DataNexus MCP

datanexusmcp/mcp-server

Public data intelligence for AI agents — CVE, compliance, patents, contracts, domains.

tools: 55
transport: STDIO, HTTP
last updated: Jul 30, 2026

View on GitHub

Install

From registry metadata

$ npx add-mcp https://datanexusmcp.com/mcp --name datanexusmcp

Run in your terminal. add-mcp asks which agents to add it to (Claude Code, Codex, Cursor and more). Add -g to install it for every project.

Review the command, arguments and environment values before installing. MCP servers run with your local permissions.

Other ways

Claude Code

$ claude mcp add --transport http datanexusmcp https://datanexusmcp.com/mcp

Run in your terminal. Add --scope user to make it available in every project.

Tools

Verified live · 55 tools

Verified live against the running server on Nov 6, 2026.

report_feedbackReport a data quality issue or agent intent gap for a DataNexus tool response. tool_id: e.g. "T10" or "security_fetch_cve_detail". query_hash: From the query_hash field of the response. signal: incorrect_data | missing_field | stale_data | not_useful | wrong_entity | data_qual...8 params

Report a data quality issue or agent intent gap for a DataNexus tool response. tool_id: e.g. "T10" or "security_fetch_cve_detail". query_hash: From the query_hash field of the response. signal: incorrect_data | missing_field | stale_data | not_useful | wrong_entity | data_qual...

Parameters* required

commentstring

Description of the issue. Optional. Max 500 characters.default:

feedback_typestring

user_feedback (default) or agent_gap. Use agent_gap when the tool returned a valid response but did not serve the user's actual need.one of user_feedback · agent_gapdefault: user_feedback

gap_descriptionvalue

What was missing or wrong in the result — used when feedback_type=agent_gap. Optional. Max 256 chars.

intended_queryvalue

What the agent was trying to accomplish — used when feedback_type=agent_gap. Optional. Max 256 chars.

missing_fieldsvalue

List of field names that are absent or wrong. Optional.

query_hash*string

Hash from the response being reported — found in the query_hash field of any response. Required.

signal*string

One of incorrect_data, missing_field, stale_data, not_useful, wrong_entity, or data_quality. Required for user_feedback.

tool_id*string

Tool identifier, e.g. T04 or security_fetch_cve_detail. Required.

report_mcpize_linkCheck MCPize subscription status for a DataNexus tool. tool_id: DataNexus tool identifier e.g. "T10". Pass the tool the user is asking about. Returns: status ("free" | "subscription_required" | "not_configured"), message, tool_id, and upgrade_url when subscription is required....1 params

Check MCPize subscription status for a DataNexus tool. tool_id: DataNexus tool identifier e.g. "T10". Pass the tool the user is asking about. Returns: status ("free" | "subscription_required" | "not_configured"), message, tool_id, and upgrade_url when subscription is required....

Parameters* required

tool_id*string

DataNexus tool identifier to check, e.g. "T01", "T07", "T10" — pass the ID of the tool the user is asking about.

validate_tool_outputValidate a DataNexus tool response for data quality issues using two-layer validation: deterministic rules first, then AI review for ambiguous cases. Read-only. Never blocks. tool_id: DataNexus tool identifier e.g. T04, T10, T22. Required. Find in the tool_id field of any resp...3 params

Validate a DataNexus tool response for data quality issues using two-layer validation: deterministic rules first, then AI review for ambiguous cases. Read-only. Never blocks. tool_id: DataNexus tool identifier e.g. T04, T10, T22. Required. Find in the tool_id field of any resp...

Parameters* required

query_hash*string

Hash from the response being validated — found in the query_hash field of any response. Enables feedback correlation. Required.

response_json*string

The full tool response, serialised as a JSON string, to validate for data quality issues. Required.

tool_id*string

DataNexus tool identifier, e.g. T04, T10, T22 — found in the tool_id field of any response. Required.

search_datanexus_toolsFind the right DataNexus tool by describing your task in plain English. Read-only. No side effects. Call this before any other DataNexus tool to reduce context load from 40000 to 800 tokens. query: Plain English description of your task e.g. check if a Python package has CVEs...2 params

Find the right DataNexus tool by describing your task in plain English. Read-only. No side effects. Call this before any other DataNexus tool to reduce context load from 40000 to 800 tokens. query: Plain English description of your task e.g. check if a Python package has CVEs...

Parameters* required

domainvalue

Restrict results to one sub-server: nonprofit, security, compliance, domain, legal, govcon, or regulatory. Optional.

query*string

Plain English description of your task, e.g. 'check if a Python package has CVEs' or 'look up a UK charity by name'. Required.

nonprofit_fetch_nonprofit_by_einFetch IRS 990 filing data for any US nonprofit by EIN. Read-only. No side effects. Idempotent. US only. ein: 9-digit Employer ID with or without dash, e.g. 46-5734087 or 465734087. Required. Returns name, revenue, expenses, assets, NTEE code, and mission from the most recent 9...1 params

Fetch IRS 990 filing data for any US nonprofit by EIN. Read-only. No side effects. Idempotent. US only. ein: 9-digit Employer ID with or without dash, e.g. 46-5734087 or 465734087. Required. Returns name, revenue, expenses, assets, NTEE code, and mission from the most recent 9...

Parameters* required

ein*string

EIN in format XX-XXXXXXX e.g. 46-5734087. Required.

nonprofit_search_nonprofits_by_nameSearch US nonprofits by name with optional state filter. Read-only. No side effects. Idempotent. US only. Returns up to 25 matches. name: Full or partial organisation name. Required. state: Two-letter US state code e.g. CA, NY. Optional, defaults to all states. Returns EIN, na...2 params

Search US nonprofits by name with optional state filter. Read-only. No side effects. Idempotent. US only. Returns up to 25 matches. name: Full or partial organisation name. Required. state: Two-letter US state code e.g. CA, NY. Optional, defaults to all states. Returns EIN, na...

Parameters* required

name*string

Organization name to search e.g. Red Cross. Required.

statestring

Two-letter US state code e.g. CA. Optional.default:

nonprofit_fetch_charity_ukFetch UK registered charity details by charity number or organisation name. Read-only. No side effects. Idempotent. UK only. charity_number_or_name: UK registered charity number (7 digits, e.g. 1234567) or full/partial organisation name. Required. Returns registration status,...1 params

Fetch UK registered charity details by charity number or organisation name. Read-only. No side effects. Idempotent. UK only. charity_number_or_name: UK registered charity number (7 digits, e.g. 1234567) or full/partial organisation name. Required. Returns registration status,...

Parameters* required

charity_number_or_name*string

UK charity number e.g. 1089464 or name substring. Required.

security_fetch_package_vulnerabilitiesFetch all known CVEs for an open source package version or a batch of packages. Read-only. No side effects. Idempotent. Single-package mode: package (e.g. requests), version (e.g. 2.28.0), ecosystem (PyPI/npm/Maven/Go/Cargo/NuGet/RubyGems). package_name is accepted as an alias...5 params

Fetch all known CVEs for an open source package version or a batch of packages. Read-only. No side effects. Idempotent. Single-package mode: package (e.g. requests), version (e.g. 2.28.0), ecosystem (PyPI/npm/Maven/Go/Cargo/NuGet/RubyGems). package_name is accepted as an alias...

Parameters* required

ecosystemvalue

Package ecosystem: npm, pypi, cargo, go, maven, nuget. Required.

packagevalue

Package name e.g. requests. Required in single-package mode.

package_namevalue

Alias for `package`. Accepted for consistency with other DataNexus tools.

packagesvalue

Batch list of {name, version, ecosystem} objects. Max 50.

versionvalue

Package version e.g. 2.28.0. Required in single-package mode.

security_fetch_dependency_graphFetch the full dependency tree for a package version including transitive dependencies. Read-only. No side effects. Idempotent. Hard 8-second timeout — large dependency trees may return partial results. package: Package name. Required. version: Exact version string e.g. 1.2.3....3 params

Fetch the full dependency tree for a package version including transitive dependencies. Read-only. No side effects. Idempotent. Hard 8-second timeout — large dependency trees may return partial results. package: Package name. Required. version: Exact version string e.g. 1.2.3....

Parameters* required

ecosystem*string

Package ecosystem: npm, pypi, cargo, go, maven, nuget. Required.

package*string

Package name e.g. requests. Required.

version*string

Package version e.g. 2.28.0. Required.

security_fetch_cve_detailFetch full detail for a specific CVE by ID. Read-only. No side effects. Idempotent. cve_id: CVE identifier in format CVE-YYYY-NNNNN e.g. CVE-2021-44228. Required. Returns description, CVSS base score, affected products, patch references, and publish date. Use this when you hav...1 params

Fetch full detail for a specific CVE by ID. Read-only. No side effects. Idempotent. cve_id: CVE identifier in format CVE-YYYY-NNNNN e.g. CVE-2021-44228. Required. Returns description, CVSS base score, affected products, patch references, and publish date. Use this when you hav...

Parameters* required

cve_id*string

CVE identifier e.g. CVE-2021-44228. Required.

security_audit_sbom_vulnerabilitiesAudit a Software Bill of Materials for known vulnerabilities across all listed packages. Read-only. No side effects. Idempotent. sbom_json: CycloneDX or SPDX SBOM as a JSON string. Required. Large SBOMs (100+ packages) may take up to 10 seconds. Returns CVEs grouped by package...1 params

Audit a Software Bill of Materials for known vulnerabilities across all listed packages. Read-only. No side effects. Idempotent. sbom_json: CycloneDX or SPDX SBOM as a JSON string. Required. Large SBOMs (100+ packages) may take up to 10 seconds. Returns CVEs grouped by package...

Parameters* required

sbom_json*string

CycloneDX or SPDX SBOM as JSON string. Required.

security_fetch_package_licenceFetch the SPDX licence identifier for an open source package version. Read-only. No side effects. Idempotent. package: Package name e.g. flask. Required. version: Exact version string e.g. 2.3.0. Required. ecosystem: One of PyPI, npm, Maven, Go, Cargo, NuGet, RubyGems. Require...3 params

Fetch the SPDX licence identifier for an open source package version. Read-only. No side effects. Idempotent. package: Package name e.g. flask. Required. version: Exact version string e.g. 2.3.0. Required. ecosystem: One of PyPI, npm, Maven, Go, Cargo, NuGet, RubyGems. Require...

Parameters* required

ecosystem*string

Package ecosystem: npm, pypi, cargo, go, maven, nuget. Required.

package*string

Package name e.g. requests. Required.

version*string

Package version e.g. 2.28.0. Required.

security_fetch_cisa_kevCheck whether a CVE is in the CISA Known Exploited Vulnerabilities (KEV) catalog. Read-only. No side effects. Idempotent. cve_id: CVE identifier in format CVE-YYYY-NNNNN e.g. CVE-2021-44228. Required. Returns in_kev (bool), date_added, due_date, ransomware_use, and notes from...1 params

Check whether a CVE is in the CISA Known Exploited Vulnerabilities (KEV) catalog. Read-only. No side effects. Idempotent. cve_id: CVE identifier in format CVE-YYYY-NNNNN e.g. CVE-2021-44228. Required. Returns in_kev (bool), date_added, due_date, ransomware_use, and notes from...

Parameters* required

cve_id*string

CVE identifier e.g. CVE-2021-44228. Required.

security_fetch_cve_epssEPSS exploit probability score for a CVE — predicts likelihood of exploitation in the next 30 days. cve_id: CVE identifier e.g. "CVE-2021-44228". Returns: epss (float 0.0–1.0) and percentile (float 0.0–100.0). Thresholds: >0.7 patch immediately, 0.3–0.7 patch soon, <0.3 monito...1 params

EPSS exploit probability score for a CVE — predicts likelihood of exploitation in the next 30 days. cve_id: CVE identifier e.g. "CVE-2021-44228". Returns: epss (float 0.0–1.0) and percentile (float 0.0–100.0). Thresholds: >0.7 patch immediately, 0.3–0.7 patch soon, <0.3 monito...

Parameters* required

cve_id*string

CVE identifier e.g. CVE-2021-44228. Required.

compliance_fetch_npi_providerFetch NPI registration details for a US healthcare provider by NPI number. Read-only. No side effects. Idempotent. US only. npi_number: 10-digit NPI number e.g. 1003000126. Required. Do not include dashes or spaces. Returns provider name, credential type, speciality taxonomy,...1 params

Fetch NPI registration details for a US healthcare provider by NPI number. Read-only. No side effects. Idempotent. US only. npi_number: 10-digit NPI number e.g. 1003000126. Required. Do not include dashes or spaces. Returns provider name, credential type, speciality taxonomy,...

Parameters* required

npi_number*string

10-digit NPI number e.g. 1003000126. No dashes. Required.

compliance_search_npi_by_nameSearch the NPPES NPI Registry by provider name with optional state and speciality filters. Read-only. No side effects. Idempotent. US only. Returns up to 10 matches. name: Full or partial provider name. Required. state: Two-letter US state code e.g. CA. Optional. speciality: S...3 params

Search the NPPES NPI Registry by provider name with optional state and speciality filters. Read-only. No side effects. Idempotent. US only. Returns up to 10 matches. name: Full or partial provider name. Required. state: Two-letter US state code e.g. CA. Optional. speciality: S...

Parameters* required

name*string

Full or partial provider name. Required.

specialitystring

Speciality keyword e.g. Cardiology. Optional.default:

statestring

Two-letter US state code e.g. CA. Optional.default:

compliance_fetch_finra_brokerFetch FINRA BrokerCheck registration for a US broker or investment adviser by CRD number. Read-only. No side effects. Idempotent. US only. crd_number: Central Registration Depository number as a string of digits e.g. 1234567. Required. CRD number only — name lookup is not supp...1 params

Fetch FINRA BrokerCheck registration for a US broker or investment adviser by CRD number. Read-only. No side effects. Idempotent. US only. crd_number: Central Registration Depository number as a string of digits e.g. 1234567. Required. CRD number only — name lookup is not supp...

Parameters* required

crd_number*string

FINRA CRD number e.g. 149777. Required.

compliance_check_sam_exclusionCheck whether an entity is on the US federal exclusions list (debarred from government contracts). Read-only. No side effects. Idempotent. US only. name_or_ein: Entity name or 9-digit EIN with or without dash e.g. Acme Corp or 13-1234567. Required. Name match is fuzzy — verify...1 params

Check whether an entity is on the US federal exclusions list (debarred from government contracts). Read-only. No side effects. Idempotent. US only. name_or_ein: Entity name or 9-digit EIN with or without dash e.g. Acme Corp or 13-1234567. Required. Name match is fuzzy — verify...

Parameters* required

name_or_ein*string

Entity name or EIN to check SAM exclusions. Required.

domain_fetch_domain_rdapFetch domain registration details via IANA RDAP (the modern structured replacement for WHOIS). Read-only. No side effects. Idempotent. domain: Domain name without protocol e.g. example.com not https://example.com. Required. Returns registrar, registration date, expiry date, na...1 params

Fetch domain registration details via IANA RDAP (the modern structured replacement for WHOIS). Read-only. No side effects. Idempotent. domain: Domain name without protocol e.g. example.com not https://example.com. Required. Returns registrar, registration date, expiry date, na...

Parameters* required

domain*string

Domain without protocol e.g. example.com. Required.

domain_fetch_ssl_certificate_chainFetch SSL certificate history for a domain from Certificate Transparency logs. Read-only. No side effects. Idempotent. domain: Domain name without protocol e.g. github.com. Required. Does not support IP addresses or wildcard domains. Returns issuer, subject, validity period, a...1 params

Fetch SSL certificate history for a domain from Certificate Transparency logs. Read-only. No side effects. Idempotent. domain: Domain name without protocol e.g. github.com. Required. Does not support IP addresses or wildcard domains. Returns issuer, subject, validity period, a...

Parameters* required

domain*string

Domain without protocol e.g. github.com. Required.

domain_fetch_dns_recordsFetch current DNS records for a domain via Cloudflare DNS over HTTPS. Read-only. No side effects. Idempotent. domain: Domain name without protocol e.g. cloudflare.com. Required. record_types: List of DNS record types to fetch. Required. Valid values: A, AAAA, MX, TXT, NS, CNAM...2 params

Fetch current DNS records for a domain via Cloudflare DNS over HTTPS. Read-only. No side effects. Idempotent. domain: Domain name without protocol e.g. cloudflare.com. Required. record_types: List of DNS record types to fetch. Required. Valid values: A, AAAA, MX, TXT, NS, CNAM...

Parameters* required

domain*string

Domain without protocol e.g. anthropic.com. Required.

record_typesarray

DNS record types e.g. ['A','MX','TXT']. Optional.

domain_fetch_domain_historyFetch historical SSL certificate issuance for a domain from Certificate Transparency logs. Read-only. No side effects. Idempotent. domain: Domain name without protocol e.g. example.com. Required. Returns all past certificates with issuer, validity dates, and SANs in reverse ch...1 params

Fetch historical SSL certificate issuance for a domain from Certificate Transparency logs. Read-only. No side effects. Idempotent. domain: Domain name without protocol e.g. example.com. Required. Returns all past certificates with issuer, validity dates, and SANs in reverse ch...

Parameters* required

domain*string

Domain without protocol e.g. example.com. Required.

domain_fetch_subdomainsEnumerate subdomains for a domain via Certificate Transparency logs. Read-only. No side effects. Idempotent. domain: Domain name without protocol e.g. anthropic.com. Required. Returns deduplicated list of known subdomains. Primary source: crt.sh Certificate Transparency (free)...1 params

Enumerate subdomains for a domain via Certificate Transparency logs. Read-only. No side effects. Idempotent. domain: Domain name without protocol e.g. anthropic.com. Required. Returns deduplicated list of known subdomains. Primary source: crt.sh Certificate Transparency (free)...

Parameters* required

domain*string

Domain without protocol e.g. anthropic.com. Required.

domain_check_email_securityCheck SPF, DMARC, and DKIM email authentication for a domain. domain: Domain without protocol e.g. "google.com". Returns: overall_grade (A–F), spf_score, dmarc_score, dkim_score (each 0–10), spf_record, dmarc_record, dkim_selectors_found. Scores reflect live DNS via Cloudflare...1 params

Check SPF, DMARC, and DKIM email authentication for a domain. domain: Domain without protocol e.g. "google.com". Returns: overall_grade (A–F), spf_score, dmarc_score, dkim_score (each 0–10), spf_record, dmarc_record, dkim_selectors_found. Scores reflect live DNS via Cloudflare...

Parameters* required

domain*string

Domain without protocol e.g. google.com. Required.

domain_fetch_reverse_ipFind domains co-hosted on the same IP address (reverse IP lookup). Read-only. No side effects. Idempotent. domain_or_ip: Domain name (e.g. shared.dreamhost.com) or IPv4 address (e.g. 1.2.3.4). Required. If a domain is given, it is first resolved to its IPv4 A record. IPv6-only...1 params

Find domains co-hosted on the same IP address (reverse IP lookup). Read-only. No side effects. Idempotent. domain_or_ip: Domain name (e.g. shared.dreamhost.com) or IPv4 address (e.g. 1.2.3.4). Required. If a domain is given, it is first resolved to its IPv4 A record. IPv6-only...

Parameters* required

domain_or_ip*string

Domain e.g. shared.dreamhost.com or IPv4 e.g. 1.2.3.4. Required.

legal_fetch_patent_by_numberFetch full patent details by patent number and jurisdiction. Read-only. No side effects. Idempotent. patent_number: Patent number in EPODOC format e.g. EP1000000 for European, CN120586032 for Chinese, JP2020123456 for Japanese, WO2020123456 for PCT, US10000000 for US. Required...2 params

Fetch full patent details by patent number and jurisdiction. Read-only. No side effects. Idempotent. patent_number: Patent number in EPODOC format e.g. EP1000000 for European, CN120586032 for Chinese, JP2020123456 for Japanese, WO2020123456 for PCT, US10000000 for US. Required...

Parameters* required

jurisdictionstring

Patent office code: EP, US, WO. Default EP. Optional.default: EP

patent_number*string

Patent number e.g. EP3456789 or US10123456. Required.

legal_search_patents_by_keywordSearch patents by keyword across EPO, USPTO, or WIPO. Read-only. No side effects. Idempotent. Returns up to 10 matches. keywords: Search terms describing the invention e.g. neural network image classification. Required. jurisdiction: One of EP, US, or WO. Optional. Default EP....3 params

Search patents by keyword across EPO, USPTO, or WIPO. Read-only. No side effects. Idempotent. Returns up to 10 matches. keywords: Search terms describing the invention e.g. neural network image classification. Required. jurisdiction: One of EP, US, or WO. Optional. Default EP....

Parameters* required

date_fromstring

Earliest filing date ISO 8601 e.g. 2020-01-31. Optional.default:

jurisdictionstring

Patent office code: EP, US, WO. Default EP. Optional.default: EP

keywords*string

Search keyword or phrase e.g. CRISPR gene editing. Required.

legal_fetch_patent_citationsFetch forward and backward citation chains for a specific patent. Read-only. No side effects. Idempotent. patent_number: Patent number in EPODOC format e.g. EP1000000 for European, CN120586032 for Chinese, JP2020123456 for Japanese, WO2020123456 for PCT, US10000000 for US. Req...2 params

Fetch forward and backward citation chains for a specific patent. Read-only. No side effects. Idempotent. patent_number: Patent number in EPODOC format e.g. EP1000000 for European, CN120586032 for Chinese, JP2020123456 for Japanese, WO2020123456 for PCT, US10000000 for US. Req...

Parameters* required

jurisdictionstring

Patent office code: EP, US, WO. Default EP. Optional.default: EP

patent_number*string

Patent number e.g. EP3456789 or US10123456. Required.

legal_fetch_inventor_portfolioFetch the patent portfolio for a named inventor with optional assignee filter. Read-only. No side effects. Idempotent. inventor_name: Inventor surname or full name e.g. Smith or John Smith. Required. Fuzzy match — common names may return many results. assignee: Company or orga...2 params

Fetch the patent portfolio for a named inventor with optional assignee filter. Read-only. No side effects. Idempotent. inventor_name: Inventor surname or full name e.g. Smith or John Smith. Required. Fuzzy match — common names may return many results. assignee: Company or orga...

Parameters* required

assigneestring

Company name to filter results e.g. Apple Inc. Optional.default:

inventor_name*string

Inventor surname or full name e.g. John Smith. Required.

govcon_search_contract_awardsSearch government contract awards by keyword, agency, and date range. keyword: Contract scope e.g. "cybersecurity software". agency: Awarding agency e.g. "Department of Defense". Optional. date_from: Earliest award date ISO 8601 e.g. "2024-01-31". Optional. jurisdiction: "US",...4 params

Search government contract awards by keyword, agency, and date range. keyword: Contract scope e.g. "cybersecurity software". agency: Awarding agency e.g. "Department of Defense". Optional. date_from: Earliest award date ISO 8601 e.g. "2024-01-31". Optional. jurisdiction: "US",...

Parameters* required

agencystring

Awarding agency name e.g. Department of Defense. Optional.default:

date_fromstring

Earliest award date ISO 8601 e.g. 2024-01-31. Optional.default:

jurisdictionstring

Jurisdiction: US, EU, or UK. Default US. Optional.default: US

keyword*string

Search terms describing the contract scope e.g. cybersecurity software. Required.

govcon_fetch_vendor_contract_historyFetch the complete federal contract award history for a specific vendor. Read-only. No side effects. Idempotent. vendor_name: Company or organisation name e.g. Booz Allen Hamilton. Required. Fuzzy match used. jurisdiction: One of US, EU, or UK. Optional. Default US. Returns to...2 params

Fetch the complete federal contract award history for a specific vendor. Read-only. No side effects. Idempotent. vendor_name: Company or organisation name e.g. Booz Allen Hamilton. Required. Fuzzy match used. jurisdiction: One of US, EU, or UK. Optional. Default US. Returns to...

Parameters* required

jurisdictionstring

Jurisdiction: US, EU, or UK. Default US. Optional.default: US

vendor_name*string

Vendor or company name to search e.g. Booz Allen Hamilton. Required.

govcon_fetch_open_solicitationsFetch currently open government contract solicitations matching a keyword. Read-only. No side effects. Idempotent. keyword: Description of goods or services sought e.g. cloud computing services. Required. Encode special characters — + becomes %2B. agency: Awarding agency name....3 params

Fetch currently open government contract solicitations matching a keyword. Read-only. No side effects. Idempotent. keyword: Description of goods or services sought e.g. cloud computing services. Required. Encode special characters — + becomes %2B. agency: Awarding agency name....

Parameters* required

agencystring

Awarding agency name. Optional, defaults to all agencies.default:

jurisdictionstring

Jurisdiction: US, EU, or UK. Default US. Optional.default: US

keyword*string

Description of goods or services sought e.g. cloud computing. Required.

regulatory_search_open_rulemakingsSearch open rulemakings and public comment periods on Regulations.gov and the Federal Register. Read-only. No side effects. Idempotent. US federal only. keyword: Topic keywords e.g. artificial intelligence, data privacy. Required. agency: Agency abbreviation e.g. FTC, FDA, SEC...3 params

Search open rulemakings and public comment periods on Regulations.gov and the Federal Register. Read-only. No side effects. Idempotent. US federal only. keyword: Topic keywords e.g. artificial intelligence, data privacy. Required. agency: Agency abbreviation e.g. FTC, FDA, SEC...

Parameters* required

agencystring

Agency abbreviation e.g. FTC, FDA, SEC. Optional.default:

keyword*string

Topic keywords e.g. artificial intelligence. Required.

statusstring

Filter: open, closed, or all. Default open. Optional.default: open

regulatory_fetch_docket_detailsFetch full details for a specific regulatory docket by ID. Read-only. No side effects. Idempotent. US federal only. docket_id: Docket identifier in agency format e.g. EPA-HQ-OAR-2021-0317 or FTC-2024-0041. Required. Timeout is 30 seconds — large dockets may be slow. Returns do...1 params

Fetch full details for a specific regulatory docket by ID. Read-only. No side effects. Idempotent. US federal only. docket_id: Docket identifier in agency format e.g. EPA-HQ-OAR-2021-0317 or FTC-2024-0041. Required. Timeout is 30 seconds — large dockets may be slow. Returns do...

Parameters* required

docket_id*string

Docket ID e.g. EPA-HQ-OAR-2021-0668. Required.

regulatory_fetch_federal_register_noticesFetch recent Federal Register notices and rules for a specific agency. Read-only. No side effects. Idempotent. US federal only. agency: Agency name or abbreviation e.g. SEC, Food and Drug Administration, EPA. Required. keyword: Optional topic filter e.g. cryptocurrency. Option...3 params

Fetch recent Federal Register notices and rules for a specific agency. Read-only. No side effects. Idempotent. US federal only. agency: Agency name or abbreviation e.g. SEC, Food and Drug Administration, EPA. Required. keyword: Optional topic filter e.g. cryptocurrency. Option...

Parameters* required

agency*string

Agency name or abbreviation e.g. SEC, EPA. Required.

date_fromstring

Earliest publication date ISO 8601 e.g. 2024-01-31. Optional.default:

keywordstring

Optional topic filter e.g. cryptocurrency. Optional.default:

security_fetch_package_maintainer_historyAnalyse ownership and release history for an npm or PyPI package to detect supply-chain risk. Uses PyPI JSON API and npm registry — data refreshed on each call, 1-hour cache. Returns maintainer_count, recent_changes, ownership_transfers, account_ages, anomaly_score (0.0–1.0),...2 params

Analyse ownership and release history for an npm or PyPI package to detect supply-chain risk. Uses PyPI JSON API and npm registry — data refreshed on each call, 1-hour cache. Returns maintainer_count, recent_changes, ownership_transfers, account_ages, anomaly_score (0.0–1.0),...

Parameters* required

ecosystem*string

Package ecosystem: npm, pypi, cargo, go. Required.one of npm · pypi · cargo · go

package_name*string

Package name e.g. requests. Required.

security_fetch_package_risk_briefSingle SHIP/CAUTION/BLOCK verdict for any package. Combines CVEs, licence, maintainer health, and transitive count in one call. Uses OSV.dev, deps.dev, PyPI, and npm registry — data refreshed on each call. Returns verdict (SHIP/CAUTION/BLOCK), critical_cve_count, high_cve_coun...3 params

Single SHIP/CAUTION/BLOCK verdict for any package. Combines CVEs, licence, maintainer health, and transitive count in one call. Uses OSV.dev, deps.dev, PyPI, and npm registry — data refreshed on each call. Returns verdict (SHIP/CAUTION/BLOCK), critical_cve_count, high_cve_coun...

Parameters* required

ecosystem*string

Package ecosystem: npm, pypi, cargo, go, maven. Required.one of npm · pypi · go · cargo · maven

package_name*string

Package name e.g. requests. Required.

versionvalue

Package version e.g. 2.28.0. Required.

security_detect_typosquattingDetect typosquatting attacks against a package name. Compares using Damerau-Levenshtein distance ≤ 2 against top-10,000 packages. Returns similar_packages with anomaly scores, and a SUSPICIOUS or CLEAN verdict. Uses PyPI and npm download stats stored in Redis. Cold-start fetch...2 params

Detect typosquatting attacks against a package name. Compares using Damerau-Levenshtein distance ≤ 2 against top-10,000 packages. Returns similar_packages with anomaly scores, and a SUSPICIOUS or CLEAN verdict. Uses PyPI and npm download stats stored in Redis. Cold-start fetch...

Parameters* required

ecosystem*string

Package ecosystem: npm, pypi, cargo, go. Required.one of npm · pypi · cargo · go

package_name*string

Package name e.g. requests. Required.

nonprofit_fetch_nonprofit_full_profileComplete nonprofit due diligence in one call. Revenue trends, executive pay, risk flags, and a health score from IRS 990 data. Uses ProPublica Nonprofit Explorer API with IRS e-File fallback. Data refreshed on each call. Returns financials, executive_compensation, risk_flags,...1 params

Complete nonprofit due diligence in one call. Revenue trends, executive pay, risk flags, and a health score from IRS 990 data. Uses ProPublica Nonprofit Explorer API with IRS e-File fallback. Data refreshed on each call. Returns financials, executive_compensation, risk_flags,...

Parameters* required

ein*string

EIN in format XX-XXXXXXX e.g. 46-5734087. Required.

security_fetch_cve_watchPersistent CVE watchlist. Create once, check anytime for new events since your last visit — patch releases, KEV listings, PoC publications, exploitation detected. Uses Redis for persistence, NVD + CISA KEV + EPSS for daily background refresh. Returns has_new_events, events (li...3 params

Persistent CVE watchlist. Create once, check anytime for new events since your last visit — patch releases, KEV listings, PoC publications, exploitation detected. Uses Redis for persistence, NVD + CISA KEV + EPSS for daily background refresh. Returns has_new_events, events (li...

Parameters* required

action*string

Action: create, check, or delete the watchlist. Required.one of create · check · delete

cve_ids*array

List of CVE IDs to watch e.g. ['CVE-2021-44228']. Required for create.

watch_id*string

Unique watch identifier to create, check, or delete. Required.

security_audit_sbom_continuousPersistent SBOM watch. Register once, check anytime for new CVEs affecting your dependency snapshot. Silent permanent watch — CycloneDX and SPDX supported. Uses OSV.dev for vulnerability lookup, Redis for persistence with 90-day TTL. Supports CycloneDX 1.4/1.5 and SPDX 2.3 JSO...3 params

Persistent SBOM watch. Register once, check anytime for new CVEs affecting your dependency snapshot. Silent permanent watch — CycloneDX and SPDX supported. Uses OSV.dev for vulnerability lookup, Redis for persistence with 90-day TTL. Supports CycloneDX 1.4/1.5 and SPDX 2.3 JSO...

Parameters* required

action*string

Action: register, check, or deregister the SBOM watch. Required.one of register · check · deregister

sbom*string

CycloneDX or SPDX SBOM as JSON string. Required for register action.

watch_id*string

Unique watch identifier for this SBOM watch. Required.

security_fetch_licence_analysisUnderstand any software licence in plain English. Returns obligations, permissions, limitations, risk level, and OSI/FSF status for any SPDX licence identifier. Static bundle covers top-50 common licences (no network call). Falls back to spdx.org API for rare identifiers. All...1 params

Understand any software licence in plain English. Returns obligations, permissions, limitations, risk level, and OSI/FSF status for any SPDX licence identifier. Static bundle covers top-50 common licences (no network call). Falls back to spdx.org API for rare identifiers. All...

Parameters* required

spdx_id*string

SPDX licence identifier e.g. MIT, Apache-2.0, GPL-3.0. Required.

security_audit_licence_compatibilityAudit the licence compatibility of your entire dependency list. Input package names (with ecosystem) or SPDX IDs; get a COMPATIBLE/CONFLICT verdict with specific conflicting pairs and recommended action. Uses static SPDX compatibility table — no network call for spdx_ids path....2 params

Audit the licence compatibility of your entire dependency list. Input package names (with ecosystem) or SPDX IDs; get a COMPATIBLE/CONFLICT verdict with specific conflicting pairs and recommended action. Uses static SPDX compatibility table — no network call for spdx_ids path....

Parameters* required

packagesvalue

List of {name, ecosystem} dicts to check compatibility. Optional.

spdx_idsvalue

List of SPDX licence identifiers to check compatibility. Optional.

security_fetch_cve_risk_summaryInstant CVE risk verdict. Combines CVSS severity, CISA KEV exploitation status, and EPSS probability in one parallel call. Returns CRITICAL_EXPLOIT, HIGH_RISK, MODERATE, LOW, or UNKNOWN verdict with patch availability from vendor advisories. UNKNOWN means all upstream sources...1 params

Instant CVE risk verdict. Combines CVSS severity, CISA KEV exploitation status, and EPSS probability in one parallel call. Returns CRITICAL_EXPLOIT, HIGH_RISK, MODERATE, LOW, or UNKNOWN verdict with patch availability from vendor advisories. UNKNOWN means all upstream sources...

Parameters* required

cve_id*string

CVE identifier e.g. CVE-2021-44228. Required.

nonprofit_search_nonprofits_by_categorySearch US nonprofits by mission category and state. Returns up to 25 results with revenue, assets, and health scores (0–100). Category maps to NTEE codes: education, healthcare, arts, environment, human_services, civil_rights, international, religion, science, sports. Raw NTEE...2 params

Search US nonprofits by mission category and state. Returns up to 25 results with revenue, assets, and health scores (0–100). Category maps to NTEE codes: education, healthcare, arts, environment, human_services, civil_rights, international, religion, science, sports. Raw NTEE...

Parameters* required

category*string

NTEE category e.g. education, healthcare, arts. Required.

statevalue

Two-letter US state code e.g. CA. Optional.

nonprofit_fetch_nonprofit_financial_trends5-year financial trend for any US nonprofit. Revenue growth, expense ratios, reserve trajectory, and health score history from IRS Form 990 data via ProPublica. Returns trend_direction (GROWING/STABLE/DECLINING/VOLATILE/INSUFFICIENT_DATA), CAGR, and year-by-year revenue, expen...2 params

5-year financial trend for any US nonprofit. Revenue growth, expense ratios, reserve trajectory, and health score history from IRS Form 990 data via ProPublica. Returns trend_direction (GROWING/STABLE/DECLINING/VOLATILE/INSUFFICIENT_DATA), CAGR, and year-by-year revenue, expen...

Parameters* required

ein*string

EIN in format XX-XXXXXXX e.g. 46-5734087. Required.

yearsinteger

Number of years of trend data 1-10. Default 5. Optional.default: 5

apikeys_generate_api_keyGenerate a DataNexus API key for the given email address. Anonymous callers get 10 free lookups/week; a registered free key unlocks 100/week. Store the returned key — it is shown only once. Pass it as the X-Api-Key header on future requests. Rate limit: 3 keys per IP per 24 ho...1 params

Generate a DataNexus API key for the given email address. Anonymous callers get 10 free lookups/week; a registered free key unlocks 100/week. Store the returned key — it is shown only once. Pass it as the X-Api-Key header on future requests. Rate limit: 3 keys per IP per 24 ho...

Parameters* required

email*string

Email address to associate with the new API key. Used for delivery and repeat-signup lookup. Required.

apikeys_rotate_api_key⚠️ DESTRUCTIVE — requires human confirmation before use in automated pipelines. Revoke the current API key and issue a replacement. Returns the new key once — store it immediately. Pass keys as the X-DataNexus-Key header.1 params

⚠️ DESTRUCTIVE — requires human confirmation before use in automated pipelines. Revoke the current API key and issue a replacement. Returns the new key once — store it immediately. Pass keys as the X-DataNexus-Key header.

Parameters* required

current_key*string

Existing active API key (dnx_...) to revoke and replace. Required.

apikeys_revoke_api_key⚠️ DESTRUCTIVE — requires human confirmation before use in automated pipelines. Permanently revoke a DataNexus API key. The key will stop working immediately. This action cannot be undone — generate a new key if access is needed again.1 params

⚠️ DESTRUCTIVE — requires human confirmation before use in automated pipelines. Permanently revoke a DataNexus API key. The key will stop working immediately. This action cannot be undone — generate a new key if access is needed again.

Parameters* required

key*string

API key (dnx_...) to permanently revoke. Required.

security_audit_sbom_license_policyAudit a CycloneDX or SPDX SBOM against an SPDX licence policy and return a PASS/WARN/BLOCK verdict. sbom: Full SBOM as a JSON string — CycloneDX or SPDX format. Required. 500 KB max. policy: Optional dict with block/warn/allow arrays of exact SPDX licence identifiers (e.g. GPL...2 params

Audit a CycloneDX or SPDX SBOM against an SPDX licence policy and return a PASS/WARN/BLOCK verdict. sbom: Full SBOM as a JSON string — CycloneDX or SPDX format. Required. 500 KB max. policy: Optional dict with block/warn/allow arrays of exact SPDX licence identifiers (e.g. GPL...

Parameters* required

policyvalue

Policy dict with block/warn/allow arrays of SPDX licence IDs. Optional.

sbom*string

CycloneDX or SPDX SBOM as JSON string. Required. 500 KB max.

security_fetch_cve_watch_statusCheck all specified CVE watches for new events since your last poll. Returns only watches with new events, making it efficient to run on a schedule. watch_ids: List of watch IDs to check — same IDs used when creating watches with security_fetch_cve_watch. Required. Uses a per-...1 params

Check all specified CVE watches for new events since your last poll. Returns only watches with new events, making it efficient to run on a schedule. watch_ids: List of watch IDs to check — same IDs used when creating watches with security_fetch_cve_watch. Required. Uses a per-...

Parameters* required

watch_ids*array

List of watch IDs to check e.g. ['watch-1','watch-2']. Required.

frontend_security_detect_typosquattingTyposquatting detection optimised for the top 500 frontend packages (React, Vite, Axios, Lodash, etc.). Fewer false positives than a full npm scan. For backend packages, use security_detect_typosquatting instead. package_name: Package name to check. Required. ecosystem: npm or...2 params

Typosquatting detection optimised for the top 500 frontend packages (React, Vite, Axios, Lodash, etc.). Fewer false positives than a full npm scan. For backend packages, use security_detect_typosquatting instead. package_name: Package name to check. Required. ecosystem: npm or...

Parameters* required

ecosystemstring

Package ecosystem: npm or pypi. Default npm.one of npm · pypidefault: npm

package_name*string

Package name e.g. requests. Required.

frontend_security_audit_manifestAudit a frontend package.json for security risks — returns a single SHIP/CAUTION/BLOCK verdict with licence risks and abandonment signals. Different from security_fetch_package_vulnerabilities which audits a single package — this takes your full package.json. manifest: Content...2 params

Audit a frontend package.json for security risks — returns a single SHIP/CAUTION/BLOCK verdict with licence risks and abandonment signals. Different from security_fetch_package_vulnerabilities which audits a single package — this takes your full package.json. manifest: Content...

Parameters* required

lockfilevalue

Contents of package-lock.json or yarn.lock. Optional.

manifest*string

Contents of package.json as a string. Required. 500 KB max.

frontend_security_audit_ci_pipelineScan GitHub Actions, Vercel, or Netlify CI configs for exposed secrets, missing lockfile enforcement, and unpinned dependencies. Paste your config content — no filesystem access required. config: Raw YAML/TOML content of your CI config. Required. 500 KB max. config_type: githu...2 params

Scan GitHub Actions, Vercel, or Netlify CI configs for exposed secrets, missing lockfile enforcement, and unpinned dependencies. Paste your config content — no filesystem access required. config: Raw YAML/TOML content of your CI config. Required. 500 KB max. config_type: githu...

Parameters* required

config*string

Raw YAML/TOML content of your CI config. Required. 500 KB max.

config_typestring

CI config type: github_actions, vercel, or netlify. Default github_actions.one of github_actions · vercel · netlifydefault: github_actions

frontend_security_fetch_package_risk_briefSHIP/CAUTION/BLOCK risk brief for an npm package with frontend-specific context. Wraps security_fetch_package_risk_brief restricted to npm, and adds weekly_downloads and is_ui_component signals. package_name: npm package name. Required. version: Optional pinned version — lates...2 params

SHIP/CAUTION/BLOCK risk brief for an npm package with frontend-specific context. Wraps security_fetch_package_risk_brief restricted to npm, and adds weekly_downloads and is_ui_component signals. package_name: npm package name. Required. version: Optional pinned version — lates...

Parameters* required

package_name*string

Package name e.g. requests. Required.

versionvalue

Package version e.g. 2.28.0. Optional.

Readme

DataNexus MCP

View the full README on GitHub

Details

Repository: github.com/datanexusmcp/mcp-server
Categories: Security & Pentesting, Data & Analytics
Package: @datanexusmcp/mcp-server
Transport: STDIO, HTTP
Registry: MCP registry, active
Tools verified: Nov 6, 2026

Related Security & Pentesting MCP servers

View all

MalwareTracker Document Malware & AI Safety Scannertylabs/malwaretracker-mcpScan PDFs, Office docs, and RAG files for malware exploits, macros, CVEs, and AI prompt injection.0stars

EPA EJScreencom.olyport/ejscreenEnvironmental justice screening indicators, pollution burden, and demographic vulnerability0stars

SkillsSafe Security Scannergucci-atlasv/skillssafe.comAI skill security scanner. Detects prompt injection, credential theft, ClawHavoc. Free, no signup.0stars

Website Searchlennyzeltser/zeltser-website-mcp-serverImprove security writing, score it against rubrics, plan IR, CTI, vuln, and product strategy.0stars

Compuute MCP Security Scannercompuute/compuute-scan-apiScan any public GitHub MCP-server repo for security issues. 37 MCP-specific L1 rules, 8 languages.0stars

SOC 2 Compliancecsoai-org/soc2-compliance-ai-mcpSOC 2 Type II compliance for trust services criteria (security, availability, processing0stars