Local MCP capabilities provider for Expo
Nothing to run from here
DataNexus MCP is installed from its publisher's own source and answers where it runs, so this marketplace is not in the path of a single call. There is no address here to send one to, and a panel that pretended otherwise would be showing you an answer we made up. Install it and call it from your own client — the Installation tab has the entry for each one.
55
tools declared
—
trust score
remote
at its publisher
—
calls last 7d
What it does
Public data intelligence for AI agents — CVE, compliance, patents, contracts, domains.
Quickstart
# 1 — add it to Claude Code
claude mcp add --scope user --transport http datanexus-mcp https://datanexusmcp.com/mcp
# 2 — ask your agent for something these tools do
# report_feedback, report_mcpize_link, validate_tool_output and 52 more
DataNexus MCP costs nothing on mcprush: there is no plan to choose here, no cap to set and nothing mcprush can bill you for.
Publishernot claimed
DCAll 1 server
datanexusmcp.com1 server
1 category
Collected from a public index. Nobody has claimed this account, so nothing here was written by its author — claim it if it is yours.
Installation
Where are you running it?
Every route below installs the same thing and ends at the same approval screen. Nothing here runs on your machine and nothing runs on ours: this server answers at its publisher’s own address, and what you install is the connection straight to it.
Claude Codedeclared by this listing
This is a public server: it answers at its publisher’s own address and this marketplace is not in the path. Claude Code registers it in one command; --scope user makes it available in every project. The transport below is http, as the publisher's own manifest declares it.
claude mcp add --scope user --transport http datanexus-mcp https://datanexusmcp.com/mcpReconnect, or start a new session, and the tools appear in the model’s tool list.
Free on mcprush, and it answers at its publisher’s own address: this marketplace is not in the path, so there is no key of ours to hold and no card to add.
What it writes
One config entry pointing straight at the publisher’s own address — this marketplace is not in the path, and nothing from this listing executes on your machine.
What you approve
55 tools, with what each one reads, writes and reaches shown before you agree — the same list on every route above. Read the tool surface.
Tool surface
What the model actually sees. Descriptions are diffed on every release — see version history.
Report a data quality issue or agent intent gap for a DataNexus tool response. tool_id: e.g. "T10" or "security_fetch_cve_detail". query_hash: From the query_hash field of the response. signal: incorrect_data | missing_field | stale_data | not_useful | wrong_entity | data_quality. comment: Issue description. Max 500 chars. missing_fields: Absent or wrong field names. feedback_type: "user_feedback
| Parameter | Type | Required | Notes |
|---|---|---|---|
| tool_id | string | yes | Tool identifier, e.g. T04 or security_fetch_cve_detail. Required. |
| query_hash | string | yes | Hash from the response being reported — found in the query_hash field of any response. Required. |
| signal | string | yes | One of incorrect_data, missing_field, stale_data, not_useful, wrong_entity, or data_quality. Required for user_feedback. |
| comment | string | no | Description of the issue. Optional. Max 500 characters. |
| missing_fields | no | List of field names that are absent or wrong. Optional. | |
| feedback_type | string | no | user_feedback (default) or agent_gap. Use agent_gap when the tool returned a valid response but did not serve the user's actual need. |
| intended_query | no | What the agent was trying to accomplish — used when feedback_type=agent_gap. Optional. Max 256 chars. | |
| gap_description | no | What was missing or wrong in the result — used when feedback_type=agent_gap. Optional. Max 256 chars. |
Check MCPize subscription status for a DataNexus tool. tool_id: DataNexus tool identifier e.g. "T10". Pass the tool the user is asking about. Returns: status ("free" | "subscription_required" | "not_configured"), message, tool_id, and upgrade_url when subscription is required. Example: report_mcpize_link(tool_id="T10")
| Parameter | Type | Required | Notes |
|---|---|---|---|
| tool_id | string | yes | DataNexus tool identifier to check, e.g. "T01", "T07", "T10" — pass the ID of the tool the user is asking about. |
Validate a DataNexus tool response for data quality issues using two-layer validation: deterministic rules first, then AI review for ambiguous cases. Read-only. Never blocks. tool_id: DataNexus tool identifier e.g. T04, T10, T22. Required. Find in the tool_id field of any response. query_hash: Hash from the response you are validating. Required. Enables feedback correlation. response_json: Full to
| Parameter | Type | Required | Notes |
|---|---|---|---|
| tool_id | string | yes | DataNexus tool identifier, e.g. T04, T10, T22 — found in the tool_id field of any response. Required. |
| query_hash | string | yes | Hash from the response being validated — found in the query_hash field of any response. Enables feedback correlation. Required. |
| response_json | string | yes | The full tool response, serialised as a JSON string, to validate for data quality issues. Required. |
Find the right DataNexus tool by describing your task in plain English. Read-only. No side effects. Call this before any other DataNexus tool to reduce context load from 40000 to 800 tokens. query: Plain English description of your task e.g. check if a Python package has CVEs or look up a UK charity by name. Required. domain: Restrict results to one sub-server: nonprofit, security, compliance, dom
| Parameter | Type | Required | Notes |
|---|---|---|---|
| query | string | yes | Plain English description of your task, e.g. 'check if a Python package has CVEs' or 'look up a UK charity by name'. Required. |
| domain | no | Restrict results to one sub-server: nonprofit, security, compliance, domain, legal, govcon, or regulatory. Optional. |
Fetch IRS 990 filing data for any US nonprofit by EIN. Read-only. No side effects. Idempotent. US only. ein: 9-digit Employer ID with or without dash, e.g. 46-5734087 or 465734087. Required. Returns name, revenue, expenses, assets, NTEE code, and mission from the most recent 990 filing. Use this when you have the exact EIN. Use nonprofit_search_nonprofits_by_name instead when you only have a name.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| ein | string | yes | EIN in format XX-XXXXXXX e.g. 46-5734087. Required. |
Search US nonprofits by name with optional state filter. Read-only. No side effects. Idempotent. US only. Returns up to 25 matches. name: Full or partial organisation name. Required. state: Two-letter US state code e.g. CA, NY. Optional, defaults to all states. Returns EIN, name, state, revenue, and NTEE code for each match. Use this when you have a name but not the EIN. Use nonprofit_fetch_nonpro
| Parameter | Type | Required | Notes |
|---|---|---|---|
| name | string | yes | Organization name to search e.g. Red Cross. Required. |
| state | string | no | Two-letter US state code e.g. CA. Optional. |
Fetch UK registered charity details by charity number or organisation name. Read-only. No side effects. Idempotent. UK only. charity_number_or_name: UK registered charity number (7 digits, e.g. 1234567) or full/partial organisation name. Required. Returns registration status, income, expenditure, activities, and trustee count. Use this for UK charities. Use nonprofit_fetch_nonprofit_by_ein or nonp
| Parameter | Type | Required | Notes |
|---|---|---|---|
| charity_number_or_name | string | yes | UK charity number e.g. 1089464 or name substring. Required. |
Fetch all known CVEs for an open source package version or a batch of packages. Read-only. No side effects. Idempotent. Single-package mode: package (e.g. requests), version (e.g. 2.28.0), ecosystem (PyPI/npm/Maven/Go/Cargo/NuGet/RubyGems). Batch mode: packages array of {name, version, ecosystem} objects — max 50 per call. If packages array is provided and non-empty, batch mode is used and package
| Parameter | Type | Required | Notes |
|---|---|---|---|
| package | no | Package name e.g. requests. Required in single-package mode. | |
| version | no | Package version e.g. 2.28.0. Required in single-package mode. | |
| ecosystem | no | Package ecosystem: npm, pypi, cargo, go, maven, nuget. Required. | |
| packages | no | Batch list of {name, version, ecosystem} objects. Max 50. |
Fetch the full dependency tree for a package version including transitive dependencies. Read-only. No side effects. Idempotent. Hard 8-second timeout — large dependency trees may return partial results. package: Package name. Required. version: Exact version string e.g. 1.2.3. Required. ecosystem: One of PyPI, npm, Maven, Go, Cargo, NuGet, RubyGems. Required. Returns all direct and transitive depe
| Parameter | Type | Required | Notes |
|---|---|---|---|
| package | string | yes | Package name e.g. requests. Required. |
| version | string | yes | Package version e.g. 2.28.0. Required. |
| ecosystem | string | yes | Package ecosystem: npm, pypi, cargo, go, maven, nuget. Required. |
Fetch full detail for a specific CVE by ID. Read-only. No side effects. Idempotent. cve_id: CVE identifier in format CVE-YYYY-NNNNN e.g. CVE-2021-44228. Required. Returns description, CVSS base score, affected products, patch references, and publish date. Use this when you have a CVE ID and need complete detail beyond what a package scan returns. Use security_fetch_package_vulnerabilities instead
| Parameter | Type | Required | Notes |
|---|---|---|---|
| cve_id | string | yes | CVE identifier e.g. CVE-2021-44228. Required. |
Audit a Software Bill of Materials for known vulnerabilities across all listed packages. Read-only. No side effects. Idempotent. sbom_json: CycloneDX or SPDX SBOM as a JSON string. Required. Large SBOMs (100+ packages) may take up to 10 seconds. Returns CVEs grouped by package with severity and fixed versions. Use this when you have a full SBOM to audit. Use security_fetch_package_vulnerabilities
| Parameter | Type | Required | Notes |
|---|---|---|---|
| sbom_json | string | yes | CycloneDX or SPDX SBOM as JSON string. Required. |
Fetch the SPDX licence identifier for an open source package version. Read-only. No side effects. Idempotent. package: Package name e.g. flask. Required. version: Exact version string e.g. 2.3.0. Required. ecosystem: One of PyPI, npm, Maven, Go, Cargo, NuGet, RubyGems. Required. Returns the SPDX licence identifier e.g. MIT, Apache-2.0, GPL-3.0. Use this to verify licence compatibility before inclu
| Parameter | Type | Required | Notes |
|---|---|---|---|
| package | string | yes | Package name e.g. requests. Required. |
| version | string | yes | Package version e.g. 2.28.0. Required. |
| ecosystem | string | yes | Package ecosystem: npm, pypi, cargo, go, maven, nuget. Required. |
Check whether a CVE is in the CISA Known Exploited Vulnerabilities (KEV) catalog. Read-only. No side effects. Idempotent. cve_id: CVE identifier in format CVE-YYYY-NNNNN e.g. CVE-2021-44228. Required. Returns in_kev (bool), date_added, due_date, ransomware_use, and notes from the CISA KEV catalog. KEV status answers 'Is this being actively exploited?' — a critical triage question not available in
| Parameter | Type | Required | Notes |
|---|---|---|---|
| cve_id | string | yes | CVE identifier e.g. CVE-2021-44228. Required. |
EPSS exploit probability score for a CVE — predicts likelihood of exploitation in the next 30 days. cve_id: CVE identifier e.g. "CVE-2021-44228". Returns: epss (float 0.0–1.0) and percentile (float 0.0–100.0). Thresholds: >0.7 patch immediately, 0.3–0.7 patch soon, <0.3 monitor. Use with security_fetch_cve_detail to prioritize patching — EPSS measures urgency, CVSS measures severity. Source: FIR
| Parameter | Type | Required | Notes |
|---|---|---|---|
| cve_id | string | yes | CVE identifier e.g. CVE-2021-44228. Required. |
Fetch NPI registration details for a US healthcare provider by NPI number. Read-only. No side effects. Idempotent. US only. npi_number: 10-digit NPI number e.g. 1003000126. Required. Do not include dashes or spaces. Returns provider name, credential type, speciality taxonomy, practice address, and active status. Use this when you have the exact 10-digit NPI. Use compliance_search_npi_by_name inste
| Parameter | Type | Required | Notes |
|---|---|---|---|
| npi_number | string | yes | 10-digit NPI number e.g. 1003000126. No dashes. Required. |
Search the NPPES NPI Registry by provider name with optional state and speciality filters. Read-only. No side effects. Idempotent. US only. Returns up to 10 matches. name: Full or partial provider name. Required. state: Two-letter US state code e.g. CA. Optional. speciality: Speciality keyword e.g. Cardiology. Optional. Returns NPI number, name, speciality, and address for each match. Use this whe
| Parameter | Type | Required | Notes |
|---|---|---|---|
| name | string | yes | Full or partial provider name. Required. |
| state | string | no | Two-letter US state code e.g. CA. Optional. |
| speciality | string | no | Speciality keyword e.g. Cardiology. Optional. |
Fetch FINRA BrokerCheck registration for a US broker or investment adviser by CRD number. Read-only. No side effects. Idempotent. US only. crd_number: Central Registration Depository number as a string of digits e.g. 1234567. Required. CRD number only — name lookup is not supported. Returns registration status, qualifications, disclosure history, and employment history. Use this when you have the
| Parameter | Type | Required | Notes |
|---|---|---|---|
| crd_number | string | yes | FINRA CRD number e.g. 149777. Required. |
Check whether an entity is on the US federal exclusions list (debarred from government contracts). Read-only. No side effects. Idempotent. US only. name_or_ein: Entity name or 9-digit EIN with or without dash e.g. Acme Corp or 13-1234567. Required. Name match is fuzzy — verify EIN for exact results. Returns excluded: true/false, exclusion type, and exclusion dates if found. Use this before awardin
| Parameter | Type | Required | Notes |
|---|---|---|---|
| name_or_ein | string | yes | Entity name or EIN to check SAM exclusions. Required. |
Fetch domain registration details via IANA RDAP (the modern structured replacement for WHOIS). Read-only. No side effects. Idempotent. domain: Domain name without protocol e.g. example.com not https://example.com. Required. Returns registrar, registration date, expiry date, nameservers, and registrant info where publicly available. Use this when you need registration metadata. Use domain_fetch_ssl
| Parameter | Type | Required | Notes |
|---|---|---|---|
| domain | string | yes | Domain without protocol e.g. example.com. Required. |
Fetch SSL certificate history for a domain from Certificate Transparency logs. Read-only. No side effects. Idempotent. domain: Domain name without protocol e.g. github.com. Required. Does not support IP addresses or wildcard domains. Returns issuer, subject, validity period, and Subject Alternative Names for each logged cert. Use this to detect unexpected certificate issuance or audit certificate
| Parameter | Type | Required | Notes |
|---|---|---|---|
| domain | string | yes | Domain without protocol e.g. github.com. Required. |
Fetch current DNS records for a domain via Cloudflare DNS over HTTPS. Read-only. No side effects. Idempotent. domain: Domain name without protocol e.g. cloudflare.com. Required. record_types: List of DNS record types to fetch. Required. Valid values: A, AAAA, MX, TXT, NS, CNAME, SOA. Example: ["A", "MX", "TXT"]. Returns all matching records currently in effect. Use this when you need live DNS reso
| Parameter | Type | Required | Notes |
|---|---|---|---|
| domain | string | yes | Domain without protocol e.g. anthropic.com. Required. |
| record_types | array | yes | DNS record types e.g. ['A','MX','TXT']. Optional. |
Fetch historical SSL certificate issuance for a domain from Certificate Transparency logs. Read-only. No side effects. Idempotent. domain: Domain name without protocol e.g. example.com. Required. Returns all past certificates with issuer, validity dates, and SANs in reverse chronological order. Use this to detect domain hijacking or audit unexpected historical certificate issuance. Use domain_fetc
| Parameter | Type | Required | Notes |
|---|---|---|---|
| domain | string | yes | Domain without protocol e.g. example.com. Required. |
Enumerate subdomains for a domain via Certificate Transparency logs. Read-only. No side effects. Idempotent. domain: Domain name without protocol e.g. anthropic.com. Required. Returns deduplicated list of known subdomains. Primary source: crt.sh Certificate Transparency (free). Fallback source: RapidDNS (free, passive CT + DNS) — used automatically when crt.sh is unavailable. Response includes sou
| Parameter | Type | Required | Notes |
|---|---|---|---|
| domain | string | yes | Domain without protocol e.g. anthropic.com. Required. |
Check SPF, DMARC, and DKIM email authentication for a domain. domain: Domain without protocol e.g. "google.com". Returns: overall_grade (A–F), spf_score, dmarc_score, dkim_score (each 0–10), spf_record, dmarc_record, dkim_selectors_found. Scores reflect live DNS via Cloudflare DoH — no cache. SPF: -all=10 (strict), ~all=7, ?all=4, none=2, +all=0 (open relay). DMARC: p=reject=10, p=quarantine=7,
| Parameter | Type | Required | Notes |
|---|---|---|---|
| domain | string | yes | Domain without protocol e.g. google.com. Required. |
Find domains co-hosted on the same IP address (reverse IP lookup). Read-only. No side effects. Idempotent. domain_or_ip: Domain name (e.g. shared.dreamhost.com) or IPv4 address (e.g. 1.2.3.4). Required. If a domain is given, it is first resolved to its IPv4 A record. IPv6-only domains are not supported. Returns list of co-hosted domains on the same IP. Useful for identifying shared hosting risk an
| Parameter | Type | Required | Notes |
|---|---|---|---|
| domain_or_ip | string | yes | Domain e.g. shared.dreamhost.com or IPv4 e.g. 1.2.3.4. Required. |
Fetch full patent details by patent number and jurisdiction. Read-only. No side effects. Idempotent. patent_number: Patent number in EPODOC format e.g. EP1000000 for European, CN120586032 for Chinese, JP2020123456 for Japanese, WO2020123456 for PCT, US10000000 for US. Required. jurisdiction: Optional hint — one of EP, CN, JP, KR, US, WO, etc. Default EP. The tool normalises the patent number autom
| Parameter | Type | Required | Notes |
|---|---|---|---|
| patent_number | string | yes | Patent number e.g. EP3456789 or US10123456. Required. |
| jurisdiction | string | no | Patent office code: EP, US, WO. Default EP. Optional. |
Search patents by keyword across EPO, USPTO, or WIPO. Read-only. No side effects. Idempotent. Returns up to 10 matches. keywords: Search terms describing the invention e.g. neural network image classification. Required. jurisdiction: One of EP, US, or WO. Optional. Default EP. date_from: Earliest filing date in ISO 8601 format e.g. 2020-01-31. Optional, defaults to no lower bound. Returns patent n
| Parameter | Type | Required | Notes |
|---|---|---|---|
| keywords | string | yes | Search keyword or phrase e.g. CRISPR gene editing. Required. |
| jurisdiction | string | no | Patent office code: EP, US, WO. Default EP. Optional. |
| date_from | string | no | Earliest filing date ISO 8601 e.g. 2020-01-31. Optional. |
Fetch forward and backward citation chains for a specific patent. Read-only. No side effects. Idempotent. patent_number: Patent number in EPODOC format e.g. EP1000000 for European, CN120586032 for Chinese, JP2020123456 for Japanese, WO2020123456 for PCT, US10000000 for US. Required. jurisdiction: Optional hint — one of EP, US, WO, CN, JP, KR, etc. Default EP. The tool normalises the patent number
| Parameter | Type | Required | Notes |
|---|---|---|---|
| patent_number | string | yes | Patent number e.g. EP3456789 or US10123456. Required. |
| jurisdiction | string | no | Patent office code: EP, US, WO. Default EP. Optional. |
Fetch the patent portfolio for a named inventor with optional assignee filter. Read-only. No side effects. Idempotent. inventor_name: Inventor surname or full name e.g. Smith or John Smith. Required. Fuzzy match — common names may return many results. assignee: Company or organisation name to narrow results e.g. Apple Inc. Optional. Returns patent numbers, titles, filing dates, jurisdictions, and
| Parameter | Type | Required | Notes |
|---|---|---|---|
| inventor_name | string | yes | Inventor surname or full name e.g. John Smith. Required. |
| assignee | string | no | Company name to filter results e.g. Apple Inc. Optional. |
Search government contract awards by keyword, agency, and date range. keyword: Contract scope e.g. "cybersecurity software". agency: Awarding agency e.g. "Department of Defense". Optional. date_from: Earliest award date ISO 8601 e.g. "2024-01-31". Optional. jurisdiction: "US", "EU", or "UK". Default "US". Returns: award amounts, recipient vendors, NAICS codes, award dates. Use govcon_fetch_vendo
| Parameter | Type | Required | Notes |
|---|---|---|---|
| keyword | string | yes | Search terms describing the contract scope e.g. cybersecurity software. Required. |
| agency | string | no | Awarding agency name e.g. Department of Defense. Optional. |
| date_from | string | no | Earliest award date ISO 8601 e.g. 2024-01-31. Optional. |
| jurisdiction | string | no | Jurisdiction: US, EU, or UK. Default US. Optional. |
Fetch the complete federal contract award history for a specific vendor. Read-only. No side effects. Idempotent. vendor_name: Company or organisation name e.g. Booz Allen Hamilton. Required. Fuzzy match used. jurisdiction: One of US, EU, or UK. Optional. Default US. Returns total award value, top awarding agencies, contract types, and recent awards with amounts and dates. Use this when researching
| Parameter | Type | Required | Notes |
|---|---|---|---|
| vendor_name | string | yes | Vendor or company name to search e.g. Booz Allen Hamilton. Required. |
| jurisdiction | string | no | Jurisdiction: US, EU, or UK. Default US. Optional. |
Fetch currently open government contract solicitations matching a keyword. Read-only. No side effects. Idempotent. keyword: Description of goods or services sought e.g. cloud computing services. Required. Encode special characters — + becomes %2B. agency: Awarding agency name. Optional, defaults to all agencies. jurisdiction: One of US, EU, or UK. Optional. Default US. Returns solicitation title,
| Parameter | Type | Required | Notes |
|---|---|---|---|
| keyword | string | yes | Description of goods or services sought e.g. cloud computing. Required. |
| agency | string | no | Awarding agency name. Optional, defaults to all agencies. |
| jurisdiction | string | no | Jurisdiction: US, EU, or UK. Default US. Optional. |
Search open rulemakings and public comment periods on Regulations.gov and the Federal Register. Read-only. No side effects. Idempotent. US federal only. keyword: Topic keywords e.g. artificial intelligence, data privacy. Required. agency: Agency abbreviation e.g. FTC, FDA, SEC, EPA. Optional, defaults to all agencies. status: One of open, closed, or all. Optional. Default open. Returns docket titl
| Parameter | Type | Required | Notes |
|---|---|---|---|
| keyword | string | yes | Topic keywords e.g. artificial intelligence. Required. |
| agency | string | no | Agency abbreviation e.g. FTC, FDA, SEC. Optional. |
| status | string | no | Filter: open, closed, or all. Default open. Optional. |
Fetch full details for a specific regulatory docket by ID. Read-only. No side effects. Idempotent. US federal only. docket_id: Docket identifier in agency format e.g. EPA-HQ-OAR-2021-0317 or FTC-2024-0041. Required. Timeout is 30 seconds — large dockets may be slow. Returns docket title, agency, status, comment period dates, total comment count, and list of related documents. Use this when you hav
| Parameter | Type | Required | Notes |
|---|---|---|---|
| docket_id | string | yes | Docket ID e.g. EPA-HQ-OAR-2021-0668. Required. |
Fetch recent Federal Register notices and rules for a specific agency. Read-only. No side effects. Idempotent. US federal only. agency: Agency name or abbreviation e.g. SEC, Food and Drug Administration, EPA. Required. keyword: Optional topic filter e.g. cryptocurrency. Optional, defaults to all notices. date_from: Earliest publication date in ISO 8601 format e.g. 2024-01-31. Optional, defaults to
| Parameter | Type | Required | Notes |
|---|---|---|---|
| agency | string | yes | Agency name or abbreviation e.g. SEC, EPA. Required. |
| keyword | string | no | Optional topic filter e.g. cryptocurrency. Optional. |
| date_from | string | no | Earliest publication date ISO 8601 e.g. 2024-01-31. Optional. |
Analyse ownership and release history for an npm or PyPI package to detect supply-chain risk. Uses PyPI JSON API and npm registry — data refreshed on each call, 1-hour cache. Returns maintainer_count, recent_changes, ownership_transfers, account_ages, anomaly_score (0.0–1.0), and maintainer_health (healthy | stale | abandoned | suspicious). Rate limit: 60/minute. No auth required. For security eng
| Parameter | Type | Required | Notes |
|---|---|---|---|
| package_name | string | yes | Package name e.g. requests. Required. |
| ecosystem | string | yes | Package ecosystem: npm, pypi, cargo, go. Required. |
Single SHIP/CAUTION/BLOCK verdict for any package. Combines CVEs, licence, maintainer health, and transitive count in one call. Uses OSV.dev, deps.dev, PyPI, and npm registry — data refreshed on each call. Returns verdict (SHIP/CAUTION/BLOCK), critical_cve_count, high_cve_count, licence_risk, maintainer_health, transitive_count, resolved_version, upstream_status, and reasoning. Rate limit: 30/minu
| Parameter | Type | Required | Notes |
|---|---|---|---|
| package_name | string | yes | Package name e.g. requests. Required. |
| ecosystem | string | yes | Package ecosystem: npm, pypi, cargo, go, maven. Required. |
| version | no | Package version e.g. 2.28.0. Required. |
Detect typosquatting attacks against a package name. Compares using Damerau-Levenshtein distance ≤ 2 against top-10,000 packages. Returns similar_packages with anomaly scores, and a SUSPICIOUS or CLEAN verdict. Uses PyPI and npm download stats stored in Redis. Cold-start fetch on first call (≤ 30s). Rate limit: 60/minute. No auth required. For security engineers auditing supply-chain package names
| Parameter | Type | Required | Notes |
|---|---|---|---|
| package_name | string | yes | Package name e.g. requests. Required. |
| ecosystem | string | yes | Package ecosystem: npm, pypi, cargo, go. Required. |
Complete nonprofit due diligence in one call. Revenue trends, executive pay, risk flags, and a health score from IRS 990 data. Uses ProPublica Nonprofit Explorer API with IRS e-File fallback. Data refreshed on each call. Returns financials, executive_compensation, risk_flags, health_score (0–100), programme_ratio, fundraising_sustainability, and upstream_status. Rate limit: 30/minute. No auth requ
| Parameter | Type | Required | Notes |
|---|---|---|---|
| ein | string | yes | EIN in format XX-XXXXXXX e.g. 46-5734087. Required. |
Persistent CVE watchlist. Create once, check anytime for new events since your last visit — patch releases, KEV listings, PoC publications, exploitation detected. Uses Redis for persistence, NVD + CISA KEV + EPSS for daily background refresh. Returns has_new_events, events (list), call_back_in="24h" on check. Rate limit: 60/minute. No auth required. For security engineers tracking CVE exposure ove
| Parameter | Type | Required | Notes |
|---|---|---|---|
| watch_id | string | yes | Unique watch identifier to create, check, or delete. Required. |
| cve_ids | array | yes | List of CVE IDs to watch e.g. ['CVE-2021-44228']. Required for create. |
| action | string | yes | Action: create, check, or delete the watchlist. Required. |
Persistent SBOM watch. Register once, check anytime for new CVEs affecting your dependency snapshot. Silent permanent watch — CycloneDX and SPDX supported. Uses OSV.dev for vulnerability lookup, Redis for persistence with 90-day TTL. Supports CycloneDX 1.4/1.5 and SPDX 2.3 JSON. Input size limit: 500 KB. Returns go_no_go signal on register; new_findings on check. Rate limit: 10/minute. No auth req
| Parameter | Type | Required | Notes |
|---|---|---|---|
| sbom | string | yes | CycloneDX or SPDX SBOM as JSON string. Required for register action. |
| watch_id | string | yes | Unique watch identifier for this SBOM watch. Required. |
| action | string | yes | Action: register, check, or deregister the SBOM watch. Required. |
Understand any software licence in plain English. Returns obligations, permissions, limitations, risk level, and OSI/FSF status for any SPDX licence identifier. Static bundle covers top-50 common licences (no network call). Falls back to spdx.org API for rare identifiers. All risk levels assume proprietary/commercial use. Rate limit: 60/minute. No auth required. For security engineers and develope
| Parameter | Type | Required | Notes |
|---|---|---|---|
| spdx_id | string | yes | SPDX licence identifier e.g. MIT, Apache-2.0, GPL-3.0. Required. |
Audit the licence compatibility of your entire dependency list. Input package names (with ecosystem) or SPDX IDs; get a COMPATIBLE/CONFLICT verdict with specific conflicting pairs and recommended action. Uses static SPDX compatibility table — no network call for spdx_ids path. Package path resolves licences from deps.dev (max 10 concurrent). Max 50 items. Rate limit: 60/minute. No auth required. F
| Parameter | Type | Required | Notes |
|---|---|---|---|
| packages | no | List of {name, ecosystem} dicts to check compatibility. Optional. | |
| spdx_ids | no | List of SPDX licence identifiers to check compatibility. Optional. |
Instant CVE risk verdict. Combines CVSS severity, CISA KEV exploitation status, and EPSS probability in one parallel call. Returns CRITICAL_EXPLOIT, HIGH_RISK, MODERATE, LOW, or UNKNOWN verdict with patch availability from vendor advisories. UNKNOWN means all upstream sources were unreachable — not that risk is low. Rate limit: 60/minute. No auth required. For security engineers triaging vulnerabi
| Parameter | Type | Required | Notes |
|---|---|---|---|
| cve_id | string | yes | CVE identifier e.g. CVE-2021-44228. Required. |
Search US nonprofits by mission category and state. Returns up to 25 results with revenue, assets, and health scores (0–100). Category maps to NTEE codes: education, healthcare, arts, environment, human_services, civil_rights, international, religion, science, sports. Raw NTEE letter (A–Z) also accepted. Uses ProPublica Nonprofit Explorer API. Rate limit: 30/minute. No auth required. Starting poin
| Parameter | Type | Required | Notes |
|---|---|---|---|
| category | string | yes | NTEE category e.g. education, healthcare, arts. Required. |
| state | no | Two-letter US state code e.g. CA. Optional. |
5-year financial trend for any US nonprofit. Revenue growth, expense ratios, reserve trajectory, and health score history from IRS Form 990 data via ProPublica. Returns trend_direction (GROWING/STABLE/DECLINING/VOLATILE/INSUFFICIENT_DATA), CAGR, and year-by-year revenue, expense, and asset trends. years parameter: 1–10, default 5. Rate limit: 30/minute. No auth required. Complements nonprofit_fetc
| Parameter | Type | Required | Notes |
|---|---|---|---|
| ein | string | yes | EIN in format XX-XXXXXXX e.g. 46-5734087. Required. |
| years | integer | no | Number of years of trend data 1-10. Default 5. Optional. |
Generate a DataNexus API key for the given email address. Anonymous callers get 10 free lookups/week; a registered free key unlocks 100/week. Store the returned key — it is shown only once. Pass it as the X-Api-Key header on future requests. Rate limit: 3 keys per IP per 24 hours.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| string | yes | Email address to associate with the new API key. Used for delivery and repeat-signup lookup. Required. |
⚠️ DESTRUCTIVE — requires human confirmation before use in automated pipelines. Revoke the current API key and issue a replacement. Returns the new key once — store it immediately. Pass keys as the X-DataNexus-Key header.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| current_key | string | yes | Existing active API key (dnx_...) to revoke and replace. Required. |
⚠️ DESTRUCTIVE — requires human confirmation before use in automated pipelines. Permanently revoke a DataNexus API key. The key will stop working immediately. This action cannot be undone — generate a new key if access is needed again.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| key | string | yes | API key (dnx_...) to permanently revoke. Required. |
Audit a CycloneDX or SPDX SBOM against an SPDX licence policy and return a PASS/WARN/BLOCK verdict. sbom: Full SBOM as a JSON string — CycloneDX or SPDX format. Required. 500 KB max. policy: Optional dict with block/warn/allow arrays of exact SPDX licence identifiers (e.g. GPL-3.0, MIT). Defaults to block GPL-3.0 and AGPL-3.0, warn LGPL-2.1/MPL-2.0/BSD-4-Clause, allow MIT/Apache-2.0/BSD-2-Clause/B
| Parameter | Type | Required | Notes |
|---|---|---|---|
| sbom | string | yes | CycloneDX or SPDX SBOM as JSON string. Required. 500 KB max. |
| policy | no | Policy dict with block/warn/allow arrays of SPDX licence IDs. Optional. |
Check all specified CVE watches for new events since your last poll. Returns only watches with new events, making it efficient to run on a schedule. watch_ids: List of watch IDs to check — same IDs used when creating watches with security_fetch_cve_watch. Required. Uses a per-user cursor (last_polled timestamp) stored in Redis. First call returns events from the last 30 days. Subsequent calls retu
| Parameter | Type | Required | Notes |
|---|---|---|---|
| watch_ids | array | yes | List of watch IDs to check e.g. ['watch-1','watch-2']. Required. |
Typosquatting detection optimised for the top 500 frontend packages (React, Vite, Axios, Lodash, etc.). Fewer false positives than a full npm scan. For backend packages, use security_detect_typosquatting instead. package_name: Package name to check. Required. ecosystem: npm or pypi — default npm. Uses Damerau-Levenshtein distance ≤ 2 against a curated frontend-package corpus. Returns is_likely_typ
| Parameter | Type | Required | Notes |
|---|---|---|---|
| package_name | string | yes | Package name e.g. requests. Required. |
| ecosystem | string | no | Package ecosystem: npm or pypi. Default npm. |
Audit a frontend package.json for security risks — returns a single SHIP/CAUTION/BLOCK verdict with licence risks and abandonment signals. Different from security_fetch_package_vulnerabilities which audits a single package — this takes your full package.json. manifest: Contents of package.json as a string. Required. 500 KB max. lockfile: Contents of package-lock.json or yarn.lock (optional). If pr
| Parameter | Type | Required | Notes |
|---|---|---|---|
| manifest | string | yes | Contents of package.json as a string. Required. 500 KB max. |
| lockfile | no | Contents of package-lock.json or yarn.lock. Optional. |
Scan GitHub Actions, Vercel, or Netlify CI configs for exposed secrets, missing lockfile enforcement, and unpinned dependencies. Paste your config content — no filesystem access required. config: Raw YAML/TOML content of your CI config. Required. 500 KB max. config_type: github_actions (full check suite), vercel, or netlify (secrets only in Sprint 8). Returns risk_level (LOW/MEDIUM/HIGH/CRITICAL),
| Parameter | Type | Required | Notes |
|---|---|---|---|
| config | string | yes | Raw YAML/TOML content of your CI config. Required. 500 KB max. |
| config_type | string | no | CI config type: github_actions, vercel, or netlify. Default github_actions. |
SHIP/CAUTION/BLOCK risk brief for an npm package with frontend-specific context. Wraps security_fetch_package_risk_brief restricted to npm, and adds weekly_downloads and is_ui_component signals. package_name: npm package name. Required. version: Optional pinned version — latest resolved if omitted. Returns verdict, CVE counts, licence risk, maintainer health, weekly_downloads, is_ui_component. Use
| Parameter | Type | Required | Notes |
|---|---|---|---|
| package_name | string | yes | Package name e.g. requests. Required. |
| version | no | Package version e.g. 2.28.0. Optional. |
Free
$0 forever
- Every tool — any call limit is its publisher’s, not ours
- No card, and mcprush charges nothing for it
- Runs at its publisher’s own address — this marketplace is not in the path
- Nothing to cap, because mcprush bills nothing
What counts against your monthly calls
| Tool | Unit | Calls used | Out of the allowance |
|---|
Nothing here is billable: mcprush charges nothing to install DataNexus MCP or to call it, at any volume.
Call allowance · this installenforced at the gateway
Monthly allowance, in calls
—
—
Alert at 80% · then the tool returns a normal MCP error
Used this month: —
—Grade not published
No rule-by-rule report on file for this release
Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.
This listing is an address its publisher runs, and you connect to it directly — this marketplace is not in the path. The scanner reads packages and public source, and an address is neither. So there is no grade — not a withheld one, an unmeasured one.
Release history
This is an address its publisher runs: which release it serves is theirs to choose, so there is nothing here to pin. The history below is for reading; the current release on file is 3.4.5.
3.4.5
undated
latestNo release note was published with this version.
—
no reviews yet
Who can review
One review per account, from a signed-in account that does not publish this listing. Nothing else is asked — you can say what you think before you install it. Publishers can reply once per review, and a review can be edited or deleted by whoever wrote it.
Sign in to write one
Any signed-in account that does not publish DataNexus MCP can review it, once — before installing it or after. A review from an account that has installed it is marked as one.
No reviews yet
Nobody has reviewed this listing. The rating on the card is the mean of the reviews written here and nothing else, so there is no rating until somebody writes the first — which takes a signed-in account that does not publish it, and nothing else.