Mockbird
by mockbird.mockbird.workers.dev · remote · no sign-in to list tools · v1.6.0 · published by dev.workers.mockbird.mockbird
Mock REST APIs, fake OAuth2/OIDC provider, uptime monitors + heartbeats, live badge/QR images.
19 tools: 1 can delete or cancel things, 2 do something that can't be undone, 11 change things and 5 only read.
Scanned Oct 21, 2026
- Deletes or cancels1Claude Code: deny: see these tools
- Can't be undone2Claude Code: ask: see these tools
- Changes things11Claude Code: ask: see these tools
- Only reads5Claude Code: allow: see these tools
1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.
claude mcp add --transport http mockbird https://mockbird.mockbird.workers.dev/mcpFindings
Matches of fixed checks, with the text they matched.
- Infoimage_url
The description is 2,005 characters long, over the 2,000 this check looks for.
What this check looks forMatched text
description ends: "...emo project; pass project:<your id> to point live badge counts at YOUR mock data."
Tools
Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.
19 tools
Deletes or cancels 1Claude Code: deny
delete_projectPermanently delete a project and ALL its data (records, resources, snapshots, custom routes, webhooks, request log).No findings
Why it is in this group
- The name "delete_project" says "delete": a word for removing or ending something.
- The description says "Permanently delete".
Description, as the server wrote it Permanently delete a project and ALL its data (records, resources, snapshots, custom routes, webhooks, request log). Irreversible. Good practice for short-lived test projects: clean up when your session is done. Requires the adminKey.
Can't be undone 2Claude Code: ask
heartbeatDead man's switch for cron jobs, scheduled tasks, and recurring agent runs — the INVERSE of uptime_monitor: the JOB pings Mockbird, and if the ping stops arriving the alert fires o…No findings
Why it is in this group
- The description says "cannot be recovered".
Description, as the server wrote it Dead man's switch for cron jobs, scheduled tasks, and recurring agent runs — the INVERSE of uptime_monitor: the JOB pings Mockbird, and if the ping stops arriving the alert fires once (plus one recovery message when pings resume). action:"create" {name?, period_minutes, grace_minutes?, notify?}: period_minutes = how often the job runs (30–10080); grace defaults to half the period. With notify, missed check-ins hit that webhook; WITHOUT notify you get a pollable heartbeat instead — poll for missed-check-in transitions, no webhook needed. Returns a ping URL (curl -fsS -m 10 <ping_url> at the end of the job — or call this tool with action:"ping"), a public status page /status/:id, badge.svg, Atom feed, and {id, secret} — STORE id, secret AND ping_url; they cannot be recovered. Creation counts as the first ping. action:"ping" {ping_url}: check in (use this to arm a heartbeat for YOUR OWN recurring runs — ping each run, and a missed run alerts your human via the webhook or your next poll). action:"poll" {id, secret}: (webhook-less heartbeats) missed-check-in / checked-in-again transitions since your last poll plus the current ping age. action:"info" {id, secret}: last ping, ping URL, recent evaluations. action:"delete" {id, secret}: disarm. notify formats are the same as uptime_monitor (Slack/Discord native, HMAC-signed JSON otherwise). Limits: 5 live heartbeats per IP — deleting one frees the slot immediately; evaluation granularity 30 min; pollable heartbeats with no polls and no pings for 30 days are removed.
uptime_monitorFree downtime alerts for any public URL — no account, armed in one call.No findings
Why it is in this group
- The description says "cannot be recovered".
Description, as the server wrote it Free downtime alerts for any public URL — no account, armed in one call. action:"create" {url, notify?}: Mockbird GETs the url every 30 minutes from Cloudflare's network (8s timeout, 2xx/3xx = up; a timeout/TLS/DNS blip on an otherwise-up url is confirmed with a same-run retry before it counts); with notify, that webhook gets ONE message when it goes down and ONE when it recovers — debounced (two consecutive checks must agree), so single blips never fire. WITHOUT notify you get a pollable monitor instead — no webhook infrastructure needed. notify formats: hooks.slack.com URLs get {"text"}, discord.com/api/webhooks get {"content"}, anything else gets JSON signed with the returned secret (x-mockbird-signature: sha256=hex(hmac-sha256(secret, body))). The result includes the CURRENT up/down state (checked immediately), a public hostname-only status page /status/:id, an embeddable badge.svg, an Atom feed, and {id, secret} — STORE BOTH; they manage the monitor and cannot be recovered. action:"poll" {id, secret}: (webhook-less monitors) the down/recovered transitions since your last poll plus the latest check — empty events = nothing changed. action:"info" {id, secret}: latest check, 24h ok-rate, recent up/down transitions, alert delivery state. action:"delete" {id, secret}: stop monitoring. Limits: 3 live monitors per IP — deleting one frees the slot immediately (the 429 states the limit); pollable monitors not polled for 30 days are removed. For cron jobs / scheduled tasks use the inverse tool: heartbeat.
Changes things 11Claude Code: ask
add_resourceAdd a resource (collection) to a project and seed it with realistic fake data.No findings
Why it is in this group
- The name "add_resource" says "add": a word for a change.
Description, as the server wrote it Add a resource (collection) to a project and seed it with realistic fake data. Either pass template (one of the built-ins, e.g. users, products, posts, comments, orders, todos, reviews, customers, events) or fields: an array of {name, type} where type ∈ uuid|firstName|lastName|fullName|username|email|avatar|image|word|words|title|sentence|paragraph|number|price|percent|boolean|date|pastDate|futureDate|url|domain|ip|phone|city|country|address|zipCode|company|jobTitle|color|latitude|longitude|rating|age|slug|status|category|refId, plus {name, type:"oneOf", values:[...]} for enums. seed = number of records to generate (default 20, max 100, 0 = empty). No project yet? Omit project AND adminKey and a fresh blank project is auto-created for this resource — the response then includes the new project id + adminKey (save both).
create_projectCreate a new mock REST API project.No findings
Why it is in this group
- The name "create_project" says "create": a word for a change.
Description, as the server wrote it Create a new mock REST API project. Returns {id, adminKey, baseUrl, resources[]}. SAVE the adminKey — it is required for admin operations (add_resource, custom_route, snapshots) and is shown only once. Presets seed a full backend: blog (posts/comments/authors), ecommerce (products/orders/customers/reviews), saas (users/teams/events), payments (Stripe-shaped sandbox: charges/refunds/subscriptions/customers + payment_intent create→confirm flow + /v1/balance — no keys), openai (ready OpenAI-compatible mock — chat completions incl. streaming SSE, embeddings with a real 1536-dim vector, models; point OPENAI_BASE_URL at {baseUrl}/v1). Omit preset for a starter project (one seeded "items" resource — live data immediately, reshape or delete it); use "blank" for a truly empty project you fill via add_resource or import_data. The mock API is then live at baseUrl: standard REST CRUD (GET/POST/PUT/PATCH/DELETE), CORS enabled, no auth needed. Every project also serves a mock OAuth2/OIDC provider at {baseUrl}/.well-known/openid-configuration (PKCE code flow, client_credentials, RS256 JWKS — any client_id works) for testing auth flows.
custom_routeDefine a custom endpoint on a project (like /health, /config/:key, or a catch-all /webhooks/* request bin).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Define a custom endpoint on a project (like /health, /config/:key, or a catch-all /webhooks/* request bin). body is a response template: {{query.x}} {{params.x}} {{body.x}} {{headers.x}} {{method}} {{path}} {{now}} {{ts}} {{uuid}} {{rand}}; triple braces {{{body}}} insert raw JSON. Custom routes take precedence over resource routes; '*' catch-alls are a fallback. Max 20 routes/project.
fork_projectCopy an entire project — resources + records verbatim, custom routes, behavior settings — into a brand-new project with its own id + adminKey.No findings
Why it is in this group
- The name "fork_project" says "fork": a word for a change.
Description, as the server wrote it Copy an entire project — resources + records verbatim, custom routes, behavior settings — into a brand-new project with its own id + adminKey. Built for parallel eval/CI runs: keep a template project, fork_project per run with a ttl (crashed runs can't leak sandboxes — the fork deletes itself), let the agent mutate the fork freely, then grade with snapshots action:"diff". withSnapshots:true also copies the template's snapshots, so a fork carries its expected/start answer keys for diff-based grading. Works on the shared playground with NO adminKey: {"project":"demo"} gives you the demo dataset as your own private project (writes persist, never resets).
generate_fake_dataGenerate realistic fake data instantly — stateless, nothing is created or stored, no project or adminKey needed.No findings
Why it is in this group
- The name "generate_fake_data" says "generate": a word for a change.
Description, as the server wrote it Generate realistic fake data instantly — stateless, nothing is created or stored, no project or adminKey needed. Ready-made resource shapes (FakerAPI-compatible): persons, users, addresses, companies, books, products, texts, images, places, credit_cards (credit cards are Luhn-valid; book EAN13/ISBN13 checksums are real; image URLs are live SVG placeholders served by Mockbird). Or pass fields for a custom shape: an object mapping output key → type, with type ∈ counter|uuid|number|boolean|word|text|longText|firstName|lastName|name|email|phone|date|dateTime|image|streetAddress|streetName|buildingNumber|city|postcode|state|country|countryCode|latitude|longitude|vat|website|company_name|card_type|card_number|card_expiration|ean|upc|pokemon|null. seed makes output deterministic — same seed + shape returns identical rows forever (reproducible fixtures). Need the data HOSTED instead? create_project / add_resource serve seeded collections at a live REST URL with full CRUD, filters, and persistence.
image_urlMint a permanent, keyless image URL rendered by Mockbird — README badges (including LIVE record-count badges), chart images, QR codes, Open Graph cards, placeholder images, initial…1 finding
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Findings
- Info
The description is 2,005 characters long, over the 2,000 this check looks for.
What this check looks forMatched text
description ends: "...emo project; pass project:<your id> to point live badge counts at YOUR mock data."
Description, as the server wrote it Mint a permanent, keyless image URL rendered by Mockbird — README badges (including LIVE record-count badges), chart images, QR codes, Open Graph cards, placeholder images, initials avatars. Deterministic: the same URL renders the same image forever (no account, no expiry, no watermark). Params are validated against the real endpoint before the URL is returned, so a returned URL is guaranteed to render. Returns {url, markdown} ready to paste into READMEs, PR comments, issues, chat, dashboards, or HTML <img> tags. Kinds and their params: badge (SVG): {label, value, color (shields-style names like brightgreen/red/blue or hex), labelColor, style: flat|flat-square|plastic|for-the-badge|social}; label ALONE renders a message-only badge (single colored segment) — OR live mode: {resource:"products"} renders the CURRENT record count of that resource in the project (extra field:value entries filter exact-match, e.g. {resource:"orders", status:"shipped"}); re-counted on every render (~60s cache) — a README badge that tracks live mock data. chart (PNG; format:"svg" for vector): {data:"1,4,2,8" — comma-separated numbers, up to 6 pipe-separated series "1,4,2|3,5,8", type: line|area|bar|spark|pie|donut, labels:"mon,tue,wed", title, theme: light|dark}; size like "800x400". qr (PNG or svg): {data:"https://…"} — any text up to 1000 chars: URLs, WIFI:T:WPA;S:net;P:pw;; strings, mailto:, plain text; optional {ecc: L|M|Q|H, margin, fg, bg (hex, no #)}; size like "512". og (PNG at the og:image-standard 1200x630 — paste straight into <meta property="og:image">): {title (≤120 chars, wrapped), subtitle (≤200), site (footer text), logo: <seed> (deterministic identicon), theme: dark|light}. placeholder: size "300x200" (WxH, default) plus {text, bg, fg (hex, no #), seed (deterministic palette), round:1 (circle)}. avatar: {name:"Ada Lovelace"} — deterministic initials avatar. By default images render under the shared demo project; pass project:<your id> to point live badge counts at YOUR mock data.
import_dataCreate a live mock API from existing artifacts.No findings
Why it is in this group
- The name "import_data" says "import": a word for a change.
Description, as the server wrote it Create a live mock API from existing artifacts. Auto-detects: OpenAPI 3.x / Swagger 2.0 spec (JSON or YAML) → resources with realistic seeded data, and non-CRUD paths (login, /search, RPC verbs like POST /invoices/{id}/send) become custom routes serving the spec's own examples verbatim; json-server db.json → hosts your exact records; Postman Collection v2.x → resources from requests, saved example responses become records verbatim; HAR (DevTools network export) or VCR/vcrpy cassette YAML → replayable mock of the recorded JSON APIs (these two up to 8 MB); bare JSON array of objects → one hosted collection; CSV/TSV → one typed collection (numbers/booleans inferred per column). Max 512 KB (HAR/cassette 8 MB). Returns {id, adminKey, baseUrl, warnings[], routes[]}.
verdictOne call = the whole eval grade.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it One call = the whole eval grade. Composes the state check (snapshot diff vs live data) with trajectory constraints on the request log into a single {pass, checks[]} verdict. Pass snapshot:"expected" to require live data to match that snapshot (author it as the answer key first via snapshots action:"save" with data), and/or trajectory constraints like [{method:"DELETE", count:0}, {method:"POST", path:"/orders", count:1}, {status_gte:400, count:0}] — each needs an expectation: count (exact), min and/or max. Typical harness: fork_project per run → agent works the fork → verdict {snapshot:"expected", trajectory:[...]} → assert .pass → delete_project. Trajectory counts see the retained request window (last 50) — fork per run so the log is exactly one episode's trace. Or pass name to run a SAVED spec (authored via PUT /api/projects/:id/verdicts/:name; forks copy them) — graders without the admin key can run saved specs keylessly via the share link: GET /api/share/:token/verdict/:name.
watch_service_statusSubscribe to down/recovered alerts for any of the public mock/testing APIs tracked by check_api_status (httpbin, JSONPlaceholder, ReqRes, FakeStoreAPI, DummyJSON …).No findings
Why it is in this group
- The name "watch_service_status" says "status": a word for reading.
- The description's first verb is "subscribe": a word for a change.
Description, as the server wrote it Subscribe to down/recovered alerts for any of the public mock/testing APIs tracked by check_api_status (httpbin, JSONPlaceholder, ReqRes, FakeStoreAPI, DummyJSON …). action:"subscribe" {service, notify?}: service is an id from check_api_status (or "*" for all tracked services). With notify, that webhook gets one message when the service goes down and one when it recovers (debounced across two consecutive hourly checks — blips never fire; a confirmation message is delivered immediately so you can see the wiring works). WITHOUT notify you get a pollable subscription instead — no webhook needed. Returns {id, secret} — store both. action:"poll" {id, secret}: (webhook-less watches) returns the down/recovered transitions since your last poll — empty events = nothing changed; checks run hourly so polling more often sees nothing new. action:"info" {id, secret}: subscription state. action:"unsubscribe" {id, secret}: stop alerts. notify formats: Slack/Discord webhooks get native payloads; anything else gets HMAC-signed JSON. Limits: 5 live watches per IP — deleting one frees the slot immediately. To watch YOUR OWN URL instead, use uptime_monitor.
write_recordCreate, update, or delete records in a mock resource.No findings
Why it is in this group
- The name "write_record" says "write": a word for a change.
Description, as the server wrote it Create, update, or delete records in a mock resource. Writes persist (unlike JSONPlaceholder/FakeStoreAPI). POST creates (auto-id), PUT replaces, PATCH merges, DELETE removes. id required for PUT/PATCH/DELETE.
Only reads 5Claude Code: allow
check_api_statusLive status of ~58 public mock/testing APIs — JSONPlaceholder, httpbin.org, ReqRes, FakeStoreAPI, DummyJSON, Postman Echo, httpstat.us, Mocky, Mockbin, CrudCrud, restcountries, and…No findings
Why it is in this group
- The name "check_api_status" says "status": a word for reading.
Description, as the server wrote it Live status of ~58 public mock/testing APIs — JSONPlaceholder, httpbin.org, ReqRes, FakeStoreAPI, DummyJSON, Postman Echo, httpstat.us, Mocky, Mockbin, CrudCrud, restcountries, and more — checked with a plain keyless GET every 30 minutes from Cloudflare's network (a service answering HTTP 200 error envelopes is probed by body and honestly reported as failing). No arguments → compact summary: up/down counts plus full detail for every failing service. Pass service (id, name, or hostname substring — e.g. "httpbin", "reqres.in") for one service's detail: latest check, last_success_at, down_since, 24h/7d uptime, note, recent check history. Use it before pointing tests or tutorials at a public API — and if it's down, the result links a Mockbird alternative guide plus the one-call hosted mock replacement.
inspect_requestsRead the project's request inspector: the most recent requests that hit the mock API (method, path, query, status, origin, captured headers incl.No findings
Why it is in this group
- The name "inspect_requests" says "inspect": a word for reading.
Description, as the server wrote it Read the project's request inspector: the most recent requests that hit the mock API (method, path, query, status, origin, captured headers incl. x-* — authorization redacted to its scheme — and a body snippet for writes). Use it to VERIFY what your app / tests / webhook sender actually sent: point code at the mock, run it, then inspect. Pairs with custom_route catch-all bins (e.g. /webhooks/*) for webhook payload + signature debugging. TRAJECTORY ASSERTIONS: filters (method / path / status / status_gte / status_lte / since) return {count} of matches in the retained window, so a grader can assert the agent never called DELETE (method:"DELETE" → count 0), stayed inside /tasks, or produced no 4xx/5xx (status_gte:400 → count 0). Fork per run and the log is exactly one episode's trace. Requires the adminKey, except project "demo" whose inspector is public.
project_infoGet a project's public root index: every resource with record counts and URLs, custom routes, auth mode, and export links (openapi.json, types.ts, postman.json, db.json, GraphQL).No findings
Why it is in this group
- The description's first verb is "get": a word for reading.
Description, as the server wrote it Get a project's public root index: every resource with record counts and URLs, custom routes, auth mode, and export links (openapi.json, types.ts, postman.json, db.json, GraphQL). No adminKey needed. Try project "demo" for the shared public playground.
query_recordsGET records from a mock resource.No findings
Why it is in this group
- The name "query_records" says "query": a word for reading.
Description, as the server wrote it GET records from a mock resource. params is an object of query parameters, all optional: exact filters (field=value), operator suffixes (price_gte, date_lte, name_like, status_ne), full-text q, _sort/_order (or _page/_limit for pagination), select (field projection, e.g. "name,price"), _expand=<parent>/_embed=<children> relations. Failure simulation for testing: mock_status=503 forces that status, mock_delay=2000 adds latency (ms), mock_chaos=0.3 fails that fraction of requests randomly, mock_seq=503,503,200 serves a deterministic status sequence (fail twice then succeed — best for retry tests), mock_jitter=500 adds random latency, mock_envelope=data wraps the response. Pass id to fetch a single record. Defaults to _limit=25 — pass _limit explicitly for more (max 100 per page).
snapshotsDeterministic test fixtures + eval grading: save the project's entire dataset under a name, restore it exactly later, or DIFF it against live data (list/delete too).No findings
Why it is in this group
- The name "snapshots" says "snapshot": a word for reading.
Description, as the server wrote it Deterministic test fixtures + eval grading: save the project's entire dataset under a name, restore it exactly later, or DIFF it against live data (list/delete too). action:"diff" is machine-checkable grading — compares the named snapshot (expected) against live data (actual, or another snapshot via against) and returns {identical, summary, resources[] with per-record added/removed/changed field detail}: author an answer-key snapshot, let the agent work the fork, then assert .identical. Any GET can also be served read-only FROM a snapshot without touching live data via query param mock_snapshot=<name> in query_records params — parallel test scenarios on one project.
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Install
Pinned to version 1.6.0. Values in angle brackets are yours to fill in.
claude mcp add --transport http mockbird https://mockbird.mockbird.workers.dev/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__mockbird__project_info",
"mcp__mockbird__query_records",
"mcp__mockbird__inspect_requests",
"mcp__mockbird__snapshots",
"mcp__mockbird__check_api_status"
],
"ask": [
"mcp__mockbird__create_project",
"mcp__mockbird__import_data",
"mcp__mockbird__fork_project",
"mcp__mockbird__add_resource",
"mcp__mockbird__write_record",
"mcp__mockbird__generate_fake_data",
"mcp__mockbird__custom_route",
"mcp__mockbird__share_project",
"mcp__mockbird__verdict",
"mcp__mockbird__uptime_monitor",
"mcp__mockbird__heartbeat",
"mcp__mockbird__watch_service_status",
"mcp__mockbird__image_url"
],
"deny": [
"mcp__mockbird__delete_project"
]
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as mockbird. Review it before you use it.