"Ruby on Rails" matching MCP tools:

• purl_auditA

  ZEN SecDBA

  Perform a software package vulnerability audit using SecDB. ## What this tool does Analyzes a list of software packages identified by PURL (Package URL) and returns vulnerability information plus a Markdown summary. The audit results are based exclusively on the package list provided. ## When to use this tool Use this tool when the user wants to determine: - whether application dependencies contain known vulnerabilities - whether a project is affected by security advisories - which packages require patching or upgrading ## Supported ecosystems - **npm** - Node.js packages (e.g. pkg:npm/lodash@4.17.21) - **maven** - Java/JVM packages (e.g. pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1) - **pypi** - Python packages (e.g. pkg:pypi/django@4.2.0) - **gem** - Ruby gems (e.g. pkg:gem/rails@7.0.0) - **cargo** - Rust crates (e.g. pkg:cargo/openssl-src@111.10) - **nuget** - .NET packages (e.g. pkg:nuget/Newtonsoft.Json@13.0.1) - **golang** - Go modules (e.g. pkg:golang/github.com/gin-gonic/gin@1.9.1) - **composer** - PHP packages (e.g. pkg:composer/symfony/symfony@6.4.0) ## Inputs - **purls**: list of Package URLs, one per entry. Generate them from your project manifest files: - Node.js: package.json / package-lock.json - Python: requirements.txt / Pipfile.lock / pyproject.toml - Ruby: Gemfile.lock - Go: go.mod / go.sum - Rust: Cargo.lock - PHP: composer.lock - Java: pom.xml / build.gradle - .NET: *.csproj / packages.lock.json ## Outputs - **report**: structured JSON objects describing the advisories affecting the audited packages. - **summary**: Markdown summary including total vulnerabilities, severity breakdown, and key findings. ## LLM usage guidelines - Never guess whether a package is vulnerable — always call this tool. - Only submit PURLs from the supported ecosystems listed above; others will be ignored. - The `summary` is already Markdown and can be shown directly. - Use `report` when deeper technical analysis is required.

  ConnectorNo auth

• verify_addressA

  PostAgent — Print and MailA

  Standalone paid address verification — no mail is sent. Checks whether an address is deliverable and returns the standardized form (US: CASS with ZIP+4; international: per-country matching). Costs a small flat USDC fee per call via x402 (a fraction of a cent vs. mailing). Two-step flow, like the mail rails: call WITHOUT `paymentSignature` to get the 402 challenge and `paymentUrl` (preferred: have the agent's x402 wallet pay `paymentUrl` in-band with the address as the JSON POST body `{"address":{...}}`); or sign the challenge and call again WITH `paymentSignature` to verify and get the result in one round trip. US addresses need line1 + (city+state or zip). International addresses need line1 + country. Note: when mailing through PostAgent you do NOT need this tool — create_mail_quote already verifies sender and recipient for free as part of the quote.

  ConnectorNo auth

• verify_addressA

  PostAgentA

  Standalone paid address verification — no mail is sent. Checks whether an address is deliverable and returns the standardized form (US: CASS with ZIP+4; international: per-country matching). Costs a small flat USDC fee per call via x402 (a fraction of a cent vs. mailing). Two-step flow, like the mail rails: call WITHOUT `paymentSignature` to get the 402 challenge and `paymentUrl` (preferred: have the agent's x402 wallet pay `paymentUrl` in-band with the address as the JSON POST body `{"address":{...}}`); or sign the challenge and call again WITH `paymentSignature` to verify and get the result in one round trip. US addresses need line1 + (city+state or zip). International addresses need line1 + country. Note: when mailing through PostAgent you do NOT need this tool — create_mail_quote already verifies sender and recipient for free as part of the quote.

  ConnectorNo auth

• api_executeA

  CrevioA

  Execute Ruby in a sandboxed VM against the Crevio REST API. Use `api_search` first to find the endpoint and its body fields, then call it here. Chain calls, transform results, return the final expression. ## Available in your code ``` get(path, params = {}) # paths auto-prefixed with /v1, routed in-process post(path, **body) # body as keyword args or a hash — both work patch(path, **body) delete(path) find_endpoints(query) # -> ["METHOD /path — summary", ...] iso8601(offset_seconds = 0) # mruby Time has no strftime/iso8601 ``` Returns the **last expression**; `puts` is side-channel only. Every run answers `{result:, calls:, output:}` — `calls` audits each REST call (`method`, `path`, `status`, plus `error_code`/`param` on failure). When `result` has unexpected nils, read `calls` for a non-2xx. Never project only success fields (`{id: r["id"]}`) — that hides the error from `result`. ## Rules that the schema does not tell you - Params are unwrapped, Stripe-style: fields at the TOP level. `{product: {...}}` is silently dropped by most endpoints. - Associations take the bare resource name and a prefix_id string — `product: "prod_x"`, never `product_id:`. Some required ones never appear in a schema's `properties`. - Courses and content live under `/experiences`, NOT `/products`. - Lists answer `{object: "list", data: [...], has_more}`; single resources answer the object directly. - Connected integrations go through the same REST surface: `post("/connections/<id>/execute", tool: "<tool>", arguments: {...})`, with ids from `get("/connections", search: "<service>")`. - Sandboxed mruby: no `File`, `ENV`, `Net::HTTP`, `Process`. 10s, 10 MB. ## Example — publishing a product (the ordering trap) A product cannot be created active: it needs a price variant first, or the call 422s. ```ruby product = post("/products", name: "...") post("/price_variants", product: product["id"], name: "Standard", amount_type: "fixed", amount: 4900, currency: "usd", billing_type: "one_time") patch("/products/#{product["id"]}", status: "active") ``` API groups: Access, Account, Ads, Analytics, ApiKeys, Approvals, Audio, BlogCategories, BlogPosts, Bookings, Bots, Broadcasts, Calls, Chapters, CheckoutConfiguration, CheckoutLinks, Checkouts, Connections, Customers, Deployments, Discounts, Domains, Email, Email Suppressions, EventSessions, EventSources, EventTypes, Events, Experiences, Files, FormSubmissions, FormationDocuments, Formations, Forms, ForumPosts, Images, Invoices, Jobs, Leads, LegalPages, Lessons, LinkItems, Logs, Me, OrderItems, Orders, Phone Consents, Phone Numbers, Phone Suppressions, PriceVariants, Products, Refunds, Reviews, Schedules, Secrets, Sites, Skills, Socials, Status, Subscriptions, Tags, TaskRuns, Tasks, Topics, Usage, Users, Video, Web, WebhookEndpoints, WebhookEvents.

  Connector

  Destructive

  No auth

• get_payment_statusA

  dns-of-moneyA

  Check whether a payment you already attempted was recorded, BEFORE you retry and risk spending twice. Pass the request_key you sent as the Idempotency-Key header on the paid request. Returns state 'settled' (we hold a receipt — do NOT pay again) or 'not_found' (we have no record — retrying is safe). Use this when a paid call timed out or its response was lost: on rails where the facilitator broadcasts, you never learn the transaction hash unless our response reaches you, so this key is the only thing that can answer. The key is a bearer secret — whoever presents it gets the receipt.

  ConnectorNo auth

• robyn_capability_snapshotA

  Robyn — Gasless Cross-Chain for AI AgentsA

  A signed, timestamped record of current capability: which chains can actually be PAID OUT ON right now, which are merely policy-eligible, which rails are execute-ready, and whether delivery figures are measured or estimated. USE `serviceableNow`, NOT `policyEligible`, when deciding where to send funds — a chain can be eligible by policy while holding no inventory, in which case the instant lane is unavailable and the transfer falls through to a bridge rail. `notServiceable` lists the difference. Fetch this BEFORE committing to a multi-step plan and keep it with your decision: if the plan later fails you can show what you were told. It is a RECORD, not a guarantee — it does not promise the same capability a minute later, and the signature does not make it an SLA.

  ConnectorNo auth

• create_projectA

  KeelenA

  Start building something new: creates a GitHub repo and begins work on it. Use this ONLY when the user wants a NEW repo scaffolded. If they already have a repo, use import_project(repo_full_name) instead — this tool would create a second, empty one beside theirs (list_github_repos() browses what the workspace can see). Scaffolds a new GitHub repo, a bootstrap-mode project, and submits `build_description` as the project's first Roadmap Request. `name` is a concise GitHub short repo slug (no owner); `project_kind` is REQUIRED and one of library | node_library | python_library | service | cli | web_app | godot_game | roblox_game; `preview_command` is required iff `project_kind == 'web_app'`. `engine` is OPTIONAL — one of claude_code | codex | glm | kimi | grok (defaults to claude_code); codex, glm, kimi, and grok require the workspace to have a matching connected credential. `org` is OPTIONAL — a GitHub organization login to create the repo inside (e.g. your company org); omit it to land the repo on a member's personal account. `private` defaults to True. `ci_runs_on` is OPTIONAL — the CI runner labels for the scaffolded workflow, e.g. ["self-hosted", "linux", "x64", "my-fleet"]. Omit it to inherit the workspace default (ubuntu-latest if unset). Labels no registered org runner carries are rejected, because GitHub would queue such a job forever rather than fail it. `framework` is OPTIONAL and `web_app`-only — one of vite | next (defaults to vite). It picks the scaffolded frontend rails: `vite` a vanilla-TypeScript SPA, `next` a Next.js app-router app. Passing it with any other `project_kind` is an error. The repo is created on the GitHub account of a workspace member with repo-create OAuth access (this path has no specific caller user), so the returned `repo` owner is whichever member's token resolved (or the chosen `org`). If no member has repo-create access — or the resolving member can't create in `org` — the call returns an actionable error. Returns {project_id, repo, thread_id, next_action, poll_after_seconds, next_step}; follow next_step (poll get_request_status with the returned thread_id). On the rare arm where the first Request failed to submit, next_action is "call_tool" with next_tool="submit_request".

  ConnectorNo auth

• api_executeA

  CrevioA

  Execute Ruby in a sandboxed VM against the Crevio REST API. Use `api_search` first to find the endpoint and its body fields, then call it here. Chain calls, transform results, return the final expression. ## Available in your code ``` get(path, params = {}) # paths auto-prefixed with /v1, routed in-process post(path, **body) # body as keyword args or a hash — both work patch(path, **body) delete(path) find_endpoints(query) # -> ["METHOD /path — summary", ...] iso8601(offset_seconds = 0) # mruby Time has no strftime/iso8601 ``` Returns the **last expression**; `puts` is side-channel only. Every run answers `{result:, calls:, output:}` — `calls` audits each REST call (`method`, `path`, `status`, plus `error_code`/`param` on failure). When `result` has unexpected nils, read `calls` for a non-2xx. Never project only success fields (`{id: r["id"]}`) — that hides the error from `result`. ## Rules that the schema does not tell you - Params are unwrapped, Stripe-style: fields at the TOP level. `{product: {...}}` is silently dropped by most endpoints. - Associations take the bare resource name and a prefix_id string — `product: "prod_x"`, never `product_id:`. Some required ones never appear in a schema's `properties`. - Courses and content live under `/experiences`, NOT `/products`. - Lists answer `{object: "list", data: [...], has_more}`; single resources answer the object directly. - Connected integrations go through the same REST surface: `post("/connections/<id>/execute", tool: "<tool>", arguments: {...})`, with ids from `get("/connections", search: "<service>")`. - Sandboxed mruby: no `File`, `ENV`, `Net::HTTP`, `Process`. 10s, 10 MB. ## Example — publishing a product (the ordering trap) A product cannot be created active: it needs a price variant first, or the call 422s. ```ruby product = post("/products", name: "...") post("/price_variants", product: product["id"], name: "Standard", amount_type: "fixed", amount: 4900, currency: "usd", billing_type: "one_time") patch("/products/#{product["id"]}", status: "active") ``` API groups: Access, Account, Ads, Analytics, ApiKeys, Approvals, Audio, BlogCategories, BlogPosts, Bookings, Bots, Broadcasts, Calls, Chapters, CheckoutConfiguration, CheckoutLinks, Checkouts, Connections, Customers, Deployments, Discounts, Domains, Email, Email Suppressions, EventSessions, EventSources, EventTypes, Events, Experiences, Files, FormSubmissions, FormationDocuments, Formations, Forms, ForumPosts, Images, Invoices, Jobs, Leads, LegalPages, Lessons, LinkItems, Logs, Me, OrderItems, Orders, Phone Consents, Phone Numbers, Phone Suppressions, PriceVariants, Products, Refunds, Reviews, Schedules, Secrets, Sites, Skills, Socials, Status, Subscriptions, Tags, TaskRuns, Tasks, Topics, Usage, Users, Video, Web, WebhookEndpoints, WebhookEvents.

  Connector

  Destructive

  No auth

• find_opportunitiesA

  Voyscout Price HistoryA

  Rank every published rail by how its LAST measurement compares with its own tracked history, so a caller can ask 'where is it unusually cheap right now?' in one call instead of one call per destination. Percentages are over observed days, not the calendar span. Descriptive only: it ranks observations and gives no verdict. Rails with too little history are returned under `excluded`, never dropped silently.

  ConnectorNo auth

• install_appA

  BorealHostA

  Install an app template on a VPS/Cloud site. Starts a background installation. Poll get_app_status() for progress. Requires: API key with write scope. VPS or Cloud plan only. Args: slug: Site identifier template: App template slug. Available: django, laravel, nextjs, nodejs, nuxtjs, rails, static app_name: Short name for the app (2-50 chars, lowercase alphanumeric + hyphens). Used as subdomain: {app_name}.{site_domain} db_type: Database type. "none", "mysql", or "postgresql" (depends on template) domain: Custom domain override (default: {app_name}.{site_domain}) display_name: Human-friendly name (default: derived from app_name) Returns: {"id": "uuid", "app_name": "myapp", "status": "installing", "message": "Installation started. Poll for progress."} Errors: FORBIDDEN: Plan does not support apps (shared plans) VALIDATION_ERROR: Invalid template, app_name, or duplicate name

  ConnectorNo auth

• agent_createA

  Conduit Agentic CommerceA

  Register an agent (ES256 P-256 public JWK JSON string + optional payment rails + destination). BEFORE: list ~/.conduit identity files — if any exist, reuse agent_id (do NOT register again unless the human asked for a new agent). AFTER: write persist.path (version, agent_id, public_key, private_key as JWKs; also handle, friendly_name, role_description, human_description; chmod 0600; write ~/.conduit/active). Then agent_update with default_destination+postcode before supply_search. Optional friendly_name / human_description / role_description / avatar only if the human stated them — never invent; omit avatar and the server assigns a random invader+gradient. Omit handle to auto-generate (e.g. parcel-watcher-12).

  ConnectorNo auth

• mercury.sendA

  DPX — Institutional Cross-Border SettlementA

  Initiate a Mercury bank payment from a connected account. Supports all Mercury payment rails: ACH (0–1 days), Wire (0–1 days), Real-Time Payment / RTP (instant), International Wire (1–3 days), and Check (7–10 days). For International Wire — the primary DPX cross-border use case — provide SWIFT/BIC code and beneficiary bank details. DPX oracle conditions and FX corridor risk should be checked via oracle.stability and market.fx before executing. Can optionally tag the payment for automatic DPX on-chain routing — when dpxRoute:true is set, the payment memo includes the DPX executor wallet address and the Mercury webhook picks it up for USDC settlement on Base mainnet. Use sandbox:true (default) for dry-run testing. Set sandbox:false only when ready to move real funds. Typical cross-border flow: 1. market.fx → check FX corridor risk for the destination currency 2. mercury.accounts → get source accountId 3. mercury.send (sandbox:true) → confirm payment parameters 4. settlement.quote → get DPX fee quote for the USDC leg 5. mercury.send (sandbox:false) → execute (requires explicit user confirmation) 6. mercury.transactions → verify payment posted

  Connector

  Destructive

  No auth

• get_aboutA

  Follow On ToursA

  Get information about Follow On Tours — who we are, what we sell (bespoke cricket and golf travel), our experience, our financial protection, and how the service works. Use this when someone asks who Follow On Tours is, whether they cover a sport or destination, or how the service operates.

  ConnectorNo auth

• check_injectionA

  ContrastAPIA

  Scan source code for injection vulnerabilities: SQL injection, command injection, path traversal via unsafe string concatenation/unsanitized input. Supports Python, JavaScript, TypeScript, Java, Go, Ruby, Shell, Bash. Use to detect input-handling bugs; for secrets use check_secrets. Companion code-security tools: check_secrets (hard-coded credential detection), check_dependencies (known-CVE vulnerability audit), check_headers (live HTTP security-header validation), scan_headers (live HTTP scan via domain). Free: 30/hr, Pro: 500/hr. Returns {total, by_severity, findings}. No data stored.

  ConnectorNo auth

• mercury.sendA

  DPX — Institutional Cross-Border SettlementA

  Initiate a Mercury bank payment from a connected account. Supports all Mercury payment rails: ACH (0–1 days), Wire (0–1 days), Real-Time Payment / RTP (instant), International Wire (1–3 days), and Check (7–10 days). For International Wire — the primary DPX cross-border use case — provide SWIFT/BIC code and beneficiary bank details. DPX oracle conditions and FX corridor risk should be checked via oracle.stability and market.fx before executing. Can optionally tag the payment for automatic DPX on-chain routing — when dpxRoute:true is set, the payment memo includes the DPX executor wallet address and the Mercury webhook picks it up for USDC settlement on Base mainnet. Use sandbox:true (default) for dry-run testing. Set sandbox:false only when ready to move real funds. Typical cross-border flow: 1. market.fx → check FX corridor risk for the destination currency 2. mercury.accounts → get source accountId 3. mercury.send (sandbox:true) → confirm payment parameters 4. settlement.quote → get DPX fee quote for the USDC leg 5. mercury.send (sandbox:false) → execute (requires explicit user confirmation) 6. mercury.transactions → verify payment posted

  Connector

  Destructive

  No auth

• generate_memeA

  MemeStackA

  Generate a new image from a text prompt using AI (Grok Imagine). Paid tool — billed per call via the agent payment rails (x402/L402); not covered by any free quota. Generation runs asynchronously on the server and this call polls until it completes, up to ~90 seconds. If you get a "still running" error, call the tool again with the SAME payment proof to resume polling — you will never be charged twice for one payment. Note for x402 clients: "quality" mode (~$0.15) exceeds the agents-SDK default per-call cap of $0.10 — raise maxPaymentValue in withX402Client to use it.

  ConnectorNo auth

• check_fullmaktA

  ApierA

  Check your fullmakt state for a Norwegian company BEFORE acting on its behalf — the read leg of the Fullmakt Rails. Per agent principal of yours holding a live delegation there it returns: the bound system_user_id, whether the delegation is `active` or still `pending` signaturrett approval, the scopes carried, and the scopes still missing. `overall_status`: `full` (act now), `partial` (`fix_steps` names the blocker), or `none` — a VALID answer, not an error: 200 with empty `principals[]`, never a 404. Reports the delegation state Apier RECORDED, not a live Altinn PDP decision. Input: { org_number } (plain 9 digits). Failure modes: SCOPE_INSUFFICIENT (needs read:altinn), VALIDATION_FAILED. To BROKER a fullmakt use request_fullmakt; to withdraw one use revoke_fullmakt; the CONSUMER-level snapshot is check_authorization. No sandbox mirror — a sandbox bearer gets SANDBOX_TOOL_UNAVAILABLE. Docs: https://www.apier.no/docs/fullmakt

  ConnectorNo auth

• what_is_wiremiA

  Wiremi Marketing MCPA

  What Wiremi is and is not, plus its regulatory registrations. Honest about being ROSCA-first (not primarily remittance), not reporting to bureaus yet, and not operating US payment rails. No personal data.

  ConnectorNo auth

• where_wiremi_operatesA

  Wiremi Marketing MCPA

  Where Wiremi operates. Lists the seven live African funding corridors, states clearly that CAD and US funding rails are NOT live yet (estimated Q3 2026), and notes North American users can download and subscribe but cannot yet fund a wallet or send money. No personal data.

  ConnectorNo auth

• baas_provider_comparatorA

  AINumbers Fintech Intelligence SuiteC

  Score and compare BaaS providers across 10 capability dimensions (regulatory standing, programme management, card issuance, rails, KYC/KYB, disputes, developer experience, pricing, FDIC pass-through, compliance tooling) with a user-adjustable 1-5 weighting matrix. Outputs a weighted comparison matrix and Markdown evaluation memo. Browser-based, client-side only, zero PII. Renders the interactive AINumbers tool as a widget; inputs are applied via the AIN Bridge and the tool runs client-side (zero PII, zero network).

  ConnectorNo auth

• ifsc_lookupA

  Ifsc InA

  Indian bank branch lookup by IFSC code. Resolves an 11-character IFSC code (printed on Indian cheques and bank statements) to the bank name, branch, address, city, district, state, MICR code, SWIFT code, and contact number, plus whether the branch supports the NEFT, RTGS, UPI, and IMPS payment rails. India banking / fund-transfer routing data via the open Razorpay IFSC dataset (keyless). Also returns an offline format_valid check of the code structure. NOTE: this validates and resolves the IFSC code itself — it does NOT verify a bank account or account holder. Examples: ifsc_lookup({ ifsc: "HDFC0CAGSBK" }), ifsc_lookup({ ifsc: "sbin0000691" }) (case and spaces are forgiven).

  ConnectorNo auth