"Ruby" matching MCP tools:

• purl_auditA

  ZEN SecDBA

  Perform a software package vulnerability audit using SecDB. ## What this tool does Analyzes a list of software packages identified by PURL (Package URL) and returns vulnerability information plus a Markdown summary. The audit results are based exclusively on the package list provided. ## When to use this tool Use this tool when the user wants to determine: - whether application dependencies contain known vulnerabilities - whether a project is affected by security advisories - which packages require patching or upgrading ## Supported ecosystems - **npm** - Node.js packages (e.g. pkg:npm/lodash@4.17.21) - **maven** - Java/JVM packages (e.g. pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1) - **pypi** - Python packages (e.g. pkg:pypi/django@4.2.0) - **gem** - Ruby gems (e.g. pkg:gem/rails@7.0.0) - **cargo** - Rust crates (e.g. pkg:cargo/openssl-src@111.10) - **nuget** - .NET packages (e.g. pkg:nuget/Newtonsoft.Json@13.0.1) - **golang** - Go modules (e.g. pkg:golang/github.com/gin-gonic/gin@1.9.1) - **composer** - PHP packages (e.g. pkg:composer/symfony/symfony@6.4.0) ## Inputs - **purls**: list of Package URLs, one per entry. Generate them from your project manifest files: - Node.js: package.json / package-lock.json - Python: requirements.txt / Pipfile.lock / pyproject.toml - Ruby: Gemfile.lock - Go: go.mod / go.sum - Rust: Cargo.lock - PHP: composer.lock - Java: pom.xml / build.gradle - .NET: *.csproj / packages.lock.json ## Outputs - **report**: structured JSON objects describing the advisories affecting the audited packages. - **summary**: Markdown summary including total vulnerabilities, severity breakdown, and key findings. ## LLM usage guidelines - Never guess whether a package is vulnerable — always call this tool. - Only submit PURLs from the supported ecosystems listed above; others will be ignored. - The `summary` is already Markdown and can be shown directly. - Use `report` when deeper technical analysis is required.

  ConnectorNo auth

• api_executeA

  CrevioA

  Execute Ruby in a sandboxed VM against the Crevio REST API. Use `api_search` first to find the endpoint and its body fields, then call it here. Chain calls, transform results, return the final expression. ## Available in your code ``` get(path, params = {}) # paths auto-prefixed with /v1, routed in-process post(path, **body) # body as keyword args or a hash — both work patch(path, **body) delete(path) find_endpoints(query) # -> ["METHOD /path — summary", ...] iso8601(offset_seconds = 0) # mruby Time has no strftime/iso8601 ``` Returns the **last expression**; `puts` is side-channel only. Every run answers `{result:, calls:, output:}` — `calls` audits each REST call (`method`, `path`, `status`, plus `error_code`/`param` on failure). When `result` has unexpected nils, read `calls` for a non-2xx. Never project only success fields (`{id: r["id"]}`) — that hides the error from `result`. ## Rules that the schema does not tell you - Params are unwrapped, Stripe-style: fields at the TOP level. `{product: {...}}` is silently dropped by most endpoints. - Associations take the bare resource name and a prefix_id string — `product: "prod_x"`, never `product_id:`. Some required ones never appear in a schema's `properties`. - Courses and content live under `/experiences`, NOT `/products`. - Lists answer `{object: "list", data: [...], has_more}`; single resources answer the object directly. - Connected integrations go through the same REST surface: `post("/connections/<id>/execute", tool: "<tool>", arguments: {...})`, with ids from `get("/connections", search: "<service>")`. - Sandboxed mruby: no `File`, `ENV`, `Net::HTTP`, `Process`. 10s, 10 MB. ## Example — publishing a product (the ordering trap) A product cannot be created active: it needs a price variant first, or the call 422s. ```ruby product = post("/products", name: "...") post("/price_variants", product: product["id"], name: "Standard", amount_type: "fixed", amount: 4900, currency: "usd", billing_type: "one_time") patch("/products/#{product["id"]}", status: "active") ``` API groups: Access, Account, Ads, Analytics, ApiKeys, Approvals, Audio, BlogCategories, BlogPosts, Bookings, Bots, Broadcasts, Calls, Chapters, CheckoutConfiguration, CheckoutLinks, Checkouts, Connections, Customers, Deployments, Discounts, Domains, Email, Email Suppressions, EventSessions, EventSources, EventTypes, Events, Experiences, Files, FormSubmissions, FormationDocuments, Formations, Forms, ForumPosts, Images, Invoices, Jobs, Leads, LegalPages, Lessons, LinkItems, Logs, Me, OrderItems, Orders, Phone Consents, Phone Numbers, Phone Suppressions, PriceVariants, Products, Refunds, Reviews, Schedules, Secrets, Sites, Skills, Socials, Status, Subscriptions, Tags, TaskRuns, Tasks, Topics, Usage, Users, Video, Web, WebhookEndpoints, WebhookEvents.

  Connector

  Destructive

  No auth

• api_executeA

  CrevioA

  Execute Ruby in a sandboxed VM against the Crevio REST API. Use `api_search` first to find the endpoint and its body fields, then call it here. Chain calls, transform results, return the final expression. ## Available in your code ``` get(path, params = {}) # paths auto-prefixed with /v1, routed in-process post(path, **body) # body as keyword args or a hash — both work patch(path, **body) delete(path) find_endpoints(query) # -> ["METHOD /path — summary", ...] iso8601(offset_seconds = 0) # mruby Time has no strftime/iso8601 ``` Returns the **last expression**; `puts` is side-channel only. Every run answers `{result:, calls:, output:}` — `calls` audits each REST call (`method`, `path`, `status`, plus `error_code`/`param` on failure). When `result` has unexpected nils, read `calls` for a non-2xx. Never project only success fields (`{id: r["id"]}`) — that hides the error from `result`. ## Rules that the schema does not tell you - Params are unwrapped, Stripe-style: fields at the TOP level. `{product: {...}}` is silently dropped by most endpoints. - Associations take the bare resource name and a prefix_id string — `product: "prod_x"`, never `product_id:`. Some required ones never appear in a schema's `properties`. - Courses and content live under `/experiences`, NOT `/products`. - Lists answer `{object: "list", data: [...], has_more}`; single resources answer the object directly. - Connected integrations go through the same REST surface: `post("/connections/<id>/execute", tool: "<tool>", arguments: {...})`, with ids from `get("/connections", search: "<service>")`. - Sandboxed mruby: no `File`, `ENV`, `Net::HTTP`, `Process`. 10s, 10 MB. ## Example — publishing a product (the ordering trap) A product cannot be created active: it needs a price variant first, or the call 422s. ```ruby product = post("/products", name: "...") post("/price_variants", product: product["id"], name: "Standard", amount_type: "fixed", amount: 4900, currency: "usd", billing_type: "one_time") patch("/products/#{product["id"]}", status: "active") ``` API groups: Access, Account, Ads, Analytics, ApiKeys, Approvals, Audio, BlogCategories, BlogPosts, Bookings, Bots, Broadcasts, Calls, Chapters, CheckoutConfiguration, CheckoutLinks, Checkouts, Connections, Customers, Deployments, Discounts, Domains, Email, Email Suppressions, EventSessions, EventSources, EventTypes, Events, Experiences, Files, FormSubmissions, FormationDocuments, Formations, Forms, ForumPosts, Images, Invoices, Jobs, Leads, LegalPages, Lessons, LinkItems, Logs, Me, OrderItems, Orders, Phone Consents, Phone Numbers, Phone Suppressions, PriceVariants, Products, Refunds, Reviews, Schedules, Secrets, Sites, Skills, Socials, Status, Subscriptions, Tags, TaskRuns, Tasks, Topics, Usage, Users, Video, Web, WebhookEndpoints, WebhookEvents.

  Connector

  Destructive

  No auth

• check_injectionA

  ContrastAPIA

  Scan source code for injection vulnerabilities: SQL injection, command injection, path traversal via unsafe string concatenation/unsanitized input. Supports Python, JavaScript, TypeScript, Java, Go, Ruby, Shell, Bash. Use to detect input-handling bugs; for secrets use check_secrets. Companion code-security tools: check_secrets (hard-coded credential detection), check_dependencies (known-CVE vulnerability audit), check_headers (live HTTP security-header validation), scan_headers (live HTTP scan via domain). Free: 30/hr, Pro: 500/hr. Returns {total, by_severity, findings}. No data stored.

  ConnectorNo auth

• check_secretsA

  ContrastAPIA

  Scan source code (or snippet) for hardcoded secrets — cloud provider keys, API tokens, connection strings, private keys, passwords. Supports Python, JavaScript, TypeScript, Java, Go, Ruby, Shell, Bash. Use to detect leaked credentials before commit; for injection detection use check_injection. Free: 30/hr, Pro: 500/hr. Returns {total, by_severity, findings}. No data stored. The generic password-assignment rule is suppressed when a more-specific credential rule fires on the same line — one targeted finding per leaked secret, not two.

  ConnectorNo auth

• dependency_vulnerability_scanA

  gapup-mcpC

  SCA (Software Composition Analysis) — scans a project dependency manifest and returns known vulnerabilities for each dependency. Supports: package.json (npm), requirements.txt (Python), go.mod (Go), Cargo.toml (Rust), composer.json (PHP), Gemfile.lock (Ruby), CycloneDX SBOM JSON. PRIMARY source: OSV.dev (keyless, free, covers npm/PyPI/Go/crates.io/Packagist/RubyGems + GHSA advisories federated). CVSS enrichment: NVD NIST (when OSV lacks score). Exploitation flag: CISA KEV (known-exploited-vulnerabilities catalog). Returns per-vuln CVE/GHSA IDs, severity, CVSS score, fixed version, and actionable upgrade recommendations. Relevant for EU NIS2 supply chain risk obligations, DORA, SOC 2 vendor assessments. Cache TTL 6h. Parallel OSV queries (concurrency=10). SLA <=30s p95.

  ConnectorNo auth

• get_dependenciesA

  RubygemsB

  Get the runtime and development dependencies for a specific version of a Ruby gem. Returns each dependency with its version requirement string. Omit version to get the latest.

  ConnectorNo auth

• get_answering_service_pricingA

  FitMyCall — Answering Service PricesA

  Get current, human-verified pricing for a specific answering service, virtual receptionist or AI receptionist (e.g. Smith.ai, Ruby, Dialzara, Abby Connect, AnswerConnect). Returns every plan with monthly price, included minutes, setup fees, overage rates, free trial, plus the date the pricing was last verified on the vendor’s own site. Use when someone asks "how much does X cost", "X pricing", "is X worth it", or asks for alternatives to a named service. Covers 21 services, updated weekly.

  ConnectorNo auth

• dependency_vulnerability_scanA

  gapup-mcpC

  SCA (Software Composition Analysis) — scans a project dependency manifest and returns known vulnerabilities for each dependency. Supports: package.json (npm), requirements.txt (Python), go.mod (Go), Cargo.toml (Rust), composer.json (PHP), Gemfile.lock (Ruby), CycloneDX SBOM JSON. PRIMARY source: OSV.dev (keyless, free, covers npm/PyPI/Go/crates.io/Packagist/RubyGems + GHSA advisories federated). CVSS enrichment: NVD NIST (when OSV lacks score). Exploitation flag: CISA KEV (known-exploited-vulnerabilities catalog). Returns per-vuln CVE/GHSA IDs, severity, CVSS score, fixed version, and actionable upgrade recommendations. Relevant for EU NIS2 supply chain risk obligations, DORA, SOC 2 vendor assessments. Cache TTL 6h. Parallel OSV queries (concurrency=10). SLA <=30s p95.

  ConnectorNo auth

• get_gemA

  RubygemsB

  Get full metadata for a published Ruby gem by name. Returns latest version, authors, license, descriptions, download counts, and project/source URLs. Use for "what is gem X?", "tell me about Ruby gem Y", or before calling get_versions/get_dependencies.

  ConnectorNo auth

• get_field_typesA

  QuintaDBB

  Повний довідник типів полів QuintaDB з описами параметрів. Виклич перед create_field якщо потрібна формула, linked_column, rel, або будь-який нестандартний тип. Повертає всі 40+ типів та детальну специфікацію формул з правилами Ruby-скриптів і прикладами.

  ConnectorNo auth

• dependency_auditA

  AgentAegisA

  Audit a dependency manifest or https git repo for known-vulnerable packages (trivy): npm, pip, Go, Ruby, Java, Cargo. The cheapest, highest-signal first step when assessing an unfamiliar repository. Costs $2 per call.

  ConnectorNo auth

• get_field_typesA

  QuintaDBC

  Повний довідник типів полів QuintaDB з описами параметрів. Виклич перед create_field якщо потрібна формула, linked_column, rel, або будь-який нестандартний тип. Повертає всі 40+ типів та детальну специфікацію формул з правилами Ruby-скриптів і прикладами.

  ConnectorNo auth

• get_versionsA

  RubygemsB

  Get full version history for a Ruby gem. Returns every published version with release date, download count, Ruby version compatibility, and licenses. Use for "what versions of X exist?" or "when did Y release version Z?".

  ConnectorNo auth

• get_field_typesA

  QuintaDBB

  Повний довідник типів полів QuintaDB з описами параметрів. Виклич перед create_field якщо потрібна формула, linked_column, rel, або будь-який нестандартний тип. Повертає всі 40+ типів та детальну специфікацію формул з правилами Ruby-скриптів і прикладами.

  ConnectorNo auth

• import_projectA

  KeelenA

  Connect an EXISTING GitHub repo as a Keelen project. This is the counterpart of create_project: use THIS tool when the user already has a repo, and create_project only to scaffold a brand-new one. `repo_full_name` is "owner/repo" — it MUST be visible to the workspace's GitHub connection (list_github_repos() to browse; a non-visible repo 404s). `engine` is OPTIONAL — one of claude_code | codex | glm | kimi | grok (defaults to claude_code); codex/glm/kimi/grok require a matching connected credential. `build_description` is OPTIONAL but STRONGLY recommended — a plain-language "what should Keelen build first?" submitted as the project's first Request so the loop has work; an imported project with no Request sits idle until you call submit_request(project_id, ...). `project_kind` is OPTIONAL — one of library | node_library | python_library | service | cli | web_app | godot_game | roblox_game | unknown. Omit it and the kind is auto-detected. PASS IT when the repo is a MONOREPO (apps in subdirectories), a stack with no standard root manifest (Java, Ruby, PHP, .NET, Elixir), or when you want a classification detection cannot infer — in those cases detection yields "unknown", which BLOCKS the dev lane until someone overrides it. A value you pass is authoritative and is never overwritten by later auto-detection. `stack` is the OPTIONAL language axis (python | node | rust | go | cpp) for a language-agnostic kind. `preview_command` is REQUIRED when project_kind is "web_app" (the command that serves the app locally, e.g. "npm run dev") and optional otherwise, where it overrides the detected one. Re-importing the same repo is idempotent (returns the existing project with already_exists=True). On a plan with no scheduled-project allowance the project is still created but with the loop OFF — next_step then steers to get_billing(). Otherwise follow next_step and poll get_provisioning_status(project_id).

  ConnectorNo auth

• count_code_linesA

  IA-QA — 130+ QA & Dev Tools for AI AgentsA

  Count lines of code: total, code lines, comment lines, blank lines, and comment density. Supports JS/TS, Python, Java/C/C++, Ruby, Go, Shell, HTML/XML, and CSS.

  ConnectorNo auth

• sast_scanA

  AgentAegisA

  Static analysis of source code or an https git repo for security flaws (Semgrep): injection, unsafe deserialization, path traversal, crypto misuse. Python, JS/TS, Java, Go, Ruby, PHP, C/C++. For code LOGIC flaws — use secret_scan for hardcoded credentials and dependency_audit for vulnerable packages. Costs $5 per call.

  ConnectorNo auth

• lookup_rubygemA

  GoCreative Agent APIB

  Get RubyGems package metadata (version, downloads, repo). Use for Ruby-dependency research. Example call: {"pkg": "rails"} Cost: $0.005–$0.05 USDC on Base per call.

  ConnectorNo auth

• dependency_vulnerability_scanA

  mcp-knowledgeC

  SCA (Software Composition Analysis) — scans a project dependency manifest and returns known vulnerabilities for each dependency. Supports: package.json (npm), requirements.txt (Python), go.mod (Go), Cargo.toml (Rust), composer.json (PHP), Gemfile.lock (Ruby), CycloneDX SBOM JSON. PRIMARY source: OSV.dev (keyless, free, covers npm/PyPI/Go/crates.io/Packagist/RubyGems + GHSA advisories federated). CVSS enrichment: NVD NIST (when OSV lacks score). Exploitation flag: CISA KEV (known-exploited-vulnerabilities catalog). Returns per-vuln CVE/GHSA IDs, severity, CVSS score, fixed version, and actionable upgrade recommendations. Relevant for EU NIS2 supply chain risk obligations, DORA, SOC 2 vendor assessments. Cache TTL 6h. Parallel OSV queries (concurrency=10). SLA <=30s p95.

  ConnectorNo auth

• microsoft_code_sample_searchA

  Microsoft Learn MCPA

  Search for code snippets and examples in official Microsoft Learn documentation. This tool retrieves relevant code samples from Microsoft documentation pages providing developers with practical implementation examples and best practices for Microsoft/Azure products and services related coding tasks. This tool will help you use the **LATEST OFFICIAL** code snippets to empower coding capabilities. ## When to Use This Tool - When you are going to provide sample Microsoft/Azure related code snippets in your answers. - When you are **generating any Microsoft/Azure related code**. ## Usage Pattern Input a descriptive query, or SDK/class/method name to retrieve related code samples. The optional parameter `language` can help to filter results. Eligible values for `language` parameter include: csharp javascript typescript python powershell azurecli al sql java kusto cpp go rust ruby php

  ConnectorNo auth