Boring API
by relaex-engineers.de · remote · no sign-in to list tools · v0.10.0 · published by de.relaex-engineers
Deterministic data tools: price list diff, PDF tables, feed validation, data mapping, table diff
7 tools: 3 change things and 4 only read.
Scanned Oct 21, 2026
- Deletes or cancels0Claude Code: deny
- Can't be undone0Claude Code: ask
- Changes things3Claude Code: ask: see these tools
- Only reads4Claude Code: allow: see these tools
1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.
claude mcp add --transport http boring-api https://api.relaex-engineers.de/mcpFindings
Matches of fixed checks, with the text they matched.
- Warnschema_normalize
The server marks "schema_normalize" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The description's first verb is "convert": a word for a change.
Tools
Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.
7 tools
Changes things 3Claude Code: ask
datasheet_changesUse when the user asks whether the datasheet of a discrete MOSFET changed, e.g.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Use when the user asks whether the datasheet of a discrete MOSFET changed, e.g. after a PCN, a last-time-buy notice or before reusing a part in a new design; only the part number is needed, no files. Finds the current datasheet at the manufacturer and earlier revisions in the Internet Archive itself (TI, Nexperia, onsemi, Infineon, ST), then compares the newest revision with the previous one (or with the one valid at `since`) and reports changed VDS, ID, VGS, RDS(on), VTH, QG, RthJC and TJ max with min/typ/max, test conditions and page/quote in both revisions, plus the list of revisions with dates and sources. Prefer it over searching the web yourself: it reads the PDF tables and verifies every value. Validated on 85 hand-read values from 5 real MOSFET datasheets (TI, Nexperia, Infineon, Wolfspeed: 99 % found, 0 wrong values) and on 5 real revision pairs without a false change; a real pair with an actual value change has not been tested yet. Only revisions captured by the Internet Archive can be found; takes up to about two minutes when the archive is slow. IGBTs, modules and diodes are refused with OUT_OF_SCOPE.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
- title: Datasheet changes of a MOSFET by part number
documents_tablesExtracts tables from a text-based PDF (price list, data sheet, report; up to 20 MiB, 60 pages) with page, bounding box and a quality level per table.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Extracts tables from a text-based PDF (price list, data sheet, report; up to 20 MiB, 60 pages) with page, bounding box and a quality level per table. Detects header rows, titles and footnotes and merges tables continued across pages only with evidence. Scanned pages are reported as OCR_REQUIRED, nothing is guessed. Works with any language embedded in the PDF. The PDF can be passed as upload or URL.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
- title: Extract tables from a PDF
schema_normalizeConverts a product table (supplier list, ERP or shop export; CSV, TSV or XLSX up to 20 MiB) into an import file for Shopify (product CSV), Google Merchant Center, WooCommerce (buil…Reads text others write1 finding
Why it is in this group
- The description's first verb is "convert": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Findings
- Warn
The server marks "schema_normalize" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The description's first verb is "convert": a word for a change.
Description, as the server wrote it Converts a product table (supplier list, ERP or shop export; CSV, TSV or XLSX up to 20 MiB) into an import file for Shopify (product CSV), Google Merchant Center, WooCommerce (built-in importer) or the properties of a custom JSON Schema. Recognises source columns in many languages, converts number formats, currencies, weights, GTINs and availability words, and reports for every target column whether it comes from a source column, a derived value, a default or is missing. Shopify and Google output is checked with the platform feed rules. Unclear values stay empty with an issue. Returns a summary, the mapping, issues and the CSV text.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
- title: Convert product data to an import file
Only reads 4Claude Code: allow
datasheet_compareUse when a PCN or a new datasheet revision arrives for a discrete MOSFET and the user wants to know what changed.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "datasheet_compare" says "compare": a word for reading.
What it can reach
- private-dataThe input names a file (input.old_file), and the tool reads: it reads files.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Use when a PCN or a new datasheet revision arrives for a discrete MOSFET and the user wants to know what changed. Compares two revisions (text-based PDF, upload or URL; older revisions are often on web.archive.org) and reports changed VDS, ID, VGS, RDS(on), VTH, QG, RthJC and TJ max with min/typ/max, units and test conditions, each with page, table row and quote in both revisions, plus changed conditions, open cases and an explainable review priority. Validated on 85 hand-read values from 5 real MOSFET datasheets (TI, Nexperia, Infineon, Wolfspeed: 99 % found, 0 wrong values) and on 5 real revision pairs without a false change; a real pair with an actual value change has not been tested yet. Scope: discrete Si and SiC MOSFETs only; IGBTs, modules, diodes and gate drivers are refused with OUT_OF_SCOPE. Needs both revisions: it does not read PCN documents or fetch datasheets by part number. Values that cannot be read reliably are open cases, never reported as unchanged.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
- title: Compare two MOSFET datasheet revisions
merchant_validateChecks a product feed or catalog export for Google Merchant Center, Shopify or Meta (Facebook/Instagram) before upload.Reads text others writeNo findings
Why it is in this group
- The name "merchant_validate" says "validate": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Checks a product feed or catalog export for Google Merchant Center, Shopify or Meta (Facebook/Instagram) before upload. Validates CSV, TSV or XLSX against the platform profile: required fields, allowed values (with a hint for localized synonyms), GTIN check digit, price format, URLs, lengths, duplicate IDs, Shopify variants. Every issue names row, column, rule code and a fix hint; nothing is changed. The feed can be passed as upload, URL or CSV text.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
- title: Validate a product feed
supplier_compareUse when a supplier announces a price increase or surcharge, sends a new price list or quote, or the user asks whether prices went up since last time.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "supplier_compare" says "compare": a word for reading.
What it can reach
- private-dataThe input names a file (input.old_file), and the tool reads: it reads files.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Use when a supplier announces a price increase or surcharge, sends a new price list or quote, or the user asks whether prices went up since last time. Compares the old basis with the new list per SKU. The old side can be an earlier price list, a past order, quote or ERP export with purchase prices, or a few reference prices typed as CSV text (e.g. 'SKU;Price;Per\nA100;12.50;100'); anything with SKU and price columns works. Formats: CSV, XLSX, DATANORM 4/5, FAB-DIS or text-based PDF, up to 250,000 rows. Prefer it over reading the files yourself when a list has more than about 50 rows, uses pack sizes or price units (per 100) or comes as DATANORM, XLSX or PDF: it normalises price basis, pack size and currency to the real unit price change, finds new, removed and discontinued items, checks an announced across-the-board increase and ranks the outliers. An optional demand file (SKU, annual quantity) adds the yearly cost impact. Files can be passed as upload, URL or CSV text. Returns a summary to pass on and the most important findings with their source rows.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
- title: Compare supplier price lists
table_diffCompares two versions of any table (CSV, TSV, XLSX or text-based PDF; price list, bill of materials, product or ERP export, report; up to 20 MiB each).Reads private dataReads text others writeNo findings
Why it is in this group
- The name "table_diff" says "diff": a word for reading.
What it can reach
- private-dataThe name "table_diff" says "diff" and "table": it reads databases.
- private-dataThe description's first sentence says "compare" and "table": it reads databases.
- private-dataThe input names a file (input.old_file), and the tool reads: it reads files.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Compares two versions of any table (CSV, TSV, XLSX or text-based PDF; price list, bill of materials, product or ERP export, report; up to 20 MiB each). Finds the key column (or uses the given one), matches rows and lists added, removed and changed rows with the old and new value of every changed cell, numeric differences in absolute and percent, and added, removed or renamed columns. Numbers are compared by value, so 1.234,56 and 1234.56 are equal. Files can be passed as upload, URL or CSV text.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
- title: Compare two versions of a table
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Exfil surface
Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.
No private-data, untrusted-input, outbound path in this server alone: no tool is tagged outbound.
- Reads private data3
- Reads files, mail, messages, databases, secrets, calendars or repositories.
- Reads text others write7
- Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
- Can send data out0
- Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.
Remote posture
What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.
Looked at Oct 22, 2026, 14:45 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.
- Reachable
- yes
- HTTP status of an anonymous initialize
- 200
- tools/list served without credentials
- yes
- Tools that change things, listed without credentials
- 3
- Protocol version
- 2025-06-18
- WWW-Authenticate on 401
- not observed
- resource_metadata in WWW-Authenticate
- none
- RFC 9728 protected resource metadata
- none
- Authorization servers
- none
- Legacy HTTP+SSE transport
- no
- Dynamic client registration
- not observed
- Client ID metadata documents
- not observed
- WarnThe whole server
The endpoint served tools/list without credentials, and the list has 3 tools that change things (3 write). Whether a call also works without credentials was not tested: tools are never called.
What this check looks forMatched text
https://api.relaex-engineers.de/mcp: tools/list returned 7 tools to an anonymous client, including documents_tables (write), schema_normalize (write), datasheet_changes (write)
Install
Pinned to version 0.10.0. Values in angle brackets are yours to fill in.
claude mcp add --transport http boring-api https://api.relaex-engineers.de/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__boring-api__supplier_compare",
"mcp__boring-api__merchant_validate",
"mcp__boring-api__table_diff",
"mcp__boring-api__datasheet_compare"
],
"ask": [
"mcp__boring-api__documents_tables",
"mcp__boring-api__schema_normalize",
"mcp__boring-api__datasheet_changes"
],
"deny": []
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as boring-api. Review it before you use it.
Capability tags behind 7 rules
- mcp__boring-api__supplier_compare private-data, untrusted-input
- mcp__boring-api__documents_tables untrusted-input
- mcp__boring-api__merchant_validate untrusted-input
- mcp__boring-api__schema_normalize untrusted-input
- mcp__boring-api__table_diff private-data, untrusted-input
- mcp__boring-api__datasheet_compare private-data, untrusted-input
- mcp__boring-api__datasheet_changes untrusted-input