Stackhal

by bahdanhal · remote · no sign-in to list tools · v1.2.0 · published by GitHub user bahdanhal

Outside-in DNS, email security, SEO, GEO and app-link checks plus developer utilities.

Changes · 6

Compare Registry entry

13 tools: 6 change things and 7 only read.

Scanned Oct 21, 2026

Deletes or cancels0Claude Code: deny
Can't be undone0Claude Code: ask
Changes things6Claude Code: ask: see these tools
Only reads7Claude Code: allow: see these tools

5 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http stackhal https://stackhal.com/mcp

Findings

Matches of fixed checks, with the text they matched.

3 warn2 info

Warnaudit_website_seo
The server marks "audit_website_seo" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
Matched text
annotations: {"readOnlyHint":true,"openWorldHint":true}; The description's first verb is "run": a word for a change.
What this check looks for
Warngenerate_favicon_suite
The server marks "generate_favicon_suite" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
Matched text
annotations: {"readOnlyHint":true,"openWorldHint":false}; The name "generate_favicon_suite" says "generate": a word for a change.
What this check looks for
Warngenerate_apple_pkpass_spec
The server marks "generate_apple_pkpass_spec" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
Matched text
annotations: {"readOnlyHint":true,"openWorldHint":false}; The name "generate_apple_pkpass_spec" says "generate": a word for a change.
What this check looks for
Infodiagnose_cors_policy
The description mentions "credential".
Matched text
description: "...quest and response headers for wildcard/credential security violations, missing Vary: Orig..."
What this check looks for
Infodiagnose_cors_policy
The input schema at properties.with_credentials.description mentions "credentials".
Matched text
inputSchema.properties.with_credentials.description: "...quest includes cookies or authorization credentials."
What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

13 tools

Changes things 6Creates or changes something that can be changed back.Claude Code: ask

audit_website_seoRun a deterministic technical SEO audit for a public website URL.1 finding
Why it is in this group
- The description's first verb is "run": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
  The server marks "audit_website_seo" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
  Matched text
  annotations: {"readOnlyHint":true,"openWorldHint":true}; The description's first verb is "run": a word for a change.
  What this check looks for
Description, as the server wrote it
Run a deterministic technical SEO audit for a public website URL. Checks canonicals, title tags, headings, robots.txt, sitemaps, redirects, crawl traps, and indexability.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: true
generate_apple_pkpass_specGenerate a production-ready, fully compliant Apple Wallet pass.json specification based on pass type, metadata, colors, barcode, and field values.1 finding
Why it is in this group
- The name "generate_apple_pkpass_spec" says "generate": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
  The server marks "generate_apple_pkpass_spec" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
  Matched text
  annotations: {"readOnlyHint":true,"openWorldHint":false}; The name "generate_apple_pkpass_spec" says "generate": a word for a change.
  What this check looks for
Description, as the server wrote it
Generate a production-ready, fully compliant Apple Wallet pass.json specification based on pass type, metadata, colors, barcode, and field values.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
generate_favicon_suiteGenerate modern multi-platform favicon bundle (adaptive dark-mode SVG, multi-resolution ICO, Apple Touch Icon, Android PWA icons, webmanifest) and minimal HTML tags from SVG or ima…1 finding
Why it is in this group
- The name "generate_favicon_suite" says "generate": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
  The server marks "generate_favicon_suite" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
  Matched text
  annotations: {"readOnlyHint":true,"openWorldHint":false}; The name "generate_favicon_suite" says "generate": a word for a change.
  What this check looks for
Description, as the server wrote it
Generate modern multi-platform favicon bundle (adaptive dark-mode SVG, multi-resolution ICO, Apple Touch Icon, Android PWA icons, webmanifest) and minimal HTML tags from SVG or image input.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
repair_apple_pkpass_specAutomatically repair and sanitize broken Apple Wallet pass.json manifests: fixes missing formatVersion, prefixes passTypeIdentifier, ensures 10-character team ID, normalizes dates …No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Automatically repair and sanitize broken Apple Wallet pass.json manifests: fixes missing formatVersion, prefixes passTypeIdentifier, ensures 10-character team ID, normalizes dates to ISO 8601 with timezones, and auto-corrects low contrast.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
transpile_regex_engineTranspile and analyze regular expressions across engines (PCRE, Go RE2, JavaScript, Python re, Rust regex) with compatibility checks and ReDoS safety analysis.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Transpile and analyze regular expressions across engines (PCRE, Go RE2, JavaScript, Python re, Rust regex) with compatibility checks and ReDoS safety analysis.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
transpile_to_caddyfileTranspile Nginx (nginx.conf, server blocks) or Apache (.htaccess, VirtualHost) web server configuration to clean, idiomatic Caddyfile with migration advisories.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Transpile Nginx (nginx.conf, server blocks) or Apache (.htaccess, VirtualHost) web server configuration to clean, idiomatic Caddyfile with migration advisories.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false

Only reads 7Looks things up and changes nothing.Claude Code: allow

analyze_geo_readinessAnalyze Generative Engine Optimization (GEO) signals and AI crawler readiness for a web page (schema, citations, provenance, answer structure, llms.txt, AI bot robots rules).No findings
Why it is in this group
- The name "analyze_geo_readiness" says "analyze": a word for reading.
Description, as the server wrote it
Analyze Generative Engine Optimization (GEO) signals and AI crawler readiness for a web page (schema, citations, provenance, answer structure, llms.txt, AI bot robots rules).
Annotations the server declares
- readOnlyHint: true
- openWorldHint: true
calculate_cidr_overlapAnalyze IPv4/IPv6 CIDR subnets for range collisions, full containment, 2D bit-tree matrix partition, and available free subnet allocation.No findings
Why it is in this group
- The description's first verb is "analyze": a word for reading.
Description, as the server wrote it
Analyze IPv4/IPv6 CIDR subnets for range collisions, full containment, 2D bit-tree matrix partition, and available free subnet allocation.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
diagnose_cors_policyAnalyze CORS HTTP request and response headers for wildcard/credential security violations, missing Vary: Origin, preflight OPTIONS handling, and header exposure.2 findings
Why it is in this group
- The description's first verb is "analyze": a word for reading.
Findings
- Info
  The description mentions "credential".
  Matched text
  description: "...quest and response headers for wildcard/credential security violations, missing Vary: Orig..."
  What this check looks for
- Info
  The input schema at properties.with_credentials.description mentions "credentials".
  Matched text
  inputSchema.properties.with_credentials.description: "...quest includes cookies or authorization credentials."
  What this check looks for
Description, as the server wrote it
Analyze CORS HTTP request and response headers for wildcard/credential security violations, missing Vary: Origin, preflight OPTIONS handling, and header exposure.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
inspect_apple_pkpassInspect and validate Apple Wallet .pkpass JSON structure (pass.json) or package manifests: checks required keys, pass styles, dates, ISO 8601 timezones, transit types, barcodes, an…No findings
Why it is in this group
- The name "inspect_apple_pkpass" says "inspect": a word for reading.
Description, as the server wrote it
Inspect and validate Apple Wallet .pkpass JSON structure (pass.json) or package manifests: checks required keys, pass styles, dates, ISO 8601 timezones, transit types, barcodes, and color contrast.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
inspect_domain_securityInspect domain email security and deliverability standards: DMARC (BIMI compliance), BIMI DNS & SVG reachability, MTA-STS (RFC 8461), SMTP TLS-RPT (RFC 8460), SPF and MX records.No findings
Why it is in this group
- The name "inspect_domain_security" says "inspect": a word for reading.
Description, as the server wrote it
Inspect domain email security and deliverability standards: DMARC (BIMI compliance), BIMI DNS & SVG reachability, MTA-STS (RFC 8461), SMTP TLS-RPT (RFC 8460), SPF and MX records.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: true
trace_dns_delegationQuery live DNS records and inspect the authoritative nameservers returned for a domain.No findings
Why it is in this group
- The description's first verb is "query": a word for reading.
Description, as the server wrote it
Query live DNS records and inspect the authoritative nameservers returned for a domain.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: true
validate_app_linksInspect and validate Apple App Site Association (apple-app-site-association) and Android Digital Asset Links (assetlinks.json) files, HTTPS hosting rules, and test URL path routing…No findings
Why it is in this group
- The name "validate_app_links" says "validate": a word for reading.
Description, as the server wrote it
Inspect and validate Apple App Site Association (apple-app-site-association) and Android Digital Asset Links (assetlinks.json) files, HTTPS hosting rules, and test URL path routing, and compare the origin AASA with the copy on Apple's CDN.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.2.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http stackhal https://stackhal.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__stackhal__validate_app_links",
      "mcp__stackhal__calculate_cidr_overlap",
      "mcp__stackhal__diagnose_cors_policy",
      "mcp__stackhal__trace_dns_delegation",
      "mcp__stackhal__inspect_domain_security",
      "mcp__stackhal__analyze_geo_readiness",
      "mcp__stackhal__inspect_apple_pkpass"
    ],
    "ask": [
      "mcp__stackhal__audit_website_seo",
      "mcp__stackhal__transpile_to_caddyfile",
      "mcp__stackhal__generate_favicon_suite",
      "mcp__stackhal__generate_apple_pkpass_spec",
      "mcp__stackhal__repair_apple_pkpass_spec",
      "mcp__stackhal__transpile_regex_engine"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as stackhal. Review it before you use it.

Keep track

Get told when this server's tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.github.bahdanhal/stackhal/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Anlyon alternative

6 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Compare with other servers for the same product.

Source: MCP Registry · repository. Synced Oct 21, 2026, 18:23 UTC.

For agents: Markdown · JSON · report this listing