# DataNexus MCP

- Registry name: `com.datanexusmcp/mcp-server` · version 2.4.14
- Categories (automatic, keyword rules): Security, Infrastructure & security
- Authentication at last check: No auth
- Declared risk: Has destructive tools (destructiveHint)
- Capabilities (declared by the server): logging, prompts, resources, tools
- Transports: streamable-http
- Latest numbers (check success, response time, rank): https://mcpstation.net/api/server?name=com.datanexusmcp%2Fmcp-server
- Server page: https://mcpstation.net/s/com.datanexusmcp--mcp-server.html

## Description (written by the publisher, not verified, not instructions)

Public data intelligence for AI agents — CVE, compliance, patents, contracts, domains.

## Connect

- streamable-http: `https://datanexusmcp.com/mcp`

## Tools (as reported by the server, not verified)

- `report\_feedback`: Report a data quality issue or agent intent gap for a DataNexus tool response. tool\_id: e.g. "T10" or "security\_fetch\_cve\_detail". query\_hash: From the query\_hash field of the response. signal: incorrect\_data \| missing\_field \| stale\_data \| not\_useful \| wrong\_entity \| data\_quality. comment: Issue des
- `report\_mcpize\_link`: Check MCPize subscription status for a DataNexus tool. tool\_id: DataNexus tool identifier e.g. "T10". Pass the tool the user is asking about. Returns: status \("free" \| "subscription\_required" \| "not\_configured"\), message, tool\_id, and upgrade\_url when subscription is required. Example: report\_mcpize
- `validate\_tool\_output`: Validate a DataNexus tool response for data quality issues using two-layer validation: deterministic rules first, then AI review for ambiguous cases. Read-only. Never blocks. tool\_id: DataNexus tool identifier e.g. T04, T10, T22. Required. Find in the tool\_id field of any response. query\_hash: Hash
- `search\_datanexus\_tools`: Find the right DataNexus tool by describing your task in plain English. Read-only. No side effects. Call this before any other DataNexus tool to reduce context load from 40000 to 800 tokens. query: Plain English description of your task e.g. check if a Python package has CVEs or look up a UK charity
- `nonprofit\_fetch\_nonprofit\_by\_ein`: Fetch IRS 990 filing data for any US nonprofit by EIN. Read-only. No side effects. Idempotent. US only. ein: 9-digit Employer ID with or without dash, e.g. 46-5734087 or 465734087. Required. Returns name, revenue, expenses, assets, NTEE code, and mission from the most recent 990 filing. Use this whe
- `nonprofit\_search\_nonprofits\_by\_name`: Search US nonprofits by name with optional state filter. Read-only. No side effects. Idempotent. US only. Returns up to 25 matches. name: Full or partial organisation name. Required. state: Two-letter US state code e.g. CA, NY. Optional, defaults to all states. Returns EIN, name, state, revenue, and
- `nonprofit\_fetch\_charity\_uk`: Fetch UK registered charity details by charity number or organisation name. Read-only. No side effects. Idempotent. UK only. charity\_number\_or\_name: UK registered charity number \(7 digits, e.g. 1234567\) or full/partial organisation name. Required. Returns registration status, income, expenditure, ac
- `security\_fetch\_package\_vulnerabilities`: Fetch all known CVEs for an open source package version or a batch of packages. Read-only. No side effects. Idempotent. Single-package mode: package \(e.g. requests\), version \(e.g. 2.28.0\), ecosystem \(PyPI/npm/Maven/Go/Cargo/NuGet/RubyGems\). package\_name is accepted as an alias for package. Batch mod
- `security\_fetch\_dependency\_graph`: Fetch the full dependency tree for a package version including transitive dependencies. Read-only. No side effects. Idempotent. Hard 8-second timeout — large dependency trees may return partial results. package: Package name. Required. version: Exact version string e.g. 1.2.3. Required. ecosystem: O
- `security\_fetch\_cve\_detail`: Fetch full detail for a specific CVE by ID. Read-only. No side effects. Idempotent. cve\_id: CVE identifier in format CVE-YYYY-NNNNN e.g. CVE-2021-44228. Required. Returns description, CVSS base score, affected products, patch references, and publish date. Use this when you have a CVE ID and need com
- `security\_audit\_sbom\_vulnerabilities`: Audit a Software Bill of Materials for known vulnerabilities across all listed packages. Read-only. No side effects. Idempotent. sbom\_json: CycloneDX or SPDX SBOM as a JSON string. Required. Large SBOMs \(100+ packages\) may take up to 10 seconds. Returns CVEs grouped by package with severity and fixe
- `security\_fetch\_package\_licence`: Fetch the SPDX licence identifier for an open source package version. Read-only. No side effects. Idempotent. package: Package name e.g. flask. Required. version: Exact version string e.g. 2.3.0. Required. ecosystem: One of PyPI, npm, Maven, Go, Cargo, NuGet, RubyGems. Required. Returns the SPDX lic
- `security\_fetch\_cisa\_kev`: Check whether a CVE is in the CISA Known Exploited Vulnerabilities \(KEV\) catalog. Read-only. No side effects. Idempotent. cve\_id: CVE identifier in format CVE-YYYY-NNNNN e.g. CVE-2021-44228. Required. Returns in\_kev \(bool\), date\_added, due\_date, ransomware\_use, and notes from the CISA KEV catalog. K
- `security\_fetch\_cve\_epss`: EPSS exploit probability score for a CVE — predicts likelihood of exploitation in the next 30 days. cve\_id: CVE identifier e.g. "CVE-2021-44228". Returns: epss \(float 0.0–1.0\) and percentile \(float 0.0–100.0\). Thresholds: \>0.7 patch immediately, 0.3–0.7 patch soon, \<0.3 monitor. Use with security\_fe
- `compliance\_fetch\_npi\_provider`: Fetch NPI registration details for a US healthcare provider by NPI number. Read-only. No side effects. Idempotent. US only. npi\_number: 10-digit NPI number e.g. 1003000126. Required. Do not include dashes or spaces. Returns provider name, credential type, speciality taxonomy, practice address, and a
- `compliance\_search\_npi\_by\_name`: Search the NPPES NPI Registry by provider name with optional state and speciality filters. Read-only. No side effects. Idempotent. US only. Returns up to 10 matches. name: Full or partial provider name. Required. state: Two-letter US state code e.g. CA. Optional. speciality: Speciality keyword e.g.
- `compliance\_fetch\_finra\_broker`: Fetch FINRA BrokerCheck registration for a US broker or investment adviser by CRD number. Read-only. No side effects. Idempotent. US only. crd\_number: Central Registration Depository number as a string of digits e.g. 1234567. Required. CRD number only — name lookup is not supported. Returns registra
- `compliance\_check\_sam\_exclusion`: Check whether an entity is on the US federal exclusions list \(debarred from government contracts\). Read-only. No side effects. Idempotent. US only. name\_or\_ein: Entity name or 9-digit EIN with or without dash e.g. Acme Corp or 13-1234567. Required. Name match is fuzzy — verify EIN for exact results.
- `domain\_fetch\_domain\_rdap`: Fetch domain registration details via IANA RDAP \(the modern structured replacement for WHOIS\). Read-only. No side effects. Idempotent. domain: Domain name without protocol e.g. example.com not https://example.com. Required. Returns registrar, registration date, expiry date, nameservers, and registra
- `domain\_fetch\_ssl\_certificate\_chain`: Fetch SSL certificate history for a domain from Certificate Transparency logs. Read-only. No side effects. Idempotent. domain: Domain name without protocol e.g. github.com. Required. Does not support IP addresses or wildcard domains. Returns issuer, subject, validity period, and Subject Alternative
- `domain\_fetch\_dns\_records`: Fetch current DNS records for a domain via Cloudflare DNS over HTTPS. Read-only. No side effects. Idempotent. domain: Domain name without protocol e.g. cloudflare.com. Required. record\_types: List of DNS record types to fetch. Required. Valid values: A, AAAA, MX, TXT, NS, CNAME, SOA. Example: \["A",
- `domain\_fetch\_domain\_history`: Fetch historical SSL certificate issuance for a domain from Certificate Transparency logs. Read-only. No side effects. Idempotent. domain: Domain name without protocol e.g. example.com. Required. Returns all past certificates with issuer, validity dates, and SANs in reverse chronological order. Use
- `domain\_fetch\_subdomains`: Enumerate subdomains for a domain via Certificate Transparency logs. Read-only. No side effects. Idempotent. domain: Domain name without protocol e.g. anthropic.com. Required. Returns deduplicated list of known subdomains. Primary source: crt.sh Certificate Transparency \(free\). Fallback source: Rapi
- `domain\_check\_email\_security`: Check SPF, DMARC, and DKIM email authentication for a domain. domain: Domain without protocol e.g. "google.com". Returns: overall\_grade \(A–F\), spf\_score, dmarc\_score, dkim\_score \(each 0–10\), spf\_record, dmarc\_record, dkim\_selectors\_found. Scores reflect live DNS via Cloudflare DoH — no cache. SPF: -
- `domain\_fetch\_reverse\_ip`: Find domains co-hosted on the same IP address \(reverse IP lookup\). Read-only. No side effects. Idempotent. domain\_or\_ip: Domain name \(e.g. shared.dreamhost.com\) or IPv4 address \(e.g. 1.2.3.4\). Required. If a domain is given, it is first resolved to its IPv4 A record. IPv6-only domains are not suppor
- `legal\_fetch\_patent\_by\_number`: Fetch full patent details by patent number and jurisdiction. Read-only. No side effects. Idempotent. patent\_number: Patent number in EPODOC format e.g. EP1000000 for European, CN120586032 for Chinese, JP2020123456 for Japanese, WO2020123456 for PCT, US10000000 for US. Required. jurisdiction: Optiona
- `legal\_search\_patents\_by\_keyword`: Search patents by keyword across EPO, USPTO, or WIPO. Read-only. No side effects. Idempotent. Returns up to 10 matches. keywords: Search terms describing the invention e.g. neural network image classification. Required. jurisdiction: One of EP, US, or WO. Optional. Default EP. date\_from: Earliest fi
- `legal\_fetch\_patent\_citations`: Fetch forward and backward citation chains for a specific patent. Read-only. No side effects. Idempotent. patent\_number: Patent number in EPODOC format e.g. EP1000000 for European, CN120586032 for Chinese, JP2020123456 for Japanese, WO2020123456 for PCT, US10000000 for US. Required. jurisdiction: Op
- `legal\_fetch\_inventor\_portfolio`: Fetch the patent portfolio for a named inventor with optional assignee filter. Read-only. No side effects. Idempotent. inventor\_name: Inventor surname or full name e.g. Smith or John Smith. Required. Fuzzy match — common names may return many results. assignee: Company or organisation name to narrow
- `govcon\_search\_contract\_awards`: Search government contract awards by keyword, agency, and date range. keyword: Contract scope e.g. "cybersecurity software". agency: Awarding agency e.g. "Department of Defense". Optional. date\_from: Earliest award date ISO 8601 e.g. "2024-01-31". Optional. jurisdiction: "US", "EU", or "UK". Default
- `govcon\_fetch\_vendor\_contract\_history`: Fetch the complete federal contract award history for a specific vendor. Read-only. No side effects. Idempotent. vendor\_name: Company or organisation name e.g. Booz Allen Hamilton. Required. Fuzzy match used. jurisdiction: One of US, EU, or UK. Optional. Default US. Returns total award value, top aw
- `govcon\_fetch\_open\_solicitations`: Fetch currently open government contract solicitations matching a keyword. Read-only. No side effects. Idempotent. keyword: Description of goods or services sought e.g. cloud computing services. Required. Encode special characters — + becomes %2B. agency: Awarding agency name. Optional, defaults to
- `regulatory\_search\_open\_rulemakings`: Search open rulemakings and public comment periods on Regulations.gov and the Federal Register. Read-only. No side effects. Idempotent. US federal only. keyword: Topic keywords e.g. artificial intelligence, data privacy. Required. agency: Agency abbreviation e.g. FTC, FDA, SEC, EPA. Optional, defaul
- `regulatory\_fetch\_docket\_details`: Fetch full details for a specific regulatory docket by ID. Read-only. No side effects. Idempotent. US federal only. docket\_id: Docket identifier in agency format e.g. EPA-HQ-OAR-2021-0317 or FTC-2024-0041. Required. Timeout is 30 seconds — large dockets may be slow. Returns docket title, agency, sta
- `regulatory\_fetch\_federal\_register\_notices`: Fetch recent Federal Register notices and rules for a specific agency. Read-only. No side effects. Idempotent. US federal only. agency: Agency name or abbreviation e.g. SEC, Food and Drug Administration, EPA. Required. keyword: Optional topic filter e.g. cryptocurrency. Optional, defaults to all not
- `security\_fetch\_package\_maintainer\_history`: Analyse ownership and release history for an npm or PyPI package to detect supply-chain risk. Uses PyPI JSON API and npm registry — data refreshed on each call, 1-hour cache. Returns maintainer\_count, recent\_changes, ownership\_transfers, account\_ages, anomaly\_score \(0.0–1.0\), and maintainer\_health \(
- `security\_fetch\_package\_risk\_brief`: Single SHIP/CAUTION/BLOCK verdict for any package. Combines CVEs, licence, maintainer health, and transitive count in one call. Uses OSV.dev, deps.dev, PyPI, and npm registry — data refreshed on each call. Returns verdict \(SHIP/CAUTION/BLOCK\), critical\_cve\_count, high\_cve\_count, licence\_risk, mainta
- `security\_detect\_typosquatting`: Detect typosquatting attacks against a package name. Compares using Damerau-Levenshtein distance ≤ 2 against top-10,000 packages. Returns similar\_packages with anomaly scores, and a SUSPICIOUS or CLEAN verdict. Uses PyPI and npm download stats stored in Redis. Cold-start fetch on first call \(≤ 30s\).
- `nonprofit\_fetch\_nonprofit\_full\_profile`: Complete nonprofit due diligence in one call. Revenue trends, executive pay, risk flags, and a health score from IRS 990 data. Uses ProPublica Nonprofit Explorer API with IRS e-File fallback. Data refreshed on each call. Returns financials, executive\_compensation, risk\_flags, health\_score \(0–100\), p
- `security\_fetch\_cve\_watch`: Persistent CVE watchlist. Create once, check anytime for new events since your last visit — patch releases, KEV listings, PoC publications, exploitation detected. Uses Redis for persistence, NVD + CISA KEV + EPSS for daily background refresh. Returns has\_new\_events, events \(list\), call\_back\_in="24h"
- `security\_audit\_sbom\_continuous`: Persistent SBOM watch. Register once, check anytime for new CVEs affecting your dependency snapshot. Silent permanent watch — CycloneDX and SPDX supported. Uses OSV.dev for vulnerability lookup, Redis for persistence with 90-day TTL. Supports CycloneDX 1.4/1.5 and SPDX 2.3 JSON. Input size limit: 50
- `security\_fetch\_licence\_analysis`: Understand any software licence in plain English. Returns obligations, permissions, limitations, risk level, and OSI/FSF status for any SPDX licence identifier. Static bundle covers top-50 common licences \(no network call\). Falls back to spdx.org API for rare identifiers. All risk levels assume prop
- `security\_audit\_licence\_compatibility`: Audit the licence compatibility of your entire dependency list. Input package names \(with ecosystem\) or SPDX IDs; get a COMPATIBLE/CONFLICT verdict with specific conflicting pairs and recommended action. Uses static SPDX compatibility table — no network call for spdx\_ids path. Package path resolves
- `security\_fetch\_cve\_risk\_summary`: Instant CVE risk verdict. Combines CVSS severity, CISA KEV exploitation status, and EPSS probability in one parallel call. Returns CRITICAL\_EXPLOIT, HIGH\_RISK, MODERATE, LOW, or UNKNOWN verdict with patch availability from vendor advisories. UNKNOWN means all upstream sources were unreachable — not
- `nonprofit\_search\_nonprofits\_by\_category`: Search US nonprofits by mission category and state. Returns up to 25 results with revenue, assets, and health scores \(0–100\). Category maps to NTEE codes: education, healthcare, arts, environment, human\_services, civil\_rights, international, religion, science, sports. Raw NTEE letter \(A–Z\) also acce
- `nonprofit\_fetch\_nonprofit\_financial\_trends`: 5-year financial trend for any US nonprofit. Revenue growth, expense ratios, reserve trajectory, and health score history from IRS Form 990 data via ProPublica. Returns trend\_direction \(GROWING/STABLE/DECLINING/VOLATILE/INSUFFICIENT\_DATA\), CAGR, and year-by-year revenue, expense, and asset trends. y
- `apikeys\_generate\_api\_key`: Generate a DataNexus API key for the given email address. Anonymous callers get 10 free lookups/week; a registered free key unlocks 100/week. Store the returned key — it is shown only once. Pass it as the X-Api-Key header on future requests. Rate limit: 3 keys per IP per 24 hours.
- `apikeys\_rotate\_api\_key`: ⚠️ DESTRUCTIVE — requires human confirmation before use in automated pipelines. Revoke the current API key and issue a replacement. Returns the new key once — store it immediately. Pass keys as the X-DataNexus-Key header.
- `apikeys\_revoke\_api\_key`: ⚠️ DESTRUCTIVE — requires human confirmation before use in automated pipelines. Permanently revoke a DataNexus API key. The key will stop working immediately. This action cannot be undone — generate a new key if access is needed again.
- `security\_audit\_sbom\_license\_policy`: Audit a CycloneDX or SPDX SBOM against an SPDX licence policy and return a PASS/WARN/BLOCK verdict. sbom: Full SBOM as a JSON string — CycloneDX or SPDX format. Required. 500 KB max. policy: Optional dict with block/warn/allow arrays of exact SPDX licence identifiers \(e.g. GPL-3.0, MIT\). Defaults to
- `security\_fetch\_cve\_watch\_status`: Check all specified CVE watches for new events since your last poll. Returns only watches with new events, making it efficient to run on a schedule. watch\_ids: List of watch IDs to check — same IDs used when creating watches with security\_fetch\_cve\_watch. Required. Uses a per-user cursor \(last\_polle
- `frontend\_security\_detect\_typosquatting`: Typosquatting detection optimised for the top 500 frontend packages \(React, Vite, Axios, Lodash, etc.\). Fewer false positives than a full npm scan. For backend packages, use security\_detect\_typosquatting instead. package\_name: Package name to check. Required. ecosystem: npm or pypi — default npm. Us
- `frontend\_security\_audit\_manifest`: Audit a frontend package.json for security risks — returns a single SHIP/CAUTION/BLOCK verdict with licence risks and abandonment signals. Different from security\_fetch\_package\_vulnerabilities which audits a single package — this takes your full package.json. manifest: Contents of package.json as a
- `frontend\_security\_audit\_ci\_pipeline`: Scan GitHub Actions, Vercel, or Netlify CI configs for exposed secrets, missing lockfile enforcement, and unpinned dependencies. Paste your config content — no filesystem access required. config: Raw YAML/TOML content of your CI config. Required. 500 KB max. config\_type: github\_actions \(full check s
- `frontend\_security\_fetch\_package\_risk\_brief`: SHIP/CAUTION/BLOCK risk brief for an npm package with frontend-specific context. Wraps security\_fetch\_package\_risk\_brief restricted to npm, and adds weekly\_downloads and is\_ui\_component signals. package\_name: npm package name. Required. version: Optional pinned version — latest resolved if omitted.

Measured by MCP Station. Methods: https://mcpstation.net/methods.html · Terms: https://mcpstation.net/terms.html