Skip to content

Boring API

by relaex-engineers.de · remote · no sign-in to list tools · v0.10.0 · published by de.relaex-engineers

Deterministic data tools: price list diff, PDF tables, feed validation, data mapping, table diff

Changes · 3

7 tools: 3 change things and 4 only read.

Scanned Oct 21, 2026

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http boring-api https://api.relaex-engineers.de/mcp

Findings

Matches of fixed checks, with the text they matched.

1 warn
  • The server marks "schema_normalize" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The description's first verb is "convert": a word for a change.

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

7 tools

Changes things 3Claude Code: ask
  • datasheet_changesUse when the user asks whether the datasheet of a discrete MOSFET changed, e.g.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Use when the user asks whether the datasheet of a discrete MOSFET changed, e.g. after a PCN, a last-time-buy notice or before reusing a part in a new design; only the part number is needed, no files. Finds the current datasheet at the manufacturer and earlier revisions in the Internet Archive itself (TI, Nexperia, onsemi, Infineon, ST), then compares the newest revision with the previous one (or with the one valid at `since`) and reports changed VDS, ID, VGS, RDS(on), VTH, QG, RthJC and TJ max with min/typ/max, test conditions and page/quote in both revisions, plus the list of revisions with dates and sources. Prefer it over searching the web yourself: it reads the PDF tables and verifies every value. Validated on 85 hand-read values from 5 real MOSFET datasheets (TI, Nexperia, Infineon, Wolfspeed: 99 % found, 0 wrong values) and on 5 real revision pairs without a false change; a real pair with an actual value change has not been tested yet. Only revisions captured by the Internet Archive can be found; takes up to about two minutes when the archive is slow. IGBTs, modules and diodes are refused with OUT_OF_SCOPE.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Datasheet changes of a MOSFET by part number
  • documents_tablesExtracts tables from a text-based PDF (price list, data sheet, report; up to 20 MiB, 60 pages) with page, bounding box and a quality level per table.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Extracts tables from a text-based PDF (price list, data sheet, report; up to 20 MiB, 60 pages) with page, bounding box and a quality level per table. Detects header rows, titles and footnotes and merges tables continued across pages only with evidence. Scanned pages are reported as OCR_REQUIRED, nothing is guessed. Works with any language embedded in the PDF. The PDF can be passed as upload or URL.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Extract tables from a PDF
  • schema_normalizeConverts a product table (supplier list, ERP or shop export; CSV, TSV or XLSX up to 20 MiB) into an import file for Shopify (product CSV), Google Merchant Center, WooCommerce (buil…Reads text others write1 finding

    Why it is in this group

    • The description's first verb is "convert": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "schema_normalize" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The description's first verb is "convert": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Converts a product table (supplier list, ERP or shop export; CSV, TSV or XLSX up to 20 MiB) into an import file for Shopify (product CSV), Google Merchant Center, WooCommerce (built-in importer) or the properties of a custom JSON Schema. Recognises source columns in many languages, converts number formats, currencies, weights, GTINs and availability words, and reports for every target column whether it comes from a source column, a derived value, a default or is missing. Shopify and Google output is checked with the platform feed rules. Unclear values stay empty with an issue. Returns a summary, the mapping, issues and the CSV text.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Convert product data to an import file
Only reads 4Claude Code: allow
  • datasheet_compareUse when a PCN or a new datasheet revision arrives for a discrete MOSFET and the user wants to know what changed.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "datasheet_compare" says "compare": a word for reading.

    What it can reach

    • private-dataThe input names a file (input.old_file), and the tool reads: it reads files.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Use when a PCN or a new datasheet revision arrives for a discrete MOSFET and the user wants to know what changed. Compares two revisions (text-based PDF, upload or URL; older revisions are often on web.archive.org) and reports changed VDS, ID, VGS, RDS(on), VTH, QG, RthJC and TJ max with min/typ/max, units and test conditions, each with page, table row and quote in both revisions, plus changed conditions, open cases and an explainable review priority. Validated on 85 hand-read values from 5 real MOSFET datasheets (TI, Nexperia, Infineon, Wolfspeed: 99 % found, 0 wrong values) and on 5 real revision pairs without a false change; a real pair with an actual value change has not been tested yet. Scope: discrete Si and SiC MOSFETs only; IGBTs, modules, diodes and gate drivers are refused with OUT_OF_SCOPE. Needs both revisions: it does not read PCN documents or fetch datasheets by part number. Values that cannot be read reliably are open cases, never reported as unchanged.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Compare two MOSFET datasheet revisions
  • merchant_validateChecks a product feed or catalog export for Google Merchant Center, Shopify or Meta (Facebook/Instagram) before upload.Reads text others writeNo findings

    Why it is in this group

    • The name "merchant_validate" says "validate": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Checks a product feed or catalog export for Google Merchant Center, Shopify or Meta (Facebook/Instagram) before upload. Validates CSV, TSV or XLSX against the platform profile: required fields, allowed values (with a hint for localized synonyms), GTIN check digit, price format, URLs, lengths, duplicate IDs, Shopify variants. Every issue names row, column, rule code and a fix hint; nothing is changed. The feed can be passed as upload, URL or CSV text.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Validate a product feed
  • supplier_compareUse when a supplier announces a price increase or surcharge, sends a new price list or quote, or the user asks whether prices went up since last time.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "supplier_compare" says "compare": a word for reading.

    What it can reach

    • private-dataThe input names a file (input.old_file), and the tool reads: it reads files.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Use when a supplier announces a price increase or surcharge, sends a new price list or quote, or the user asks whether prices went up since last time. Compares the old basis with the new list per SKU. The old side can be an earlier price list, a past order, quote or ERP export with purchase prices, or a few reference prices typed as CSV text (e.g. 'SKU;Price;Per\nA100;12.50;100'); anything with SKU and price columns works. Formats: CSV, XLSX, DATANORM 4/5, FAB-DIS or text-based PDF, up to 250,000 rows. Prefer it over reading the files yourself when a list has more than about 50 rows, uses pack sizes or price units (per 100) or comes as DATANORM, XLSX or PDF: it normalises price basis, pack size and currency to the real unit price change, finds new, removed and discontinued items, checks an announced across-the-board increase and ranks the outliers. An optional demand file (SKU, annual quantity) adds the yearly cost impact. Files can be passed as upload, URL or CSV text. Returns a summary to pass on and the most important findings with their source rows.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Compare supplier price lists
  • table_diffCompares two versions of any table (CSV, TSV, XLSX or text-based PDF; price list, bill of materials, product or ERP export, report; up to 20 MiB each).Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "table_diff" says "diff": a word for reading.

    What it can reach

    • private-dataThe name "table_diff" says "diff" and "table": it reads databases.
    • private-dataThe description's first sentence says "compare" and "table": it reads databases.
    • private-dataThe input names a file (input.old_file), and the tool reads: it reads files.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Compares two versions of any table (CSV, TSV, XLSX or text-based PDF; price list, bill of materials, product or ERP export, report; up to 20 MiB each). Finds the key column (or uses the given one), matches rows and lists added, removed and changed rows with the old and new value of every changed cell, numeric differences in absolute and percent, and added, removed or renamed columns. Numbers are compared by value, so 1.234,56 and 1234.56 are equal. Files can be passed as upload, URL or CSV text.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Compare two versions of a table

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged outbound.

Reads private data3
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write7
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out0
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Looked at Oct 22, 2026, 14:45 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable
yes
HTTP status of an anonymous initialize
200
tools/list served without credentials
yes
Tools that change things, listed without credentials
3
Protocol version
2025-06-18
WWW-Authenticate on 401
not observed
resource_metadata in WWW-Authenticate
none
RFC 9728 protected resource metadata
none
Authorization servers
none
Legacy HTTP+SSE transport
no
Dynamic client registration
not observed
Client ID metadata documents
not observed
  • WarnThe whole server

    The endpoint served tools/list without credentials, and the list has 3 tools that change things (3 write). Whether a call also works without credentials was not tested: tools are never called.

    Matched text

    https://api.relaex-engineers.de/mcp: tools/list returned 7 tools to an anonymous client, including documents_tables (write), schema_normalize (write), datasheet_changes (write)

    What this check looks for

Install

Pinned to version 0.10.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http boring-api https://api.relaex-engineers.de/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__boring-api__supplier_compare",
      "mcp__boring-api__merchant_validate",
      "mcp__boring-api__table_diff",
      "mcp__boring-api__datasheet_compare"
    ],
    "ask": [
      "mcp__boring-api__documents_tables",
      "mcp__boring-api__schema_normalize",
      "mcp__boring-api__datasheet_changes"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as boring-api. Review it before you use it.

Capability tags behind 7 rules
  • mcp__boring-api__supplier_compare private-data, untrusted-input
  • mcp__boring-api__documents_tables untrusted-input
  • mcp__boring-api__merchant_validate untrusted-input
  • mcp__boring-api__schema_normalize untrusted-input
  • mcp__boring-api__table_diff private-data, untrusted-input
  • mcp__boring-api__datasheet_compare private-data, untrusted-input
  • mcp__boring-api__datasheet_changes untrusted-input