DataNexus MCP

{
  "id": "aix_76cf0460dc",
  "name": "DataNexus MCP",
  "operator": "(unclaimed - source: registry-official · publisher: com.datanexusmcp)",
  "description": "Public data intelligence for AI agents — CVE, compliance, patents, contracts, domains.",
  "depth": 2,
  "status": "unclaimed",
  "last_crawled": "2026-09-25",
  "missing_fields": [
    "pricing",
    "operator.identity"
  ],
  "skills": [
    "cache-store",
    "citation-check",
    "cloud-ops",
    "github-ops",
    "malware-analysis",
    "onchain-data",
    "threat-intel",
    "vulnerability-scan"
  ],
  "protocols": {
    "mcp": "https://datanexusmcp.com/mcp",
    "a2a": null
  },
  "pricing": null,
  "regions": [
    "global"
  ],
  "languages": [
    "en"
  ],
  "reputation": {
    "tasks_completed": null,
    "dispute_rate": null,
    "p95_latency_ms": 1058,
    "uptime_30d": 1,
    "onchain_volume_30d_usd": null
  },
  "aix_score": 58,
  "verification": {
    "identity": "none",
    "health": "probe/24h",
    "pricing": "unknown",
    "last_check": "2026-09-25T04:00:56.270Z"
  },
  "pricing_model": "unknown",
  "profile": {
    "mcp_server": "DataNexus MCP",
    "mcp_version": "3.4.5",
    "tool_count": 55,
    "tools": [
      {
        "name": "report_feedback",
        "description": "Report a data quality issue or agent intent gap for a DataNexus tool response.\n\ntool_id: e.g. \"T10\" or \"security_fetch_cve_detail\".\nquery_hash: From the query_hash field of the response.\nsignal: incorrect_data | missing_field | stale_data | not_useful | wrong_entity | data_quality.\ncomment: Issue description. Max 500 chars.\nmissing_fields: Absent or wrong field names.\nfeedback_type: \"user_feedback\" (default) or \"agent_gap\".\nintended_query: Agent's goal. Max 256 chars.\ngap_description: What was missing. Max 256 chars.\n\nExample: report_feedback(tool_id=\"T10\", query_hash=\"abc123\", signal=\"incorre"
      },
      {
        "name": "report_mcpize_link",
        "description": "Check MCPize subscription status for a DataNexus tool.\n\ntool_id: DataNexus tool identifier e.g. \"T10\". Pass the tool the user is asking about.\n\nReturns: status (\"free\" | \"subscription_required\" | \"not_configured\"), message, tool_id, and upgrade_url when subscription is required.\n\nExample: report_mcpize_link(tool_id=\"T10\")"
      },
      {
        "name": "validate_tool_output",
        "description": "Validate a DataNexus tool response for data quality issues using two-layer validation: deterministic rules first, then AI review for ambiguous cases. Read-only. Never blocks. tool_id: DataNexus tool identifier e.g. T04, T10, T22. Required. Find in the tool_id field of any response. query_hash: Hash from the response you are validating. Required. Enables feedback correlation. response_json: Full tool response serialised as a JSON string. Required. Returns pass or issues_found, with issues from each layer and whether feedback was auto-filed. Both layers must agree before feedback is filed. Use v"
      },
      {
        "name": "search_datanexus_tools",
        "description": "Find the right DataNexus tool by describing your task in plain English. Read-only. No side effects. Call this before any other DataNexus tool to reduce context load from 40000 to 800 tokens. query: Plain English description of your task e.g. check if a Python package has CVEs or look up a UK charity by name. Required. domain: Restrict results to one sub-server: nonprofit, security, compliance, domain, legal, govcon, or regulatory. Optional. Returns matching tool names and parameter hints you can call directly. Do not call this recursively or to validate results — use validate_tool_output for t"
      },
      {
        "name": "nonprofit_fetch_nonprofit_by_ein",
        "description": "Fetch IRS 990 filing data for any US nonprofit by EIN. Read-only. No side effects. Idempotent. US only. ein: 9-digit Employer ID with or without dash, e.g. 46-5734087 or 465734087. Required. Returns name, revenue, expenses, assets, NTEE code, and mission from the most recent 990 filing. Use this when you have the exact EIN. Use nonprofit_search_nonprofits_by_name instead when you only have a name. Verified source: IRS EO BMF + IRS TEOS. 7-day cache. If this tool's response does not serve the user's need, call report_feedback with feedback_type=\"agent_gap\", tool_id=\"nonprofit_fetch_nonprofit_by"
      },
      {
        "name": "nonprofit_search_nonprofits_by_name",
        "description": "Search US nonprofits by name with optional state filter. Read-only. No side effects. Idempotent. US only. Returns up to 25 matches. name: Full or partial organisation name. Required. state: Two-letter US state code e.g. CA, NY. Optional, defaults to all states. Returns EIN, name, state, revenue, and NTEE code for each match. Use this when you have a name but not the EIN. Use nonprofit_fetch_nonprofit_by_ein instead when you have the exact EIN for a precise single lookup. Verified source: IRS EO BMF. 7-day cache. If this tool's response does not serve the user's need, call report_feedback with "
      },
      {
        "name": "nonprofit_fetch_charity_uk",
        "description": "Fetch UK registered charity details by charity number or organisation name. Read-only. No side effects. Idempotent. UK only. charity_number_or_name: UK registered charity number (7 digits, e.g. 1234567) or full/partial organisation name. Required. Returns registration status, income, expenditure, activities, and trustee count. Use this for UK charities. Use nonprofit_fetch_nonprofit_by_ein or nonprofit_search_nonprofits_by_name for US nonprofits. Verified source: UK Charity Commission OGL v3. 24-hour cache. If this tool's response does not serve the user's need, call report_feedback with feedb"
      },
      {
        "name": "security_fetch_package_vulnerabilities",
        "description": "Fetch all known CVEs for an open source package version or a batch of packages. Read-only. No side effects. Idempotent. Single-package mode: package (e.g. requests), version (e.g. 2.28.0), ecosystem (PyPI/npm/Maven/Go/Cargo/NuGet/RubyGems). Batch mode: packages array of {name, version, ecosystem} objects — max 50 per call. If packages array is provided and non-empty, batch mode is used and package/version/ecosystem are ignored. Batch returns {results: [...], partial: bool, failed_count: int}. Each result has vuln_count and vulnerabilities list. Returns CVE ID, severity, CVSS score, affected ra"
      },
      {
        "name": "security_fetch_dependency_graph",
        "description": "Fetch the full dependency tree for a package version including transitive dependencies. Read-only. No side effects. Idempotent. Hard 8-second timeout — large dependency trees may return partial results. package: Package name. Required. version: Exact version string e.g. 1.2.3. Required. ecosystem: One of PyPI, npm, Maven, Go, Cargo, NuGet, RubyGems. Required. Returns all direct and transitive dependencies with version constraints. Use this to understand full supply chain exposure. Use security_fetch_package_vulnerabilities instead when you only need CVEs for a single package. Verified source: "
      },
      {
        "name": "security_fetch_cve_detail",
        "description": "Fetch full detail for a specific CVE by ID. Read-only. No side effects. Idempotent. cve_id: CVE identifier in format CVE-YYYY-NNNNN e.g. CVE-2021-44228. Required. Returns description, CVSS base score, affected products, patch references, and publish date. Use this when you have a CVE ID and need complete detail beyond what a package scan returns. Use security_fetch_package_vulnerabilities instead when you want all CVEs for a package version. Verified source: NIST NVD. 1-hour cache. If this tool's response does not serve the user's need, call report_feedback with feedback_type=\"agent_gap\", tool"
      },
      {
        "name": "security_audit_sbom_vulnerabilities",
        "description": "Audit a Software Bill of Materials for known vulnerabilities across all listed packages. Read-only. No side effects. Idempotent. sbom_json: CycloneDX or SPDX SBOM as a JSON string. Required. Large SBOMs (100+ packages) may take up to 10 seconds. Returns CVEs grouped by package with severity and fixed versions. Use this when you have a full SBOM to audit. Use security_fetch_package_vulnerabilities instead when checking a single package version. Verified source: Google OSV.dev batch API. 1-hour cache. If this tool's response does not serve the user's need, call report_feedback with feedback_type"
      },
      {
        "name": "security_fetch_package_licence",
        "description": "Fetch the SPDX licence identifier for an open source package version. Read-only. No side effects. Idempotent. package: Package name e.g. flask. Required. version: Exact version string e.g. 2.3.0. Required. ecosystem: One of PyPI, npm, Maven, Go, Cargo, NuGet, RubyGems. Required. Returns the SPDX licence identifier e.g. MIT, Apache-2.0, GPL-3.0. Use this to verify licence compatibility before including a dependency. Use security_fetch_package_vulnerabilities instead when checking for security issues not licences. Verified source: deps.dev (Google). 1-hour cache. If this tool's response does not"
      },
      {
        "name": "security_fetch_cisa_kev",
        "description": "Check whether a CVE is in the CISA Known Exploited Vulnerabilities (KEV) catalog. Read-only. No side effects. Idempotent. cve_id: CVE identifier in format CVE-YYYY-NNNNN e.g. CVE-2021-44228. Required. Returns in_kev (bool), date_added, due_date, ransomware_use, and notes from the CISA KEV catalog. KEV status answers 'Is this being actively exploited?' — a critical triage question not available in NIST NVD. Verified source: CISA KEV catalog (updated daily, cached). Use security_fetch_cve_detail for full CVE severity. Use security_fetch_cve_epss for exploit probability. If this tool's response d"
      },
      {
        "name": "security_fetch_cve_epss",
        "description": "EPSS exploit probability score for a CVE — predicts likelihood of exploitation in the next 30 days.\n\ncve_id: CVE identifier e.g. \"CVE-2021-44228\".\n\nReturns: epss (float 0.0–1.0) and percentile (float 0.0–100.0).\nThresholds: >0.7 patch immediately, 0.3–0.7 patch soon, <0.3 monitor.\nUse with security_fetch_cve_detail to prioritize patching — EPSS measures urgency, CVSS measures severity.\nSource: FIRST.org. 6-hour cache.\n\nExample: fetch_cve_epss(cve_id=\"CVE-2021-44228\")"
      },
      {
        "name": "compliance_fetch_npi_provider",
        "description": "Fetch NPI registration details for a US healthcare provider by NPI number. Read-only. No side effects. Idempotent. US only. npi_number: 10-digit NPI number e.g. 1003000126. Required. Do not include dashes or spaces. Returns provider name, credential type, speciality taxonomy, practice address, and active status. Use this when you have the exact 10-digit NPI. Use compliance_search_npi_by_name instead when you only have the provider name. Verified source: NPPES NPI Registry (CMS). 24-hour cache. If this tool's response does not serve the user's need, call report_feedback with feedback_type=\"agen"
      },
      {
        "name": "compliance_search_npi_by_name",
        "description": "Search the NPPES NPI Registry by provider name with optional state and speciality filters. Read-only. No side effects. Idempotent. US only. Returns up to 10 matches. name: Full or partial provider name. Required. state: Two-letter US state code e.g. CA. Optional. speciality: Speciality keyword e.g. Cardiology. Optional. Returns NPI number, name, speciality, and address for each match. Use this when you do not have the NPI number. Use compliance_fetch_npi_provider instead when you have the exact 10-digit NPI. Verified source: NPPES NPI Registry (CMS). 24-hour cache. If this tool's response does"
      },
      {
        "name": "compliance_fetch_finra_broker",
        "description": "Fetch FINRA BrokerCheck registration for a US broker or investment adviser by CRD number. Read-only. No side effects. Idempotent. US only. crd_number: Central Registration Depository number as a string of digits e.g. 1234567. Required. CRD number only — name lookup is not supported. Returns registration status, qualifications, disclosure history, and employment history. Use this when you have the CRD number. Use compliance_search_npi_by_name instead for healthcare providers, not financial advisers. Verified source: FINRA BrokerCheck. 24-hour cache. If this tool's response does not serve the us"
      },
      {
        "name": "compliance_check_sam_exclusion",
        "description": "Check whether an entity is on the US federal exclusions list (debarred from government contracts). Read-only. No side effects. Idempotent. US only. name_or_ein: Entity name or 9-digit EIN with or without dash e.g. Acme Corp or 13-1234567. Required. Name match is fuzzy — verify EIN for exact results. Returns excluded: true/false, exclusion type, and exclusion dates if found. Use this before awarding federal contracts or grants. Use govcon_search_contract_awards instead to find what contracts an entity has won. Verified source: SAM.gov. 24-hour cache. If this tool's response does not serve the u"
      },
      {
        "name": "domain_fetch_domain_rdap",
        "description": "Fetch domain registration details via IANA RDAP (the modern structured replacement for WHOIS). Read-only. No side effects. Idempotent. domain: Domain name without protocol e.g. example.com not https://example.com. Required. Returns registrar, registration date, expiry date, nameservers, and registrant info where publicly available. Use this when you need registration metadata. Use domain_fetch_ssl_certificate_chain instead when you need certificate history. Use domain_fetch_dns_records instead when you need live DNS resolution. Verified source: IANA RDAP. 4-hour cache. If this tool's response "
      },
      {
        "name": "domain_fetch_ssl_certificate_chain",
        "description": "Fetch SSL certificate history for a domain from Certificate Transparency logs. Read-only. No side effects. Idempotent. domain: Domain name without protocol e.g. github.com. Required. Does not support IP addresses or wildcard domains. Returns issuer, subject, validity period, and Subject Alternative Names for each logged cert. Use this to detect unexpected certificate issuance or audit certificate history. Use domain_fetch_domain_rdap instead when you need registration data not certificate data. Verified source: crt.sh Certificate Transparency. 4-hour cache. If this tool's response does not ser"
      },
      {
        "name": "domain_fetch_dns_records",
        "description": "Fetch current DNS records for a domain via Cloudflare DNS over HTTPS. Read-only. No side effects. Idempotent. domain: Domain name without protocol e.g. cloudflare.com. Required. record_types: List of DNS record types to fetch. Required. Valid values: A, AAAA, MX, TXT, NS, CNAME, SOA. Example: [\"A\", \"MX\", \"TXT\"]. Returns all matching records currently in effect. Use this when you need live DNS resolution. Use domain_fetch_domain_rdap instead when you need registration metadata not DNS records. Verified source: Cloudflare DoH. 4-hour cache. If this tool's response does not serve the user's need,"
      },
      {
        "name": "domain_fetch_domain_history",
        "description": "Fetch historical SSL certificate issuance for a domain from Certificate Transparency logs. Read-only. No side effects. Idempotent. domain: Domain name without protocol e.g. example.com. Required. Returns all past certificates with issuer, validity dates, and SANs in reverse chronological order. Use this to detect domain hijacking or audit unexpected historical certificate issuance. Use domain_fetch_ssl_certificate_chain instead when you only need the current certificate chain. Verified source: crt.sh Certificate Transparency. 4-hour cache. If this tool's response does not serve the user's need"
      },
      {
        "name": "domain_fetch_subdomains",
        "description": "Enumerate subdomains for a domain via Certificate Transparency logs. Read-only. No side effects. Idempotent. domain: Domain name without protocol e.g. anthropic.com. Required. Returns deduplicated list of known subdomains. Primary source: crt.sh Certificate Transparency (free). Fallback source: RapidDNS (free, passive CT + DNS) — used automatically when crt.sh is unavailable. Response includes source field indicating which source was used. Results are cached 24h — second call returns in under 500ms. First call may be slower (8s max per source). Circuit breaker trips after 3 timeouts or 5xx err"
      },
      {
        "name": "domain_check_email_security",
        "description": "Check SPF, DMARC, and DKIM email authentication for a domain.\n\ndomain: Domain without protocol e.g. \"google.com\".\n\nReturns: overall_grade (A–F), spf_score, dmarc_score, dkim_score (each 0–10), spf_record, dmarc_record, dkim_selectors_found. Scores reflect live DNS via Cloudflare DoH — no cache.\n\nSPF: -all=10 (strict), ~all=7, ?all=4, none=2, +all=0 (open relay).\nDMARC: p=reject=10, p=quarantine=7, p=none=4, absent=0; +1 for rua set.\nDKIM: selector found=10, none=0. Checks 10 common selectors in parallel.\n\nExample: check_email_security(domain=\"google.com\")"
      },
      {
        "name": "domain_fetch_reverse_ip",
        "description": "Find domains co-hosted on the same IP address (reverse IP lookup). Read-only. No side effects. Idempotent. domain_or_ip: Domain name (e.g. shared.dreamhost.com) or IPv4 address (e.g. 1.2.3.4). Required. If a domain is given, it is first resolved to its IPv4 A record. IPv6-only domains are not supported. Returns list of co-hosted domains on the same IP. Useful for identifying shared hosting risk and mapping corporate infrastructure. Daily quota guard: 100 calls/day free tier. Verified source: HackerTarget API. 24-hour cache. If this tool's response does not serve the user's need, call report_fe"
      }
    ],
    "profiled_at": "2026-09-25T04:00:56.270Z"
  },
  "unreachable": false
}