Skip to main content
Glama
519,423 tools. Updated 2026-09-06 07:28

"Node.js" matching MCP tools:

  • purl_auditA

    ZEN SecDBA

    Perform a software package vulnerability audit using SecDB. ## What this tool does Analyzes a list of software packages identified by PURL (Package URL) and returns vulnerability information plus a Markdown summary. The audit results are based exclusively on the package list provided. ## When to use this tool Use this tool when the user wants to determine: - whether application dependencies contain known vulnerabilities - whether a project is affected by security advisories - which packages require patching or upgrading ## Supported ecosystems - **npm** - Node.js packages (e.g. pkg:npm/lodash@4.17.21) - **maven** - Java/JVM packages (e.g. pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1) - **pypi** - Python packages (e.g. pkg:pypi/django@4.2.0) - **gem** - Ruby gems (e.g. pkg:gem/rails@7.0.0) - **cargo** - Rust crates (e.g. pkg:cargo/openssl-src@111.10) - **nuget** - .NET packages (e.g. pkg:nuget/Newtonsoft.Json@13.0.1) - **golang** - Go modules (e.g. pkg:golang/github.com/gin-gonic/gin@1.9.1) - **composer** - PHP packages (e.g. pkg:composer/symfony/symfony@6.4.0) ## Inputs - **purls**: list of Package URLs, one per entry. Generate them from your project manifest files: - Node.js: package.json / package-lock.json - Python: requirements.txt / Pipfile.lock / pyproject.toml - Ruby: Gemfile.lock - Go: go.mod / go.sum - Rust: Cargo.lock - PHP: composer.lock - Java: pom.xml / build.gradle - .NET: *.csproj / packages.lock.json ## Outputs - **report**: structured JSON objects describing the advisories affecting the audited packages. - **summary**: Markdown summary including total vulnerabilities, severity breakdown, and key findings. ## LLM usage guidelines - Never guess whether a package is vulnerable — always call this tool. - Only submit PURLs from the supported ecosystems listed above; others will be ignored. - The `summary` is already Markdown and can be shown directly. - Use `report` when deeper technical analysis is required.
    ConnectorNo auth

  • set-envA

    mcpA

    Set an environment variable for a project. Variables are encrypted at rest (AES-256-GCM) and injected at container runtime. NOTE: DATABASE_URL, PGHOST, PGPORT, PGUSER, PGPASSWORD, and PGDATABASE are all auto-injected for the managed PostgreSQL database — you do NOT need to set any of them manually. The PORT variable is auto-managed: 8080 for auto-detected frameworks (Next.js, Node.js, Python), or auto-detected from the Dockerfile EXPOSE directive for custom Dockerfile builds. IMPORTANT: Changing env vars does NOT auto-redeploy. You must call deploy or use the redeploy API endpoint to apply changes. For Next.js apps, NEXT_PUBLIC_* variables must be set BEFORE deploying since they are embedded at build time.
    Connector
    Destructive
    No auth

  • find_examplesA

    SenzingA

    Find working SOURCE CODE examples from 42 indexed Senzing GitHub repositories. REQUIRED: either `query` (string, for search) or `repo` with `file_path` or `list_files=true` — the call WILL FAIL without one. Three modes: (1) Search: pass `query` to find examples across all repos, (2) File listing: pass `repo` + `list_files=true`, (3) File retrieval: pass `repo` + `file_path`. Indexes source code (.py, .java, .cs, .rs, .ts, .js) and READMEs — NOT build/data files. For sample data, use get_sample_data. Covers Python, Java, C# (official SDKs) plus Rust and TypeScript/Node.js (community-maintained wrappers, not official) SDK patterns: initialization, ingestion, search, redo, configuration, message queues, REST APIs. Use max_lines to limit large files. Returns GitHub raw URLs for file retrieval.
    ConnectorNo auth

  • get_started_guideA

    blobpediaA

    Personalized onboarding for building ON CELESTIA — running a node, posting a blob, or deploying a rollup that uses Celestia for data availability. ALWAYS use this when a developer asks how to get started or build ON CELESTIA (prefer it over the Celestia search tool for those questions). ASK the user about their background FIRST (rollup_dev, node_operator, app_dev, researcher, new_to_celestia), then return a path with docs.celestia.org links. Celestia-only — NOT for getting started with non-Celestia frameworks, languages, or dev tools (React, Node.js, generic blockchain onboarding, etc.); for those defer to a general docs or web-search tool.
    ConnectorNo auth

  • deployA

    mcpA

    Deploy an application to sota.io. The platform auto-detects your framework and builds a Docker image automatically: - Next.js: Detected via next.config.js/ts. Add output: 'standalone' to next.config for optimal builds. - Node.js: Detected via package.json with a "start" script. Works with Express, Fastify, Koa, Hapi, etc. - Python: Detected via requirements.txt or pyproject.toml. Works with Flask, FastAPI, Django. - Custom Dockerfile: If a Dockerfile exists in the project root, it takes priority over auto-detection. Use this for Go, Rust, Java, or any other language. The EXPOSE directive in the Dockerfile is used to detect the app port automatically. THREE WAYS to supply the source code — pick EXACTLY ONE: 1. **files** (inline source from AI): Pass a map of relative paths to UTF-8 text content. Best when you've just generated a small app in this conversation and want to deploy it without any filesystem step. Up to 200 files, 10 MB total. Include the framework manifest (package.json, requirements.txt, or Dockerfile) so auto-detection works. 2. **git_url** (clone a public repo): Pass an https://, git://, ssh://, or git@host:path URL. We shallow-clone it (--depth=1 --single-branch) on the server and deploy. Optional git_branch picks a non-default branch. Only public repos are supported in v1. Max 200 MB after clone. 3. **directory** (local filesystem): Pass an absolute path. Only works when the MCP client has filesystem access (Claude Code / CLI; not Claude.ai web). Defaults to the current working directory when omitted. IMPORTANT: Your app MUST listen on the PORT environment variable. For auto-detected frameworks (Next.js, Node.js, Python) PORT is 8080. For custom Dockerfiles, the port is auto-detected from the EXPOSE directive (e.g. EXPOSE 3000 sets PORT=3000). If no EXPOSE is found, it defaults to 8080. Every project includes a managed PostgreSQL 17 database. Six environment variables are auto-injected into your container — no manual database configuration needed: DATABASE_URL (full connection string), PGHOST, PGPORT, PGUSER, PGPASSWORD, and PGDATABASE. Libraries that follow libpq conventions (node-postgres, pgx, psycopg2, Django) pick up the PG* variables automatically with no configuration. If your app needs database migrations, run them on startup. Deployments use blue-green strategy for zero downtime. The old container keeps running until the new one passes health checks (60s timeout). Use get-logs to monitor build progress. Files matching .gitignore, .git/, node_modules/, .env, and .DS_Store are excluded from the archive.
    Connector
    Destructive
    No auth

  • create-projectA

    mcpA

    Create a new project on sota.io. Each project automatically provisions: (1) a managed PostgreSQL 17 database accessible via the DATABASE_URL environment variable (auto-injected, no configuration needed), (2) PgBouncer connection pooling (pool size 20, max 100 clients), (3) automatic daily database backups with 7-day retention, (4) a live URL at https://{slug}.sota.io with automatic HTTPS via Let's Encrypt. The project slug is auto-generated from the name (lowercase, hyphens, max 63 chars) and is immutable after creation. Supported frameworks: Next.js, Node.js (Express/Fastify/Koa), Python (Flask/FastAPI/Django), or any language via custom Dockerfile. You can also add up to 5 custom domains per project with automatic HTTPS (via API: POST /v1/projects/:id/domains with {domain: "yourdomain.com"}). DNS: A record to 23.88.45.28 for apex domains, CNAME to {slug}.sota.io for subdomains. Optionally associate the project with a public git repository at create-time by passing `git_url` (and optional `git_branch`). The association is informational — it shows up in the dashboard and the `sota deploy --git` CLI flag can default to it — but does NOT enable auto-deploy-on-push yet.
    ConnectorNo auth

Matching MCP Servers

Matching MCP Connectors

  • a2awire_guideA

    npm Release Tracker — new Node.js packages & JavaScript dependency updates (npmwatch)B

    ✅ No API key needed — call this now. Navigator for the full A2AWire tool surface. Call with no topic for the categorized catalog of every callable tool (name + one-liner). Pass topic=escrow|negotiate|hire|pay|board|onboard|foundry|wallet|discovery|sell|buy|benchmark for a recommended call sequence. Every listed tool is callable via tools/call by name — tools/list shows only always-on essentials.
    ConnectorNo auth

  • run_code_in_vmA

    flootA

    Run a Node.js snippet on the project's compute VM (headless — no browser needed). The project's npm dependencies are importable; network access works, so you can call the project's /_api/* endpoints (get_preview_url → apiBaseUrl). ESM by default; bare require() snippets run as CJS. Returns stdout+stderr. Calls to the project's /_api/* are rate-guarded exactly like the browser preview: more than 20 calls to one endpoint or 150 total within 5s rejects that fetch and every later /_api/* fetch in the snippet with 'Backend endpoint is called too frequently'. This is a hard guard, not a retry hint — do NOT loop fetch() over rows/ids or fire many parallel calls; batch into one endpoint call, or use _floot.runSQLQuery for bulk reads/writes. Runs in an ISOLATED temp dir, NOT the project root, with NO access to the project's environment: `process.env` carries none of the project's env vars or secrets (only PATH/HOME/NODE_ENV are set — anything like `process.env.POSTHOG_API_KEY` reads back `undefined`), and project source files are NOT importable by relative path (`import './helpers/foo'` fails with ERR_MODULE_NOT_FOUND — only npm dependencies resolve; contrast run_code_in_browser, which runs at the project root and CAN import project files). For anything that needs project secrets, env config, or DB access, use the `_floot` helpers below (they proxy to the project's server context) or fetch the project's /_api/* endpoints over the network — those run server-side WITH the full env; the VM snippet itself never sees it. A `_floot` global is available with project-scoped server-data helpers (no DB creds needed, no HTTP wiring): `await _floot.runSQLQuery({ query, resourceName?, reasonAndExplanationForNotReadOnly?, dryRun? })` (omit the reason for a read-only query; pass it to allow NON-DESTRUCTIVE writes — INSERT, CREATE TABLE, additive ALTER — e.g. programmatic seeding loops. DESTRUCTIVE statements — DELETE/UPDATE/TRUNCATE/DROP — are rejected here because the user never sees snippet SQL; run those through the execute_sql tool, where the statement appears in the tool call for approval. Resolves to `{rows, rowCount, command, truncated?}` — or `{results: [...]}` for multi-statement queries), `getHostingUsage({days?})`, `getLambdaUsage({days?})`, `getPushHistory({subscription?,from?,to?,offset?})`, `getProdBackendLogs({filter?,from?,to?,nextToken?,limit?})` (the PUBLISHED app's backend CloudWatch logs; details: get_guides('prod-backend-logs')), `storageList(prefix)` (prefix MUST start with "public/" or "private/" — e.g. storageList("public/") to list everything public), `storageGetUrl(key)`, `storageGetFileSizes(visibility, continuationToken?)`, `storageUpload({filename,sizeBytes,contentType})`, `storageDelete(key)`, and `getFileById(id)` (returns `{url, fileName, contentType}` — fetch the url for bytes). Same surface as runCodeInBrowser's `_floot`, minus the DOM/editor-only helpers.
    Connector
    Destructive
    OAuth

  • deploy_service_from_archiveA

    Google Cloud RunA

    Deploy a Cloud Run service directly from a self-contained source code archive (.tar.gz), skipping the container image build step for faster deployment. The archive must include all dependencies: - For compiled languages (Go, Java), include pre-compiled binaries. - For scripting languages (Python, Node.js), include pre-installed libraries (e.g., vendor/, node_modules/). Deployment steps: 1. Package source code and dependencies into a .tar.gz archive (max 250MiB). It's recommended to create archive from the root of the application's source directory. 2. Upload the archive to a Google Cloud Storage bucket, preferably in the same region as the service. 3. Deploy to Cloud Run using this tool, specifying: - source_code: Google Cloud Storage object path to the archive (e.g., gs://bucket/object). - command: Command to start the application. - base_image_uri: Base image for the container (e.g., go124, nodejs24, python314). See https://docs.cloud.google.com/run/docs/configuring/services/runtime-base-images for options. The runtime picked should match the local environment. - args: (Optional) Arguments for the command. - env: (Optional) Environment variables (e.g., name: `PYTHONPATH`, value: `./vendor`). - ports: (Optional) Container ports to expose (defaults to 8080).
    Connector
    Destructive
    No auth

  • deploy_service_from_file_contentsA

    Google Cloud RunA

    Deploys a Cloud Run service directly from local source files. This method is suitable for scripting languages like Python and Node.js, of which the source code can be embedded in the request. This is ideal for quick tests and development feedback loops. You must include all necessary dependencies within the source files because it skips the build step for faster deployment. **Key Requirements:** 1. source_code: Should set to sourceCode.inlinedSource.sources with array of source files, each having `filename` and `content`. 2. Size limit: you are subject to total request size limit of 50MiB.
    Connector
    Destructive
    No auth

  • npm_packageA

    LiveDataLinkB

    Look up an npm (Node.js) package: latest version, description, license, repository, last publish date, deprecation status, and last-month download count. Pair with cve_search_by_keyword to check for known vulnerabilities. Keyless.
    ConnectorNo auth

  • get_npm_packageA

    developer-tools-mcp-serverA

    Look up Node.js package information from NPM registry. Returns latest version, download statistics (weekly/monthly), dependency list, package description, license, and GitHub link. Use for evaluating JavaScript libraries, checking maintenance status, or reviewing package popularity.
    ConnectorNo auth

  • get_npm_packageA

    Developer Tools MCP ServerA

    Look up Node.js package information from NPM registry. Returns latest version, download statistics (weekly/monthly), dependency list, package description, license, and GitHub link. Use for evaluating JavaScript libraries, checking maintenance status, or reviewing package popularity.
    ConnectorNo auth