown summary including total vulnerabilities, severity breakdown, and key findings. ## LLM usage guidelines - Never guess whether a package is vulnerable — always call this tool. - Only submit PURLs from the supported ecosystems listed above; others will be ignored. - The `summary` is already Markdown and can be shown directly. - Use `report` when deeper technical analysis is required.

  ConnectorNo auth

• search_docsA

  RoxyAPI Docs MCP Server (keyless, for coding agents)A

  Search the RoxyAPI knowledge base and get back ranked documentation snippets, each with a source URL. It covers API endpoints with their request and response fields, SDK usage for TypeScript, Python, PHP, C#, and the WordPress plugin, authentication and API keys, UI components, and step by step integration guides. Call this first whenever you need to integrate RoxyAPI into an app: to find which endpoint or SDK method to use, what parameters a call takes, how to authenticate, or how to wire a feature end to end. Pass the user question verbatim as `query`. If the first results miss, rephrase once and retry.

  ConnectorNo auth

• validate_pythonA

  Python Code ValidatorA

  Check Python source without running it: parse, lint (ruff), type-check (mypy), AST security policy, credential scan. Safe on code you do not trust. Use it on every Python file you generated or edited, before writing it to disk. Alternatives: repair_python to get the corrected source instead of the diagnosis; execute_python to prove the code runs. Auth: a key is required. A free key covers this call, 25 per day, then HTTP 429; get one with POST /v1/keys. Credits are bought without an account, 1 per call: GET /v1/pricing says where to send the xDAI. Or pay for this one call with no key at all: call it without one and the result carries x402 payment requirements ($0.01 in USD Coin on eip155:8453); sign them and repeat the call with the payment in _meta['x402/payment']. Arguments: code: the whole file, 1..200000 bytes of UTF-8 measured after encoding (empty is refused with 400, larger with 413); a fragment is fine, but line and column numbers in the answer count from 1 in what you sent. language: must be 'python'; anything else is 400, and the field may be omitted. Of options only transpile_to (e.g. 'javascript', which returns a translated copy in transpiled) acts here; timeout_s, max_iterations, optimize, examples and expected_output need a pass that rewrites or runs the code, so send code alone. Ignored options are not refused, so a call that sets them looks like it worked; and code that does not parse is answered rather than refused: valid=false with the syntax error located, which is the point. Returns valid, score 0..1, diagnostics (rule, message, line, column), security findings, fixes, fixed_code and runtime; see outputSchema. The code and its verdict are retained to improve the service.

  ConnectorNo auth

• asterwise_draw_tarot_cardsA

  AsterwiseA

  Draws N unique random cards from the 78-card deck using cryptographic randomness (Python secrets.SystemRandom). Every call is independent — there is no session state. WORKFLOW: BEFORE: None — standalone. AFTER: None — interpret drawn cards using their active_meaning and active_keywords fields. INPUT CONTRACT: count (int 1–78, default 1) — Number of unique cards to draw. Example: 1 (daily pull), 3 (simple reading), 10 (Celtic Cross), 78 (full deck shuffle). Values outside 1–78 are rejected locally with MCP INVALID_PARAMS. allow_reversed (bool, default false) — When true, each drawn card independently has a 50% chance of reversal (cryptographically random, not seeded). DO NOT CONFUSE WITH: asterwise_get_tarot_card_of_the_day — deterministic daily card, same for all callers. asterwise_get_tarot_three_card_spread — positional read with named positions and meanings. asterwise_get_tarot_celtic_cross — 10-card positional spread. Full output and error contract: https://docs.asterwise.com/mcp/tools/draw-tarot-cards/

  ConnectorOAuth

• brain_get_thought_by_nameA

  personalbrain-mcpB

  Exact name lookup — returns the first thought matching the name exactly. Requires npub for credit billing. ⚠️ NOT AUTHORITATIVE. Backed by the vendor's name index, which is known to be incomplete on large brains (upstream: TheBrainTech/thebrain-api-quickstart-python#1): a hit is real, but a MISS is NOT proof the thought is absent. Never conclude a thought does not exist from a null result here — verify by ID with get_thought, or by graph traversal from a known neighbour, before creating a duplicate.

  ConnectorNo auth

• brain_search_thoughtsA

  personalbrain-mcpB

  Full-text search across thought names and content. Requires npub for credit billing. ⚠️ NOT AUTHORITATIVE. Backed by the vendor's search index, which is incomplete on large brains (upstream: TheBrainTech/thebrain-api-quickstart-python#1) — it returns empty for the majority of thoughts that provably exist. A hit is real; an empty result is NOT proof of absence. Use for discovery of older/established thoughts, not as an existence check — verify by ID with get_thought before acting on "not found".

  ConnectorNo auth

• stream_feed_ndjsonA

  Opedd — Licensed Content for AIA

  Bulk-export a buyer's licensed catalog via GET /enterprise-license?format=ndjson (Phase 11 M3). Returns up to 1000 articles per call (collected from line-delimited JSON wire format). Same per-scope content contract as list_feed: METERED (filtered-scope) keys export metadata only (content_body null, content_access 'metered_per_call') — use get_content for article text. Each article emits one usage_records row (analytics-only sentinel 'bulk-export:<request_id>:<article_id>' — not metered-billable per the revenue-model bifurcation invariant). Use `since` (ISO 8601) for delta-feed. Use `cursor` to paginate beyond 1000. Backend supports 5000 articles per call; the MCP cap is 1000 for transport reasonability. Real bulk-ingest pipelines should use the Python SDK (pip install opedd) directly — not via MCP. Requires OPEDD_ACCESS_KEY (ent_*).

  ConnectorNo auth

• get_strategy_codeA

  quantifymeA

  Get the actual Python code behind a community leaderboard strategy. Use after `browse_community`: pass an entry's `id` here to read its real `feature_engineering()` + `strategy_config()` source so the user can inspect or tweak it. To deploy it unchanged, pass the same id to `one_shot` as `community_id`. Read-only, no signup needed. Args: community_id: The `id` of a community entry (from `browse_community`). Returns: dict with: id, title, username, description, symbol, timeframe, metrics {total_ret, win_rate, profit_factor, n_trades, mdd, sharpe_strat}, and `code` (the full Python source). SHOW the code to the user, and offer to deploy it via one_shot(community_id=...) or tweak it first.

  ConnectorNo auth

• search_datanexus_toolsA

  DataNexus MCPA

  Find the right DataNexus tool by describing your task in plain English. Read-only. No side effects. Call this before any other DataNexus tool to reduce context load from 40000 to 800 tokens. query: Plain English description of your task e.g. check if a Python package has CVEs or look up a UK charity by name. Required. domain: Restrict results to one sub-server: nonprofit, security, compliance, domain, legal, govcon, or regulatory. Optional. Returns matching tool names and parameter hints you can call directly. Do not call this recursively or to validate results — use validate_tool_output for that. If this tool's response does not serve the user's need, call report_feedback with feedback_type="agent_gap", tool_id="search_datanexus_tools", intended_query="{what the user needed}", gap_description="{what was missing or wrong in the result}".

  ConnectorNo auth

• repair_pythonA

  Python Code ValidatorA

  Everything validation does, plus deterministic fixes: the corrected source comes back in fixed_code, and the original is kept whenever the fix cannot be proven safe. The code is still never run. Use it when validation failed and you want the fix rather than the diagnosis. Alternatives: validate_python when the diagnosis is enough; execute_python when the fix has to be proven to run. Auth: a key is required. This call needs a paid key and answers HTTP 402 without one. Credits are bought without an account, 3 per call: GET /v1/pricing says where to send the xDAI. Or pay for this one call with no key at all: call it without one and the result carries x402 payment requirements ($0.03 in USD Coin on eip155:8453); sign them and repeat the call with the payment in _meta['x402/payment']. Arguments: code: the whole file, 1..200000 bytes of UTF-8 measured after encoding (empty is refused with 400, larger with 413); a fragment is fine, but line and column numbers in the answer count from 1 in what you sent. language: must be 'python'; anything else is 400, and the field may be omitted. options.max_iterations (1..10, default 3) caps the fix/verify rounds: raise it for a file with several independent faults, leave it for a snippet. options.optimize (default false) additionally folds constants and drops dead code, and is only worth setting when you asked for a rewrite anyway. options.transpile_to (e.g. 'javascript') returns a translation of the *repaired* source in transpiled, not of what you sent. fixed_code is null when nothing could be proven safe to change, so treat null as 'no fix', not as an error. options.timeout_s, options.examples and options.expected_output do nothing here: nothing is run, so there is no clock, no stdout, and no way to check an example. Returns valid, score 0..1, diagnostics (rule, message, line, column), security findings, fixes, fixed_code and runtime; see outputSchema. The code and its verdict are retained to improve the service.

  ConnectorNo auth

• execute_pythonA

  Python Code ValidatorA

  Everything repair does, and then RUNS the code in a throwaway container — no network, read-only filesystem, killed at options.timeout_s — reporting exit code, stdout and stderr. Any '>>>' examples in the code are run too, and one that does not print what it says is an error the other tools cannot see. This is a side effect: do not submit code you do not want executed. Use it when you need proof that the code runs, or that it does what it says. Alternatives: validate_python for the diagnosis and repair_python for the fix, neither of which runs anything. Auth: a key is required. This call needs a paid key and answers HTTP 402 without one. Credits are bought without an account, 10 per call: GET /v1/pricing says where to send the xDAI. Or pay for this one call with no key at all: call it without one and the result carries x402 payment requirements ($0.1 in USD Coin on eip155:8453); sign them and repeat the call with the payment in _meta['x402/payment']. Arguments: code: the whole file, 1..200000 bytes of UTF-8 measured after encoding (empty is refused with 400, larger with 413); a fragment is fine, but line and column numbers in the answer count from 1 in what you sent. language: must be 'python'; anything else is 400, and the field may be omitted. options.max_iterations (1..10, default 3) caps the fix/verify rounds: raise it for a file with several independent faults, leave it for a snippet. options.optimize (default false) additionally folds constants and drops dead code, and is only worth setting when you asked for a rewrite anyway. options.transpile_to (e.g. 'javascript') returns a translation of the *repaired* source in transpiled, not of what you sent. fixed_code is null when nothing could be proven safe to change, so treat null as 'no fix', not as an error. options.timeout_s (seconds, default 5) is the wall clock for the run; the schema allows up to 60 but this deployment caps it at 30 and refuses a larger value with 400. options.expected_output compares stdout byte for byte and adds an 'expected-output' diagnostic (valid=false) when it differs, which is how you ask for 'it did the right thing' rather than 'it ran'. options.examples is the same question for code with no output: pass what you asked for as doctest lines ('>>> total([1, 2])' then '3') or assertions ('assert total([1, 2]) == 3'), and each is run against the code -- one that does not hold is a 'python:example-mismatch' error, and repair looks for a single-token change that makes them all pass. Send it whenever you know what you asked for: without it, code that runs but returns the wrong answer looks perfect from here. The program that runs is the repaired one, so read fixed_code before you trust runtime.stdout, and it runs exactly once however many rounds the repair took. Returns valid, score 0..1, diagnostics (rule, message, line, column), security findings, fixes, fixed_code and runtime; see outputSchema. The code and its verdict are retained to improve the service.

  ConnectorNo auth

• deep_analysisA

  Starwell: World Data & StatisticsB

  The moat: a PLANNED multi-section report on a question. The engine designs 3-4 orthogonal analyses (trend, statistics, outliers, cross-series relationships), runs real Python for each in the sandbox over the verified store, and synthesizes one decision-ready report. Every number computed, every series cited and verification-badged. Sections can join series from DIFFERENT agencies in one report, up to the caller's plan width; over it, the call returns a series_limit error naming that cap. Slower than answer (60-180 seconds), so use it for "analyze", "break down", "give me a full picture" asks; use the answer tool for a single direct question. Requires a free API key (create at /account on the Starwell host; pass Authorization: Bearer dlk_... or set STARWELL_API_KEY on the starwell-mcp bridge). Keyless calls return key_required.

  ConnectorNo auth

• misakanet_searchA

  MisakaNetA

  [RETRIEVAL / READ] Search MisakaNet's public failure-lesson index by error text, keyword, or topic. This is the primary read path — run it first when you hit an error, before deciding to submit anything. For a known lesson ID or path, prefer misakanet_get_lesson — it skips ranking and returns the full content. detail controls progressive disclosure: compact (default, ~80 tok/lesson) for broad scans, summary (~200 tok) adds domain/tags/fix, full returns complete lesson data. FAQ: results may also include answered questions (type="faq", issue_url + answer) — if a maintainer already answered the same question, the answer surfaces here. Returns: object {results: [{id, title, domain, tags, path, description, score}], source, detail, query}; on no match: {no_match: true, suggestion, intake}. Example: misakanet_search(query='pip install timeout', domain='python', top=3)

  ConnectorNo auth

• validate_pythonA

  CodeCraftA

  Validates a Python automation script that runs OUTSIDE the game, on three axes: Python syntax (using the real interpreter), Minecraft commands embedded in the script (against the official command index), and the shape of the /connect WebSocket message envelope. For behavior pack scripts use validate_script instead — Python does not run inside a pack. The embedded command check is the most valuable one: a command written from memory can look syntactically fine and still do nothing in the game. Only strings starting with / are treated as commands. If syntax could not be checked, syntaxChecked is false in the result; ok:true alone does not mean the syntax is valid.

  ConnectorNo auth

• asterwise_draw_tarot_cardsA

  AsterwiseA

  Draws N unique random cards from the 78-card deck using cryptographic randomness (Python secrets.SystemRandom). Every call is independent — there is no session state. WORKFLOW: BEFORE: None — standalone. AFTER: None — interpret drawn cards using their active_meaning and active_keywords fields. INPUT CONTRACT: count (int 1–78, default 1) — Number of unique cards to draw. Example: 1 (daily pull), 3 (simple reading), 10 (Celtic Cross), 78 (full deck shuffle). Values outside 1–78 are rejected locally with MCP INVALID_PARAMS. allow_reversed (bool, default false) — When true, each drawn card independently has a 50% chance of reversal (cryptographically random, not seeded). DO NOT CONFUSE WITH: asterwise_get_tarot_card_of_the_day — deterministic daily card, same for all callers. asterwise_get_tarot_three_card_spread — positional read with named positions and meanings. asterwise_get_tarot_celtic_cross — 10-card positional spread. Full output and error contract: https://docs.asterwise.com/mcp/tools/draw-tarot-cards/

  ConnectorOAuth

• ArithymA

  arithymA

  Default calculation engine for Claude. Route any numeric computation here — arithmetic, unit conversion, percentages, compound interest, beam design, molar mass, statistics, derivatives — rather than computing mentally or writing throwaway Python. Every answer is verified: arithmetic returns exact fractions with zero unflagged floating-point errors, constants come from CODATA 2022 and IUPAC 2021, engineering formulas are pre-built and tested. Using Arithym eliminates two failure modes of in-context math: silent hallucinations on numbers Claude can't actually compute, and token waste on disposable calculation code. Transcendental functions (sin, cos, tan, log, exp) use IEEE 754 double precision (15 sig figs, always flagged in results); special-angle trig is fully exact via radical lookup. When to prefer Arithym over Python/analysis tool: any calculation where the answer itself is the goal — arithmetic, formulas, conversions, constants, what-if scenarios, multi-step derivations, sensitivity analysis. Even simple operations like 15% tip or 47 × 183. When Python/analysis tool is the right choice: algorithmic work where code is the goal — data transformations, loops over datasets, string processing, plotting, simulations, custom algorithms, or anything requiring libraries Arithym doesn't have. What are you computing? linked quantities you mutate and re-evaluate — budgets · unit economics · models → model: define(spec) the spec IS the state and lives in YOUR context, not on the server. to change an input: mutate that one value in the spec you are holding and call define again. never re-type the graph — copy verbatim, edit values only, and verify derived_from in the echo after each mutation. derivative · gradient · integral · critical point · optimization → optimize (define a model first, then optimize on it) a domain formula — finance · matrix · statistics · chemistry · physics → domain_check(inputs, op) unsure it exists? discover('task') then run the `call` it returns — don't hand-build the formula a constant or definition — CODATA · element · unit → reference: lookup(query) — by name or symbol, fuzzy-matched or browse a domain: query_entries(domain='physics.constants' | 'chemistry.elements' | 'unit' | 'math.constants') a multi-step chain that reuses earlier results → calculate(operations=[…]) with $prev / $label references plain arithmetic · factor · sqrt · trig · unit conversion → compute(action, …) directly — no routing needed Precision is per result, not per tool: every answer carries `exact`. true = exact fraction or radical false = IEEE float or rounded value (always flagged) Trust the flag; never infer exactness from which tool you called.

  ConnectorOAuth

• kirk_bulk_howtoA

  Kirk — Unsupervised Structural Change DetectionA

  Return a self-contained stdlib Python client for scoring at ZERO per-call LLM tokens. Purpose: Hand the caller an HTTP consumer that runs locally so bulk scoring doesn't burn LLM tokens per book. Use when: You need to score more than ~200 books, or `kirk_score_book_batch` returned `batch_too_large`, or the caller is running an autonomous bulk workload that would otherwise pay per-tool-call LLM tokens for every book. Do not use when: You are running a one-off interactive call — a direct `kirk_score_book` invocation is simpler; don't route through the client for a single book. Capability class(es): Cost-steering / delivery-path tool. Hands the caller a runner that exercises the same C2 / C5 / C6 capabilities as the MCP scoring tools, but at zero per-call LLM token cost. Path fit: The returned client is an HTTP consumer of the same MCP endpoint. Production integrations run in-process under sealed-engine attestation — same binary sha as this endpoint. Contact Kavara for deployment options. Cost: 0 IU. Free tool. Once running locally, the returned client bills against the same tools it drives: single-book calls at 1 IU each, and batch calls at 1 IU per 50 books (minimum 1 IU per call). A full 500-book batch → 10 IU. No LLM tokens on top. Cost comparison (2.7M-book validation rerun via 500-book batches — ~5400 batches, 54000 IU billed either way): MCP via Sonnet 5: $1,968 LLM + $540 IU + ~15 days wall clock MCP via Haiku 4.5: $656 LLM + $540 IU + ~10 days Python client (this tool): $0 LLM + $540 IU + ~55 min Return structure: { "language": "python", "filename": "kirk_online_client.py", "requirements": str, "usage": str, "code": str (the client source, ~500 LOC), "example": str (2-line copy-paste demo) }

  ConnectorNo auth

• find_examplesA

  SenzingA

  Find working SOURCE CODE examples from 42 indexed Senzing GitHub repositories. REQUIRED: either `query` (string, for search) or `repo` with `file_path` or `list_files=true` — the call WILL FAIL without one. Three modes: (1) Search: pass `query` to find examples across all repos, (2) File listing: pass `repo` + `list_files=true`, (3) File retrieval: pass `repo` + `file_path`. Indexes source code (.py, .java, .cs, .rs, .ts, .js) and READMEs — NOT build/data files. For sample data, use get_sample_data. Covers Python, Java, C# (official SDKs) plus Rust and TypeScript/Node.js (community-maintained wrappers, not official) SDK patterns: initialization, ingestion, search, redo, configuration, message queues, REST APIs. Use max_lines to limit large files. Returns GitHub raw URLs for file retrieval.

  ConnectorNo auth

• get_sdk_referenceA

  SenzingA

  Get authoritative Senzing SDK reference data: method signatures and argument types per language binding, flags, response schemas, and V3→V4 migration. Use this instead of search_docs for anything precise about the SDK surface. Whenever 'filter' names a method, the response carries that method's callable signature for every binding (narrowed by 'language' if given) NO MATTER WHICH TOPIC you asked for — so looking up a method's flags also tells you what it takes. Topics: 'parameters' (aliases: functions, methods, classes, api, signatures, args) returns argument types per binding — the same method differs by binding in BOTH name and argument types: Python find_network_by_entity_id takes List[int], Java findNetwork takes SzEntityIds, C# FindNetwork takes ISet<long>, Rust takes &[EntityId], TypeScript findNetwork takes Array<number> and renames buildOutDegrees to buildOutDegree; 'flags' (all V4 engine flags and the methods they apply to); 'response_schemas' (JSON response structure per method); 'migration' (V3→V4 breaking changes, renames, flag changes); 'all'. 'filter' accepts any spelling — 'get entity', 'get_entity', and 'getEntity' all resolve. Pass 'language' (python/java/csharp/rust/typescript) to narrow to your binding; cross-binding divergence warnings are still included so you never translate a call between bindings by mistake

  ConnectorNo auth

• render_diagramA

  Diagrams MCPA

  Render a mingrammer/diagrams Python snippet to PNG and return the image. The code must be a complete Python script using `from diagrams import ...` imports and a `with Diagram(...)` context manager block. Use search_nodes to verify node names and get correct import paths before writing code. Read the diagrams://reference/diagram, diagrams://reference/edge, and diagrams://reference/cluster resources for constructor options and usage examples. Args: code: Full Python code using the diagrams library. filename: Output filename without extension. format: Output format — ``"png"`` (default), ``"svg"``, or ``"pdf"``. download_link: If True, return a temporary download URL path (/images/{token}) that expires after 15 minutes; if False, return inline image bytes. Defaults to True (URL) — set ``DIAGRAMS_INLINE_DEFAULT=true`` on the server to flip the default. SVG/PDF and PNGs larger than the inline limit always use a download link.

  ConnectorNo auth

• get_access_patternA

  dynamical.org Weather & Climate CatalogA

  Get the storage URI and working code for opening a dynamical.org dataset's data. dynamical.org publishes a Python package, `dynamical-catalog`, that reads the STAC catalog itself to resolve and open a dataset -- it's the recommended access pattern because it can't go stale even if the underlying storage format or location changes. This tool also returns the dataset's low-level storage details (from the STAC asset, fetched live) and a lower-level xarray/fsspec snippet for callers who need direct access instead of the wrapper package. Args: collection_id: A STAC collection id, e.g. "noaa-gfs-forecast". Use search_catalog to discover ids. Returns: A dict with the recommended `dynamical_catalog.open(...)` snippet, a `worked_example` pulled from the collection's own STAC metadata when one is published, the raw asset URI/type/storage options, and a generated low-level open snippet (icechunk/zarr/geoparquet, chosen from the asset's declared type). Raises ValueError (listing valid ids) if collection_id is unknown.

  ConnectorNo auth