DataNexus MCP
datanexusmcp/mcp-server
Public data intelligence for AI agents — CVE, compliance, patents, contracts, domains.
- tools
- 55
- transport
- STDIO, HTTP
- last updated
- Jul 30, 2026
Install
From registry metadata$ npx add-mcp https://datanexusmcp.com/mcp --name datanexusmcpRun in your terminal. add-mcp asks which agents to add it to (Claude Code, Codex, Cursor and more). Add -g to install it for every project.
Review the command, arguments and environment values before installing. MCP servers run with your local permissions.
Other ways
Claude Code
$ claude mcp add --transport http datanexusmcp https://datanexusmcp.com/mcpRun in your terminal. Add --scope user to make it available in every project.
Tools
Verified live · 55 toolsVerified live against the running server on Nov 6, 2026.
report_feedbackReport a data quality issue or agent intent gap for a DataNexus tool response. tool_id: e.g. "T10" or "security_fetch_cve_detail". query_hash: From the query_hash field of the response. signal: incorrect_data | missing_field | stale_data | not_useful | wrong_entity | data_qual...8 params
Report a data quality issue or agent intent gap for a DataNexus tool response. tool_id: e.g. "T10" or "security_fetch_cve_detail". query_hash: From the query_hash field of the response. signal: incorrect_data | missing_field | stale_data | not_useful | wrong_entity | data_qual...
Parameters* required
commentstringDescription of the issue. Optional. Max 500 characters.default:
feedback_typestringuser_feedback (default) or agent_gap. Use agent_gap when the tool returned a valid response but did not serve the user's actual need.one of
user_feedback · agent_gapdefault: user_feedbackgap_descriptionvalueWhat was missing or wrong in the result — used when feedback_type=agent_gap. Optional. Max 256 chars.
intended_queryvalueWhat the agent was trying to accomplish — used when feedback_type=agent_gap. Optional. Max 256 chars.
missing_fieldsvalueList of field names that are absent or wrong. Optional.
query_hash*stringHash from the response being reported — found in the query_hash field of any response. Required.
signal*stringOne of incorrect_data, missing_field, stale_data, not_useful, wrong_entity, or data_quality. Required for user_feedback.
tool_id*stringTool identifier, e.g. T04 or security_fetch_cve_detail. Required.
report_mcpize_linkCheck MCPize subscription status for a DataNexus tool. tool_id: DataNexus tool identifier e.g. "T10". Pass the tool the user is asking about. Returns: status ("free" | "subscription_required" | "not_configured"), message, tool_id, and upgrade_url when subscription is required....1 params
Check MCPize subscription status for a DataNexus tool. tool_id: DataNexus tool identifier e.g. "T10". Pass the tool the user is asking about. Returns: status ("free" | "subscription_required" | "not_configured"), message, tool_id, and upgrade_url when subscription is required....
Parameters* required
tool_id*stringDataNexus tool identifier to check, e.g. "T01", "T07", "T10" — pass the ID of the tool the user is asking about.
validate_tool_outputValidate a DataNexus tool response for data quality issues using two-layer validation: deterministic rules first, then AI review for ambiguous cases. Read-only. Never blocks. tool_id: DataNexus tool identifier e.g. T04, T10, T22. Required. Find in the tool_id field of any resp...3 params
Validate a DataNexus tool response for data quality issues using two-layer validation: deterministic rules first, then AI review for ambiguous cases. Read-only. Never blocks. tool_id: DataNexus tool identifier e.g. T04, T10, T22. Required. Find in the tool_id field of any resp...
Parameters* required
query_hash*stringHash from the response being validated — found in the query_hash field of any response. Enables feedback correlation. Required.
response_json*stringThe full tool response, serialised as a JSON string, to validate for data quality issues. Required.
tool_id*stringDataNexus tool identifier, e.g. T04, T10, T22 — found in the tool_id field of any response. Required.
search_datanexus_toolsFind the right DataNexus tool by describing your task in plain English. Read-only. No side effects. Call this before any other DataNexus tool to reduce context load from 40000 to 800 tokens. query: Plain English description of your task e.g. check if a Python package has CVEs...2 params
Find the right DataNexus tool by describing your task in plain English. Read-only. No side effects. Call this before any other DataNexus tool to reduce context load from 40000 to 800 tokens. query: Plain English description of your task e.g. check if a Python package has CVEs...
Parameters* required
domainvalueRestrict results to one sub-server: nonprofit, security, compliance, domain, legal, govcon, or regulatory. Optional.
query*stringPlain English description of your task, e.g. 'check if a Python package has CVEs' or 'look up a UK charity by name'. Required.
nonprofit_fetch_nonprofit_by_einFetch IRS 990 filing data for any US nonprofit by EIN. Read-only. No side effects. Idempotent. US only. ein: 9-digit Employer ID with or without dash, e.g. 46-5734087 or 465734087. Required. Returns name, revenue, expenses, assets, NTEE code, and mission from the most recent 9...1 params
Fetch IRS 990 filing data for any US nonprofit by EIN. Read-only. No side effects. Idempotent. US only. ein: 9-digit Employer ID with or without dash, e.g. 46-5734087 or 465734087. Required. Returns name, revenue, expenses, assets, NTEE code, and mission from the most recent 9...
Parameters* required
ein*stringEIN in format XX-XXXXXXX e.g. 46-5734087. Required.
nonprofit_search_nonprofits_by_nameSearch US nonprofits by name with optional state filter. Read-only. No side effects. Idempotent. US only. Returns up to 25 matches. name: Full or partial organisation name. Required. state: Two-letter US state code e.g. CA, NY. Optional, defaults to all states. Returns EIN, na...2 params
Search US nonprofits by name with optional state filter. Read-only. No side effects. Idempotent. US only. Returns up to 25 matches. name: Full or partial organisation name. Required. state: Two-letter US state code e.g. CA, NY. Optional, defaults to all states. Returns EIN, na...
Parameters* required
name*stringOrganization name to search e.g. Red Cross. Required.
statestringTwo-letter US state code e.g. CA. Optional.default:
nonprofit_fetch_charity_ukFetch UK registered charity details by charity number or organisation name. Read-only. No side effects. Idempotent. UK only. charity_number_or_name: UK registered charity number (7 digits, e.g. 1234567) or full/partial organisation name. Required. Returns registration status,...1 params
Fetch UK registered charity details by charity number or organisation name. Read-only. No side effects. Idempotent. UK only. charity_number_or_name: UK registered charity number (7 digits, e.g. 1234567) or full/partial organisation name. Required. Returns registration status,...
Parameters* required
charity_number_or_name*stringUK charity number e.g. 1089464 or name substring. Required.
security_fetch_package_vulnerabilitiesFetch all known CVEs for an open source package version or a batch of packages. Read-only. No side effects. Idempotent. Single-package mode: package (e.g. requests), version (e.g. 2.28.0), ecosystem (PyPI/npm/Maven/Go/Cargo/NuGet/RubyGems). package_name is accepted as an alias...5 params
Fetch all known CVEs for an open source package version or a batch of packages. Read-only. No side effects. Idempotent. Single-package mode: package (e.g. requests), version (e.g. 2.28.0), ecosystem (PyPI/npm/Maven/Go/Cargo/NuGet/RubyGems). package_name is accepted as an alias...
Parameters* required
ecosystemvaluePackage ecosystem: npm, pypi, cargo, go, maven, nuget. Required.
packagevaluePackage name e.g. requests. Required in single-package mode.
package_namevalueAlias for `package`. Accepted for consistency with other DataNexus tools.
packagesvalueBatch list of {name, version, ecosystem} objects. Max 50.
versionvaluePackage version e.g. 2.28.0. Required in single-package mode.
security_fetch_dependency_graphFetch the full dependency tree for a package version including transitive dependencies. Read-only. No side effects. Idempotent. Hard 8-second timeout — large dependency trees may return partial results. package: Package name. Required. version: Exact version string e.g. 1.2.3....3 params
Fetch the full dependency tree for a package version including transitive dependencies. Read-only. No side effects. Idempotent. Hard 8-second timeout — large dependency trees may return partial results. package: Package name. Required. version: Exact version string e.g. 1.2.3....
Parameters* required
ecosystem*stringPackage ecosystem: npm, pypi, cargo, go, maven, nuget. Required.
package*stringPackage name e.g. requests. Required.
version*stringPackage version e.g. 2.28.0. Required.
security_fetch_cve_detailFetch full detail for a specific CVE by ID. Read-only. No side effects. Idempotent. cve_id: CVE identifier in format CVE-YYYY-NNNNN e.g. CVE-2021-44228. Required. Returns description, CVSS base score, affected products, patch references, and publish date. Use this when you hav...1 params
Fetch full detail for a specific CVE by ID. Read-only. No side effects. Idempotent. cve_id: CVE identifier in format CVE-YYYY-NNNNN e.g. CVE-2021-44228. Required. Returns description, CVSS base score, affected products, patch references, and publish date. Use this when you hav...
Parameters* required
cve_id*stringCVE identifier e.g. CVE-2021-44228. Required.
security_audit_sbom_vulnerabilitiesAudit a Software Bill of Materials for known vulnerabilities across all listed packages. Read-only. No side effects. Idempotent. sbom_json: CycloneDX or SPDX SBOM as a JSON string. Required. Large SBOMs (100+ packages) may take up to 10 seconds. Returns CVEs grouped by package...1 params
Audit a Software Bill of Materials for known vulnerabilities across all listed packages. Read-only. No side effects. Idempotent. sbom_json: CycloneDX or SPDX SBOM as a JSON string. Required. Large SBOMs (100+ packages) may take up to 10 seconds. Returns CVEs grouped by package...
Parameters* required
sbom_json*stringCycloneDX or SPDX SBOM as JSON string. Required.
security_fetch_package_licenceFetch the SPDX licence identifier for an open source package version. Read-only. No side effects. Idempotent. package: Package name e.g. flask. Required. version: Exact version string e.g. 2.3.0. Required. ecosystem: One of PyPI, npm, Maven, Go, Cargo, NuGet, RubyGems. Require...3 params
Fetch the SPDX licence identifier for an open source package version. Read-only. No side effects. Idempotent. package: Package name e.g. flask. Required. version: Exact version string e.g. 2.3.0. Required. ecosystem: One of PyPI, npm, Maven, Go, Cargo, NuGet, RubyGems. Require...
Parameters* required
ecosystem*stringPackage ecosystem: npm, pypi, cargo, go, maven, nuget. Required.
package*stringPackage name e.g. requests. Required.
version*stringPackage version e.g. 2.28.0. Required.
security_fetch_cisa_kevCheck whether a CVE is in the CISA Known Exploited Vulnerabilities (KEV) catalog. Read-only. No side effects. Idempotent. cve_id: CVE identifier in format CVE-YYYY-NNNNN e.g. CVE-2021-44228. Required. Returns in_kev (bool), date_added, due_date, ransomware_use, and notes from...1 params
Check whether a CVE is in the CISA Known Exploited Vulnerabilities (KEV) catalog. Read-only. No side effects. Idempotent. cve_id: CVE identifier in format CVE-YYYY-NNNNN e.g. CVE-2021-44228. Required. Returns in_kev (bool), date_added, due_date, ransomware_use, and notes from...
Parameters* required
cve_id*stringCVE identifier e.g. CVE-2021-44228. Required.
security_fetch_cve_epssEPSS exploit probability score for a CVE — predicts likelihood of exploitation in the next 30 days. cve_id: CVE identifier e.g. "CVE-2021-44228". Returns: epss (float 0.0–1.0) and percentile (float 0.0–100.0). Thresholds: >0.7 patch immediately, 0.3–0.7 patch soon, <0.3 monito...1 params
EPSS exploit probability score for a CVE — predicts likelihood of exploitation in the next 30 days. cve_id: CVE identifier e.g. "CVE-2021-44228". Returns: epss (float 0.0–1.0) and percentile (float 0.0–100.0). Thresholds: >0.7 patch immediately, 0.3–0.7 patch soon, <0.3 monito...
Parameters* required
cve_id*stringCVE identifier e.g. CVE-2021-44228. Required.
compliance_fetch_npi_providerFetch NPI registration details for a US healthcare provider by NPI number. Read-only. No side effects. Idempotent. US only. npi_number: 10-digit NPI number e.g. 1003000126. Required. Do not include dashes or spaces. Returns provider name, credential type, speciality taxonomy,...1 params
Fetch NPI registration details for a US healthcare provider by NPI number. Read-only. No side effects. Idempotent. US only. npi_number: 10-digit NPI number e.g. 1003000126. Required. Do not include dashes or spaces. Returns provider name, credential type, speciality taxonomy,...
Parameters* required
npi_number*string10-digit NPI number e.g. 1003000126. No dashes. Required.
compliance_search_npi_by_nameSearch the NPPES NPI Registry by provider name with optional state and speciality filters. Read-only. No side effects. Idempotent. US only. Returns up to 10 matches. name: Full or partial provider name. Required. state: Two-letter US state code e.g. CA. Optional. speciality: S...3 params
Search the NPPES NPI Registry by provider name with optional state and speciality filters. Read-only. No side effects. Idempotent. US only. Returns up to 10 matches. name: Full or partial provider name. Required. state: Two-letter US state code e.g. CA. Optional. speciality: S...
Parameters* required
name*stringFull or partial provider name. Required.
specialitystringSpeciality keyword e.g. Cardiology. Optional.default:
statestringTwo-letter US state code e.g. CA. Optional.default:
compliance_fetch_finra_brokerFetch FINRA BrokerCheck registration for a US broker or investment adviser by CRD number. Read-only. No side effects. Idempotent. US only. crd_number: Central Registration Depository number as a string of digits e.g. 1234567. Required. CRD number only — name lookup is not supp...1 params
Fetch FINRA BrokerCheck registration for a US broker or investment adviser by CRD number. Read-only. No side effects. Idempotent. US only. crd_number: Central Registration Depository number as a string of digits e.g. 1234567. Required. CRD number only — name lookup is not supp...
Parameters* required
crd_number*stringFINRA CRD number e.g. 149777. Required.
compliance_check_sam_exclusionCheck whether an entity is on the US federal exclusions list (debarred from government contracts). Read-only. No side effects. Idempotent. US only. name_or_ein: Entity name or 9-digit EIN with or without dash e.g. Acme Corp or 13-1234567. Required. Name match is fuzzy — verify...1 params
Check whether an entity is on the US federal exclusions list (debarred from government contracts). Read-only. No side effects. Idempotent. US only. name_or_ein: Entity name or 9-digit EIN with or without dash e.g. Acme Corp or 13-1234567. Required. Name match is fuzzy — verify...
Parameters* required
name_or_ein*stringEntity name or EIN to check SAM exclusions. Required.
domain_fetch_domain_rdapFetch domain registration details via IANA RDAP (the modern structured replacement for WHOIS). Read-only. No side effects. Idempotent. domain: Domain name without protocol e.g. example.com not https://example.com. Required. Returns registrar, registration date, expiry date, na...1 params
Fetch domain registration details via IANA RDAP (the modern structured replacement for WHOIS). Read-only. No side effects. Idempotent. domain: Domain name without protocol e.g. example.com not https://example.com. Required. Returns registrar, registration date, expiry date, na...
Parameters* required
domain*stringDomain without protocol e.g. example.com. Required.
domain_fetch_ssl_certificate_chainFetch SSL certificate history for a domain from Certificate Transparency logs. Read-only. No side effects. Idempotent. domain: Domain name without protocol e.g. github.com. Required. Does not support IP addresses or wildcard domains. Returns issuer, subject, validity period, a...1 params
Fetch SSL certificate history for a domain from Certificate Transparency logs. Read-only. No side effects. Idempotent. domain: Domain name without protocol e.g. github.com. Required. Does not support IP addresses or wildcard domains. Returns issuer, subject, validity period, a...
Parameters* required
domain*stringDomain without protocol e.g. github.com. Required.
domain_fetch_dns_recordsFetch current DNS records for a domain via Cloudflare DNS over HTTPS. Read-only. No side effects. Idempotent. domain: Domain name without protocol e.g. cloudflare.com. Required. record_types: List of DNS record types to fetch. Required. Valid values: A, AAAA, MX, TXT, NS, CNAM...2 params
Fetch current DNS records for a domain via Cloudflare DNS over HTTPS. Read-only. No side effects. Idempotent. domain: Domain name without protocol e.g. cloudflare.com. Required. record_types: List of DNS record types to fetch. Required. Valid values: A, AAAA, MX, TXT, NS, CNAM...
Parameters* required
domain*stringDomain without protocol e.g. anthropic.com. Required.
record_typesarrayDNS record types e.g. ['A','MX','TXT']. Optional.
domain_fetch_domain_historyFetch historical SSL certificate issuance for a domain from Certificate Transparency logs. Read-only. No side effects. Idempotent. domain: Domain name without protocol e.g. example.com. Required. Returns all past certificates with issuer, validity dates, and SANs in reverse ch...1 params
Fetch historical SSL certificate issuance for a domain from Certificate Transparency logs. Read-only. No side effects. Idempotent. domain: Domain name without protocol e.g. example.com. Required. Returns all past certificates with issuer, validity dates, and SANs in reverse ch...
Parameters* required
domain*stringDomain without protocol e.g. example.com. Required.
domain_fetch_subdomainsEnumerate subdomains for a domain via Certificate Transparency logs. Read-only. No side effects. Idempotent. domain: Domain name without protocol e.g. anthropic.com. Required. Returns deduplicated list of known subdomains. Primary source: crt.sh Certificate Transparency (free)...1 params
Enumerate subdomains for a domain via Certificate Transparency logs. Read-only. No side effects. Idempotent. domain: Domain name without protocol e.g. anthropic.com. Required. Returns deduplicated list of known subdomains. Primary source: crt.sh Certificate Transparency (free)...
Parameters* required
domain*stringDomain without protocol e.g. anthropic.com. Required.
domain_check_email_securityCheck SPF, DMARC, and DKIM email authentication for a domain. domain: Domain without protocol e.g. "google.com". Returns: overall_grade (A–F), spf_score, dmarc_score, dkim_score (each 0–10), spf_record, dmarc_record, dkim_selectors_found. Scores reflect live DNS via Cloudflare...1 params
Check SPF, DMARC, and DKIM email authentication for a domain. domain: Domain without protocol e.g. "google.com". Returns: overall_grade (A–F), spf_score, dmarc_score, dkim_score (each 0–10), spf_record, dmarc_record, dkim_selectors_found. Scores reflect live DNS via Cloudflare...
Parameters* required
domain*stringDomain without protocol e.g. google.com. Required.
domain_fetch_reverse_ipFind domains co-hosted on the same IP address (reverse IP lookup). Read-only. No side effects. Idempotent. domain_or_ip: Domain name (e.g. shared.dreamhost.com) or IPv4 address (e.g. 1.2.3.4). Required. If a domain is given, it is first resolved to its IPv4 A record. IPv6-only...1 params
Find domains co-hosted on the same IP address (reverse IP lookup). Read-only. No side effects. Idempotent. domain_or_ip: Domain name (e.g. shared.dreamhost.com) or IPv4 address (e.g. 1.2.3.4). Required. If a domain is given, it is first resolved to its IPv4 A record. IPv6-only...
Parameters* required
domain_or_ip*stringDomain e.g. shared.dreamhost.com or IPv4 e.g. 1.2.3.4. Required.
legal_fetch_patent_by_numberFetch full patent details by patent number and jurisdiction. Read-only. No side effects. Idempotent. patent_number: Patent number in EPODOC format e.g. EP1000000 for European, CN120586032 for Chinese, JP2020123456 for Japanese, WO2020123456 for PCT, US10000000 for US. Required...2 params
Fetch full patent details by patent number and jurisdiction. Read-only. No side effects. Idempotent. patent_number: Patent number in EPODOC format e.g. EP1000000 for European, CN120586032 for Chinese, JP2020123456 for Japanese, WO2020123456 for PCT, US10000000 for US. Required...
Parameters* required
jurisdictionstringPatent office code: EP, US, WO. Default EP. Optional.default: EP
patent_number*stringPatent number e.g. EP3456789 or US10123456. Required.
legal_search_patents_by_keywordSearch patents by keyword across EPO, USPTO, or WIPO. Read-only. No side effects. Idempotent. Returns up to 10 matches. keywords: Search terms describing the invention e.g. neural network image classification. Required. jurisdiction: One of EP, US, or WO. Optional. Default EP....3 params
Search patents by keyword across EPO, USPTO, or WIPO. Read-only. No side effects. Idempotent. Returns up to 10 matches. keywords: Search terms describing the invention e.g. neural network image classification. Required. jurisdiction: One of EP, US, or WO. Optional. Default EP....
Parameters* required
date_fromstringEarliest filing date ISO 8601 e.g. 2020-01-31. Optional.default:
jurisdictionstringPatent office code: EP, US, WO. Default EP. Optional.default: EP
keywords*stringSearch keyword or phrase e.g. CRISPR gene editing. Required.
legal_fetch_patent_citationsFetch forward and backward citation chains for a specific patent. Read-only. No side effects. Idempotent. patent_number: Patent number in EPODOC format e.g. EP1000000 for European, CN120586032 for Chinese, JP2020123456 for Japanese, WO2020123456 for PCT, US10000000 for US. Req...2 params
Fetch forward and backward citation chains for a specific patent. Read-only. No side effects. Idempotent. patent_number: Patent number in EPODOC format e.g. EP1000000 for European, CN120586032 for Chinese, JP2020123456 for Japanese, WO2020123456 for PCT, US10000000 for US. Req...
Parameters* required
jurisdictionstringPatent office code: EP, US, WO. Default EP. Optional.default: EP
patent_number*stringPatent number e.g. EP3456789 or US10123456. Required.
legal_fetch_inventor_portfolioFetch the patent portfolio for a named inventor with optional assignee filter. Read-only. No side effects. Idempotent. inventor_name: Inventor surname or full name e.g. Smith or John Smith. Required. Fuzzy match — common names may return many results. assignee: Company or orga...2 params
Fetch the patent portfolio for a named inventor with optional assignee filter. Read-only. No side effects. Idempotent. inventor_name: Inventor surname or full name e.g. Smith or John Smith. Required. Fuzzy match — common names may return many results. assignee: Company or orga...
Parameters* required
assigneestringCompany name to filter results e.g. Apple Inc. Optional.default:
inventor_name*stringInventor surname or full name e.g. John Smith. Required.
govcon_search_contract_awardsSearch government contract awards by keyword, agency, and date range. keyword: Contract scope e.g. "cybersecurity software". agency: Awarding agency e.g. "Department of Defense". Optional. date_from: Earliest award date ISO 8601 e.g. "2024-01-31". Optional. jurisdiction: "US",...4 params
Search government contract awards by keyword, agency, and date range. keyword: Contract scope e.g. "cybersecurity software". agency: Awarding agency e.g. "Department of Defense". Optional. date_from: Earliest award date ISO 8601 e.g. "2024-01-31". Optional. jurisdiction: "US",...
Parameters* required
agencystringAwarding agency name e.g. Department of Defense. Optional.default:
date_fromstringEarliest award date ISO 8601 e.g. 2024-01-31. Optional.default:
jurisdictionstringJurisdiction: US, EU, or UK. Default US. Optional.default: US
keyword*stringSearch terms describing the contract scope e.g. cybersecurity software. Required.
govcon_fetch_vendor_contract_historyFetch the complete federal contract award history for a specific vendor. Read-only. No side effects. Idempotent. vendor_name: Company or organisation name e.g. Booz Allen Hamilton. Required. Fuzzy match used. jurisdiction: One of US, EU, or UK. Optional. Default US. Returns to...2 params
Fetch the complete federal contract award history for a specific vendor. Read-only. No side effects. Idempotent. vendor_name: Company or organisation name e.g. Booz Allen Hamilton. Required. Fuzzy match used. jurisdiction: One of US, EU, or UK. Optional. Default US. Returns to...
Parameters* required
jurisdictionstringJurisdiction: US, EU, or UK. Default US. Optional.default: US
vendor_name*stringVendor or company name to search e.g. Booz Allen Hamilton. Required.
govcon_fetch_open_solicitationsFetch currently open government contract solicitations matching a keyword. Read-only. No side effects. Idempotent. keyword: Description of goods or services sought e.g. cloud computing services. Required. Encode special characters — + becomes %2B. agency: Awarding agency name....3 params
Fetch currently open government contract solicitations matching a keyword. Read-only. No side effects. Idempotent. keyword: Description of goods or services sought e.g. cloud computing services. Required. Encode special characters — + becomes %2B. agency: Awarding agency name....
Parameters* required
agencystringAwarding agency name. Optional, defaults to all agencies.default:
jurisdictionstringJurisdiction: US, EU, or UK. Default US. Optional.default: US
keyword*stringDescription of goods or services sought e.g. cloud computing. Required.
regulatory_search_open_rulemakingsSearch open rulemakings and public comment periods on Regulations.gov and the Federal Register. Read-only. No side effects. Idempotent. US federal only. keyword: Topic keywords e.g. artificial intelligence, data privacy. Required. agency: Agency abbreviation e.g. FTC, FDA, SEC...3 params
Search open rulemakings and public comment periods on Regulations.gov and the Federal Register. Read-only. No side effects. Idempotent. US federal only. keyword: Topic keywords e.g. artificial intelligence, data privacy. Required. agency: Agency abbreviation e.g. FTC, FDA, SEC...
Parameters* required
agencystringAgency abbreviation e.g. FTC, FDA, SEC. Optional.default:
keyword*stringTopic keywords e.g. artificial intelligence. Required.
statusstringFilter: open, closed, or all. Default open. Optional.default: open
regulatory_fetch_docket_detailsFetch full details for a specific regulatory docket by ID. Read-only. No side effects. Idempotent. US federal only. docket_id: Docket identifier in agency format e.g. EPA-HQ-OAR-2021-0317 or FTC-2024-0041. Required. Timeout is 30 seconds — large dockets may be slow. Returns do...1 params
Fetch full details for a specific regulatory docket by ID. Read-only. No side effects. Idempotent. US federal only. docket_id: Docket identifier in agency format e.g. EPA-HQ-OAR-2021-0317 or FTC-2024-0041. Required. Timeout is 30 seconds — large dockets may be slow. Returns do...
Parameters* required
docket_id*stringDocket ID e.g. EPA-HQ-OAR-2021-0668. Required.
regulatory_fetch_federal_register_noticesFetch recent Federal Register notices and rules for a specific agency. Read-only. No side effects. Idempotent. US federal only. agency: Agency name or abbreviation e.g. SEC, Food and Drug Administration, EPA. Required. keyword: Optional topic filter e.g. cryptocurrency. Option...3 params
Fetch recent Federal Register notices and rules for a specific agency. Read-only. No side effects. Idempotent. US federal only. agency: Agency name or abbreviation e.g. SEC, Food and Drug Administration, EPA. Required. keyword: Optional topic filter e.g. cryptocurrency. Option...
Parameters* required
agency*stringAgency name or abbreviation e.g. SEC, EPA. Required.
date_fromstringEarliest publication date ISO 8601 e.g. 2024-01-31. Optional.default:
keywordstringOptional topic filter e.g. cryptocurrency. Optional.default:
security_fetch_package_maintainer_historyAnalyse ownership and release history for an npm or PyPI package to detect supply-chain risk. Uses PyPI JSON API and npm registry — data refreshed on each call, 1-hour cache. Returns maintainer_count, recent_changes, ownership_transfers, account_ages, anomaly_score (0.0–1.0),...2 params
Analyse ownership and release history for an npm or PyPI package to detect supply-chain risk. Uses PyPI JSON API and npm registry — data refreshed on each call, 1-hour cache. Returns maintainer_count, recent_changes, ownership_transfers, account_ages, anomaly_score (0.0–1.0),...
Parameters* required
ecosystem*stringPackage ecosystem: npm, pypi, cargo, go. Required.one of
npm · pypi · cargo · gopackage_name*stringPackage name e.g. requests. Required.
security_fetch_package_risk_briefSingle SHIP/CAUTION/BLOCK verdict for any package. Combines CVEs, licence, maintainer health, and transitive count in one call. Uses OSV.dev, deps.dev, PyPI, and npm registry — data refreshed on each call. Returns verdict (SHIP/CAUTION/BLOCK), critical_cve_count, high_cve_coun...3 params
Single SHIP/CAUTION/BLOCK verdict for any package. Combines CVEs, licence, maintainer health, and transitive count in one call. Uses OSV.dev, deps.dev, PyPI, and npm registry — data refreshed on each call. Returns verdict (SHIP/CAUTION/BLOCK), critical_cve_count, high_cve_coun...
Parameters* required
ecosystem*stringPackage ecosystem: npm, pypi, cargo, go, maven. Required.one of
npm · pypi · go · cargo · mavenpackage_name*stringPackage name e.g. requests. Required.
versionvaluePackage version e.g. 2.28.0. Required.
security_detect_typosquattingDetect typosquatting attacks against a package name. Compares using Damerau-Levenshtein distance ≤ 2 against top-10,000 packages. Returns similar_packages with anomaly scores, and a SUSPICIOUS or CLEAN verdict. Uses PyPI and npm download stats stored in Redis. Cold-start fetch...2 params
Detect typosquatting attacks against a package name. Compares using Damerau-Levenshtein distance ≤ 2 against top-10,000 packages. Returns similar_packages with anomaly scores, and a SUSPICIOUS or CLEAN verdict. Uses PyPI and npm download stats stored in Redis. Cold-start fetch...
Parameters* required
ecosystem*stringPackage ecosystem: npm, pypi, cargo, go. Required.one of
npm · pypi · cargo · gopackage_name*stringPackage name e.g. requests. Required.
nonprofit_fetch_nonprofit_full_profileComplete nonprofit due diligence in one call. Revenue trends, executive pay, risk flags, and a health score from IRS 990 data. Uses ProPublica Nonprofit Explorer API with IRS e-File fallback. Data refreshed on each call. Returns financials, executive_compensation, risk_flags,...1 params
Complete nonprofit due diligence in one call. Revenue trends, executive pay, risk flags, and a health score from IRS 990 data. Uses ProPublica Nonprofit Explorer API with IRS e-File fallback. Data refreshed on each call. Returns financials, executive_compensation, risk_flags,...
Parameters* required
ein*stringEIN in format XX-XXXXXXX e.g. 46-5734087. Required.
security_fetch_cve_watchPersistent CVE watchlist. Create once, check anytime for new events since your last visit — patch releases, KEV listings, PoC publications, exploitation detected. Uses Redis for persistence, NVD + CISA KEV + EPSS for daily background refresh. Returns has_new_events, events (li...3 params
Persistent CVE watchlist. Create once, check anytime for new events since your last visit — patch releases, KEV listings, PoC publications, exploitation detected. Uses Redis for persistence, NVD + CISA KEV + EPSS for daily background refresh. Returns has_new_events, events (li...
Parameters* required
action*stringAction: create, check, or delete the watchlist. Required.one of
create · check · deletecve_ids*arrayList of CVE IDs to watch e.g. ['CVE-2021-44228']. Required for create.
watch_id*stringUnique watch identifier to create, check, or delete. Required.
security_audit_sbom_continuousPersistent SBOM watch. Register once, check anytime for new CVEs affecting your dependency snapshot. Silent permanent watch — CycloneDX and SPDX supported. Uses OSV.dev for vulnerability lookup, Redis for persistence with 90-day TTL. Supports CycloneDX 1.4/1.5 and SPDX 2.3 JSO...3 params
Persistent SBOM watch. Register once, check anytime for new CVEs affecting your dependency snapshot. Silent permanent watch — CycloneDX and SPDX supported. Uses OSV.dev for vulnerability lookup, Redis for persistence with 90-day TTL. Supports CycloneDX 1.4/1.5 and SPDX 2.3 JSO...
Parameters* required
action*stringAction: register, check, or deregister the SBOM watch. Required.one of
register · check · deregistersbom*stringCycloneDX or SPDX SBOM as JSON string. Required for register action.
watch_id*stringUnique watch identifier for this SBOM watch. Required.
security_fetch_licence_analysisUnderstand any software licence in plain English. Returns obligations, permissions, limitations, risk level, and OSI/FSF status for any SPDX licence identifier. Static bundle covers top-50 common licences (no network call). Falls back to spdx.org API for rare identifiers. All...1 params
Understand any software licence in plain English. Returns obligations, permissions, limitations, risk level, and OSI/FSF status for any SPDX licence identifier. Static bundle covers top-50 common licences (no network call). Falls back to spdx.org API for rare identifiers. All...
Parameters* required
spdx_id*stringSPDX licence identifier e.g. MIT, Apache-2.0, GPL-3.0. Required.
security_audit_licence_compatibilityAudit the licence compatibility of your entire dependency list. Input package names (with ecosystem) or SPDX IDs; get a COMPATIBLE/CONFLICT verdict with specific conflicting pairs and recommended action. Uses static SPDX compatibility table — no network call for spdx_ids path....2 params
Audit the licence compatibility of your entire dependency list. Input package names (with ecosystem) or SPDX IDs; get a COMPATIBLE/CONFLICT verdict with specific conflicting pairs and recommended action. Uses static SPDX compatibility table — no network call for spdx_ids path....
Parameters* required
packagesvalueList of {name, ecosystem} dicts to check compatibility. Optional.
spdx_idsvalueList of SPDX licence identifiers to check compatibility. Optional.
security_fetch_cve_risk_summaryInstant CVE risk verdict. Combines CVSS severity, CISA KEV exploitation status, and EPSS probability in one parallel call. Returns CRITICAL_EXPLOIT, HIGH_RISK, MODERATE, LOW, or UNKNOWN verdict with patch availability from vendor advisories. UNKNOWN means all upstream sources...1 params
Instant CVE risk verdict. Combines CVSS severity, CISA KEV exploitation status, and EPSS probability in one parallel call. Returns CRITICAL_EXPLOIT, HIGH_RISK, MODERATE, LOW, or UNKNOWN verdict with patch availability from vendor advisories. UNKNOWN means all upstream sources...
Parameters* required
cve_id*stringCVE identifier e.g. CVE-2021-44228. Required.
nonprofit_search_nonprofits_by_categorySearch US nonprofits by mission category and state. Returns up to 25 results with revenue, assets, and health scores (0–100). Category maps to NTEE codes: education, healthcare, arts, environment, human_services, civil_rights, international, religion, science, sports. Raw NTEE...2 params
Search US nonprofits by mission category and state. Returns up to 25 results with revenue, assets, and health scores (0–100). Category maps to NTEE codes: education, healthcare, arts, environment, human_services, civil_rights, international, religion, science, sports. Raw NTEE...
Parameters* required
category*stringNTEE category e.g. education, healthcare, arts. Required.
statevalueTwo-letter US state code e.g. CA. Optional.
nonprofit_fetch_nonprofit_financial_trends5-year financial trend for any US nonprofit. Revenue growth, expense ratios, reserve trajectory, and health score history from IRS Form 990 data via ProPublica. Returns trend_direction (GROWING/STABLE/DECLINING/VOLATILE/INSUFFICIENT_DATA), CAGR, and year-by-year revenue, expen...2 params
5-year financial trend for any US nonprofit. Revenue growth, expense ratios, reserve trajectory, and health score history from IRS Form 990 data via ProPublica. Returns trend_direction (GROWING/STABLE/DECLINING/VOLATILE/INSUFFICIENT_DATA), CAGR, and year-by-year revenue, expen...
Parameters* required
ein*stringEIN in format XX-XXXXXXX e.g. 46-5734087. Required.
yearsintegerNumber of years of trend data 1-10. Default 5. Optional.default: 5
apikeys_generate_api_keyGenerate a DataNexus API key for the given email address. Anonymous callers get 10 free lookups/week; a registered free key unlocks 100/week. Store the returned key — it is shown only once. Pass it as the X-Api-Key header on future requests. Rate limit: 3 keys per IP per 24 ho...1 params
Generate a DataNexus API key for the given email address. Anonymous callers get 10 free lookups/week; a registered free key unlocks 100/week. Store the returned key — it is shown only once. Pass it as the X-Api-Key header on future requests. Rate limit: 3 keys per IP per 24 ho...
Parameters* required
email*stringEmail address to associate with the new API key. Used for delivery and repeat-signup lookup. Required.
apikeys_rotate_api_key⚠️ DESTRUCTIVE — requires human confirmation before use in automated pipelines. Revoke the current API key and issue a replacement. Returns the new key once — store it immediately. Pass keys as the X-DataNexus-Key header.1 params
⚠️ DESTRUCTIVE — requires human confirmation before use in automated pipelines. Revoke the current API key and issue a replacement. Returns the new key once — store it immediately. Pass keys as the X-DataNexus-Key header.
Parameters* required
current_key*stringExisting active API key (dnx_...) to revoke and replace. Required.
apikeys_revoke_api_key⚠️ DESTRUCTIVE — requires human confirmation before use in automated pipelines. Permanently revoke a DataNexus API key. The key will stop working immediately. This action cannot be undone — generate a new key if access is needed again.1 params
⚠️ DESTRUCTIVE — requires human confirmation before use in automated pipelines. Permanently revoke a DataNexus API key. The key will stop working immediately. This action cannot be undone — generate a new key if access is needed again.
Parameters* required
key*stringAPI key (dnx_...) to permanently revoke. Required.
security_audit_sbom_license_policyAudit a CycloneDX or SPDX SBOM against an SPDX licence policy and return a PASS/WARN/BLOCK verdict. sbom: Full SBOM as a JSON string — CycloneDX or SPDX format. Required. 500 KB max. policy: Optional dict with block/warn/allow arrays of exact SPDX licence identifiers (e.g. GPL...2 params
Audit a CycloneDX or SPDX SBOM against an SPDX licence policy and return a PASS/WARN/BLOCK verdict. sbom: Full SBOM as a JSON string — CycloneDX or SPDX format. Required. 500 KB max. policy: Optional dict with block/warn/allow arrays of exact SPDX licence identifiers (e.g. GPL...
Parameters* required
policyvaluePolicy dict with block/warn/allow arrays of SPDX licence IDs. Optional.
sbom*stringCycloneDX or SPDX SBOM as JSON string. Required. 500 KB max.
security_fetch_cve_watch_statusCheck all specified CVE watches for new events since your last poll. Returns only watches with new events, making it efficient to run on a schedule. watch_ids: List of watch IDs to check — same IDs used when creating watches with security_fetch_cve_watch. Required. Uses a per-...1 params
Check all specified CVE watches for new events since your last poll. Returns only watches with new events, making it efficient to run on a schedule. watch_ids: List of watch IDs to check — same IDs used when creating watches with security_fetch_cve_watch. Required. Uses a per-...
Parameters* required
watch_ids*arrayList of watch IDs to check e.g. ['watch-1','watch-2']. Required.
frontend_security_detect_typosquattingTyposquatting detection optimised for the top 500 frontend packages (React, Vite, Axios, Lodash, etc.). Fewer false positives than a full npm scan. For backend packages, use security_detect_typosquatting instead. package_name: Package name to check. Required. ecosystem: npm or...2 params
Typosquatting detection optimised for the top 500 frontend packages (React, Vite, Axios, Lodash, etc.). Fewer false positives than a full npm scan. For backend packages, use security_detect_typosquatting instead. package_name: Package name to check. Required. ecosystem: npm or...
Parameters* required
ecosystemstringPackage ecosystem: npm or pypi. Default npm.one of
npm · pypidefault: npmpackage_name*stringPackage name e.g. requests. Required.
frontend_security_audit_manifestAudit a frontend package.json for security risks — returns a single SHIP/CAUTION/BLOCK verdict with licence risks and abandonment signals. Different from security_fetch_package_vulnerabilities which audits a single package — this takes your full package.json. manifest: Content...2 params
Audit a frontend package.json for security risks — returns a single SHIP/CAUTION/BLOCK verdict with licence risks and abandonment signals. Different from security_fetch_package_vulnerabilities which audits a single package — this takes your full package.json. manifest: Content...
Parameters* required
lockfilevalueContents of package-lock.json or yarn.lock. Optional.
manifest*stringContents of package.json as a string. Required. 500 KB max.
frontend_security_audit_ci_pipelineScan GitHub Actions, Vercel, or Netlify CI configs for exposed secrets, missing lockfile enforcement, and unpinned dependencies. Paste your config content — no filesystem access required. config: Raw YAML/TOML content of your CI config. Required. 500 KB max. config_type: githu...2 params
Scan GitHub Actions, Vercel, or Netlify CI configs for exposed secrets, missing lockfile enforcement, and unpinned dependencies. Paste your config content — no filesystem access required. config: Raw YAML/TOML content of your CI config. Required. 500 KB max. config_type: githu...
Parameters* required
config*stringRaw YAML/TOML content of your CI config. Required. 500 KB max.
config_typestringCI config type: github_actions, vercel, or netlify. Default github_actions.one of
github_actions · vercel · netlifydefault: github_actionsfrontend_security_fetch_package_risk_briefSHIP/CAUTION/BLOCK risk brief for an npm package with frontend-specific context. Wraps security_fetch_package_risk_brief restricted to npm, and adds weekly_downloads and is_ui_component signals. package_name: npm package name. Required. version: Optional pinned version — lates...2 params
SHIP/CAUTION/BLOCK risk brief for an npm package with frontend-specific context. Wraps security_fetch_package_risk_brief restricted to npm, and adds weekly_downloads and is_ui_component signals. package_name: npm package name. Required. version: Optional pinned version — lates...
Parameters* required
package_name*stringPackage name e.g. requests. Required.
versionvaluePackage version e.g. 2.28.0. Optional.
Sponsors
Promote your product hereReach 125k+ visitors monthlyPromote your product hereReach 125k+ visitors monthly
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any language
Agent CaffeineSponsoredClose your lid, come back to finished workSnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthlyWaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthlyknobsSponsoredSee your site on any phone, any day, in any languageReadme
Details
- Repository
- github.com/datanexusmcp/mcp-server
- Categories
- Security & Pentesting, Data & Analytics
- Package
@datanexusmcp/mcp-server- Transport
- STDIO, HTTP
- Registry
- MCP registry, active
- Tools verified
- Nov 6, 2026
