CPANscan

Catalyst::Plugin::MCP adds a Model Context Protocol (MCP) server to a Catalyst application by levering Catalyst::Plugin::JSONRPC::Server and exposing a simple seam for registering per-request provider objects that supply tools, resources or prompts and for dispatching MCP requests. You call mcp_register_provider during an action to add providers for the current request and then call mcp_dispatch to build a fresh, request-local MCP engine, route the verb and write the response, which avoids cross-request handler leakage and concurrency hazards. The plugin reads and size-checks the request body for you unless you supply a raw JSON body, supports configurable protocol versions and advertised server_info, and requires that the application load Catalyst::Plugin::JSONRPC::Server first. It intentionally ships no authentication or Origin validation so you must protect the endpoint and validate Origin before dispatching. Recent releases tighten compatibility with the underlying JSONRPC server and now require Catalyst::Plugin::JSONRPC::Server 0.003 so mcp_dispatch can return the correct HTTP 202 empty-status for notification-only requests.

AWS::Lambda provides an easy path to run Perl code on AWS Lambda by supplying a custom runtime plus prebuilt Lambda layers, zip archives and container images so you can drop in a handler.pl or build a Docker image and deploy quickly. It bundles helpers to find the correct layer ARNs, preinstalls common modules such as JSON and AWS::XRay, supports streaming responses and X‑Ray tracing, and offers optional Paws layers for calling AWS APIs from your function. The distribution includes tooling for local testing with Docker and guidance for creating custom module layers, follows the Perl community policy for supported Perl releases, and targets Amazon Linux 2023 while marking older AL and AL2 layers as legacy and no longer maintained. The latest 0.10.0 release adds support for Perl 5.44.0 and performs a few dependency updates while temporarily removing two regions for safety.

Catalyst::Plugin::OAuth2::ResourceServer is a Catalyst plugin that makes it simple to protect routes with OAuth 2.1 bearer JWTs by verifying access tokens, checking audience and issuer, and exposing token claims, scopes, and an app-resolved identity to your controllers. It handles extraction of Bearer tokens, performs cryptographic verification with a configured signing key, provides helpers to require authentication and specific scopes, and emits RFC 6750 WWW-Authenticate challenges plus an RFC 9728 protected-resource metadata document served with Cache-Control no-store. Configuration covers signing_key, resource and issuer validation, allowed JWT algorithms, clock skew leeway, advertised authorization servers and scopes, and an optional metadata URL which is otherwise derived from the resource URI when possible. You can implement oauth_resolve_subject to map the token subject to an application identity which is important for enforcing revocation or account deactivation, and the actual verification engine lives in a separate Server module so this plugin remains a thin Catalyst integration layer. An examples directory provides a runnable demo to get you started.

Catalyst::Plugin::OAuth2::AuthorizationServer adds a ready-made OAuth 2.1 authorization server (MCP profile) to a Catalyst application, providing authorization_code with PKCE-S256 for public clients, refresh_token rotation, dynamic client registration and standard AS metadata endpoints so you can expose a discovery document, register clients and issue tokens from your app. It issues signed JWT access tokens using symmetric HMAC (HS256/HS384/HS512) only, so it is intended for single-deployment setups where the Authorization Server and Resource Server share a secret and not for scenarios where third parties must verify tokens via JWKS. The plugin wires protocol logic into Catalyst and expects your app to handle user authentication and consent via an oauth_authenticate hook that calls back to oauth_issue_code; an optional oauth_dcr_allow_registration hook can rate-limit dynamic registration. Note the important operational limits: refresh-token reuse revokes the entire token family and does not retroactively invalidate already-issued stateless access tokens so you should keep access_ttl short, there is no built-in revocation endpoint or denylist, and Store implementors must follow the module's Role::Store contract. Recent updates mostly clean up examples and documentation to use generic example scopes; earlier changes introduced stricter PKCE verifier validation, signing_key length checks and an updated Store contract to support refresh-token family revocation.

Catalyst::Plugin::JSONRPC::Server is a small plugin that adds JSON-RPC 2.0 request handling to Catalyst apps by giving your context two helpers, jsonrpc_register and jsonrpc_dispatch, so you can register method handlers inside a request and have the plugin parse, route and respond to JSON-RPC calls over HTTP. It builds a fresh dispatcher per request so handlers and any closures do not leak between requests, and you can tune behavior with configuration like max_body_bytes (default 10 MiB) or supply your own dispatcher to change limits such as max_batch (default 1000). Handlers receive the JSON-RPC params and return results or throw a Catalyst::Plugin::JSONRPC::Server::Error to signal JSON-RPC errors while a plain die becomes a guarded internal error. Dispatch writes the appropriate HTTP response, returning the response payload or undef for notifications, and there is a jsonrpc_dispatch_with method if you need to reuse or preconfigure a dispatcher. The distribution includes a runnable example app and client so you can see echo and sum handlers in action.

Arango::Tango is a lightweight Perl client that gives you a straightforward mapping to the ArangoDB REST API so you can create and manage servers, databases, collections and documents from Perl without a heavy dependency. It exposes a simple top-level object that returns Database and Collection objects and covers common tasks such as creating and deleting databases and collections, managing users and permissions, running queries and cursors, importing documents in bulk, and inspecting server and cluster metadata and statistics. The distribution focuses on practical, easy to use methods rather than covering every advanced feature and it validates options with JSON::Schema::Fit which may silently adjust inputs, and it will die on errors so callers should use eval or a try/catch wrapper. Recent work refactored error behavior and added a create_index method to create hash, skiplist, persistent and geo indexes. The module is intentionally minimalist and evolving so contributions and patches are welcome.

RPi::OLED::SSD1306::128_64 is a Perl driver for 128x64 SSD1306-based monochrome OLED panels on the Raspberry Pi that makes it easy to draw text and simple graphics from Perl. It uses a small bundled C layer and wiringPi to mirror the display's 1KB framebuffer on the Pi and push updates over I2C, and exposes simple methods for text, characters, pixels, lines, rectangles, display refresh and clearing so you can build and then push a whole frame. The module defaults to I2C address 0x3C, requires wiringPi (3.18+), supports dimming and inversion, and is implemented as a singleton so repeated new() calls return the same live display object. Recent improvements include a flicker-free clear_buffer/display workflow and a much faster display() that streams the full framebuffer in one I2C transaction for noticeably quicker refreshes.

Lingua::JA::Moji is a comprehensive Perl toolkit for converting among the many written forms of Japanese text and related encodings, including romanized Japanese, hiragana, katakana, halfwidth and fullwidth kana, circled forms, braille, Japanese morse, wide ASCII, hentaigana, and a range of kanji variants such as pre- and post‑1949 forms and bracketed/circled kanji, and it also offers experimental mappings to Cyrillic and Hangul; it provides validators and normalizers for romaji with multiple strictness levels and supports several romanization styles like Hepburn and Kunrei, while expecting Unicode (UTF-8) input and loading conversion data on demand to avoid heavy memory use. The module does not attempt to convert kanji into kana readings or perform morphological segmentation for accurate braille, and some experimental conversions warn of limited correctness. A small but useful recent change in version 0.62 makes is_romaji_semistrict return a canonical romaji form rather than a simple true value when the input is accepted.

Langertha is a unified Perl toolkit for talking to modern large language models and local inference servers that hides provider differences behind a consistent API. It lets you do chat, streaming, embeddings, transcription and image generation across many engines (OpenAI, Anthropic, Gemini, Ollama, Groq, Mistral, HuggingFace, Replicate, vLLM, and more) and includes support for tool/function calling, automatic multi-round MCP tool loops, and an autonomous agent called Raider with history, compression and plugins. The library provides sync and async APIs, streaming iterators/callbacks, response objects that carry token usage and rate‑limit info, a plugin system and Langfuse observability hooks, and dynamic discovery of third‑party engine extensions under LangerthaX. The project is still a work in progress, but recent fixes include correct parsing of OpenAI's Responses API function_call output so tool calls work reliably with reasoning-only models such as gpt-5.5-pro. If you need a single Perl surface to experiment with multiple LLM providers, tool-calling agents, or to add observability and structured outputs, Langertha is designed to make that integration straightforward.

AI::Anthropic is a lightweight Perl client for Anthropic's Claude API that makes it easy to send single messages or full chat conversations to Claude models such as Claude 4 Opus, Sonnet, and Haiku. It exposes simple methods like message and chat, handles model selection and parameters like max_tokens, temperature, and timeout, and supports streaming responses, image (vision) inputs, and tool or function-calling workflows. You can provide your API key when creating the object or via the ANTHROPIC_API_KEY environment variable, and the module can also list available models. If you want to integrate Claude into Perl scripts, chatbots, or services, this module provides a straightforward, high-level interface. The initial 0.01 release includes support for the messages API, streaming, vision, and tools.

CANBUS is a small Perl extension that provides a straightforward way to send and receive Controller Area Network (CAN) messages on Linux by wrapping the system CAN socket API. It exposes functions in the CANBUS namespace to open and bind a socket to a named interface, transmit frames by ID with an arrayref of data bytes, read incoming frames, and close the socket. The module assumes a Linux environment with CAN interfaces configured and typically requires you to bring the interface up with ip link or use the can-utils tools beforehand. This minimal wrapper is useful when you need quick scripting access to CAN devices from Perl, and the package is at its initial 0.01 release.

PAGI::Nano is a compact Perl micro-framework built on PAGI-Tools for demos and small web apps of roughly under 20 endpoints. It gives you a simple DSL that returns an assembled PAGI app instead of mutating globals so apps are composable, nestable, and testable. It provides HTTP routing with named routes and path placeholders, raw handlers for full control, per-route and app-wide middleware, lifecycle hooks with a shared app state, static file serving, streaming, WebSocket and SSE support, and a tiny three-scope service registry. Handlers use sensible return-value coercion to JSON or text and the framework includes strong-parameters for asynchronous input parsing. Builders run eagerly at startup and must be synchronous, there is no automatic service teardown, and mounted Nano apps do not run their own startup/shutdown or declare services, so it is best suited to small, self-contained apps that benefit from a readable single-file structure while still exposing the underlying PAGI primitives when you need them.

PAGI::StructuredParameters is a lightweight, no-dependency Perl utility that whitelists and reshapes incoming request parameters into well-formed nested data before they reach your model or validator. It understands flat form and query keys like "name.first" and "email[0]" and reconstructs them into nested hashes and arrays while simply whitelisting already-nested bodies such as decoded JSON. You interact with it through a lenient permitted() call or a strict required() call that invokes a caller-supplied callback for missing keys, and there are convenient request adapters for body, query, or decoded-data sources with async support. The module also offers sane defaults for array flattening and protects you from abusive input with a configurable maximum array depth that raises an exception when exceeded. This initial release is a focused, decoupled port of the core of Catalyst::Utils::StructuredParameters intended to sit upstream of validation rather than perform validation itself.

DBIx::Class::Valiant plugs the Valiant validation system into DBIx::Class so you can declare filters and validations on your result classes or columns and have them run automatically when records are created or updated. If validation fails the database operation is aborted and you get back the DBIC result object with the attempted values and an errors collection you can inspect, which makes wiring server-side form handling and error reporting straightforward. It also supports nested creates and updates with accept_nested_for, aggregates errors across related records and will roll back the whole changeset on failure, and it honors validation contexts like create and update. You can declare validations inline in add_columns, use it schema-wide by adding components to base result/resultset classes, and it integrates with DBIx::Class::Candy. Be aware nested validation support and many-to-many handling are still evolving and require careful use of prefetch and parameter sanitization to avoid edge cases and security issues.

Valiant is a domain-level validation framework for Moo or Moose objects that gives you a compact, Rails-style DSL to declare attribute and model validations, apply input filters, and collect human-friendly error messages instead of raising exceptions at construction time. You can write simple coderefs, reuse or extend validator classes, or plug in Type::Tiny constraints, and Valiant bundles many common validators plus internationalization, nested object/array support, an Errors collection with message formatting and JSON output, and helpers for generating HTML form elements. It is intended for business-logic and form validation where invalid but well-formed objects must be reported back to users rather than aborting execution. Note that the project recently refocused the distribution so the core framework is now framework-agnostic and ORM/web integrations such as DBIx::Class::Valiant have been split into separate distributions, so upgrading may require installing those companion dists.

PAGI::Middleware::Session::Store::Cookie provides a simple way to keep session data on the client by encrypting it into the cookie so you can avoid server-side session storage. It uses AES-256-GCM for authenticated encryption and derives the key from a required secret you pass to new(), and its async API returns Futures for set (which produces the encrypted blob to store in the cookie), get (which accepts that blob and returns the decoded session hash or undef on tampering) and delete (a no-op for cookie-backed sessions). Because everything lives in the cookie you must keep session payloads small to avoid the roughly 4KB browser cookie limit and you cannot revoke sessions without introducing server-side state such as a blocklist. Recent important fixes include replacing an insecure rand() fallback with Crypt::PRNG to generate IVs (security fix CVE-2026-5087) and declaring the PAGI::Tools runtime dependency to prevent installation/runtime failures.

PAGI::Tools is a convenience toolkit for building applications on top of PAGI, the Perl Asynchronous Gateway Interface, that saves you from hand-emitting low-level protocol events by providing request and response objects, routing, a middleware suite, high-level endpoint helpers for HTTP, SSE and WebSocket, test utilities, and assorted composition and lifespan helpers. It lets you write normal handler code or mount ready-made apps and responses, then run them on any PAGI server or embed them inside larger PAGI apps, so authors exploring PAGI or building higher-level frameworks get a consistent, ergonomic base. Recent notable changes include the distribution split that formalized PAGI::Tools as its own package and a breaking API shift where PAGI::Response is a value and endpoint handlers return response values instead of sending them directly, so upgrading callers should check the new return-and-respond pattern. The toolkit continues to evolve with practical fixes and features such as better session handling for non-HTTP scopes, improved CSRF options, and a new constant-time compare utility used by security-sensitive components.

RPi::PWM::PCA9685 is a pure-Perl driver for the NXP PCA9685 16-channel, 12-bit PWM and servo controller accessed over I2C from a Raspberry Pi. It gives a simple object interface to set a single PWM frequency for all channels and control per-channel duty, phase or raw on/off ticks at 4096 resolution so LEDs and hobby servos are driven in hardware with almost no CPU overhead. The module supports percentage or tick duty settings, microsecond servo pulses, hard on/off, phase control, inversion and an open-drain sink_mode for wiring LEDs to an external supply, and it exposes low-level register access plus sleep, wake and reset operations. It is pure Perl but uses RPi::I2C for the bus transport so it runs on Linux, and new() wakes and verifies the chip for you. This initial release adds the OO API, examples and documentation, bundled datasheet, and the new drive and sink_mode conveniences, making the module a practical choice if you want to manage many PWM channels from a Pi without writing low-level I2C code.

CPAN::Perl::Releases is a small utility module that provides a static mapping from Perl release versions to the CPAN "authors/id/" paths where the release tarballs are stored. Its main function, perl_tarballs, accepts a Perl version string and returns a hashref that maps compression types such as "tar.gz", "tar.bz2", or "tar.xz" to the relative CPAN path for that tarball, or undef if the version is not known. Not all releases have every compression format so results vary. The module also offers perl_versions to list all known Perl releases in ascending order and perl_pumpkins to list the PAUSE IDs of Perl maintainers. The mapping is packaged as static data and the module is updated when new Perl releases are uploaded to CPAN. Use this module when you need to programmatically locate or construct CPAN URLs for specific Perl release tarballs or to enumerate available Perl versions.

Module::CoreList is a Perl library and command line tool for discovering which modules and versions shipped with each Perl release, letting you quickly answer questions like when a module first became part of core, whether a given module and version is bundled with a particular Perl, or what changed between two Perl releases. It offers a simple programmatic API with functions such as first_release, first_release_by_date, is_core, find_modules, find_version and changes_between, and exposes data hashes including %Module::CoreList::version, %delta, %released, %families, %upstream and %bug_tracker for deeper inspection. Use it to search core modules by regex, check deprecation or removal history, find upstream/bug tracker info for core libraries, and automate compatibility or packaging checks. The module is actively maintained and its data are regularly refreshed for new Perl releases, most recently updated to include Perl 5.44.0.

CPANSA::DB provides the CPAN Security Advisory dataset as a ready-to-use Perl data structure. It exposes a single subroutine, db, which returns a hashref containing all advisories and is primarily used by CPAN::Audit but can be used by any code that needs programmatic access to CPAN security reports. Each release includes a .gpg signature and GitHub attestations so you can verify the archive and module file, and a JSON file with the same data is also available for non-Perl consumers. The project is published on GitHub with attestations and GPG signatures to help ensure you are using authentic advisory data.

Net::Blossom::Server::Backend::S3 is a storage backend for Net::Blossom::Server that stores blob data in S3-compatible object stores like Amazon S3, Ceph, or Garage while leaving descriptor and owner metadata to a separate MetadataStore (for example SQLite or Postgres). It stages uploads on disk and automatically uses single PUTs or multipart uploads depending on file size, streams downloads with ranged reads so object bodies are not held in memory, and exposes configuration for bucket, endpoint, region, credentials, multipart thresholds, temporary directory, and custom S3 clients. The module implements the Net::Blossom::Server::Storage interface and provides hooks such as a post-commit cleanup error handler and a pluggable object-key generation function for testing. Because metadata and object storage cannot be committed atomically, failed metadata commits or deletions can leave unreachable objects, so buckets must be precreated and operators should monitor cleanup errors. If you need S3-compatible blob storage for a Blossom server with configurable upload behavior and streaming reads, this module is a ready-made option.

Mojolicious::Plugin::Fondation::Perm::UI::Bootstrap adds a ready-made Bootstrap 5 user interface for assigning permissions to groups in apps using Fondation::Perm. Install it in your Mojolicious config and it injects a permissions section into the group add/edit modal and ships two JavaScript helpers. loadPerms() pulls the permission list from /api/perm, renders the checkboxes and prechecks those a group already has. collectPermAssignments() returns the checked permission IDs for use when saving a group. This plugin is ideal when you want a simple, drop-in UI for managing group permissions that integrates with DatatableGroup.js.

Mojolicious::Plugin::Fondation::Group::UI::Bootstrap is a Mojolicious plugin that adds a Bootstrap 5 web UI for managing user groups, acting as the front end to the Fondation::Group backend. It injects a multi-select group picker into user add/edit forms, extends the user list with a groups column that renders memberships and marks inactive groups in strikethrough, and provides a standalone /groups page with a DataTable plus inline add, edit and delete modals guarded by the appropriate permissions. The plugin ships client scripts for fetching groups and wiring the UI, exposes loadGroups and collectGroupAssignments hooks for user forms, and includes English and French translations. It depends on the Fondation group backend and the Bootstrap layout plugin and was first released on 2026-07-15.

Test2::Plugin::Cover is a lightweight coverage helper for Perl tests that records which source files a test actually touched with very low overhead. It uses a small XS hook to note filenames when subroutines run and when files are opened, then attaches that minimal coverage map to a Test2 event at test exit so harnesses like Test2::Harness can consume it. This is not a full line or branch coverage tool like Devel::Cover but a practical way to determine which files a test exercises so you can select or optimize which tests to run after code changes. The module exposes simple APIs to query the files and structured data, to manually touch coverage entries, to enable or disable collection, and to tag or group calls with set_from/get_from for subtest attribution. There are known limits because magic such as eval, goto, inlined constants, XS subs, threads and some exotic open() forms can mask filenames or be unrecordable. The most recent release focused on robustness and performance by making touch_* respect disable, turning internal failures into warnings instead of dying, deduplicating and deterministically sorting caller metadata, caching control flags in XS to reduce per-call overhead, re-enabling the sysopen hook and fixing memory leaks and crash risks. If you want fast, low-cost mapping from tests to touched files this module is a good fit, and if you need exhaustive coverage reporting you should prefer Devel::Cover.

Mojolicious::Plugin::Fondation::Menu is a plugin for the Mojolicious web framework that gives your app declarative, database-backed menu and breadcrumb management. Menus are declared in a simple share/menus.json file shipped with each plugin and then synchronized into the database with a provided menu sync command. The module stores titles, links, FontAwesome icons, grouping names, parent/child relationships, ordering, visibility flags and simple conditions such as group:NAME or perm:NAME so you can show items based on role or permission. It exposes handy helpers for controllers and templates like menus, menu_by_name, menu_by_id, breadcrumb, render_menu and render_menu_breadcrumb, and it includes an auto-generated REST API with CRUD endpoints and permission checks for menu_read, menu_create, menu_update and menu_delete. Use it when you need a maintainable way to build dynamic navbars and breadcrumbs that respect user roles and plugin-provided menu definitions.

Mojolicious::Plugin::Fondation::Authorization is a small plugin for the Fondation stack that loads a user's group-based grants from the database and gives your app simple synchronous helpers to check permissions and group membership. On the first authenticated request in a session it loads permissions asynchronously with an around_dispatch hook and stores them in the session so subsequent requests do not hit the database. Permissions are inherited through group membership only, following the chain user -> user_group -> group -> group_perm -> perm, and the plugin exposes check_perm and check_group helpers for use in controllers and templates. It depends on the Fondation Auth, Group and Perm plugins for authentication and the underlying DB models, so it is a drop-in way to add cached, database-driven access control to a Mojolicious application.

Data::Checks supplies a ready-made set of value-constraint checks for Perl plus an XS-level framework so other modules can build and enforce those checks efficiently. You can import named constraints like Defined, Object, Str, Num, Maybe, Any and All, or use parametric checks such as StrEq, StrMatch, NumEq, NumRange and the various NumGT/GE/LE/LT forms, and there are handy reference and capability checks like ArrayRef, HashRef, Callable, Isa and Can. It integrates cleanly with attribute and operator-based systems so you can declare checked parameters or use "is" style tests, and each constraint is usable as an object with a ->check method for programmatic testing. Authors of XS modules get helper functions to construct and assert checks at the C level and to emit useful error messages. Note that plain CODE refs as constraint specs were deprecated to improve error reporting, and the most recent release includes a compatibility fix so the module builds cleanly against the latest Perl versions.

Mojolicious::Plugin::Fondation::Auth is a small Mojolicious plugin that adds ready-made DBIx::Class backed login and logout routes and ties them into the Fondation user model and Mojolicious::Plugin::Authentication so you get authentication routes, session handling and helpers out of the box. It delegates actual credential checks to a configurable provider so you can keep the default DBIx provider or swap in LDAP or another system, while password hashing with Argon2id is performed by the user Result class so the plugin only verifies credentials. The plugin ships a login template and translations, exposes helpers like is_user_authenticated, current_user, authenticate and logout, and expects a simple user table with username and hashed password columns. Defaults include a 30 minute session timeout and a configurable session key and column names, and recent updates simplify schema mapping by using the result_class name and add better setup and integration with the Fondation User UI bootstrap. If you need a drop-in, DBIx-aware authentication layer for a Mojolicious app that can be extended to other providers, this module provides a practical starting point.

Mojolicious::Plugin::Fondation::Perm is a small plugin that brings permission management to applications using the Fondation toolkit on the Mojolicious web framework. It is intended to help developers enforce access control within Fondation-based web apps by integrating permission checks into the normal Mojolicious workflow. The module is authored by Daniel Brosseau, carries version 0.01, and is distributed under the same license as Perl itself. Use it if you need a lightweight, framework-native way to add permission handling to Fondation projects.