Skip to content
anlyon.devby Anlyon

Finekot API

io.github.denyskot1986/finekot-api-mcpdenyskot1986streamable-httpv0.1.0Scanned

89 pay-per-call tools for agents: screenshots, scraping, PDF, OCR, TTS, STT, invoices, KYC, utils

91 tools: 2 can delete or cancel things, 9 do something that can't be undone, 66 change things and 14 only read.

Tools: 2 delete, 9 irreversible, 66 write, 14 read.
  • Reads private data · 2
  • Reads text others write · 7
  • Can send data out · 46
  • No findings

Anlyon alternative

77 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →
Compare with similar serversMarkdownJSONReport this listing

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

91 tools

Deletes or cancels 2Claude Code: deny
  • exif_stripRemoves EXIF, XMP and GPS metadata from JPEG, PNG and WebP by cutting the raw marker/chunk — pixels are never recompressed.No findings

    Why it is in this group

    • The description's first verb is "remove": a word for removing or ending something.
    Description, as the server wrote it
    Removes EXIF, XMP and GPS metadata from JPEG, PNG and WebP by cutting the raw marker/chunk — pixels are never recompressed. GPS values are never returned, only which groups were found and removed. Cost €0.0005 per image, charged to the API key in Authorization: Bearer. Parameters — url: image url.
  • remove_backgroundCut-out with alpha channel.No findings

    Why it is in this group

    • The name "remove_background" says "remove": a word for removing or ending something.
    Description, as the server wrote it
    Cut-out with alpha channel. Input: url or file (JPEG/PNG/WebP up to 25 MB). Output: PNG with transparency. Cost €0.02 per image, charged to the API key in Authorization: Bearer. Parameters — url: string (http/https image url); format: png | webp (default png).
Can't be undone 9Claude Code: ask
  • csv_convertConvert between csv, tsv, json, ndjson, xlsx and parquet.Can send data outNo findings

    Why it is in this group

    • The name "csv_convert" says "convert": a word for a change.
    • The input addresses people (input.to): what it sends cannot be taken back.

    What it can reach

    • outboundThe input takes a destination (input.to): what the tool writes goes there.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Convert between csv, tsv, json, ndjson, xlsx and parquet. Delimiter and encoding (utf-8, utf-8-sig, cp1251, latin-1) auto-detected for csv/tsv, format auto-detected from the file signature when 'from' is omitted. schema_only=true returns just column names and types. Up to 10 MB, 1M cells. Cost €0.006 per file, charged to the API key in Authorization: Bearer. Parameters — url: file url; filename: original name, helps auto-detection; source: csv | tsv | json | ndjson | xlsx | parquet (default auto); to: csv | tsv | json | ndjson | xlsx | parquet (required unless schema_only); sheet: sheet name/index for xlsx input or output; delimiter: csv/tsv delimiter override; schema_only: bool, return column names and types only, no file.
  • doc_convertDOCX, XLSX, PPTX, ODT, ODS, RTF, CSV, HTML → PDF, DOCX, ODT, HTML, TXT, XLSX, CSV, PNG.Can send data outNo findings

    Why it is in this group

    • The name "doc_convert" says "convert": a word for a change.
    • The input addresses people (input.to): what it sends cannot be taken back.

    What it can reach

    • outboundThe input takes a destination (input.to): what the tool writes goes there.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    DOCX, XLSX, PPTX, ODT, ODS, RTF, CSV, HTML → PDF, DOCX, ODT, HTML, TXT, XLSX, CSV, PNG. Faithful layout, fonts embedded in PDF. Cost €0.005 per document, charged to the API key in Authorization: Bearer. Parameters — url: document url; source: source extension if url has none, e.g. docx; to: pdf (default) | docx | odt | html | txt | xlsx | ods | csv | pptx | png | jpg.
  • docx_genFill a DOCX template with Jinja placeholders ({{ name }}, loops, conditions) from JSON data; optionally return PDF.Can send data outNo findings

    Why it is in this group

    • The description's first verb is "fill": a word for a change.
    • The input addresses people (input.to): what it sends cannot be taken back.

    What it can reach

    • outboundThe input takes a destination (input.to): what the tool writes goes there.
    Description, as the server wrote it
    Fill a DOCX template with Jinja placeholders ({{ name }}, loops, conditions) from JSON data; optionally return PDF. Contracts, offers, certificates. Cost €0.004 per document, charged to the API key in Authorization: Bearer. Parameters — template_url: docx template url; data: JSON object with values; to: docx (default) | pdf.
  • md_convertGitHub-flavoured Markdown (tables, strikethrough, autolinks) to HTML, PDF or DOCX.Can send data outNo findings

    Why it is in this group

    • The name "md_convert" says "convert": a word for a change.
    • The input addresses people (input.to): what it sends cannot be taken back.

    What it can reach

    • outboundThe input takes a destination (input.to): what the tool writes goes there.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    GitHub-flavoured Markdown (tables, strikethrough, autolinks) to HTML, PDF or DOCX. Raw HTML in the source is escaped, never executed; PDF render loads no network beyond the same public-host guard as html-pdf. Cost €0.002 per document, charged to the API key in Authorization: Bearer. Parameters — markdown: source text; url: url to a .md/.txt file (alternative); to: html (default) | pdf | docx; format: A4 (default) | A3 | A5 | Letter | Legal (to=pdf); margin: e.g. 15mm (to=pdf).
  • pdf_toolsmerge (list of urls), split/extract pages, rotate, compress, protect with AES-256, unlock, info.Can send data outNo findings

    Why it is in this group

    • The description's first verb is "merge": a word for a change that another call does not undo.

    What it can reach

    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    merge (list of urls), split/extract pages, rotate, compress, protect with AES-256, unlock, info. Up to 200 pages. Cost €0.002 per operation, charged to the API key in Authorization: Bearer. Parameters — op: merge | split | rotate | compress | protect | unlock | info; url: pdf url; urls: list for merge; pages: e.g. 1-3,5 (split, rotate); degrees: 90 | 180 | 270; password: protect / unlock; quality: image quality for compress (default 70).
  • purchase_order_extractPurchase order PDF, scan or photo → PO number and date, buyer, supplier, ship-to, delivery date, payment terms, Incoterms and every order line (SKU, description, qty, unit, unit pr…Can send data outNo findings

    Why it is in this group

    • The name "purchase_order_extract" says "purchase": a word that usually means money moves, which cannot be taken back.

    What it can reach

    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Purchase order PDF, scan or photo → PO number and date, buyer, supplier, ship-to, delivery date, payment terms, Incoterms and every order line (SKU, description, qty, unit, unit price, discount, amount, VAT rate). Arithmetic is checked deterministically: qty × price = line amount, lines = subtotal, subtotal + VAT = total, delivery after order date, EU VAT-ID format. Ready to feed invoice-parse mode=pro po= matching. The file is not stored. Cost €0.05 per document (up to 10 pages), charged to the API key in Authorization: Bearer. Parameters — url: PO url (PDF or image); language: OCR languages for scans (default en,de,fr,es,it,nl,pl,uk).
  • translateTranslation that keeps Markdown, placeholders and tone; glossary supported; 38 languages.Can send data outNo findings

    Why it is in this group

    • The input addresses people (input.to): what it sends cannot be taken back.

    What it can reach

    • outboundThe input takes a destination (input.to): what the tool writes goes there.
    Description, as the server wrote it
    Translation that keeps Markdown, placeholders and tone; glossary supported; 38 languages. Billed per started 1 000 chars. Cost €0.01 per 1 000 chars, charged to the API key in Authorization: Bearer. Parameters — text: text; to: target ISO code, e.g. en, de, uk; tone: neutral (default) | formal | casual | marketing; glossary: source=target pairs, comma-separated.
  • tz_convertop=convert moves an ISO time between IANA timezones; op=diff returns the span between two ISO times (days/hours/minutes/seconds, plus business days if country is given); op=add_bus…Can send data outNo findings

    Why it is in this group

    • The name "tz_convert" says "convert": a word for a change.
    • The input addresses people (input.to): what it sends cannot be taken back.

    What it can reach

    • outboundThe input takes a destination (input.to): what the tool writes goes there.
    Description, as the server wrote it
    op=convert moves an ISO time between IANA timezones; op=diff returns the span between two ISO times (days/hours/minutes/seconds, plus business days if country is given); op=add_business_days steps N working days from a date, skipping weekends and public holidays of the given country. Cost €0.0005 per call, charged to the API key in Authorization: Bearer. Parameters — op: convert (default) | diff | add_business_days; time: ISO datetime (convert); source: IANA tz (convert); to: IANA tz (convert); start: ISO datetime (diff); end: ISO datetime (diff); date: ISO date (add_business_days); days: integer, can be negative (add_business_days); country: ISO country code for holidays, optional; subdiv: state/region code, optional.
  • unit_convertConverts a value between physical units (length, mass, speed, temperature with correct offset handling, etc).Can send data outNo findings

    Why it is in this group

    • The name "unit_convert" says "convert": a word for a change.
    • The input addresses people (input.to): what it sends cannot be taken back.

    What it can reach

    • outboundThe input takes a destination (input.to): what the tool writes goes there.
    Description, as the server wrote it
    Converts a value between physical units (length, mass, speed, temperature with correct offset handling, etc). Any pint-recognized unit name or symbol works; incompatible dimensions return 422. Cost €0.0005 per call, charged to the API key in Authorization: Bearer. Parameters — value: number; source: unit name, e.g. 'celsius' or 'km/h'; to: unit name.
Changes things 66Claude Code: ask
  • accountBalance and recent usage of the API key in Authorization: Bearer.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Balance and recent usage of the API key in Authorization: Bearer.
  • bank_statement_parseBank statement PDF, scan or photo → account, IBAN, period, opening and closing balance and every transaction (date, value date, description, counterparty, reference, signed amount,…Can send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Bank statement PDF, scan or photo → account, IBAN, period, opening and closing balance and every transaction (date, value date, description, counterparty, reference, signed amount, running balance). Arithmetic is checked deterministically: opening + movements = closing, running balance line by line (wrong signs are corrected and flagged), printed credit/debit totals, IBAN checksum. categorize=true adds an accounting category per line; csv=true also returns a CSV file. Up to 30 pages, billed per started 10 pages. The file is not stored. Cost €0.1 per statement (up to 10 pages), charged to the API key in Authorization: Bearer. Parameters — url: statement url (PDF or image); categorize: bool — add a category per transaction (default false); csv: bool — also return transactions as a CSV file (default false); language: OCR languages for scans (default en,de,fr,es,it,nl,pl,uk).
  • barcodeop=read (default): decodes every linear and 2D symbology from a photo or scan — EAN-13/8, UPC-A/E, Code128/39/93, ITF, Codabar, QR, Micro QR, Data Matrix, PDF417, Aztec — returns t…Can send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    op=read (default): decodes every linear and 2D symbology from a photo or scan — EAN-13/8, UPC-A/E, Code128/39/93, ITF, Codabar, QR, Micro QR, Data Matrix, PDF417, Aztec — returns text, format and the 4 corner points per code found; found:0 if none. op=generate reuses the qr service's generator (same type/format params). Cost €0.001 per code, charged to the API key in Authorization: Bearer. Parameters — op: read (default) | generate; url: image url (op=read); formats: comma list of symbologies to limit the search to, e.g. qrcode,ean13 (default all); data: text to encode (op=generate); type: barcode type (op=generate), see qr service.
  • base64op=encode text to base64, op=decode back to text (or hex + binary:true if the result isn't valid UTF-8).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    op=encode text to base64, op=decode back to text (or hex + binary:true if the result isn't valid UTF-8). url_safe switches to the - _ alphabet. Cost €0.0005 per call, charged to the API key in Authorization: Bearer. Parameters — op: encode (default) | decode; text: text to encode, or base64 to decode; url_safe: bool, default false.
  • browserA real Chromium session per call: open a URL and run up to 25 steps (click, fill, press, select, scroll, wait, extract).Can send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    A real Chromium session per call: open a URL and run up to 25 steps (click, fill, press, select, scroll, wait, extract). Returns page text, step results and a state object you pass back to continue logged-in. 90 s per call. Cost €0.01 per session-minute, charged to the API key in Authorization: Bearer. Parameters — url: start url; steps: JSON array, e.g. [{"do":"fill","selector":"#q","text":"x"},{"do":"press","key":"Enter"},{"do":"extract","selector":"h3"}]; state: state object from a previous call (cookies, localStorage); output: json (default) | screenshot; text: bool, return page text (default true); width: 320–1920; height: 240–1920; locale: e.g. de-DE.
  • captionAlt text ≤125 chars, a 2–3 sentence caption, tags, text found in the image and dominant colors.Can send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Alt text ≤125 chars, a 2–3 sentence caption, tags, text found in the image and dominant colors. For catalogs, accessibility and SEO. Cost €0.003 per image, charged to the API key in Authorization: Bearer. Parameters — url: image url; language: output language (default en); context: what the image is for.
  • chart_renderChart.js configuration (plain JSON — type, data, options; no callbacks, JSON.parse can't execute code) rendered to PNG or SVG.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Chart.js configuration (plain JSON — type, data, options; no callbacks, JSON.parse can't execute code) rendered to PNG or SVG. Each call spawns its own Node process, no server state kept between calls. Cost €0.002 per chart, charged to the API key in Authorization: Bearer. Parameters — config: Chart.js configuration object (JSON): {type, data, options, ...}; format: png | svg (default png); width: int 100–4000 (default 800); height: int 100–4000 (default 600); background: #rrggbb or 'transparent' — canvas fill behind the chart (default #ffffff).
  • classifyZero-shot classification into your labels (up to 30) with confidence and a one-line reason; single or multi-label.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Zero-shot classification into your labels (up to 30) with confidence and a one-line reason; single or multi-label. Tickets, reviews, leads, moderation. Cost €0.002 per request, charged to the API key in Authorization: Bearer. Parameters — text: text; labels: comma-separated labels; multi: bool, allow several labels.
  • color_paletteN dominant colors as hex, rgb and their share of the image, sorted by prevalence.Can send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    N dominant colors as hex, rgb and their share of the image, sorted by prevalence. Brand colors, mood boards, product shots. Cost €0.001 per image, charged to the API key in Authorization: Bearer. Parameters — url: image url; colors: 2–16 (default 5).
  • company_verifyLegal entity lookup for KYB and invoicing: by LEI (checksum validated locally, ISO 17442), by name + country (up to 5 candidates with match score), or by UK company number.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Legal entity lookup for KYB and invoicing: by LEI (checksum validated locally, ISO 17442), by name + country (up to 5 candidates with match score), or by UK company number. Returns legal name, status, legal form, jurisdiction, legal and HQ addresses, registration authority id, renewal dates and optional direct/ultimate parent. UK: status, type, incorporation date, registered office, SIC codes, overdue accounts flags. No directors or personal data. Source: GLEIF LEI data (CC0); UK data from Companies House under the OGL v3.0. Cost €0.02 per company, charged to the API key in Authorization: Bearer. Parameters — lei: 20-character LEI; name: legal name to search (alternative to lei); country: ISO-2 country filter for name search; uk_number: UK company number, e.g. 00445790 or SC123456; include_parents: true to add direct and ultimate parent (LEI only).
  • compressConvert and shrink images: JPEG, PNG, WebP, AVIF, GIF out; HEIC and AVIF in.Can send data outNo findings

    Why it is in this group

    • The description's first verb is "convert": a word for a change.

    What it can reach

    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Convert and shrink images: JPEG, PNG, WebP, AVIF, GIF out; HEIC and AVIF in. Resize to fit, EXIF orientation applied and metadata stripped. Cost €0.001 per image, charged to the API key in Authorization: Bearer. Parameters — url: image url; format: webp | jpeg | png | avif | gif (default webp); quality: 1–100 (default 82); width: max width px; height: max height px.
  • contract_clause_extractContract PDF, DOCX or text → 24 clause types (term, auto-renewal, renewal notice, termination, payment, liability cap, indemnities, warranty, SLA, penalties, confidentiality, GDPR,…Can send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Contract PDF, DOCX or text → 24 clause types (term, auto-renewal, renewal notice, termination, payment, liability cap, indemnities, warranty, SLA, penalties, confidentiality, GDPR, IP, non-compete, exclusivity, assignment, governing law, disputes, force majeure…) with a summary, typed values and the verbatim source quote with page; every quote is verified against the document text. Key dates (initial term end, renewal notice deadline) and risk flags are computed. Not legal advice. Up to 80 pages, billed per started ~20 pages. The document is not stored. Cost €0.2 per contract (≈20 pages), charged to the API key in Authorization: Bearer. Parameters — url: contract url (PDF or DOCX); text: contract text (alternative); language: OCR languages for scans (default en,de,fr,es,it,nl,pl,uk).
  • denoiseSpectral noise reduction for voice memos, calls and podcasts, plus high-pass and loudness normalisation to -16 LUFS.Can send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Spectral noise reduction for voice memos, calls and podcasts, plus high-pass and loudness normalisation to -16 LUFS. Output MP3, OGG or WAV. Billed per started minute. Cost €0.006 per minute, charged to the API key in Authorization: Bearer. Parameters — url: audio or video url; strength: 0.1–1.0 (default 0.85); stationary: bool, constant hum (default false); normalize: bool (default true); format: mp3 (default) | ogg | wav.
  • detect_langISO-639-1 language of a text with confidence and top-3 candidates, 55 languages, works from a few words.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    ISO-639-1 language of a text with confidence and top-3 candidates, 55 languages, works from a few words. Cost €0.0005 per request, charged to the API key in Authorization: Bearer. Parameters — text: text, up to 20 000 chars.
  • diagram_renderMermaid diagram source (flowchart, sequence, class, state, ER, Gantt, pie, mindmap, …) rendered to SVG or PNG.No findings

    Why it is in this group

    • The input takes a statement or command to run (input.code), which can change anything it can reach.
    Description, as the server wrote it
    Mermaid diagram source (flowchart, sequence, class, state, ER, Gantt, pie, mindmap, …) rendered to SVG or PNG. mermaid.js runs in a sandboxed Chromium page with all network access blocked and securityLevel 'strict' — labels can't inject HTML or scripts. Cost €0.002 per diagram, charged to the API key in Authorization: Bearer. Parameters — code: Mermaid diagram source, up to 20000 chars; format: svg | png (default svg); theme: default | dark | forest | neutral | base (default default); scale: 1 | 2 — PNG pixel density (retina); background: #rrggbb or 'transparent' — PNG canvas behind the diagram (default #ffffff).
  • doc_redactMask emails, phones, IBANs, card numbers, IPs and — via NER (en, ru, uk, de) — names, organisations, locations in text or a PDF.Can send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Mask emails, phones, IBANs, card numbers, IPs and — via NER (en, ru, uk, de) — names, organisations, locations in text or a PDF. Returns redacted text and entity positions. Cost €0.01 per page (3 000 chars), charged to the API key in Authorization: Bearer. Parameters — text: text to redact; url: pdf url (alternative); entities: email,phone,iban,card,ip,person,org,location (default all); mode: mask → [EMAIL] (default) | label → [PERSON_1] consistent per value; language: en | ru | uk | de (default auto); country: default region for phones (default UA); return_values: bool, include original values.
  • domain_healthDNS (A, AAAA, MX, TXT, NS, CAA), SPF and DMARC parsing, WHOIS (registrar, dates, name servers, 24h cache), TLS certificate validity and days to expiry.Can send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    DNS (A, AAAA, MX, TXT, NS, CAA), SPF and DMARC parsing, WHOIS (registrar, dates, name servers, 24h cache), TLS certificate validity and days to expiry. NXDOMAIN returns 200 with exists:false, not an error. Under 10 s. Cost €0.002 per domain, charged to the API key in Authorization: Bearer. Parameters — domain: domain name; url: page url (alternative to domain); checks: comma list: dns,whois,ssl,mail (default all).
  • e_invoiceop=validate: EU e-invoice in UBL 2.1 or UN/CEFACT CII XML, or a ZUGFeRD/Factur-X PDF with the embedded XML.Can send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    op=validate: EU e-invoice in UBL 2.1 or UN/CEFACT CII XML, or a ZUGFeRD/Factur-X PDF with the embedded XML. Detects syntax and profile (XRechnung, Peppol BIS, Factur-X/ZUGFeRD, EN 16931) and checks it against the official EN 16931 schematron rules plus KoSIT XRechnung rules for XRechnung profiles; returns every violation with rule id, severity, message and XPath location. Verdict is technical validity only, not a legal or tax assessment; XSD and PDF/A-3 are not checked. op=create: invoice JSON → XRechnung 3.0 or EN 16931 XML in UBL or CII with VAT totals computed, validated by the same rules; output=pdf returns a Factur-X / ZUGFeRD EN 16931 (COMFORT) PDF with a rendered invoice and the CII XML embedded, checked by the Factur-X XSD and by validate; billed ×2. Cost €0.02 per document, charged to the API key in Authorization: Bearer. Parameters — op: validate | create (default validate); url: invoice url (XML or PDF), op=validate; xml: invoice XML as a string (alternative to url/file); rules: auto | en16931 | xrechnung — auto picks XRechnung rules from the profile id (op=validate); output: xml | pdf (op=create, default xml) — pdf = Factur-X EN 16931 hybrid PDF, needs syntax=cii, profile=en16931 (defaults); syntax: ubl | cii (op=create, default ubl; cii for output=pdf); profile: xrechnung | en16931 (op=create, default xrechnung; en16931 for output=pdf); invoice: op=create: {number, issue_date, due_date?, currency, buyer_reference (Leitweg-ID, required by XRechnung), delivery_date? | period{start,end}?, note?, order_reference?, seller{name, vat_id|tax_number, address{street, city, postcode, country}, contact{name, phone, email}, electronic_address{scheme,id}?}, buyer{name, address{...}, electronic_address|contact.email}, payment{means_code=58, iban, bic?, terms?}, lines[{name, quantity, unit=C62, price, vat_rate, vat_category=S, description?, item_id?, exemption_reason?}], prepaid?}.
  • email_verifySyntax, MX records, disposable domain, role address, free provider, typo suggestion and a 0–100 score.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Syntax, MX records, disposable domain, role address, free provider, typo suggestion and a 0–100 score. Mailbox existence is not probed. Cost €0.002 per address, charged to the API key in Authorization: Bearer. Parameters — email: address to check.
  • embed384-dimensional normalized vectors for search and RAG, 50 languages.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    384-dimensional normalized vectors for search and RAG, 50 languages. Up to 100 texts per call, 8 000 chars each. Billed per started 1 000 tokens. Cost €0.0002 per 1 000 tokens, charged to the API key in Authorization: Bearer. Parameters — text: one text; texts: JSON array of texts (alternative); kind: passage (default) | query.
  • entity_extractmode=ner (default): people, organizations, locations, dates, money, percent — en/de/ru/uk, auto-detected language.Can send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    mode=ner (default): people, organizations, locations, dates, money, percent — en/de/ru/uk, auto-detected language. mode=llm: your own entity types, any language, billed at ×3 (price ×3). Positions are recomputed against the source text. Up to 20 000 chars. Cost €0.001 per request, charged to the API key in Authorization: Bearer. Parameters — text: text to scan; url: page url (alternative); mode: ner (default) | llm; types: ner: comma list to keep (default all 6); llm: your own types, required; language: ISO-2 for mode=ner (default auto).
  • extract_jsonStructured data from free text, email or a page by your JSON Schema or a field list.Can send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Structured data from free text, email or a page by your JSON Schema or a field list. Nulls for missing values, ISO dates, numeric numbers. Cost €0.005 per request (4 000 chars), charged to the API key in Authorization: Bearer. Parameters — text: source text; url: page url (alternative); schema: JSON Schema object or comma-separated field list; instructions: extra rules.
  • file_type_detectReal file type from the byte signature, not the extension: mime, description, expected extensions, mismatch flag, executable flag (PE/ELF/Mach-O, shell/Python/Perl scripts, APK/JAR…Can send data outNo findings

    Why it is in this group

    • The name "file_type_detect" says "type": a word for a change.

    What it can reach

    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Real file type from the byte signature, not the extension: mime, description, expected extensions, mismatch flag, executable flag (PE/ELF/Mach-O, shell/Python/Perl scripts, APK/JAR) and macro-enabled Office files (vbaProject.bin). Up to 25 MB, first 64 KB inspected. Cost €0.0005 per file, charged to the API key in Authorization: Bearer. Parameters — url: file url; filename: original file name, for the mismatch check.
  • fxDaily reference rates for 31 currencies plus UAH, any base, conversion of an amount, history for the last 90 days.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Daily reference rates for 31 currencies plus UAH, any base, conversion of an amount, history for the last 90 days. Cost €0.0002 per request, charged to the API key in Authorization: Bearer. Parameters — base: currency code (default EUR); symbols: comma-separated codes (default all); amount: number to convert; date: YYYY-MM-DD within 90 days.
  • hashmd5, sha1, sha256, sha512 (or 'all') of text or base64-encoded bytes, as hex and base64; optional hmac key for a keyed digest.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    md5, sha1, sha256, sha512 (or 'all') of text or base64-encoded bytes, as hex and base64; optional hmac key for a keyed digest. Cost €0.0005 per call, charged to the API key in Authorization: Bearer. Parameters — text: string (plain or base64, see encoding); encoding: utf8 (default) | base64; algo: md5 | sha1 | sha256 | sha512 | comma-list | all; key: HMAC key, optional.
  • holidaysOfficial holidays by country and region (ISO-3166), localized names, workday check and business-day shift.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Official holidays by country and region (ISO-3166), localized names, workday check and business-day shift. 501 countries/regions. Cost €0.0005 per call, charged to the API key in Authorization: Bearer. Parameters — op: list (default) | is_workday | add_business_days | countries; country: ISO-2/3 or exact code from op=countries; subdiv: region/state code, e.g. BY for Bavaria; year: for op=list (default current year); language: localize holiday names if supported; date: YYYY-MM-DD, for op=is_workday and op=add_business_days; days: signed integer, for op=add_business_days.
  • html_pdfPixel-accurate PDF from a URL or your HTML: print CSS, page size, margins, header, footer with page numbers.Can send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Pixel-accurate PDF from a URL or your HTML: print CSS, page size, margins, header, footer with page numbers. Invoices, reports, contracts. Cost €0.006 per document, charged to the API key in Authorization: Bearer. Parameters — url: page url (or html); html: raw HTML string; format: A4 (default) | A3 | A5 | Letter | Legal; landscape: bool; margin: e.g. 15mm; header: header text; footer: footer text, page numbers appended; page_numbers: bool; print_css: bool, use @media print (default true); wait: ms after load.
  • image_moderateNudity check for marketplaces and bots: verdict safe / suggestive / explicit, score, faces, labelled boxes.Can send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Nudity check for marketplaces and bots: verdict safe / suggestive / explicit, score, faces, labelled boxes. Weapons, drugs and text are not evaluated. Cost €0.002 per image, charged to the API key in Authorization: Bearer. Parameters — url: image url.
  • invoice_3way_matchMatches a supplier invoice against the purchase order and the goods received note, line by line (SKU, then fuzzy description): price above PO, invoiced more than ordered or receive…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Matches a supplier invoice against the purchase order and the goods received note, line by line (SKU, then fuzzy description): price above PO, invoiced more than ordered or received, lines not received, invoice lines not on the PO, PO reference and currency, plus amount at risk. Each document as JSON or URL (PDF/scan/photo, extracted for you); receipt optional for a 2-way match; tolerances in percent. A finding, not a payment decision. Documents are not stored. Cost €0.12 per match, charged to the API key in Authorization: Bearer. Parameters — po: purchase order as JSON {po_number, currency, items[{sku, description, qty, unit_price}]}; po_url: PO document url (alternative); invoice: invoice as JSON {invoice_number, po_number, currency, items[...]}; invoice_url: invoice url (alternative); receipt: goods received note as JSON {receipt_number, po_number, items[{sku, description, qty_received}]}; receipt_url: goods received note url (optional); price_tolerance_pct: allowed price overrun, % (default 0); qty_tolerance_pct: allowed quantity overrun, % (default 0).
  • invoice_parseVendor, customer, number, dates, currency, totals, VAT and line items from a photo, scan or PDF invoice.Can send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Vendor, customer, number, dates, currency, totals, VAT and line items from a photo, scan or PDF invoice. Totals are cross-checked. mode=pro (€0.06): every line with SKU and VAT rate, VAT breakdown by rate, PO and payment references, deterministic checks (lines vs subtotal, base × rate vs VAT, IBAN checksum, EU VAT-ID format, due date) and optional matching against a purchase order. Cost €0.03 per document, charged to the API key in Authorization: Bearer. Parameters — url: image or pdf url; language: OCR languages for scans (default en,ru,uk,de); mode: basic (default, €0.03) | pro (€0.06): line items with SKU and per-line VAT, VAT breakdown by rate, payment details, arithmetic, IBAN, VAT-ID and date checks; po: pro only: purchase order JSON {number, items:[{sku, description, qty, unit_price}]} to match invoice lines against.
  • ip_geoCountry, region, city, coordinates, EU flag, ASN and organisation, datacenter/hosting flag for IPv4 and IPv6.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Country, region, city, coordinates, EU flag, ASN and organisation, datacenter/hosting flag for IPv4 and IPv6. Cost €0.0003 per lookup, charged to the API key in Authorization: Bearer. Parameters — ip: IPv4 or IPv6; 'me' = caller address.
  • jwt_toolsop=decode reads header/payload without checking the signature.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    op=decode reads header/payload without checking the signature. op=verify checks it with a secret (HS*), a PEM public_key (RS*/ES*/PS*) or a jwks_url (cached 10 min); the allowed algorithm family is pinned to the key type you provide, blocking alg-confusion attacks. op=sign issues a new token (HS256/384/512, RS256, ES256). Tokens and keys are never logged or cached. Cost €0.0005 per call, charged to the API key in Authorization: Bearer. Parameters — op: decode (default) | verify | sign; token: JWT (decode, verify); secret: HMAC secret (verify, sign); public_key: PEM public key (verify); private_key: PEM private key (sign); jwks_url: JWKS endpoint (verify); payload: JSON object of claims (sign); alg: HS256|HS384|HS512|RS256|ES256, default HS256 (sign); exp_seconds: lifetime in seconds, optional (sign).
  • lib_docsAnswer a question about a package's README and documentation site: resolves the registry (npm, PyPI or crates.io), indexes README plus up to 8 docs pages on first call (cached 7 da…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Answer a question about a package's README and documentation site: resolves the registry (npm, PyPI or crates.io), indexes README plus up to 8 docs pages on first call (cached 7 days, repeat calls are instant), returns ranked fragments with section and source url. Optional answer=true adds a short cited summary at the same price. Cost €0.003 per query, charged to the API key in Authorization: Bearer. Parameters — package: package name; registry: pypi | npm | crates | auto (default auto, tries pypi, npm, crates in order); version: exact version (default latest); question: what to find in the docs; top_k: 1–10 (default 5); answer: bool, short cited answer from the fragments (default false, same price).
  • math_evalSafe arithmetic without eval(): +-*/, **, parentheses, math functions (sqrt, sin, log, round, abs, min, max…), constants pi/e, optional variables.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Safe arithmetic without eval(): +-*/, **, parentheses, math functions (sqrt, sin, log, round, abs, min, max…), constants pi/e, optional variables. Expression up to 500 chars, no code execution. Cost €0.0005 per call, charged to the API key in Authorization: Bearer. Parameters — expression: string, e.g. '(2+3)*sqrt(16)'; vars: JSON object name→number, optional.
  • mcp_hostEvery Finekot service is a tool on one remote MCP server (streamable HTTP).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Every Finekot service is a tool on one remote MCP server (streamable HTTP). This call returns ready configs for Claude Code, Claude Desktop, Cursor and VS Code. Tool calls are billed at each service price. Cost €0 per setup, charged to the API key in Authorization: Bearer. Parameters — .
  • memoryLong-term memory behind your key: add facts (deduplicated by meaning), recall by meaning with an optional recency boost, list, forget.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Long-term memory behind your key: add facts (deduplicated by meaning), recall by meaning with an optional recency boost, list, forget. Spaces per user or agent, 20 000 items. Add billed per item. Cost €0.001 per operation, charged to the API key in Authorization: Bearer. Parameters — op: search (default) | add | list | spaces | delete; space: namespace, e.g. user:42 (default 'default'); text: memory text for add; items: JSON array [{text, meta}] for batch add; meta: JSON object; query: what to recall; top_k: 1–50 (default 5); recency: 0–1, weight of freshness (default 0); ids: ids to delete, comma-separated; all: bool, delete the whole space.
  • news_brief3–8 bullet summary of the latest news on a topic with sources and dates; deduplicates reprints of the same story and scores its own confidence.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    3–8 bullet summary of the latest news on a topic with sources and dates; deduplicates reprints of the same story and scores its own confidence. Full article text is never returned. Cost €0.01 per brief, charged to the API key in Authorization: Bearer. Parameters — topic: search topic; period: 24h (default) | 7d; language: output language (default English); max_items: 1–15 (default 8).
  • ocrText from images and scanned PDFs with line boxes and confidence.Can send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Text from images and scanned PDFs with line boxes and confidence. Languages: en, ru, uk, de, fr, es, it, pl, pt, sr, tr, nl (combine with commas). Billed per page. Cost €0.008 per page, charged to the API key in Authorization: Bearer. Parameters — url: image or pdf url; language: en (default) | ru | uk | de | … | en,ru; pages: for PDF, e.g. 1-3; boxes: bool, return line boxes (default true).
  • og_image1200×630 PNG for social previews from a template (post, minimal, product) or your own HTML.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    1200×630 PNG for social previews from a template (post, minimal, product) or your own HTML. Fonts, colors and product image supported. Cost €0.012 per image, charged to the API key in Authorization: Bearer. Parameters — template: post (default) | minimal | product | html; title: headline; subtitle: second line; eyebrow: small label above; site: footer text; bg: background color; fg: text color; accent: accent color; image_url: product image (template=product); html: full HTML body (template=html).
  • pdf_signop=verify: every signature in a PDF — signer and certificate, digest and cryptographic validity, whether the file was edited after signing (no trust store, chain of trust is not as…Can send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    op=verify: every signature in a PDF — signer and certificate, digest and cryptographic validity, whether the file was edited after signing (no trust store, chain of trust is not asserted). op=sign: add a PAdES-B (adbe.pkcs7.detached) signature from a PKCS#12 bundle; billed ×2. Unsigned PDF on verify returns signatures: []. Cost €0.005 per document, charged to the API key in Authorization: Bearer. Parameters — op: verify | sign; url: pdf url; p12_base64: PKCS#12 (.p12/.pfx) bundle, base64-encoded — required for op=sign; a multipart p12 alongside the pdf file is not supported, this API accepts one binary upload per call; password: PKCS#12 password (op=sign, empty if the bundle has none); reason: signing reason shown in the signature (op=sign, optional); location: signer location (op=sign, optional); contact: contact info (op=sign, optional).
  • pdf_textText layer of a PDF as Markdown: headings by font size, bullets, tables as Markdown tables.Can send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Text layer of a PDF as Markdown: headings by font size, bullets, tables as Markdown tables. Flags scanned PDFs (no text layer) so you can send them to OCR. Billed per page. Cost €0.005 per page, charged to the API key in Authorization: Bearer. Parameters — url: pdf url; pages: e.g. 1-5 (default all); tables: bool, include tables (default true).
  • prompt_guardRisk assessment, not a guarantee.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Risk assessment, not a guarantee. Catches jailbreak phrases in 6 languages, hidden text (zero-width, bidi, HTML comments, white-on-white), base64-encoded instructions (2 levels deep), markdown-image URL exfiltration and API-key-shaped secrets. The model is called only when the regex score is ambiguous (0.3–0.7) or deep=true, so most calls never touch an LLM. Cost €0.003 per request, charged to the API key in Authorization: Bearer. Parameters — text: text to screen (user input, a document, a tool result); deep: bool, always ask the model too.
  • qrQR codes (optional logo in the middle, custom colors) and barcodes EAN-13, EAN-8, UPC-A, ISBN-13, Code128.Can send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    QR codes (optional logo in the middle, custom colors) and barcodes EAN-13, EAN-8, UPC-A, ISBN-13, Code128. SVG or PNG. mode=read decodes a QR/MicroQR from an image (url or file) back to text — for any other barcode format use the barcode service. Cost €0.0005 per code, charged to the API key in Authorization: Bearer. Parameters — data: text or url to encode (generate); type: qr (default) | ean13 | ean8 | upca | isbn13 | code128; format: svg (default) | png; scale: module size px, 2–40; color: #rrggbb dark (default #000000); background: #rrggbb | transparent; ec: QR error correction l | m | q | h; logo_url: logo for QR center (png only); mode: generate (default) | read — read a QR from url/file instead of making one; url: image url (mode=read).
  • readability_scoreFlesch Reading Ease, Flesch-Kincaid grade, Gunning Fog, SMOG, Coleman-Liau, ARI for en/de/es/fr/it/nl/pl/ru/hu (formulas are calibrated per language); word/sentence counts, average…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Flesch Reading Ease, Flesch-Kincaid grade, Gunning Fog, SMOG, Coleman-Liau, ARI for en/de/es/fr/it/nl/pl/ru/hu (formulas are calibrated per language); word/sentence counts, average sentence length, long-word ratio and reading time for any language. Up to 100 000 chars. Cost €0.001 per request, charged to the API key in Authorization: Bearer. Parameters — text: text to score; language: ISO-2 (default en); unsupported languages get language-independent metrics only.
  • regex_testTests a Python regex against text: op=match (first match), op=findall (all matches with groups and positions), op=sub (replace).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Tests a Python regex against text: op=match (first match), op=findall (all matches with groups and positions), op=sub (replace). Runs in a separate process with a 100 ms timeout, so catastrophic backtracking (ReDoS) returns 422 instead of hanging. Text up to 10 000 chars, pattern up to 1 000. Cost €0.0005 per call, charged to the API key in Authorization: Bearer. Parameters — pattern: regex pattern; text: text to test; flags: any of i,m,s,x; op: match (default) | findall | sub; replacement: replacement string (sub).
  • resume_parsePDF or DOCX résumé → name, contacts, links, summary, work experience, education, skills and languages as JSON.Can send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    PDF or DOCX résumé → name, contacts, links, summary, work experience, education, skills and languages as JSON. Email and phone are cross-checked by regex. The file is not stored — not even temporarily. Scans without a text layer are rejected (no OCR). Up to 10 pages / 30 000 chars. Cost €0.04 per file, charged to the API key in Authorization: Bearer. Parameters — url: resume url.
  • rewriteRewrite in a given tone and length, keep facts and Markdown; optional language switch and custom instructions.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Rewrite in a given tone and length, keep facts and Markdown; optional language switch and custom instructions. Cost €0.004 per request (6 000 chars), charged to the API key in Authorization: Bearer. Parameters — text: text; tone: e.g. friendly, formal, marketing; length: same (default) | shorter | longer; language: output language; instructions: extra rules.
  • sanctions_screenScreens a person or company name against the official US OFAC SDN list, the EU consolidated financial sanctions list and the UK Sanctions List with fuzzy, transliteration-aware mat…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Screens a person or company name against the official US OFAC SDN list, the EU consolidated financial sanctions list and the UK Sanctions List with fuzzy, transliteration-aware matching (word order, legal forms and spelling variants). Returns potential matches with score 0–1, list, programmes, birth data and a link to the official record. A match needs human review; no match is not a clearance. Lists refresh every 24 h. Cost €0.04 per check, charged to the API key in Authorization: Bearer. Parameters — name: person or organisation name, any script; type: any (default) | person | entity; birth_year: optional, narrows person matches; threshold: 0.80–1.00 match score cut-off (default 0.88); lists: comma list: ofac,eu,uk (default all).
  • seo_audit16 on-page checks (title, description, H1, alt, canonical, OG, structured data, viewport, load time, overflow…) with a score and 5 prioritized fixes.Can send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    16 on-page checks (title, description, H1, alt, canonical, OG, structured data, viewport, load time, overflow…) with a score and 5 prioritized fixes. Cost €0.04 per page, charged to the API key in Authorization: Bearer. Parameters — url: page url; advice: bool, LLM fixes (default true).
  • seo_metaTitle ≤60, description ≤155, H1, keywords, slug, Open Graph texts and 3 FAQ pairs from page content or a URL.Can send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Title ≤60, description ≤155, H1, keywords, slug, Open Graph texts and 3 FAQ pairs from page content or a URL. Cost €0.004 per page, charged to the API key in Authorization: Bearer. Parameters — url: page url; text: page text (alternative); language: output language; keywords: target keywords.
  • speech_to_textTranscription with timestamps and language detection, 99 languages.Can send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Transcription with timestamps and language detection, 99 languages. Input: url or file (mp3, m4a, wav, ogg, webm, mp4) up to 25 MB / 30 min. Output: text, segments, optional SRT/VTT. Billed per started minute. Cost €0.004 per minute, charged to the API key in Authorization: Bearer. Parameters — url: string (audio/video url); language: ISO code, e.g. en, ru, uk (default: auto); translate: bool — translate to English; format: json | srt | vtt (default json, adds subtitles field).
  • sql_lintParse errors with line/column, dialect translation (postgres, mysql, sqlite, bigquery, snowflake, tsql…), schema check against your table/column list, pretty-print.No findings

    Why it is in this group

    • The input takes a statement or command to run (input.sql), which can change anything it can reach.
    Description, as the server wrote it
    Parse errors with line/column, dialect translation (postgres, mysql, sqlite, bigquery, snowflake, tsql…), schema check against your table/column list, pretty-print. fix=true asks the model for a corrected query and re-validates it (price ×2). Never connects to a database. Cost €0.002 per query, charged to the API key in Authorization: Bearer. Parameters — sql: query text; dialect: source dialect (default generic); to_dialect: translate to this dialect; schema: JSON {table: {column: type}}; pretty: bool, format the output; fix: bool, LLM-fix on error (price ×2).
  • subtitlesTranscribe a video or audio, wrap cues to 42 chars, return SRT/VTT or burn styled subtitles into an MP4 for Reels and Shorts.Can send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Transcribe a video or audio, wrap cues to 42 chars, return SRT/VTT or burn styled subtitles into an MP4 for Reels and Shorts. Optional translation to English. Billed per started minute. Cost €0.02 per minute, charged to the API key in Authorization: Bearer. Parameters — url: video or audio url; mode: srt (default) | vtt | burn; language: ISO code (default auto); translate: bool, to English; max_chars: 16–80 per cue (default 42); font_size: 12–72 (burn); position: bottom (default) | middle | top; color: hex text color (default FFFFFF).
  • table_extractEvery table on the given pages as JSON rows, CSV file or Markdown.Can send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Every table on the given pages as JSON rows, CSV file or Markdown. Bank statements, price lists, invoices with a text layer. Billed per page. Cost €0.025 per page, charged to the API key in Authorization: Bearer. Parameters — url: pdf url; pages: e.g. 2-4 (default all); format: json (default) | csv | markdown.
  • text_to_speechNatural voice from text, 24 kHz.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Natural voice from text, 24 kHz. 21 voices: English US/UK, Spanish, French, Italian, Portuguese, Hindi, Japanese, Chinese. Output: MP3, OGG or WAV. Up to 5 000 chars per call; billed per started 1 000 chars. Cost €0.015 per 1 000 chars, charged to the API key in Authorization: Bearer. Parameters — text: string, up to 5 000 chars; voice: af_heart (default) | af_bella | am_adam | bf_emma | bm_george | ef_dora | ff_siwis | if_sara | pf_dora | jf_alpha | zf_xiaoxiao | …; speed: 0.5–2.0 (default 1.0); format: mp3 | ogg | wav (default mp3).
  • uptimeHTTP status, latency, redirects, server header, TLS certificate issuer and days to expiry.Can send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    HTTP status, latency, redirects, server header, TLS certificate issuer and days to expiry. One probe per call; schedule them from your side. Cost €0.0005 per check, charged to the API key in Authorization: Bearer. Parameters — url: site url or host.
  • url_safetyPhishing and scam risk of a link from its own signals, without a paid threat feed: lookalike and typosquatted brand domains, mixed-alphabet (homograph) hosts, brand names on foreig…Can send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Phishing and scam risk of a link from its own signals, without a paid threat feed: lookalike and typosquatted brand domains, mixed-alphabet (homograph) hosts, brand names on foreign domains, IP hosts, shorteners, redirect chain, domain age, TLS, password or seed-phrase forms on the page. Returns score 0–1, verdict low | medium | high and every signal with evidence. Under 15 s. Cost €0.002 per url, charged to the API key in Authorization: Bearer. Parameters — url: link to check; deep: true (default): follow redirects, WHOIS age, TLS and page; false: address only, under 50 ms.
  • url_to_markdownMain content of a page as clean Markdown for LLM context: title, author, date, text with links and tables; navigation, ads and cookie banners stripped.Can send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Main content of a page as clean Markdown for LLM context: title, author, date, text with links and tables; navigation, ads and cookie banners stripped. JS-rendered pages supported. Cost €0.0015 per page, charged to the API key in Authorization: Bearer. Parameters — url: string (http/https page url); js: bool — render with Chromium (default true); false = plain fetch, faster; links: bool — keep links (default true); images: bool — keep images (default true); main_only: bool — main article only (default true); wait: ms to wait after load, 0–8000.
  • uuidkind=v4 random, v7 time-ordered (RFC 9562, monotonic within a batch), ulid (Crockford base32, also monotonic).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    kind=v4 random, v7 time-ordered (RFC 9562, monotonic within a batch), ulid (Crockford base32, also monotonic). Up to 100 per call. Cost €0.0005 per call, charged to the API key in Authorization: Bearer. Parameters — kind: v4 (default) | v7 | ulid; count: 1–100.
  • vat_checkValidity of an EU VAT number via VIES (27 EU states + XI), with registered company name and address when the member state returns them.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Validity of an EU VAT number via VIES (27 EU states + XI), with registered company name and address when the member state returns them. Cost €0.004 per lookup, charged to the API key in Authorization: Bearer. Parameters — vat: number with or without country prefix, e.g. DE123456789; country: ISO-2 if not in the number.
  • video_clipTrim by start/end, centre-crop to 9:16, 1:1, 4:5, 16:9, resize, mute; output MP4, WebM, an animated GIF or WebP (clip up to 15 s), a JPG frame or MP3 audio.Can send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Trim by start/end, centre-crop to 9:16, 1:1, 4:5, 16:9, resize, mute; output MP4, WebM, an animated GIF or WebP (clip up to 15 s), a JPG frame or MP3 audio. Input up to 25 MB / 20 min. Cost €0.008 per minute, charged to the API key in Authorization: Bearer. Parameters — url: video url; start: seconds; end: seconds; aspect: 9:16 | 1:1 | 4:5 | 16:9 | 4:3; width: output width px; format: mp4 (default) | webm | gif | webp | jpg | mp3; fps: gif/webp frames per second (default 12); quality: 1–100 for webp (default 75); at: frame time for jpg; mute: bool; crf: 18–35 quality for mp4 (default 23).
  • vin_decodeDecodes a 17-character VIN into make, model, year, body, engine, transmission and assembly plant.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Decodes a 17-character VIN into make, model, year, body, engine, transmission and assembly plant. Most complete for the US market. A mismatched check digit is returned as a warning (checksum_valid:false), not a 422. Cost €0.002 per lookup, charged to the API key in Authorization: Bearer. Parameters — vin: 17-character VIN (letters I, O, Q are not valid VIN characters).
  • watermarkText or logo watermark: corner, center or tiled, with opacity.Can send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Text or logo watermark: corner, center or tiled, with opacity. Output JPEG, PNG or WebP. Cost €0.001 per image, charged to the API key in Authorization: Bearer. Parameters — url: image url; text: watermark text (or logo_url); logo_url: PNG/SVG-rendered logo url; position: bottom-right (default) | bottom-left | top-right | top-left | center | tile; opacity: 5–100 (default 35); format: jpeg | png | webp.
  • weatherCurrent conditions, hourly forecast and daily min/max temperature and precipitation from MET Norway.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Current conditions, hourly forecast and daily min/max temperature and precipitation from MET Norway. Coordinates only, no city geocoding. Attribution is required by the CC BY 4.0 license and included in every response. Cost €0.001 per call, charged to the API key in Authorization: Bearer. Parameters — lat: latitude, -90..90; lon: longitude, -180..180; hours: hours ahead, 1-72 (default 24).
  • web_answerAnswers a question grounded in live web search: searches, reads the top pages and replies with numbered citations, or says the answer wasn't found instead of guessing.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Answers a question grounded in live web search: searches, reads the top pages and replies with numbered citations, or says the answer wasn't found instead of guessing. Cost €0.008 per question, charged to the API key in Authorization: Bearer. Parameters — question: question to answer; region: ddgs region, e.g. de-de, us-en (default wt-wt).
Only reads 14Show 14 read-only tools
  • change_monitorSnapshot the main text of a page under your key; each check returns whether it changed, added and removed lines, similarity.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The description's first verb is "snapshot": a word for reading.

    What it can reach

    • untrusted-inputThe input takes a URL (input.url), and the tool reads it: it reads web pages, which anyone can write.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.

    Claude Code: ask, because it is tagged outbound.

    Description, as the server wrote it
    Snapshot the main text of a page under your key; each check returns whether it changed, added and removed lines, similarity. Schedule calls from your side. Cost €0.002 per check, charged to the API key in Authorization: Bearer. Parameters — url: page url; op: check (default) | list | delete; selector_text: start comparing from this text; js: bool, render with Chromium (default true).
  • cron_explainHuman-readable description of a 5-field cron expression plus the next N run times in a given IANA timezone.No findings

    Why it is in this group

    • The name "cron_explain" says "explain": a word for reading.
    Description, as the server wrote it
    Human-readable description of a 5-field cron expression plus the next N run times in a given IANA timezone. Cost €0.0005 per call, charged to the API key in Authorization: Bearer. Parameters — expr: cron expression, e.g. '0 9 * * 1-5'; language: en (default) | ru | uk | ua; tz: IANA timezone, default UTC; count: 1–20, default 5.
  • iban_validateStructure and checksum of an IBAN (country, bank/branch/account codes, derived BIC, bank name where the registry has it) and/or a standalone BIC.No findings

    Why it is in this group

    • The name "iban_validate" says "validate": a word for reading.
    Description, as the server wrote it
    Structure and checksum of an IBAN (country, bank/branch/account codes, derived BIC, bank name where the registry has it) and/or a standalone BIC. An invalid IBAN/BIC is a normal 200 response with valid:false and a reason, not an error. Cost €0.005 per lookup, charged to the API key in Authorization: Bearer. Parameters — iban: IBAN, any formatting (spaces ignored); bic: BIC/SWIFT code (alternative or in addition to iban).
  • llms_txtReturns a site's existing /llms.txt as is, or builds one from its sitemap (falling back to the homepage links) per the llmstxt.org spec, respecting robots.txt.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The description's first verb is "return": a word for reading.

    What it can reach

    • untrusted-inputThe input takes a URL (input.url), and the tool reads it: it reads web pages, which anyone can write.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.

    Claude Code: ask, because it is tagged outbound.

    Description, as the server wrote it
    Returns a site's existing /llms.txt as is, or builds one from its sitemap (falling back to the homepage links) per the llmstxt.org spec, respecting robots.txt. Cost €0.01 per site, charged to the API key in Authorization: Bearer. Parameters — url: site url; max_pages: 1–20 pages to crawl when no llms.txt exists (default 20).
  • phone_validateValidity, E.164 and national formats, country, line type (mobile, landline, VoIP…), carrier, location, time zones.No findings

    Why it is in this group

    • The name "phone_validate" says "validate": a word for reading.
    Description, as the server wrote it
    Validity, E.164 and national formats, country, line type (mobile, landline, VoIP…), carrier, location, time zones. Cost €0.0015 per number, charged to the API key in Authorization: Bearer. Parameters — phone: number in any format; country: ISO-2 default region for local numbers, e.g. UA.
  • profanity_filterFinds and masks profanity in en, ru, uk, de, es, fr (auto-detects across all of them unless language is set).No findings

    Why it is in this group

    • The description's first verb is "find": a word for reading.
    Description, as the server wrote it
    Finds and masks profanity in en, ru, uk, de, es, fr (auto-detects across all of them unless language is set). Catches basic obfuscation: latin look-alikes for Cyrillic letters, repeated letters, stray asterisks/digits inside a word. Up to 50 000 chars. Cost €0.0005 per request, charged to the API key in Authorization: Bearer. Parameters — text: text to check; language: auto (default, all 6) | comma-separated subset; mode: mask (default) | detect; mask_char: single character (default *).
  • screenshotRendered screenshot of any public URL.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "screenshot" says "screenshot": a word for reading.

    What it can reach

    • untrusted-inputThe description's first sentence says "url": it reads web pages, which anyone can write.
    • untrusted-inputThe input takes a URL (input.url), and the tool reads it: it reads web pages, which anyone can write.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.

    Claude Code: ask, because it is tagged outbound.

    Description, as the server wrote it
    Rendered screenshot of any public URL. Viewport, full page, element by CSS selector, dark mode, retina 2x. Output: PNG, JPEG or WebP. Cost €0.004 per shot, charged to the API key in Authorization: Bearer. Parameters — url: string (http/https page url); width: int 320–3840 (default 1280); height: int 240–3840 (default 720); full_page: bool (default false); selector: CSS selector — shoot one element; format: png | jpeg | webp (default png); scale: 1 | 2 (retina); dark: bool — prefers-color-scheme: dark; wait: ms to wait after load, 0–8000.
  • servicesList all services with prices per call.No findings

    Why it is in this group

    • The description's first verb is "list": a word for reading.
    Description, as the server wrote it
    List all services with prices per call.
  • summarizeFaithful summary of text or a URL: short, medium or long; paragraph, bullets or TL;DR; any output language.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "summarize" says "summarize": a word for reading.

    What it can reach

    • untrusted-inputThe description's first sentence says "url": it reads web pages, which anyone can write.
    • untrusted-inputThe input takes a URL (input.url), and the tool reads it: it reads web pages, which anyone can write.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.

    Claude Code: ask, because it is tagged outbound.

    Description, as the server wrote it
    Faithful summary of text or a URL: short, medium or long; paragraph, bullets or TL;DR; any output language. Billed per started 4 000 chars. Cost €0.003 per request (4 000 chars), charged to the API key in Authorization: Bearer. Parameters — text: text to summarize; url: page url (alternative); length: short | medium (default) | long; format: paragraph (default) | bullets | tldr; language: output language (default same).
  • text_diffUnified diff, added/removed lines and similarity percent between two texts, or two files given by url/upload (PDF, DOCX, plain text extracted on our side).Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "text_diff" says "diff": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "file": it reads files.
    • untrusted-inputThe description's first sentence says "url": it reads web pages, which anyone can write.
    Description, as the server wrote it
    Unified diff, added/removed lines and similarity percent between two texts, or two files given by url/upload (PDF, DOCX, plain text extracted on our side). Billed ×3 when a side is a PDF or DOCX. Side b only can be a multipart file. Cost €0.001 per text, charged to the API key in Authorization: Bearer. Parameters — text_a: first text; url_a: url to pdf/docx/txt (alternative to text_a); text_b: second text; url_b: url (alternative to text_b); context: unified diff context lines, 0–10 (default 3); ignore_whitespace: bool, trim each line before comparing (default false).
  • webhook_relayGet an inbound URL that accepts webhooks for you and forwards them to your target with HMAC signature and 5 retries over 7 hours; or call a URL on a schedule (every 5–1440 min).Reads text others writeNo findings

    Why it is in this group

    • The description's first verb is "get": a word for reading.

    What it can reach

    • untrusted-inputThe description's first sentence says "get" and "url": it reads web pages, which anyone can write.
    Description, as the server wrote it
    Get an inbound URL that accepts webhooks for you and forwards them to your target with HMAC signature and 5 retries over 7 hours; or call a URL on a schedule (every 5–1440 min). Event log and replay. Cost €0.0005 per event, charged to the API key in Authorization: Bearer. Parameters — op: create (default) | schedule | list | events | replay | delete; target: your https endpoint; name: label; every_minutes: 5–1440 for schedule; method: GET | POST for schedule; body: JSON body for scheduled POST; id: hook id; event_id: event to replay.

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

644 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 2 private-data tools breaks every one.

Reads private data2
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write7
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out46
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
deny to break every path
{
  "permissions": {
    "deny": [
      "mcp__finekot-api__semantic_search",
      "mcp__finekot-api__text_diff"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

No check matched anything in these tool definitions. That is not a safety guarantee.

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 0.1.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http finekot-api https://api.finekot.com/mcp --header 'Authorization: <your-authorization>'
claude mcp add --transport http finekot-api https://api.finekot.com/mcp --header 'Authorization: <your-authorization>'

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__finekot-api__text_diff",
      "mcp__finekot-api__phone_validate",
      "mcp__finekot-api__semantic_search",
      "mcp__finekot-api__profanity_filter",
      "mcp__finekot-api__web_search",
      "mcp__finekot-api__webhook_relay",
      "mcp__finekot-api__cron_explain",
      "mcp__finekot-api__iban_validate",
      "mcp__finekot-api__paper_search",
      "mcp__finekot-api__services"
    ],
    "ask": [
      "mcp__finekot-api__screenshot",
      "mcp__finekot-api__url_to_markdown",
      "mcp__finekot-api__web_answer",
      "mcp__finekot-api__news_brief",
      "mcp__finekot-api__llms_txt",
      "mcp__finekot-api__text_to_speech",
      "mcp__finekot-api__speech_to_text",
      "mcp__finekot-api__compress",
      "mcp__finekot-api__watermark",
      "mcp__finekot-api__qr",
      "mcp__finekot-api__barcode",
      "mcp__finekot-api__og_image",
      "mcp__finekot-api__color_palette",
      "mcp__finekot-api__html_pdf",
      "mcp__finekot-api__pdf_tools",
      "mcp__finekot-api__pdf_text",
      "mcp__finekot-api__table_extract",
      "mcp__finekot-api__doc_convert",
      "mcp__finekot-api__csv_convert",
      "mcp__finekot-api__md_convert",
      "mcp__finekot-api__link_preview",
      "mcp__finekot-api__email_verify",
      "mcp__finekot-api__detect_lang",
      "mcp__finekot-api__fx",
      "mcp__finekot-api__ip_geo",
      "mcp__finekot-api__uptime",
      "mcp__finekot-api__vat_check",
      "mcp__finekot-api__ocr",
      "mcp__finekot-api__image_moderate",
      "mcp__finekot-api__embed",
      "mcp__finekot-api__doc_redact",
      "mcp__finekot-api__readability_score",
      "mcp__finekot-api__entity_extract",
      "mcp__finekot-api__denoise",
      "mcp__finekot-api__subtitles",
      "mcp__finekot-api__video_clip",
      "mcp__finekot-api__summarize",
      "mcp__finekot-api__translate",
      "mcp__finekot-api__extract_json",
      "mcp__finekot-api__classify",
      "mcp__finekot-api__rewrite",
      "mcp__finekot-api__seo_meta",
      "mcp__finekot-api__caption",
      "mcp__finekot-api__invoice_parse",
      "mcp__finekot-api__docx_gen",
      "mcp__finekot-api__seo_audit",
      "mcp__finekot-api__change_monitor",
      "mcp__finekot-api__sql_lint",
      "mcp__finekot-api__prompt_guard",
      "mcp__finekot-api__resume_parse",
      "mcp__finekot-api__memory",
      "mcp__finekot-api__browser",
      "mcp__finekot-api__mcp_host",
      "mcp__finekot-api__domain_health",
      "mcp__finekot-api__url_safety",
      "mcp__finekot-api__file_type_detect",
      "mcp__finekot-api__math_eval",
      "mcp__finekot-api__unit_convert",
      "mcp__finekot-api__tz_convert",
      "mcp__finekot-api__regex_test",
      "mcp__finekot-api__hash",
      "mcp__finekot-api__uuid",
      "mcp__finekot-api__base64",
      "mcp__finekot-api__jwt_tools",
      "mcp__finekot-api__holidays",
      "mcp__finekot-api__vin_decode",
      "mcp__finekot-api__weather",
      "mcp__finekot-api__company_verify",
      "mcp__finekot-api__lib_docs",
      "mcp__finekot-api__diagram_render",
      "mcp__finekot-api__chart_render",
      "mcp__finekot-api__pdf_sign",
      "mcp__finekot-api__sanctions_screen",
      "mcp__finekot-api__e_invoice",
      "mcp__finekot-api__bank_statement_parse",
      "mcp__finekot-api__purchase_order_extract",
      "mcp__finekot-api__invoice_3way_match",
      "mcp__finekot-api__contract_clause_extract",
      "mcp__finekot-api__account"
    ],
    "deny": [
      "mcp__finekot-api__remove_background",
      "mcp__finekot-api__exif_strip"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as finekot-api. Review it before you use it.

Capability tags behind 50 rules
  • mcp__finekot-api__screenshot untrusted-input, outbound
  • mcp__finekot-api__url_to_markdown outbound
  • mcp__finekot-api__llms_txt untrusted-input, outbound
  • mcp__finekot-api__speech_to_text outbound
  • mcp__finekot-api__compress outbound
  • mcp__finekot-api__watermark outbound
  • mcp__finekot-api__qr outbound
  • mcp__finekot-api__barcode outbound
  • mcp__finekot-api__color_palette outbound
  • mcp__finekot-api__html_pdf outbound
  • mcp__finekot-api__pdf_tools outbound
  • mcp__finekot-api__pdf_text outbound
  • mcp__finekot-api__table_extract outbound
  • mcp__finekot-api__doc_convert outbound
  • mcp__finekot-api__csv_convert outbound
  • mcp__finekot-api__text_diff private-data, untrusted-input
  • mcp__finekot-api__md_convert outbound
  • mcp__finekot-api__link_preview outbound
  • mcp__finekot-api__uptime outbound
  • mcp__finekot-api__ocr outbound
  • mcp__finekot-api__image_moderate outbound
  • mcp__finekot-api__semantic_search private-data
  • mcp__finekot-api__doc_redact outbound
  • mcp__finekot-api__entity_extract outbound
  • mcp__finekot-api__denoise outbound
  • mcp__finekot-api__subtitles outbound
  • mcp__finekot-api__video_clip outbound
  • mcp__finekot-api__summarize untrusted-input, outbound
  • mcp__finekot-api__translate outbound
  • mcp__finekot-api__extract_json outbound
  • mcp__finekot-api__seo_meta outbound
  • mcp__finekot-api__caption outbound
  • mcp__finekot-api__invoice_parse outbound
  • mcp__finekot-api__docx_gen outbound
  • mcp__finekot-api__web_search untrusted-input
  • mcp__finekot-api__seo_audit outbound
  • mcp__finekot-api__change_monitor untrusted-input, outbound
  • mcp__finekot-api__resume_parse outbound
  • mcp__finekot-api__browser outbound
  • mcp__finekot-api__webhook_relay untrusted-input
  • mcp__finekot-api__domain_health outbound
  • mcp__finekot-api__url_safety outbound
  • mcp__finekot-api__file_type_detect outbound
  • mcp__finekot-api__unit_convert outbound
  • mcp__finekot-api__tz_convert outbound
  • mcp__finekot-api__pdf_sign outbound
  • mcp__finekot-api__e_invoice outbound
  • mcp__finekot-api__bank_statement_parse outbound
  • mcp__finekot-api__purchase_order_extract outbound
  • mcp__finekot-api__contract_clause_extract outbound

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/io.github.denyskot1986/finekot-api-mcp/verify?hash=b25c97dfe841bc32ec67cc87d8f32365cb41e71f5188c6ccf7d1179111978d22" | jq -e '.changed == false'

Pinned hash b25c97dfe841, from Nov 3, 2026, 14:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.github.denyskot1986/finekot-api-mcp/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for io.github.denyskot1986/finekot-api-mcp
[![anlyon.dev](https://anlyon.dev/badge/io.github.denyskot1986/finekot-api-mcp.svg)](https://anlyon.dev/servers/io.github.denyskot1986/finekot-api-mcp)

Source: MCP Registry · repository. Synced Nov 3, 2026, 14:17 UTC.