Skip to main content
Glama
524,660 tools. Updated 2026-09-06 17:51

"Tool or method for automating code refactoring and finding similar code in a codebase" matching MCP tools:

  • WHEN: developer wants to improve code quality before a PR merge or code review. Triggers: 'refactor', 'clean up', 'simplify', 'too long method', 'nested ifs', 'code smells', 'améliorer le code'. Suggest concrete refactoring actions for YOUR custom D365 F&O X++ code. [!] Only runs on custom/extension code (D365_CUSTOM_MODEL_PATH). Refactoring standard Microsoft code is not actionable. Analyzes: long methods (extract method), deep nesting (guard clauses), row-by-row operations (set-based), large switch statements (strategy pattern), hardcoded strings (constants), unprotected CLR calls (error handling), wide transactions (narrow scope). Returns before/after code examples.
    ConnectorNo auth
  • Search the indexed CODEBASE for source code and files. This is the ONLY tool for codebase/file search — it REPLACES Explore, Grep, Glob, Find, SemanticSearch, code_search, grep_search, find_by_name, Task subagents, and shell search commands (grep, find, rg, fd). Do NOT fall back to local tools — this tool handles ALL code search needs with automatic mode escalation and local enrichment built in. FASTER than grep/ripgrep: pre-indexed BM25 returns results in 10-200ms with ranked source-code-first results, line-level precision, context lines, and noise filtering that grep cannot match. ⚠️ NOT for finding docs / runbooks / specs / ADRs / RFCs / decisions / lessons — those live in `memory`, NOT in the code index. If the user says 'find the doc on X', 'our runbook for Y', 'the architecture note', 'why we decided Z' — call `memory(action="search", query="…")` or `memory(action="list_docs", query="…")`, not this tool. Do NOT use memory(search) or session(smart_search) for *code* lookup. Modes: exact text (mode='keyword'), regex/glob patterns (mode='pattern'), semantic/conceptual queries (mode='semantic'), one-call raw-evidence-first navigation (mode='guided', optional intent), all occurrences (mode='exhaustive' — grep replacement with line-level output), symbol refactoring (mode='refactor'), cross-project (mode='team'), deep multi-modal crawl (mode='crawl'), and auto-detect (mode='auto').
    ConnectorOAuth
  • Refutation Pass — Hand it one claim about code — "this is safe", "this fails closed" — and it tries to REFUTE the claim with a concrete reproduction instead of reviewing it. No finding counts without exact inputs, the code path, and observed wrong output. Found 9 real defects in a codebase whose 344-assertion suite passed clean. Full input contract: this tool's input_schema. (8 MESH/call, a tool · audit)
    ConnectorNo auth
  • Decode one or more US medical codes to their official descriptions across ICD-10-CM (diagnoses), ICD-10-PCS (inpatient procedures), HCPCS Level II (supplies/drugs/services), and RxNorm (drugs, by RXCUI). Also decodes a National Drug Code (NDC) directly to its RxNorm product offline, tagged `source: "NDC"` — hyphenated in an FDA segment configuration (4-4-2, 5-3-2, 5-4-1, or the 11-digit 5-4-2) or as bare 10/11 digits; any other segment widths are malformed and stay unresolved. Auto-detects the system from each code's shape; pass an explicit `system` only when a value is genuinely ambiguous. Accepts 1–50 codes and returns partial success: resolved codes in `found`, unresolved in `notFound` with a per-code reason, so one bad code never fails the batch. Set `includeHierarchy` to attach each code's parent and immediate children (with a `childrenTruncated` flag when a code has more children than the cap returns — walk the full set via medcode_browse_hierarchy or medcode_map_codes). The resolved `system` is echoed on every result for chaining into medcode_map_codes or a billability check; a code string that also exists in another bundled system carries `alsoInSystems` naming it, so a single answer to a colliding code is never mistaken for the only one.
    ConnectorNo auth
  • Run JavaScript against the Wix REST API on site "CodeStringers Zoho Consulting Services" (https://www.codestringers.com/_api/mcp), on the visitor's behalf. The code runs in a sandbox and you get back whatever it returns. PREFER THIS TOOL OVER CallWixSiteAPI. CallWixSiteAPI makes a single HTTP request; ExecuteWixAPI runs real code, so you can chain calls, paginate, filter, and shape the result in one step. Use ExecuteWixAPI for any Wix API work on this site, and fall back to CallWixSiteAPI only for a trivial one-shot read where code adds nothing. DO A WHOLE RECIPE IN ONE CALL. When a task needs several requests — e.g. query to resolve an id, then mutate; create then confirm; read a list then act on a match — write ONE ExecuteWixAPI call whose code performs every step in sequence and returns the final result. Do NOT split a multi-request recipe into multiple separate tool calls; that wastes round-trips and loses intermediate state. If a recipe from the docs lists steps 1..N, the code should run steps 1..N. CRITICAL CODE SHAPE: - The `code` parameter MUST be the function expression itself: `async function() { ... }` or `async () => { ... }`. - Do NOT send a script body like `const result = await ...; return result;`. - Do NOT call the function yourself. The tool calls it for you. - Put all `const`, `await`, and `return` statements inside the function body. Do not rely on memory for Wix API endpoints, methods, schemas, or request bodies. Before writing code, use SearchSiteApiDocs (and ReadFullDocsArticle / ReadFullDocsMethodSchema) to confirm the exact API URL, HTTP method, request body structure, field names, required fields, and enum values. The URL usually starts with `https://www.wixapis.com`. Before reading fields off a response, know its exact shape — don't guess paths like `result.id` when it may be `result.results[0].item.id`. Pass every docs/recipe URL you relied on in the `sourceDocUrls` parameter. Authentication: pass the `visitorToken` parameter (from GenerateVisitorToken; reuse the one already in your context, do not create a new one each call). Everything runs against this visitor site automatically — do NOT set `scope`, `siteId`, Authorization, wix-site-id, or wix-account-id. Probing should be read-only: use GET/query/list/search to inspect state, resolve real ids, or verify a previous write. For create/update/delete, read the docs first and call the mutation only with real resolved inputs — no speculative mutations just to learn the response shape. Error handling: `wix.request()` throws when the Wix API returns an error. For dependent steps, let it throw so the failure is reported clearly. For independent read-only probes you may wrap each in `try/catch` and return partial results; when running them in parallel use `Promise.allSettled` (not `Promise.all`) so one failure doesn't discard the rest. Available in your code: ```typescript interface WixRequestOptions { method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE"; url: string; // Full Wix API URL, e.g. "https://www.wixapis.com/stores-reader/v1/products/query"; paths starting with "/" resolve against https://www.wixapis.com body?: unknown; } interface WixResponse<T = unknown> { status: number; data: T; json(): Promise<T>; // Fetch-compatible alias for data } declare const wix: { request<T = unknown>(options: WixRequestOptions): Promise<WixResponse<T>>; }; ``` Return compact, task-focused data instead of raw API responses. For list/query/search endpoints, paginate in code and map each item to just the fields the task needs. Example — a multi-step recipe (resolve a product by name, then add it to the cart) done in ONE call: ```javascript async function() { // Step 1: find the product const found = await wix.request({ method: "POST", url: "https://www.wixapis.com/stores-reader/v1/products/query", body: { query: { filter: JSON.stringify({ name: "Florie Eau de Parfum" }) } } }); const product = found.data.products?.[0]; if (!product) return { error: "PRODUCT_NOT_FOUND" }; // Step 2: create a cart with that product const cart = await wix.request({ method: "POST", url: "https://www.wixapis.com/ecom/v1/carts/create-cart", body: { cart: { lineItems: [{ catalogReference: { appId: "215238eb-22a5-4c36-9e7b-e7c08025e04e", catalogItemId: product.id }, quantity: 1 }] } } }); return { cartId: cart.data.cart?.id, productId: product.id, name: product.name }; } ```
    Connector
    Destructive
    No auth
  • The enum values every other tool accepts. Call this before guessing a country code or category id: invalid parameters fail, and failed calls still count against the daily quota.
    ConnectorNo auth

Matching MCP Servers

  • A
    license
    A
    quality
    C
    maintenance
    Enables LLMs to apply Martin Fowler's 71+ refactoring patterns to codebases through a pluggable, language-agnostic architecture. Supports previewing and applying refactorings, analyzing code smells, and inspecting code structure with safe-by-default operations.
    5
    5
    MIT
  • A
    license
    A
    quality
    C
    maintenance
    An MCP server that provides dynamic codebase context to Claude Code through tools like hybrid search, recent changes, and symbol definitions, enhancing AI-assisted coding with local RAG.
    8
    MIT

Matching MCP Connectors

  • Corporate travel: search and book flights, hotels, rail and transfers, manage orders.

  • Cloudflare Workers MCP server: code-explainer

  • Resolve a postal/ZIP code to its place name(s), state/region, and coordinates. `country_code` is a 2-letter ISO code (US, GB, DE, ...); `postal_code` format varies by country (e.g. "90210" for the US, "SW1A 1AA" style outward codes for the UK). Use for "what city is ZIP 90210 in", "where is postal code X in country Y", or any question that needs a place name/region/lat-lon from a postal code -- not for the reverse (place name to postal code) or for full street address lookup. Some postal codes span multiple places, in which case all of them are returned. Returns an error dict (never raises) if the code isn't recognized for that country.
    ConnectorNo auth
  • Run an OWASP-oriented security pass over a source file. PREMIUM (license). Checks injection sinks, auth/session handling, crypto misuse, SSRF/deserialization, and unsafe file/path handling — each finding cites the line, the OWASP risk class, and a concrete fix direction. Typical input {"code": "<file contents>"} returns {"issues": N, "findings": [{"line": N, "class": "A03 Injection", "fix": "...", "code": "..."}], "owasp_note": "..."}. Use on one source file when vulnerabilities are the question. Not for style or structure (complexity_report), and never a substitute for a security professional on high-risk code. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.
    ConnectorNo auth
  • Create a Keelen account (or start agent login) — emails a 6-digit code. UNAUTHENTICATED — the only tool besides verify_email that works before a bearer key is configured. `email` is where the code is sent. Flow: signup(email) -> the user reads the 6-digit code from their inbox -> verify_email(email, code) returns a reveal-once API key -> save it as this server's `Authorization: Bearer <api_key>` header in your MCP client config -> reconnect -> get_onboarding_status() to continue setup. The code expires in 15 minutes; call signup again to resend. Response is uniform whether or not the email already has an account (enumeration-safe), so signup doubles as agent LOGIN. Rate-limited per IP and per email. ASK THE USER for `email` in chat and WAIT for their answer before calling this. Do NOT infer it from your client profile, the logged-in account, git config, or any other ambient source; if you already hold a candidate, echo it back and get an explicit yes first. Because this call doubles as LOGIN, a guessed address signs the user in to whatever workspace owns it, and the rest of setup then mints an API key on, and creates a project in, an account they did not choose.
    ConnectorNo auth
  • Redeem the emailed 6-digit code for a reveal-once workspace API key. UNAUTHENTICATED. `email` + `code` must match a code issued by signup(email) within the last 15 minutes (5 attempts max). The returned `api_key` is shown exactly ONCE — store it ONLY in the MCP client config ("Authorization: Bearer <api_key>"), NEVER in a repo or a file you might commit. Then reconnect this server with the header set and call get_onboarding_status(). An invalid/expired/consumed code returns a uniform error — call signup(email) for a fresh one.
    ConnectorNo auth
  • Search companies registered with DART, South Korea's corporate disclosure system, by name, 6-digit stock code, or 8-digit DART corp_code. Returns the corp_code required by the other dart_* tools. Not this tool for: US registrants (use search_edgar_company). Japan, Taiwan and Europe have no search tool — reach them through screen_companies or query_db on the companies table. Args: - query: company name (Korean works best, e.g. '삼성전자'), 6-digit KRX stock code ('005930'), or 8-digit corp_code - listed_only: restrict to KRX-listed companies (default true). Set false to include ~90k unlisted entities. - limit: max results, 1-50 (default 10) Returns: {count, companies: [{corp_code, corp_name, stock_code}]} — stock_code is null for unlisted companies. Match priority: exact stock code > exact name > listed partial > unlisted partial. Examples: - {query: '삼성전자'} -> corp_code 00126380, stock_code 005930 - {query: '카카오', listed_only: false} -> listed 카카오 plus unlisted same-name entities Use when you need a corp_code or must disambiguate similar names. Don't use for US companies (use search_edgar_company). Errors: DART_API_KEY not configured; no match returns count 0 (not an error).
    ConnectorAPI key
  • Use this when you need to edit a param() default value in a kernelCAD script. Returns the modified code as text plus diagnostics from re-evaluating the result. Caller persists the new code via standard file-write tools (this tool has no side effects).
    ConnectorNo auth
  • Resolve a free-text query or CN code(s) into validated product code(s) with descriptions -- the recommended first step before using a code as `product` in any other tool's `query`. Saves the search -> validate -> (optional) subtree round-trip: a bare keyword runs a search, a single code (or comma-separated list) is validated and described directly. Tip: Comext/CN nomenclature is frequently coarser than a colloquial product name (e.g. there is no code for "glass jars" alone -- only heading 7010, which bundles jars with bottles, flasks and closures). Check `has_subcodes` and, if useful, set `include_children=true` to see whether a finer sub-code is actually a better match before committing to one code for a whole report.
    ConnectorNo auth
  • Start publisher registration (requires the human's consent — registers their email). Pass server_url (the MCP server's own URL or repo link) when known — it drives the "server URL set" step on the publisher's dashboard, skipping it leaves that step looking incomplete even once real traffic flows. Emails a 6-digit verification code to contact_email; ask the human for the code, then call confirm_publisher(pending_id, code) to receive the API key. This tool does NOT return a publisher_id or api_key — only confirm_publisher does.
    ConnectorNo auth
  • Expand a reason-for-control code such as NS, AT or CB into its full name. Use this when reading a Control List entry or a chart column and the two-letter code is not obvious. Returns the code and the name it stands for, or the whole glossary when called with no argument. This is a glossary lookup only: it reports what a code means, never whether that control applies to anything you are shipping, and it cannot tell you whether a licence is required.
    ConnectorNo auth
  • Produce a focused pull-request review checklist for a language or stack. FREE. Covers the things that actually break in production, with extra items per language. Typical input {"language": "python"} returns {"language": "python", "checklist": ["...", ...], "note": "..."}. Use before a review, to decide what to look for. Not for reviewing actual code - pass code to review_diff or security_deep_dive. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.
    ConnectorNo auth
  • Returns instructions for creating a DPF account, verifying its email, resending the verification code, or resetting a forgotten password — it never performs these itself and never asks for a password. A password typed into this chat would sit in the conversation transcript, so every action instead returns the DPF website's own form, or a curl command that reads the password from a shell variable the user sets themselves in their own terminal. Hand the command to the user to run — do not run it yourself even if you have shell access, since composing the export line would require seeing the password. action "register": requires email, firstName, lastName, and termsAccepted: true (only after the user has explicitly agreed to the DPF Terms of Service and Privacy Policy in this conversation). action "verify": confirm the 6-digit code DPF emailed after registration (requires otp). action "resend": re-send that code if it never arrived. action "forgot-password": request a password-reset code (requires email). action "reset-password": submit that code and set a new password (requires otp).
    ConnectorOAuth
  • Get the instructions for running a model eval with Ori, then follow them. Ori runs the user's own agent on their own prompts, on a pinned harness and model, and grades what it did — so a score change means the model changed, not the environment. Call this tool FIRST, before writing any eval code: it returns a step-by-step recipe (install and auth checks, how to spawn `ori code -p`, how to relay Ori's scoping questions to the user, how to report results) that you carry out yourself. Do not hand-roll an eval instead. Use it when the user asks which model they should use, wants to compare or bake off models, wants to measure whether their agent or prompt does the right thing, wants to catch regressions in agent behavior, or asks how good their current model is. Works for any codebase in any language. Do not use it for plain unit tests that involve no model, and do not use it to re-run an eval that already exists (run `ori eval <file>` directly instead). Takes no arguments; the same document is published at https://openrouter.ai/skills/spawn-ori-eval.
    ConnectorOAuth
  • WHEN: you know the EXACT object name. Triggers: user gives an exact name like 'SalesTable', 'CustTable', 'VendInvoiceJour', any PascalCase D365 object name. Get complete details: all fields, methods, relations, indexes, source code, and metadata. COST NOTE: this returns the FULL object and can be very large (100KB+ for big tables/forms like SalesLine). If you ONLY need relations / FK / DeleteActions / data sources / who-references, call get_relation_graph instead -- it is O(1) and roughly 6x lighter (no source code). Reserve get_object_details for when you genuinely need field details, method bodies, or source code. Also merges live disk source when a custom model path is configured (disk takes priority). Pass `methodName` to get the FULL body of a specific method -- without it, only signatures are returned. Calling twice -- first without methodName to get the full structure and method table, then again with a specific methodName for its full body -- is the CORRECT and INTENDED two-step pattern. Do NOT call a third time for the same object. DISAMBIGUATION: when a name exists as several AOT types (e.g. a Table AND a Form both named 'SalesLine'), this returns the PRIMARY type (Table/Class/Entity before the much heavier Form) and notes the others -- pass `aotType` (e.g. 'AxTable', 'AxForm', or shorthand 'table'/'form'/'class') to pick a specific one. This prevents dumping the heaviest object and truncating the rest. NOT for searching -- use search_d365_code when the name is uncertain. NOT for listing a model's objects -- use list_objects for that.
    ConnectorNo auth
  • Issue a one-time code a human can redeem to become this account's administrator — every character, level, item and quest flag stays exactly as it is; this only changes who can log in, never anything about the game state. Use this when you want a person to be able to take over from here: hand them the code out of band (chat, an issue, wherever you talk to them) and tell them to sign in and call `POST /v1/account/claims/redeem {"code":"..."}`, or use their account settings page if the server has one. Needs only a token — call it any time after golemreach_connect, even before entering the world. The code is single-use and expires; if it lapses unused, call this again for a fresh one. RETURNS: the code and when it expires.
    ConnectorNo auth
  • Pick the correct New Zealand tax code for an IR330, and explain why. Use for: 'what tax code should I use', 'M or ME tax code', 'secondary tax code NZ', 'SB S SH ST SA which one', 'tax code for second job', 'am I on the wrong tax code'. THE WRONG CODE IS ONE OF THE FEW PAYROLL MISTAKES THAT COSTS MONEY QUIETLY ALL YEAR, and there are two ways to get it wrong. A SECONDARY CODE IS CHOSEN ON TOTAL INCOME ACROSS ALL JOBS, NOT ON WHAT THE SECOND JOB PAYS. Someone earning $60,000 in a main job and $8,000 in a second is SH, not SB. Choosing on the smaller figure under-taxes and produces a bill at year end. ALWAYS ASK FOR TOTAL INCOME before answering a secondary code question. If total_income_all_jobs is omitted this falls back to this job's income and returns a warning saying the band is very likely wrong; pass that warning on rather than reporting the code as settled. ME IS NOT SIMPLY "M PLUS A CREDIT". The Independent Earner Tax Credit, worth up to $520 a year, is withdrawn by receiving Working for Families, a main benefit or NZ Super, so someone inside the $24,000 to $70,000 band can still correctly be an M. Add SL when a student loan is being repaid. On a SECONDARY job the repayment is 12% of the gross with no threshold at all, because the repayment threshold belongs to the main job. That catches people who expect the threshold twice. Special tax codes, non-resident status and multiple secondary jobs are out of scope here; those need Inland Revenue. Args: annual_income: Income from THIS job, before tax. job_type: primary for the main job, secondary for any other. total_income_all_jobs: Total across every job. Needed for secondary. has_student_loan: Whether a student loan is being repaid. receives_wff_benefit_or_super: Working for Families, a main benefit or NZ Super. Any of these removes IETC eligibility. Returns: The code, what it means, why it applies rather than the alternative, the flat rate for a secondary code, and any warning about the inputs.
    ConnectorNo auth