"A tool for decompiling Android APK files" matching MCP tools:

• linux_auditA

  ZEN SecDBA

  Perform a Linux package vulnerability audit using SecDB. ## What this tool does Analyzes the installed packages of a Linux system-identified by OS and OS version-and returns vulnerability information plus a Markdown summary. The audit results are based exclusively on the package list provided by the user. ## When to use this tool Use this tool when the user wants to determine: - whether installed packages contain known vulnerabilities - whether a host, VM, container, or base image is affected by security advisories - which packages require patching or upgrading If the user does not know the valid values for `os` or `version`, first call the `linux_os` tool to retrieve the exact supported combinations. ## Inputs - **os**: Linux distribution identifier supported by SecDB (use `linux_os` to obtain allowed values). - **version**: OS version or codename corresponding to the selected distribution. - **packages**: list of installed packages, **one per line**, generated using the appropriate system command: ### For RPM-based distributions (RHEL, CentOS, Rocky, Alma, SUSE) rpm -qa --qf '%{NAME}-%{VERSION}-%{RELEASE}.%{ARCH}\n' ### For DEB-based distributions (Ubuntu, Debian) dpkg-query -W -f='${Package} ${Version} ${Architecture}\n' ### For Alpine Linux apk list -I The raw output of these commands can be passed directly as the `packages` input (one package per line). ... python3 3.12.3-0ubuntu2.1 amd64 systemd 255.4-1ubuntu8.10 amd64 tmux 3.4-1ubuntu0.1 amd64 ... ## Outputs - **report**: structured objects describing the advisories affecting the audited packages. - **summary**: Markdown summary including total vulnerabilities, severity breakdown, and key findings. ## LLM usage guidelines - Never guess whether a package is vulnerable-always call this tool for Linux audits. - If `os` or `version` is unclear or missing, call `linux_os` and ask the user to choose a valid combination. - Normalize the package list to “one entry per line” if the user provides unstructured output. - The `summary` is already Markdown and can be shown directly. - Use `report` when deeper technical analysis is required.

  ConnectorNo auth

• upload_fileA

  BorealHostA

  Upload a base64-encoded file to a site's container. Use this for binary files (images, archives, fonts, etc.). For text files, prefer write_file(). Requires: API key with write scope. Args: slug: Site identifier path: Relative path including filename (e.g. "images/logo.png") content_b64: Base64-encoded file content Returns: {"success": true, "path": "images/logo.png", "size": 45678} Errors: VALIDATION_ERROR: Invalid base64 encoding FORBIDDEN: Protected system path

  ConnectorNo auth

• commit_deployA

  vibedeployA

  Atomically apply a staging session's files to the live site. Runs preflight + secret/malware scan against the complete staged set; on failure the session stays open and can be re-attempted or aborted. For replace-mode against a site with existing files, requires confirm:"I-want-to-replace-all-files".

  Connector

  Destructive

  No auth

• write_site_filesA

  sitectrlA

  Push files (HTML/CSS/JS/images) into a site's DRAFT — use this when YOU are writing the code yourself instead of asking sitectrl's AI. Text files go in 'content'; binary files (images/fonts) in 'content_base64'. Max 40 files/call, 2 MB/file. Keep the <script defer src="sc-track.js"></script> include on every HTML page (the site's built-in private analytics — publish re-adds it if missing). Use clearly-marked placeholder contact info unless the user provided real details. For working forms, POST to /_sc/form/submit with a hidden _form name field — submissions reach the owner's dashboard + email (never use mailto:). Follow with publish_site to go live.

  Connector

  Destructive

  No auth

• generate_runner_profileA

  CourseProfilerA

  Generate a segment-evidence USRProf runner profile artifact from uploaded runner evidence or an existing .usrprof source. Before using this tool, ask what profile the user wants: target race/course, target distance/elevation range, general trail profile, or insights-only profile. Do not silently use every local file or arbitrary folders; if many evidence files are available, summarize candidates and ask the user to approve a selection strategy. A USRProf is not just average pace: CourseProfiler uses segment evidence to estimate climbs, descents, runnable grades, fatigue/durability, terrain fit, uphill running limits, and pacing confidence. Evidence choice affects race-plan times and standalone athlete insights. Use this when the user does not already have an already-converted usrprof_artifact_id. Accepted evidence includes GPX/FIT/CRSProf activity files, ZIP/TAR/TAR.GZ/TGZ/TAR.XZ/TXZ archives containing those files, and .usrprof files passed as source_file artifacts from POST /api/artifact-uploads, raw_file inline content/base64, or fetchable HTTPS URLs. Archives must use purpose runner_evidence, are expanded server-side, and report skipped nested archives, duplicate contents, unsupported entries, and parse failures by filename/path. For Strava, do not use generate_runner_profile and never ask for credentials or tokens. Call build_runner_profile_from_strava with the target course or a user-confirmed target distance; if the user provides neither, it classifies the available runs and uses the most populated distance category. It returns a private browser authorization link, selects similar Run/TrailRun activities, resumes the same job, and produces a USRProf artifact ready for create_race_plan. After this tool succeeds, pass the returned usrprof artifact ID to create_race_plan as runner.usrprof_artifact_id.

  ConnectorNo auth

• cabgo_pricingA

  Cabgo BuilderA

  Public (no auth): informational pricing reference. Returns monthly SaaS subscriptions (Basic / Professional / Enterprise — $15/$30/$70 per month) and one-time app-build packages (Starter $399 Android-only, Pro $699 Android+iOS, Full $999 Android+iOS+source code). All plans include unlimited drivers / users / admins; Cabgo never charges commission per trip. **Informational only.** Do not generate or return a payment URL from this tool. When the operator wants to purchase, direct them to visit https://www.cabgo.app/empezar in their browser — all checkout happens on cabgo.app externally via Stripe, not inside this conversation.

  ConnectorNo auth

• publish_siteA

  shiplyB

  Publish files to the web → live URL at <slug>.shiply.now. UPDATING: never create a new site for changes — re-call with claimToken (anonymous sites) or slug (sites you own with a Bearer key) and the SAME URL gets the new version. Unchanged files are hash-skipped server-side, so re-publishing (including retrying a failed publish) is cheap — always update the same site rather than creating a new one. Works WITHOUT auth (anonymous: 24h lifetime, returns claimToken/claimUrl — SAVE THEM). With a Bearer shp_ key sites are permanent. ≤50 files / 2 MB inline; bigger: REST flow per https://shiply.now/llms.txt. index.html serves at /. spaMode for client-side routing.

  ConnectorNo auth

• delete_sponsorA

  agendaforgeA

  Permanently delete a sponsor. Destructive and disabled by default; an organizer must allow direct destructive access and this tool. Depending on the organization's settings, this either executes immediately or files a proposal for approval; the response status field says which happened.

  Connector

  Destructive

  No auth

• update_project_filesA

  DplooyA

  EDIT a deployed site — call get_project_files first, never edit from memory. PREFERRED: targeted edits ({ path, oldString, newString }) — you send only the changed text, and the server verifies oldString against the ACTUAL live file (exactly one match required), so a stale copy can never overwrite anything. Use files (full content) only for rewrites or new files, deletePaths for removals. Every file you do NOT name is guaranteed untouched — deletions never happen by omission. All-or-nothing: any failed match or invalid path rejects the whole patch with nothing changed. Text files only (HTML/CSS/JS) — images live in the Media Library. Single-file projects accept edits to their one file (path "/"); adding/deleting files is multi-file only.

  Connector

  Destructive

  OAuth

• publish_siteA

  mcpA

  Deploy files to a live URL. No slug → create a NEW site (works without auth; anonymous sites expire in 24h — always show the user the claimUrl). With slug → UPDATE that site (complete snapshot: send ALL files). A Dockerfile in the files makes it a server-side app (auth required; listen on process.env.PORT; persist under /data; poll app_status). Total payload ≤ 8 MB — for bigger sites use the dataecho skill scripts.

  ConnectorNo auth

• how-toA

  Fast.ioA

  Built-in product help — ask a natural-language "how do I…" question about Fastio and get a grounded, product-aware answer (or a short clarifying question) back in one call. EXPLAIN-ONLY / ADVISORY: it returns GUIDANCE TEXT and performs NO platform action (it will not create shares, move files, or change anything) — read the guidance, then act with the other tools. Answers are grounded in Fastio's own how-to knowledge AND phrased in terms of these MCP tools — they name the concrete `<tool> action="…"` calls to make — so prefer this over guessing endpoints or burning exploratory calls. For Q&A over YOUR uploaded files (RAG) use the `ai` tool instead — `how-to` answers questions about Fastio ITSELF. FREE and requires only an authenticated user (no org, no plan gate, no billing). Call action='describe' for the full action/param reference.

  ConnectorNo auth

• hires_upload_candidate_fileA

  100Hires - AI ATS & Recruitment SoftwareA

  Upload a file for a candidate using a base64 payload. Used for portfolio uploads and document attachment. WARNING: host function-call serializers (both OpenAI and Anthropic) truncate tool arguments above ~20KB, so binary files larger than that will arrive corrupted. For resumes specifically, prefer hires_create_candidate / hires_update_candidate with resume_text — the model parses the file from chat context and passes extracted text, avoiding the size limit entirely.

  ConnectorNo auth

• cabgo_create_my_appA

  Cabgo BuilderA

  Materializes a free Cabgo workspace for the operator and queues an Android build of their branded app. No payment, no card, no checkout — the workspace is free to create and operate. Call ONLY when the user explicitly wants to create / launch / spin up / set up a new app for their business — verbs like 'create', 'launch', 'build me', 'set up an app for'. Do NOT call this for setup / installation / connector questions (use cabgo_install_instructions). Ask the user 2 things: (1) what type of business — taxi / food delivery / gas distribution? (2) what brand name for their app? Optionally city + brand color. **The connected OAuth user becomes the owner automatically** — no email or name is needed in the body. **A single user can own multiple tenants** — calling this again creates a NEW workspace rather than erroring. Branding tweaks happen via other Cabgo tools after creation. Any plan / billing / subscription management is done by the operator on https://www.cabgo.app — never through this tool.

  ConnectorNo auth

• update_logbook_entryA

  EpovestA

  Edit a manual logbook entry: only the fields you send change (empty notes clear them). It is the customer's own logbook: a typo or a wrong date is simply corrected. quest_id files an entry under a quest after the fact, and null files it back under the project alone. Tool events cannot be edited: they are derived from the canon and surface registries.

  ConnectorNo auth

• submit_briefA

  IBO Studio MCPA

  Submit the creative brief for a PAID order: pass order_token (from get_order; session ids are not accepted here) plus project fields (product, goal, audience, channels, resolution, launch, links, constraints) and files[] from create_upload_url. Delivery resolution must be selected before creative kickoff. Customer identity comes from the verified payment. NOTE: unpaid/anonymous submissions are rejected here; for Custom Production inquiries without payment use the submit_custom_inquiry tool instead.

  ConnectorNo auth

• batch_upload_pdfA

  KDAN PDFA

  Upload multiple PDF files from ChatGPT file attachments. Use this when the user provides multiple file attachments in ChatGPT. Downloads each PDF from its signed URL and stores it. Returns session_id and a list of job_ids. Like upload_pdf, this ONLY works on hosts that resolve chat attachments for you (ChatGPT). On Claude and other MCP clients, call create_upload_page instead. Never invent or guess a download_url or file_id. MANDATORY WORKFLOW before calling this tool: 1. ALWAYS call check_upload_status FIRST — even if you think the files are new. 2. Only include files confirmed absent from check_upload_status. If ALL files are already uploaded, skip batch_upload_pdf entirely and reuse the existing job_ids. 3. Reuse job_ids from already_uploaded — do NOT re-upload those files. Skipping step 1 and calling batch_upload_pdf directly is FORBIDDEN. After batch_upload_pdf completes: if the user requested a comparison, call 'compare_pdfs' with the returned job_ids immediately.

  ConnectorNo auth

• check_upload_statusA

  KDAN PDFA

  Check existing uploads and determine which files still need uploading. Call this BEFORE upload_pdf or create_upload_page to avoid duplicate uploads. Also call it after the user uploads via the widget to discover the new file and its job_id. Returns 'session_id' (always — store it!), plus: - 'already_uploaded': files from pending_filenames that are already in this session, with reusable job_ids (empty when pending_filenames is omitted) - 'needs_upload': files not yet in this session (must be uploaded) - 'jobs' / 'count': every file currently stored in this session You MUST call this tool before any upload, and you MUST act on its result immediately. When you passed pending_filenames: - 'needs_upload' is non-empty → call upload_pdf (single) or batch_upload_pdf (multiple) with ONLY the files listed in 'needs_upload'. Pass the same session_id. Do NOT upload files in 'already_uploaded'. - 'needs_upload' is empty → skip uploading entirely; use the job_ids from 'already_uploaded'. When pending_filenames is omitted, 'already_uploaded' and 'needs_upload' are always empty and carry NO meaning — read 'jobs' instead. A non-empty 'jobs' means the files are already here: use those job_ids and do NOT ask the user to upload again.

  ConnectorNo auth

• deploy_appA

  AppDeployA

  Deploy or update a website or web app to get a public URL. Text files only in files[]. files[] must be a JSON array, even for one file. Example: files: [{"filename":"src/App.tsx","content":"..."}]. Never pass a bare string or a single file object. Use files[] for inline text edits and diffs, not for copying large existing local file contents into tool params. Never inline or base64-encode binary assets/resources in files[]; use upload_assets first for images, fonts, media, PDFs, archives, and other client-supplied file assets, then pass upload_id. Inline deploy_app text payloads MUST be compact. For JavaScript/TypeScript/JSX/TSX string literals, use single quotes wherever valid. Keep inline HTML/CSS/JS/TS diff from/to values single-line wherever valid; do not include newline characters unless required for valid syntax. Template files from get_app_template are auto-included as the baseline — use diffs[] to modify them; content is otherwise only for entirely new files. New apps: tests/tests.txt is the intentional template-file exception and must be sent as a complete content replacement. New apps: set app_id to null, provide app_name, description, app_type, frontend_template, and features. Updates: provide existing app_id, features, and either changed files/deletePaths or upload_id. If upload_id is provided, do not also send files[] or deletePaths[]; the upload manifest owns all text changes, diffs, and delete operations. Rules: do not add @appdeploy/client or @appdeploy/sdk to package.json (platform-injected). SPAs must use HashRouter. Frontend must never import @appdeploy/sdk; backend must never import @appdeploy/client. Frontend must use api from @appdeploy/client for backend calls, never fetch() or axios. If frontend realtime is used, @appdeploy/client websocket usage is ws.connect() only; do not call ws.subscribe/ws.publish/ws.send directly on ws. After deploy, poll get_app_status every 5s until status is 'ready' or 'failed'. On a lifetime-limit error, stop deploy_app calls unless the account limit increases. The limit does not reset; show the returned upgrade link to the user. If get_app_status returns QA/e2e/runtime errors, attempt automatic fixes and redeploy up to 3 times before asking the user for guidance.

  Connector

  Destructive

  OAuth

• update_project_metadataA

  flootA

  Update project settings (current values appear at the top of list_files). Keys: title (2-100 chars), description, iconUrl, splashUrl, mobileAppId, enableSSR (boolean), flootAiDisallowed (boolean — true opts the project out of @floot/ai), and iOS Info.plist purpose strings (NS…UsageDescription — set to a string, or null to remove) plus boolean Info.plist keys (UIViewControllerBasedStatusBarAppearance — set to a boolean, or null to restore the template default). Invalid keys/values are reported and skipped. NOTE: these take effect on the published app only after the next publish (publish_app, or the user's Publish button). The iosInfoPlist keys only affect builds made before the first iOS publish; after the iOS app is published, edit the project file `static/__dev/native/ios-info.plist` directly with write_file/edit_file (see get_guides('ios-info-plist')). Likewise, after the first Android publish, edit `static/__dev/native/android-manifest.xml` directly for manifest changes (see get_guides('android-manifest')). `shareTarget` makes the native app appear in the iOS and Android share sheets (other apps can share photos/videos/files/text into it): pass { enabled: true, mimeTypes?, allowMultiple? } to register, { enabled: false } to remove; receiving the shared items still needs the handler in app code — read get_guides('share-target') first and ship both together. `nativeSystemBars` controls how the native app treats the status bar / Android navigation bar: mode 'inset' (default) keeps the app below the bars and paints the exposed strips `color` (default black — set it to the app's header color for a seamless look); mode 'edge-to-edge' runs the app under the bars, which REQUIRES the app to pad by var(--safe-area-inset-top/bottom) itself — read get_guides('native-system-bars') first and ship both changes together. Not superseded by the __dev/native files.

  ConnectorOAuth

• read_codeA

  ZephexA

  Read a known symbol or file from the user's project without dumping the whole tree. AST extract — signature plus body — cheaper than opening a 2,000-line file. ALWAYS call when find_code just returned a name or path, when the user named a function to inspect, or before you edit a large file. If they named Zephex or MCP and asked you to open or explain a function, this is the tool. Prefer this over native Read on files over ~50 lines. mode=symbol — extract by name (target or targets[]). mode=file — batch 1–20 paths. mode=outline — table of contents + plain-English overview before drilling a 300+ line file. mode=scan/smell — keywords or bug smells across files[] you already have. Works on any local project on their machine. Local/stdio: omit path to use editor cwd, or pass path as their project folder. No disk: inline_files. Call-graph modes (callers, blast_radius, dead_code) need local disk only. Returns summary, data.symbols or data.files, next_calls. Follow next_calls if truncated. Not for unknown location (find_code first). Not for stack/scripts (get_project_context). Example: read_code({ mode: "symbol", target: "validateToken" }) or read_code({ mode: "outline", files: ["src/auth.ts"] }). After find_code, do not re-search — pass the symbol as target or the path in files[]. detail_level=signature is enough to decide; body when you will edit. compact:true drops line numbers. Batch files[] instead of opening one path at a time.

  ConnectorNo auth

• pathrule_resolve_refreshA

  PathruleA

  Close a Pathrule refresh task after reviewing its brief. Normal remote flow: call pathrule_list_pending_refreshes, then pathrule_get_refresh_brief, then use this tool with status='rejected' when the signal is stale or not actionable. Remote MCP may refuse status='applied' because it cannot verify local source files; use Pathrule Studio/CLI for applied resolutions that require local verification.

  Connector

  Destructive

  No auth