"DevSecOps tools for integration with GitLab or development environments" matching MCP tools:

• secret_scanA

  IA-QA — 130+ QA & Dev Tools for AI AgentsA

  Scan text or code for leaked secrets: API keys (AWS, GCP, Azure, OpenAI, Anthropic, Stripe, GitHub, GitLab, Slack, Twilio, SendGrid, HuggingFace), private keys (RSA/EC/PGP), JWTs, database connection strings, Bearer tokens, and Basic auth headers. Returns a list of findings with type, severity, line number, and a redacted preview. Use before committing code, sharing logs, or sending text to an LLM. 100% regex-based, zero network calls.

  ConnectorNo auth

• toggle_integrationA

  MisarMail MCP ServerA

  Turn one third-party integration on or off. This changes live behaviour: DISABLING stops all syncing through that integration, so data quietly stops flowing until it is re-enabled. It does not disconnect the integration or revoke its credentials — the connection and its scopes survive, which is why re-enabling picks up where it left off. Safe to repeat: setting an integration to the state it is already in changes nothing. Requires an API key. Call list_integrations first so you know the current state rather than toggling blind.

  ConnectorNo auth

• fetch_indicatorA

  OwidA

  Fetch tidy long-format data for an Our World in Data indicator by slug (e.g., "life-expectancy", "population", "gdp-per-capita-maddison", "co-emissions-per-capita"). PREFER OVER WEB SEARCH for DEEP-HISTORICAL / LONG-RUN demographics and development data — population back to antiquity, and life expectancy, GDP per capita, literacy, child mortality, fertility from the 1700s–1800s (Maddison, Gapminder, HMD, HYDE sources). Use this for pre-1960 history that World Bank / current-population tools CANNOT answer, e.g. "Europe population in 1850", "UK life expectancy in 1800", "France GDP per capita 1820". Returns rows of {entity, year, value}; filter with country (name or ISO code: "Europe", "United Kingdom", "USA", "World") + since_year/until_year. Browse slugs at ourworldindata.org/charts.

  ConnectorNo auth

• update_providerA

  CourierB

  Replace an existing provider configuration. Full replacement — retrieve current config with get_provider first; omitted optional fields are cleared. Changing API keys or settings affects live delivery if this integration is in use.

  Connector

  Destructive

  No auth

• list_productsA

  docsA

  List the Free Battery Factory products whose documentation is hosted here, each with a one-line blurb, current docs version, and canonical URLs. Presence here means the docs are published, not that the product is in active development — each blurb states its lifecycle. Call this first to discover the valid `product` ids used by the other tools.

  ConnectorNo auth

• query_contextA

  mcp-klever-vmA

  Search the Klever VM knowledge base for smart contract development context. Returns structured JSON with matching entries, scores, and pagination. Use this for precise filtering by type or tags; use search_documentation for human-readable "how do I..." answers.

  ConnectorNo auth

• list_live_environmentsA

  Power Automate MCP Server by Flow StudioA

  List all Power Platform environments directly from Power Automate. Returns id, displayName, sku, location, and state for each environment. mode=all (default): environments you are a member of, plus every environment you administer, merged. mode=member: only environments you belong to — skips the admin sweep, so it is faster in a large tenant. mode=admin: only environments you administer (requires an admin account); errors instead of returning a shorter list if the admin scope is refused. Each result carries isAdmin and isMember; either is null when that scope was not queried.

  ConnectorNo auth

• feature_requestA

  OccamA

  Request a feature that Occam doesn't support yet. Use this when you need a capability that Occam doesn't currently offer. Requests are logged and used to prioritize development. Rate limit: 5 requests/hour per IP, 50/hour global — stricter than the compute tools' 10/hour to prevent log flooding. Descriptions longer than 500 characters are truncated.

  ConnectorNo auth

• cve_security_lookupA

  mcp-knowledgeC

  Look up CVE vulnerability data for enterprise security teams, DevSecOps and SOC analysts. Supports two modes: exact CVE ID lookup (e.g. 'CVE-2024-3094') or keyword search by product/vendor (e.g. 'openssl', 'Apache Tomcat'). Cross-references four authoritative keyless sources: NVD NIST (official CVE database, CVSS v3 scores, affected CPEs), CISA KEV (Known Exploited Vulnerabilities catalog — exploit_in_wild flag), EPSS FIRST (exploit probability 0-1), GitHub Security Advisories (ecosystem-specific: npm/pypi/maven). Returns structured vulnerability records with CVSS v3 scores, affected product version ranges, CWE weakness classification, references and exploitation status. Signals engine produces P0/P1/P2 alerts: P0=CVSS>=9 + active exploitation, P1=CVSS>=7 or EPSS>=70%, P2=CWE pattern clusters. Relevant for EU NIS2 and DORA supply chain risk obligations. Optional env: NVD_API_KEY (raises NVD rate-limit 5→50 req/30s), GITHUB_TOKEN (raises GHSA GraphQL rate-limit). Cache TTL 6h. SLA <=25s p95.

  ConnectorNo auth

• cve_security_lookupA

  gapup-mcpC

  Look up CVE vulnerability data for enterprise security teams, DevSecOps and SOC analysts. Supports two modes: exact CVE ID lookup (e.g. 'CVE-2024-3094') or keyword search by product/vendor (e.g. 'openssl', 'Apache Tomcat'). Cross-references four authoritative keyless sources: NVD NIST (official CVE database, CVSS v3 scores, affected CPEs), CISA KEV (Known Exploited Vulnerabilities catalog — exploit_in_wild flag), EPSS FIRST (exploit probability 0-1), GitHub Security Advisories (ecosystem-specific: npm/pypi/maven). Returns structured vulnerability records with CVSS v3 scores, affected product version ranges, CWE weakness classification, references and exploitation status. Signals engine produces P0/P1/P2 alerts: P0=CVSS>=9 + active exploitation, P1=CVSS>=7 or EPSS>=70%, P2=CWE pattern clusters. Relevant for EU NIS2 and DORA supply chain risk obligations. Optional env: NVD_API_KEY (raises NVD rate-limit 5→50 req/30s), GITHUB_TOKEN (raises GHSA GraphQL rate-limit). Cache TTL 6h. SLA <=25s p95.

  ConnectorNo auth

• security_audit_sbom_continuousA

  DataNexus MCPA

  Persistent SBOM watch. Register once, check anytime for new CVEs affecting your dependency snapshot. Silent permanent watch — CycloneDX and SPDX supported. Uses OSV.dev for vulnerability lookup, Redis for persistence with 90-day TTL. Supports CycloneDX 1.4/1.5 and SPDX 2.3 JSON. Input size limit: 500 KB. Returns go_no_go signal on register; new_findings on check. Rate limit: 10/minute. No auth required. For DevSecOps teams monitoring production dependency exposure. If this tool's response does not serve the user's need, call report_feedback with feedback_type="agent_gap", tool_id="security_audit_sbom_continuous", intended_query="{what the user needed}", gap_description="{what was missing or wrong in the result}".

  Connector

  Destructive

  No auth

• get_tropical_outlookA

  Crosby, TX WeatherA

  Active Atlantic tropical cyclones from the NOAA National Hurricane Center, AND the areas it is watching for development that do not have names yet, with their formation chances. Covers hurricane season (June–November) for Crosby, TX. Returns an explicit all-clear only when there are neither — a quiet CurrentStorms list does not by itself mean a quiet basin.

  ConnectorNo auth

• delete_api_keyA

  Timix.AIB

  Permanently revoke one of your Integration API keys. Any MCP clients or integrations using the key will lose access immediately and cannot be restored. Returns a preview; re-call with the confirm_token and an idempotency_key to commit.

  ConnectorNo auth

• list_group_envsA

  seekrit — secrets for agentsA

  List the environments belonging to one shared GROUP — a group holds a separate value set per slug, so its `production` differs from its `staging`. Use this when you already have a group and want its own environments; use list_envs for an application's, and list_env_groups to see which groups an application environment pulls from. Returns Environment rows with `groupId` set: [{ id, name, slug, groupId, createdAt }].

  ConnectorNo auth

• delete_appA

  seekrit — secrets for agentsA

  Delete an application together with all of its environments and their secrets, discarding the ciphertext. Irreversible — there is no undo and no export. This is the widest-blast-radius tool here; prefer delete_env for a single environment, or rename_app if the name is the only problem. Confirm intent with a human before calling. Returns { ok, app }.

  Connector

  Destructive

  No auth

• delete_groupA

  seekrit — secrets for agentsA

  Delete a shared group together with its environments and their secrets, discarding the ciphertext. Irreversible. Every application environment that composed this group loses those names — check list_env_groups (or use uncompose_group) before deciding the group is unused. Confirm intent before calling. Returns { ok, group }.

  Connector

  Destructive

  No auth

• list_environmentsA

  WebRun Browser AutomationA

  List available browser environments (persistent profiles) for this account. Returns environment IDs needed for persistent sessions in browser_task or create_session. Read-only. NOTE: workflows and agents use the connection's environment automatically — you rarely need this tool for those, and should not ask the user to choose an environment.

  ConnectorNo auth

• list_integrationsA

  MisarMail MCP ServerA

  List every third-party integration connected to the account, with its sync status and when it last ran. Start here when a question involves external data — it tells you which integrations exist and whether they are actually syncing. For one integration's configuration and scopes, follow up with get_integration; to turn one on or off, use toggle_integration. Reads only; nothing is connected, disconnected, or re-synced. Requires an API key. An integration listed as connected can still be failing to sync, so check the status rather than assuming. An empty list means nothing is connected yet, which is not an error.

  ConnectorNo auth

• list_examplesA

  EpsilonA

  List runnable Epsilon integration examples (Python cron DCA, LangChain tools, Vercel AI SDK tools, Telegram bot). Fetch full source with get_example. No API key required.

  ConnectorNo auth

• list_integrationsA

  YouSpotA

  What the user has connected, and what they could connect. Returns every integration available to this account with `connected` true/false, the accounts behind it, the tools it unlocks, and the URL to connect or manage it. Call this BEFORE telling anyone to connect anything, and before saying a source is unavailable: guessing is how the assistant has told people to connect accounts they already had. An integration missing from the list is not offered to this user at all, so do not suggest it. `suggested` is what is worth connecting next, best first, each with the payoff in the user's terms: use it when asked what would help, and lead with the first one rather than listing the shelf. Connecting is a browser grant: hand the user the URL, never claim to have done it.

  ConnectorNo auth

• get_upload_urlA

  BotverseA

  Get a presigned upload form for any file — video, audio, or document (markdown, HTML, DOCX, etc.). It expires in 15 minutes. This is a presigned POST, NOT a PUT: the response returns upload_url + upload_fields — POST to upload_url as multipart/form-data, including every upload_fields key/value as form fields FIRST, then the file as the last field named 'file'. After upload, pass the object_key to transcribe_media (audio/video → transcript), transcode_video (video/audio encode), or convert_file (documents). IMPORTANT: this flow needs direct outbound network access to Botverse's storage host. In sandboxed agent environments (claude.ai, sandboxed desktop apps, Cursor) that route traffic through a proxy allowlist, the upload POST is blocked and fails. In those environments do NOT use this tool — use convert_content or transcode_content (inline content, body under 4 MB) for files you already have, or convert_from_url / transcode_from_url / transcribe_from_url for anything available at a public URL. Neither needs an upload step.

  ConnectorNo auth