Benchline
by fabwaseem · remote · no sign-in to list tools · v0.1.1 · published by GitHub user fabwaseem
Open-source developer, PDF, image, SEO and security tools over a stateless HTTP MCP server. No key.
82 tools: 1 can delete or cancel things, 7 do something that can't be undone, 53 change things and 21 only read.
Scanned Oct 21, 2026
- Deletes or cancels1Claude Code: deny: see these tools
- Can't be undone7Claude Code: ask: see these tools
- Changes things53Claude Code: ask: see these tools
- Only reads21Claude Code: allow: see these tools
37 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.
claude mcp add --transport http benchline https://benchline.fabwaseem.com/mcpFindings
Matches of fixed checks, with the text they matched.
The server marks "generate_llms_txt" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":false}; The name "generate_llms_txt" says "generate": a word for a change.
- Warnbuild_open_graph
The server marks "build_open_graph" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":false}; The name "build_open_graph" says "open": a word for a change.
The server marks "build_nextjs_dockerfile" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "generate": a word for a change.
The server marks "convert_data_format" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":false}; The name "convert_data_format" says "convert": a word for a change.
- Warnconvert_csv_json
The server marks "convert_csv_json" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":false}; The name "convert_csv_json" says "convert": a word for a change.
- Warnconvert_image
The server marks "convert_image" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":true}; The name "convert_image" says "convert": a word for a change.
Show 31 more findingsShow fewer
- Warnresize_image
The server marks "resize_image" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":true}; The name "resize_image" says "resize": a word for a change.
- Warnconvert_color
The server marks "convert_color" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":false}; The name "convert_color" says "convert": a word for a change.
The server marks "convert_unix_timestamp" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":false}; The name "convert_unix_timestamp" says "convert": a word for a change.
- Warngenerate_uuid
The server marks "generate_uuid" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":false}; The name "generate_uuid" says "generate": a word for a change.
The server marks "generate_password" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":false}; The name "generate_password" says "generate": a word for a change.
- Warnexplain_chmod
The server marks "explain_chmod" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":false}; The name "explain_chmod" says "explain": a word for reading.
- Warnmerge_pdf
The server marks "merge_pdf" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":true}; The name "merge_pdf" says "merge": a word for a change that another call does not undo.
- Warngenerate_qr_code
The server marks "generate_qr_code" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":false}; The name "generate_qr_code" says "generate": a word for a change.
The server marks "convert_markdown_html" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":false}; The name "convert_markdown_html" says "convert": a word for a change.
- Warngenerate_favicon
The server marks "generate_favicon" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":true}; The name "generate_favicon" says "generate": a word for a change.
The server marks "remove_background" read-only (readOnlyHint: true), and its own name, description or input give the class "destructive".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":true}; The name "remove_background" says "remove": a word for removing or ending something.
- Warnconvert_case
The server marks "convert_case" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":false}; The name "convert_case" says "convert": a word for a change.
The server marks "generate_fake_data" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":false}; The name "generate_fake_data" says "generate": a word for a change.
- Warntest_regex
The server marks "test_regex" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "run": a word for a change.
- Warnformat_sql
The server marks "format_sql" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":false}; The input takes a statement or command to run (input.sql), which can change anything it can reach.
- Warnconvert_units
The server marks "convert_units" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":false}; The name "convert_units" says "convert": a word for a change.
- Warngenerate_keypair
The server marks "generate_keypair" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":false}; The name "generate_keypair" says "generate": a word for a change.
- Warngenerate_totp
The server marks "generate_totp" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":false}; The name "generate_totp" says "generate": a word for a change.
- Warnquery_jsonpath
The server marks "query_jsonpath" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":false}; The name "query_jsonpath" says "query": a word for reading.
The server marks "calculate_programmer" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "evaluate": a word for a change.
The server marks "convert_json_to_types" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":false}; The name "convert_json_to_types" says "convert": a word for a change.
- Warnminify_code
The server marks "minify_code" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":false}; The input takes a statement or command to run (input.code), which can change anything it can reach.
- Warnconvert_curl
The server marks "convert_curl" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":false}; The name "convert_curl" says "convert": a word for a change.
- Warnexecute_graphql
The server marks "execute_graphql" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":true}; The name "execute_graphql" says "execute": a word for a change.
- Warngenerate_resume
The server marks "generate_resume" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":false}; The name "generate_resume" says "generate": a word for a change.
- Warngenerate_invoice
The server marks "generate_invoice" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":false}; The name "generate_invoice" says "generate": a word for a change.
The server marks "resize_social_image" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":true}; The name "resize_social_image" says "resize": a word for a change.
- Warnconvert_currency
The server marks "convert_currency" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":true}; The name "convert_currency" says "convert": a word for a change.
- Warngenerate_meme
The server marks "generate_meme" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":true}; The name "generate_meme" says "generate": a word for a change.
- Warnzip_files
The server marks "zip_files" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":true}; The description's first verb is "create": a word for a change.
- Warnfill_pdf_form
The server marks "fill_pdf_form" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":true}; The name "fill_pdf_form" says "fill": a word for a change.
Tools
Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.
82 tools
Deletes or cancels 1Claude Code: deny
remove_backgroundRemove a solid or near-solid background by flood-filling from the border.1 finding
Why it is in this group
- The name "remove_background" says "remove": a word for removing or ending something.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "remove_background" read-only (readOnlyHint: true), and its own name, description or input give the class "destructive".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":true}; The name "remove_background" says "remove": a word for removing or ending something.
Description, as the server wrote it Remove a solid or near-solid background by flood-filling from the border. color is an optional #rrggbb. The portrait model runs in the browser, not in this handler: MODNet is Apache-2.0, RMBG-1.4 is non-commercial, and the ONNX runtime is too large for the serverless function. Send base64 or a public URL. Private addresses are refused and the decoded file is capped at 10 MB. Returns a PNG as base64.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: true
Can't be undone 7Claude Code: ask
convert_currencyConvert money between ISO 4217 currencies using live exchange rates from the Frankfurter API, fetched through the SSRF-safe outbound guard.1 finding
Why it is in this group
- The name "convert_currency" says "convert": a word for a change.
- The input addresses people (input.to): what it sends cannot be taken back.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "convert_currency" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":true}; The name "convert_currency" says "convert": a word for a change.
Description, as the server wrote it Convert money between ISO 4217 currencies using live exchange rates from the Frankfurter API, fetched through the SSRF-safe outbound guard. Supports historical dates.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: true
convert_data_formatConvert between JSON, YAML, TOML, and XML.1 finding
Why it is in this group
- The name "convert_data_format" says "convert": a word for a change.
- The input addresses people (input.to): what it sends cannot be taken back.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "convert_data_format" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":false}; The name "convert_data_format" says "convert": a word for a change.
Description, as the server wrote it Convert between JSON, YAML, TOML, and XML. Auto-detects the source. Numbers that do not fit in a JavaScript number keep their digits. Errors include a line and column. TOML refuses null and a non-table root.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: false
convert_markdown_htmlConvert GitHub-flavored Markdown to HTML, or HTML to Markdown.1 finding
Why it is in this group
- The name "convert_markdown_html" says "convert": a word for a change.
- The input addresses people (input.to): what it sends cannot be taken back.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "convert_markdown_html" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":false}; The name "convert_markdown_html" says "convert": a word for a change.
Description, as the server wrote it Convert GitHub-flavored Markdown to HTML, or HTML to Markdown. to is html or markdown. sanitize strips scripts from the text output. The conversion does not fetch a URL.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: false
convert_unitsConvert length, mass, volume, temperature, area, speed, time, and data size.1 finding
Why it is in this group
- The name "convert_units" says "convert": a word for a change.
- The input addresses people (input.to): what it sends cannot be taken back.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "convert_units" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":false}; The name "convert_units" says "convert": a word for a change.
Description, as the server wrote it Convert length, mass, volume, temperature, area, speed, time, and data size. Decimal bytes (kB, MB) and binary bytes (KiB, MiB) are separate categories.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: false
execute_graphqlSend a GraphQL query with optional variables and headers to a public http or https endpoint on port 80 or 443 and return the response data or errors.1 finding
Why it is in this group
- The name "execute_graphql" says "execute": a word for a change.
- The description's first verb is "send": a word for sending, and what is sent cannot be taken back.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "execute_graphql" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":true}; The name "execute_graphql" says "execute": a word for a change.
Description, as the server wrote it Send a GraphQL query with optional variables and headers to a public http or https endpoint on port 80 or 443 and return the response data or errors. Local, private, and internal addresses are refused.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: true
generate_invoiceBuild an invoice or quote PDF from company and client details, line items with quantities and rates, a tax rate, and an optional percent or flat discount.1 finding
Why it is in this group
- The name "generate_invoice" says "generate": a word for a change.
- The input addresses people (input.invoice.to): what it sends cannot be taken back.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "generate_invoice" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":false}; The name "generate_invoice" says "generate": a word for a change.
Description, as the server wrote it Build an invoice or quote PDF from company and client details, line items with quantities and rates, a tax rate, and an optional percent or flat discount. All money is computed in integer cents, so there are no float rounding errors. Returns the PDF as base64 plus the total.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: false
merge_pdfCombine PDF files.1 finding
Why it is in this group
- The name "merge_pdf" says "merge": a word for a change that another call does not undo.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "merge_pdf" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":true}; The name "merge_pdf" says "merge": a word for a change that another call does not undo.
Description, as the server wrote it Combine PDF files. Each file is base64 or a public URL, and can keep a page range such as 1-3,5. Private addresses are refused. Returns one PDF as base64.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: true
Changes things 53Claude Code: ask
aes_cryptAES-256-GCM encryption with PBKDF2-SHA256 key derivation.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it AES-256-GCM encryption with PBKDF2-SHA256 key derivation. Encrypt returns a base64 bundle (salt, IV, ciphertext); decrypt reverses it.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: false
base64_codecEncode UTF-8 text as Base64, or decode Base64 and data URIs.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Encode UTF-8 text as Base64, or decode Base64 and data URIs. URL-safe output uses - and _ and omits padding. Decode reports the sniffed media type and whether the bytes are UTF-8 text.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: false
build_cspBuild a Content-Security-Policy from directives, or lint an existing policy.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Build a Content-Security-Policy from directives, or lint an existing policy. Returns the header line, a Next.js headers() snippet, and warnings for unsafe sources.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: false
build_json_ldBuild schema.org JSON-LD for one type, plus a script tag and a list of missing fields.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Build schema.org JSON-LD for one type, plus a script tag and a list of missing fields. Use this when you already know the fields. It does not fetch a page.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: false
build_nextjs_dockerfileGenerate a production Dockerfile, dockerignore, compose file, and next.config snippet for a Next.js app.1 finding
Why it is in this group
- The description's first verb is "generate": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "build_nextjs_dockerfile" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "generate": a word for a change.
Description, as the server wrote it Generate a production Dockerfile, dockerignore, compose file, and next.config snippet for a Next.js app. Defaults match a pnpm standalone image.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: false
build_open_graphRender one of the Open Graph templates as a PNG and a Next.js opengraph-image.tsx file.1 finding
Why it is in this group
- The name "build_open_graph" says "open": a word for a change.
- The input takes a statement or command to run (input.command), which can change anything it can reach.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "build_open_graph" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":false}; The name "build_open_graph" says "open": a word for a change.
Description, as the server wrote it Render one of the Open Graph templates as a PNG and a Next.js opengraph-image.tsx file. Pass a template id from list_og_templates, the fields that template uses, colors, a size, and optional base64 images.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: false
calculate_emiCalculate a reducing-balance loan installment and its amortization schedule.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Calculate a reducing-balance loan installment and its amortization schedule. Money is rounded half up to cents. An optional extra monthly payment reduces principal.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: false
calculate_percentageCalculate percent of a value, what percent one number is of another, percent change, the reverse, an increase or decrease, and margin versus markup.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Calculate percent of a value, what percent one number is of another, percent change, the reverse, an increase or decrease, and margin versus markup.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: false
calculate_programmerEvaluate integer expressions with C-like precedence (hex/octal/binary literals, bitwise ops, shifts) and report base conversions plus signed/unsigned interpretations.1 finding
Why it is in this group
- The description's first verb is "evaluate": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "calculate_programmer" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "evaluate": a word for a change.
Description, as the server wrote it Evaluate integer expressions with C-like precedence (hex/octal/binary literals, bitwise ops, shifts) and report base conversions plus signed/unsigned interpretations.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: false
check_sslConnect to a public host on port 443 and report certificate expiry, subject alternative names, protocol, and chain.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Connect to a public host on port 443 and report certificate expiry, subject alternative names, protocol, and chain. Private addresses are refused. The handshake times out after 8 seconds.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: true
compress_imageRe-encode an image at a quality from 1 to 100, optionally capping the longest edge.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Re-encode an image at a quality from 1 to 100, optionally capping the longest edge. Send base64 or a public URL. Private addresses are refused and the decoded file is capped at 10 MB. Returns the image as base64.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: true
compress_pdfRecompress embedded images in a PDF.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Recompress embedded images in a PDF. Presets are light, medium, and strong. Send base64 or a public URL. Private addresses are refused. An optional target size tries harder. Returns the PDF and the sizes before and after.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: true
convert_caseConvert text to camelCase, snake_case, kebab-case, CONSTANT_CASE, and AP or Chicago title case.1 finding
Why it is in this group
- The name "convert_case" says "convert": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "convert_case" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":false}; The name "convert_case" says "convert": a word for a change.
Description, as the server wrote it Convert text to camelCase, snake_case, kebab-case, CONSTANT_CASE, and AP or Chicago title case. Returns every style unless one is requested.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: false
convert_colorConvert HEX, RGB, HSL, OKLCH, or CMYK into every format, name the nearest Tailwind token, and report the WCAG 2 contrast ratio against a background.1 finding
Why it is in this group
- The name "convert_color" says "convert": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "convert_color" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":false}; The name "convert_color" says "convert": a word for a change.
Description, as the server wrote it Convert HEX, RGB, HSL, OKLCH, or CMYK into every format, name the nearest Tailwind token, and report the WCAG 2 contrast ratio against a background.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: false
convert_csv_jsonConvert CSV to JSON or JSON to CSV.1 finding
Why it is in this group
- The name "convert_csv_json" says "convert": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "convert_csv_json" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":false}; The name "convert_csv_json" says "convert": a word for a change.
Description, as the server wrote it Convert CSV to JSON or JSON to CSV. Supports comma, tab, semicolon, and pipe delimiters, an optional header, type inference, and dotted flattening. Inferred numbers that do not fit in a JavaScript number keep their digits.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: false
convert_curlParse a curl command and generate equivalent JavaScript fetch, Python requests, Go, PHP, or Rust code.1 finding
Why it is in this group
- The name "convert_curl" says "convert": a word for a change.
- The input takes a statement or command to run (input.command), which can change anything it can reach.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "convert_curl" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":false}; The name "convert_curl" says "convert": a word for a change.
Description, as the server wrote it Parse a curl command and generate equivalent JavaScript fetch, Python requests, Go, PHP, or Rust code.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: false
convert_imageConvert an image to JPEG, PNG, WebP, or AVIF.1 finding
Why it is in this group
- The name "convert_image" says "convert": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "convert_image" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":true}; The name "convert_image" says "convert": a word for a change.
Description, as the server wrote it Convert an image to JPEG, PNG, WebP, or AVIF. Send base64 or a public URL. Private addresses are refused and the decoded file is capped at 10 MB. Returns the image as base64. HEIC is not decoded here.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: true
convert_json_to_typesInfer types from a JSON document and generate TypeScript interfaces, Zod schemas, Python Pydantic models or dataclasses, and Go structs.1 finding
Why it is in this group
- The name "convert_json_to_types" says "convert": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "convert_json_to_types" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":false}; The name "convert_json_to_types" says "convert": a word for a change.
Description, as the server wrote it Infer types from a JSON document and generate TypeScript interfaces, Zod schemas, Python Pydantic models or dataclasses, and Go structs.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: false
convert_unix_timestampConvert epoch seconds, milliseconds, microseconds, or nanoseconds to ISO-8601 and RFC 2822 in an IANA time zone, or convert a calendar time back to epoch.1 finding
Why it is in this group
- The name "convert_unix_timestamp" says "convert": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "convert_unix_timestamp" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":false}; The name "convert_unix_timestamp" says "convert": a word for a change.
Description, as the server wrote it Convert epoch seconds, milliseconds, microseconds, or nanoseconds to ISO-8601 and RFC 2822 in an IANA time zone, or convert a calendar time back to epoch.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: false
crop_imageCrop an image to a pixel box or a 0 to 1 ratio box.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Crop an image to a pixel box or a 0 to 1 ratio box. circle cuts a round mask. format is png, jpeg, or webp. Send base64 or a public URL. Private addresses are refused and the decoded file is capped at 10 MB. Returns the image as base64.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: true
decode_jwtDecode a signed JSON Web Token into its header, payload, and registered claims.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Decode a signed JSON Web Token into its header, payload, and registered claims. Dates are absolute ISO timestamps. The signature is not checked.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: false
explain_chmodConvert an octal or symbolic file mode into octal, symbolic notation, and a chmod command, including setuid, setgid, and the sticky bit.1 finding
Why it is in this group
- The name "explain_chmod" says "explain": a word for reading.
- The description's first verb is "convert": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "explain_chmod" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":false}; The name "explain_chmod" says "explain": a word for reading.
Description, as the server wrote it Convert an octal or symbolic file mode into octal, symbolic notation, and a chmod command, including setuid, setgid, and the sticky bit.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: false
fill_pdf_formFill an interactive PDF form's text fields, checkboxes, dropdowns, and radios by field name, with an option to flatten the result.1 finding
Why it is in this group
- The name "fill_pdf_form" says "fill": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "fill_pdf_form" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":true}; The name "fill_pdf_form" says "fill": a word for a change.
Description, as the server wrote it Fill an interactive PDF form's text fields, checkboxes, dropdowns, and radios by field name, with an option to flatten the result. Pass inspectOnly to list the fields first.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: true
format_jsonPretty-print or minify JSON.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Pretty-print or minify JSON. A number that does not fit in a JavaScript number keeps the digits you sent. Returns the formatted text when it is valid, or the line and column of each syntax error.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: false
format_sqlFormat SQL for PostgreSQL, MySQL, BigQuery, Snowflake, and other dialects.1 finding
Why it is in this group
- The input takes a statement or command to run (input.sql), which can change anything it can reach.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "format_sql" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":false}; The input takes a statement or command to run (input.sql), which can change anything it can reach.
Description, as the server wrote it Format SQL for PostgreSQL, MySQL, BigQuery, Snowflake, and other dialects. Choose keyword case and an indent of 2 or 4 spaces.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: false
generate_fake_dataGenerate seeded lorem ipsum, or fake JSON, CSV, or SQL rows from a list of field types.1 finding
Why it is in this group
- The name "generate_fake_data" says "generate": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "generate_fake_data" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":false}; The name "generate_fake_data" says "generate": a word for a change.
Description, as the server wrote it Generate seeded lorem ipsum, or fake JSON, CSV, or SQL rows from a list of field types.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: false
generate_faviconBuild a favicon pack from an image or up to three letters.1 finding
Why it is in this group
- The name "generate_favicon" says "generate": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "generate_favicon" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":true}; The name "generate_favicon" says "generate": a word for a change.
Description, as the server wrote it Build a favicon pack from an image or up to three letters. The ZIP contains favicon.ico, PNG sizes, a web manifest, an HTML snippet, and a Next.js metadata snippet. Letters are drawn with a built-in bitmap font so the result does not depend on a system font. Send base64 or a public URL. Private addresses are refused and the decoded file is capped at 10 MB.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: true
generate_keypairGenerate an RSA, EC, or Ed25519 key pair as PEM and JWK, or convert between PEM and JWK.1 finding
Why it is in this group
- The name "generate_keypair" says "generate": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "generate_keypair" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":false}; The name "generate_keypair" says "generate": a word for a change.
Description, as the server wrote it Generate an RSA, EC, or Ed25519 key pair as PEM and JWK, or convert between PEM and JWK. The private key is returned in the result and is not stored. The page in the browser generates keys locally and does not send them.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: false
generate_llms_txtRender llms.txt and llms-full.txt from a site name, a summary, and a list of pages.1 finding
Why it is in this group
- The name "generate_llms_txt" says "generate": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "generate_llms_txt" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":false}; The name "generate_llms_txt" says "generate": a word for a change.
Description, as the server wrote it Render llms.txt and llms-full.txt from a site name, a summary, and a list of pages. It does not crawl. Grouping follows the page URLs.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: false
generate_memeRender a classic top/bottom-caption meme as a PNG.1 finding
Why it is in this group
- The name "generate_meme" says "generate": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "generate_meme" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":true}; The name "generate_meme" says "generate": a word for a change.
Description, as the server wrote it Render a classic top/bottom-caption meme as a PNG. Give it an image (base64, data URI, or public URL) or pick a gradient style, and it returns captioned meme artwork.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: true
generate_passwordGenerate cryptographic passwords or EFF-wordlist passphrases and report the entropy in bits.1 finding
Why it is in this group
- The name "generate_password" says "generate": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "generate_password" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":false}; The name "generate_password" says "generate": a word for a change.
Description, as the server wrote it Generate cryptographic passwords or EFF-wordlist passphrases and report the entropy in bits. Randomness comes from the platform CSPRNG.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: false
generate_qr_codeBuild a static QR code for text, a URL, Wi-Fi, or a vCard.1 finding
Why it is in this group
- The name "generate_qr_code" says "generate": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "generate_qr_code" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":false}; The name "generate_qr_code" says "generate": a word for a change.
Description, as the server wrote it Build a static QR code for text, a URL, Wi-Fi, or a vCard. Returns the payload, an SVG string, and a PNG as base64.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: false
generate_resumeBuild a resume PDF from profile, experience, education, and skills.1 finding
Why it is in this group
- The name "generate_resume" says "generate": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "generate_resume" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":false}; The name "generate_resume" says "generate": a word for a change.
Description, as the server wrote it Build a resume PDF from profile, experience, education, and skills. A name plus at least one experience, education, or skills entry is required. Choose the clean, modern, or compact template. Returns the A4 PDF as base64.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: false
generate_totpCompute RFC 4226/6238 one-time passcodes from a base32 secret.1 finding
Why it is in this group
- The name "generate_totp" says "generate": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "generate_totp" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":false}; The name "generate_totp" says "generate": a word for a change.
Description, as the server wrote it Compute RFC 4226/6238 one-time passcodes from a base32 secret. Supports 6/8 digits, SHA1/SHA256/SHA512, and custom periods.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: false
generate_uuidGenerate UUID version 4 or version 7 from cryptographic randomness, up to 10,000 at once, or inspect the version, variant, and v7 timestamp.1 finding
Why it is in this group
- The name "generate_uuid" says "generate": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "generate_uuid" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":false}; The name "generate_uuid" says "generate": a word for a change.
Description, as the server wrote it Generate UUID version 4 or version 7 from cryptographic randomness, up to 10,000 at once, or inspect the version, variant, and v7 timestamp.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: false
hash_dataCompute MD5, SHA-1, SHA-256, and SHA-512 for UTF-8 text or base64 bytes.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Compute MD5, SHA-1, SHA-256, and SHA-512 for UTF-8 text or base64 bytes. Pass hmacKey for HMAC and expected to see which digest matches.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: false
hash_passwordHash a password with bcrypt or argon2id, or verify a hash.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Hash a password with bcrypt or argon2id, or verify a hash. Returns an htpasswd line when a username is set. The password is not stored or logged. The page in the browser never sends the password; this call only hashes the arguments you send.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: false
images_to_pdfTurn images, sent as base64 or public URLs in order, into one PDF.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Turn images, sent as base64 or public URLs in order, into one PDF. JPEG and PNG are embedded directly. Other formats are converted to PNG first. Page size is A4, Letter, or fit. Private addresses are refused. Returns the PDF as base64.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: true
make_collageArrange up to 9 photos into a collage layout (duo, trio, focus, quad, six, nine) with a gap and background color, and get back a square PNG.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Arrange up to 9 photos into a collage layout (duo, trio, focus, quad, six, nine) with a gap and background color, and get back a square PNG.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: true
minify_codeMinify source code with Terser (JS), csso (CSS), or a structural HTML pass and report before/after byte counts.1 finding
Why it is in this group
- The input takes a statement or command to run (input.code), which can change anything it can reach.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "minify_code" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":false}; The input takes a statement or command to run (input.code), which can change anything it can reach.
Description, as the server wrote it Minify source code with Terser (JS), csso (CSS), or a structural HTML pass and report before/after byte counts.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: false
optimize_svgMinify an SVG with SVGO.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Minify an SVG with SVGO. Send markup or a file as base64 or a public URL. Private addresses are refused and the file is capped at 10 MB. The viewBox is kept unless removeViewBox is true. Returns the optimized markup and the byte counts.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: true
organize_pdfReorder, rotate, or drop PDF pages.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Reorder, rotate, or drop PDF pages. Each entry names a 1-based source page and a rotation of 0, 90, 180, or 270. The same page may be listed twice. Send base64 or a public URL. Private addresses are refused.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: true
protect_pdfProtect a PDF with AES-256, or unlock one when the password is known.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Protect a PDF with AES-256, or unlock one when the password is known. action is protect or unlock. password is the user password. ownerPassword is optional. permissions cover printing, copying, modifying, annotating, filling forms, accessibility, and assembly. Send base64 or a public URL. Private addresses are refused.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: true
query_jsonpathEvaluate a JSONPath Plus query against a JSON document and return the matches with their paths.1 finding
Why it is in this group
- The name "query_jsonpath" says "query": a word for reading.
- The description's first verb is "evaluate": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "query_jsonpath" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":false}; The name "query_jsonpath" says "query": a word for reading.
Description, as the server wrote it Evaluate a JSONPath Plus query against a JSON document and return the matches with their paths. A number that does not fit in a JavaScript number is returned as its original digits, with a precision warning.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: false
render_pdf_pagesRender PDF pages to PNG or JPEG.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Render PDF pages to PNG or JPEG. DPI is 72 to 216. A page range such as 1-3,5 is optional. At most 24 pages and 25 MB of images. Send base64 or a public URL. Private addresses are refused. Returns image base64 and a ZIP when there is more than one page.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: true
resize_imageResize an image by pixels or percent.1 finding
Why it is in this group
- The name "resize_image" says "resize": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "resize_image" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":true}; The name "resize_image" says "resize": a word for a change.
Description, as the server wrote it Resize an image by pixels or percent. Fit is contain, cover, or stretch. Send base64 or a public URL. Private addresses are refused and the decoded file is capped at 10 MB. Returns the image as base64.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: true
resize_social_imageCrop and resize an image to an exact social media preset: instagram-post (1080x1080), instagram-portrait (1080x1350), instagram-story (1080x1920), youtube-thumbnail (1280x720), x-p…1 finding
Why it is in this group
- The name "resize_social_image" says "resize": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "resize_social_image" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":true}; The name "resize_social_image" says "resize": a word for a change.
Description, as the server wrote it Crop and resize an image to an exact social media preset: instagram-post (1080x1080), instagram-portrait (1080x1350), instagram-story (1080x1920), youtube-thumbnail (1280x720), x-post (1200x675), x-header (1500x500), linkedin-post (1200x627), or facebook-post (1200x630). The cover crop keeps the center subject. Send base64 or a public URL. Private addresses are refused and the decoded file is capped at 10 MB. Returns the image as base64 PNG.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: true
sign_pdfStamp a PNG signature image onto one or more PDF pages at given positions (fractions of the page, x and y measured from the top-left, width as a fraction of page width).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Stamp a PNG signature image onto one or more PDF pages at given positions (fractions of the page, x and y measured from the top-left, width as a fraction of page width). The signature keeps its aspect ratio. Returns the signed PDF as base64.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: true
split_pdfExtract a page range into one PDF, or split into single pages or chunks of N.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Extract a page range into one PDF, or split into single pages or chunks of N. Send base64 or a public URL. Private addresses are refused. Returns PDF base64 and a ZIP when there are several files.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: true
test_regexRun a JavaScript regular expression against a sample and return every match, capture group, a short explanation, and an optional replacement.1 finding
Why it is in this group
- The description's first verb is "run": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "test_regex" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "run": a word for a change.
Description, as the server wrote it Run a JavaScript regular expression against a sample and return every match, capture group, a short explanation, and an optional replacement.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: false
trim_audioTrim a WAV audio file to a time range with optional fade in and out, returning a 16-bit PCM WAV as base64.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Trim a WAV audio file to a time range with optional fade in and out, returning a 16-bit PCM WAV as base64. Only WAV is accepted; the web UI handles MP3/OGG/M4A.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: true
url_codecPercent-encode or decode text, or parse a URL into its host, path, hash, and query parameters.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Percent-encode or decode text, or parse a URL into its host, path, hash, and query parameters.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: false
zip_filesCreate a ZIP archive from files or list and extract the contents of a ZIP archive.1 finding
Why it is in this group
- The description's first verb is "create": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "zip_files" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true,"openWorldHint":true}; The description's first verb is "create": a word for a change.
Description, as the server wrote it Create a ZIP archive from files or list and extract the contents of a ZIP archive. Everything is handled in memory; no files are stored.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: true
Only reads 21Claude Code: allow
analyze_harParse a HAR (HTTP Archive) capture and summarize it: request counts, status distribution, slowest and largest requests, top hosts, and per-request timings.No findings
Why it is in this group
- The name "analyze_har" says "analyze": a word for reading.
Description, as the server wrote it Parse a HAR (HTTP Archive) capture and summarize it: request counts, status distribution, slowest and largest requests, top hosts, and per-request timings.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: false
calculate_cidrReturn the network, broadcast, host range, and host count for an IPv4 or IPv6 CIDR.No findings
Why it is in this group
- The description's first verb is "return": a word for reading.
Description, as the server wrote it Return the network, broadcast, host range, and host count for an IPv4 or IPv6 CIDR. Optionally test whether an address is inside it, split it, or merge it with other CIDRs.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: false
check_http_headersFetch a public URL, follow redirects, and grade HSTS, Content-Security-Policy, framing, nosniff, and Referrer-Policy.No findings
Why it is in this group
- The description's first verb is "fetch": a word for reading.
Description, as the server wrote it Fetch a public URL, follow redirects, and grade HSTS, Content-Security-Policy, framing, nosniff, and Referrer-Policy. Private addresses are refused. The body is not stored.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: true
check_robots_txtFetch a public robots.txt and report whether the wildcard group blocks the site and whether Sitemap lines are absolute.No findings
Why it is in this group
- The description's first verb is "fetch": a word for reading.
Description, as the server wrote it Fetch a public robots.txt and report whether the wildcard group blocks the site and whether Sitemap lines are absolute. Use this when you have a URL, not a pasted file.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: true
count_textCount words, code points, graphemes, sentences, and paragraphs, and compare the length with SEO and social limits.No findings
Why it is in this group
- The name "count_text" says "count": a word for reading.
Description, as the server wrote it Count words, code points, graphemes, sentences, and paragraphs, and compare the length with SEO and social limits.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: false
count_tokensCount tokens with the o200k or cl100k encoder and price the count against the published model table.No findings
Why it is in this group
- The name "count_tokens" says "count": a word for reading.
Description, as the server wrote it Count tokens with the o200k or cl100k encoder and price the count against the published model table. Claude and Gemini rows are estimates, not those vendors' tokenizers.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: false
date_differenceCount calendar days, elapsed time, and business days between two dates.No findings
Why it is in this group
- The description's first verb is "count": a word for reading.
Description, as the server wrote it Count calendar days, elapsed time, and business days between two dates. Business days skip weekends and any YYYY-MM-DD holidays you list.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: false
diff_textCompare two texts by line, word, or character, or compare JSON so object key order does not matter.No findings
Why it is in this group
- The name "diff_text" says "diff": a word for reading.
Description, as the server wrote it Compare two texts by line, word, or character, or compare JSON so object key order does not matter. Returns an inline diff, side-by-side rows for line and JSON modes, and a unified patch.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: false
explain_cronTurn a cron expression into English, the next UTC run times, and snippets for crontab, GitHub Actions, Vercel, Kubernetes, and node-cron.No findings
Why it is in this group
- The name "explain_cron" says "explain": a word for reading.
Description, as the server wrote it Turn a cron expression into English, the next UTC run times, and snippets for crontab, GitHub Actions, Vercel, Kubernetes, and node-cron.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: false
extract_pdf_textRead the selectable text layer of a PDF.No findings
Why it is in this group
- The description's first verb is "read": a word for reading.
Description, as the server wrote it Read the selectable text layer of a PDF. Returns per-page text, markdown-style headings, and an o200k token count. Does not OCR scans. Send base64 or a public URL. Private addresses are refused.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: true
fetch_page_markdownFetch a public HTML page and return the article as Markdown, plus a title, excerpt, and o200k token count.No findings
Why it is in this group
- The name "fetch_page_markdown" says "fetch": a word for reading.
Description, as the server wrote it Fetch a public HTML page and return the article as Markdown, plus a title, excerpt, and o200k token count. Private and local addresses are refused. The response is capped at 800 KB.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: true
inspect_meta_tagsFetch one public HTML page and report title, description, canonical, Open Graph, Twitter, and JSON-LD.No findings
Why it is in this group
- The name "inspect_meta_tags" says "inspect": a word for reading.
Description, as the server wrote it Fetch one public HTML page and report title, description, canonical, Open Graph, Twitter, and JSON-LD. Use this to see what a live URL advertises.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: true
list_og_templatesList Open Graph card templates with ids, names, categories, defaults, color presets, and field schemas.No findings
Why it is in this group
- The name "list_og_templates" says "list": a word for reading.
Description, as the server wrote it List Open Graph card templates with ids, names, categories, defaults, color presets, and field schemas.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: false
lookup_dnsQuery A, AAAA, MX, TXT, CNAME, and CAA for a public hostname over DNS-over-HTTPS, and parse SPF and DMARC.No findings
Why it is in this group
- The name "lookup_dns" says "lookup": a word for reading.
Description, as the server wrote it Query A, AAAA, MX, TXT, CNAME, and CAA for a public hostname over DNS-over-HTTPS, and parse SPF and DMARC. Private names are refused. The resolver is Cloudflare or Google.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: true
read_barcodeRead QR codes and barcodes from an image.No findings
Why it is in this group
- The name "read_barcode" says "read": a word for reading.
Description, as the server wrote it Read QR codes and barcodes from an image. Send base64 or a public URL. Private addresses are refused and the decoded file is capped at 10 MB. Returns each code's text and format. An image with no code returns an empty list.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: true
read_exifRead EXIF tags, including GPS, or strip them.No findings
Why it is in this group
- The name "read_exif" says "read": a word for reading.
Description, as the server wrote it Read EXIF tags, including GPS, or strip them. action is read or strip. scope is all or gps. gps-only removal keeps the other JPEG tags. Other formats are re-encoded, which drops every tag. Send base64 or a public URL. Private addresses are refused and the decoded file is capped at 10 MB.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: true
read_image_textExtract text from an image with Tesseract.No findings
Why it is in this group
- The name "read_image_text" says "read": a word for reading.
Description, as the server wrote it Extract text from an image with Tesseract. language defaults to eng. Other codes in the list are fetched when first used. Send base64 or a public URL. Private addresses are refused and the decoded file is capped at 10 MB. Returns the text and a confidence from 0 to 100. An image with no text returns an empty string.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: true
score_ai_seoFetch a public page plus its robots.txt, sitemap, and llms.txt, then score how ready it is for AI search crawlers.No findings
Why it is in this group
- The description's first verb is "fetch": a word for reading.
Description, as the server wrote it Fetch a public page plus its robots.txt, sitemap, and llms.txt, then score how ready it is for AI search crawlers. Use this when you have a live URL.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: true
validate_json_schemaInfer a JSON Schema from a sample, or validate JSON against a schema.No findings
Why it is in this group
- The name "validate_json_schema" says "validate": a word for reading.
Description, as the server wrote it Infer a JSON Schema from a sample, or validate JSON against a schema. Returns error paths plus TypeScript and Zod generated from the sample.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: false
validate_sitemapValidate sitemap XML or a public sitemap URL, including a sitemap index and a sample of HTTP statuses.No findings
Why it is in this group
- The name "validate_sitemap" says "validate": a word for reading.
Description, as the server wrote it Validate sitemap XML or a public sitemap URL, including a sitemap index and a sample of HTTP statuses. Or generate a urlset from a list of URLs. Private addresses are refused and responses are size-capped.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: true
validate_websocket_urlValidate and parse a ws:// or wss:// URL into its components, and optionally decode a WebSocket close code.No findings
Why it is in this group
- The name "validate_websocket_url" says "validate": a word for reading.
Description, as the server wrote it Validate and parse a ws:// or wss:// URL into its components, and optionally decode a WebSocket close code.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: false
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Install
Pinned to version 0.1.1. Values in angle brackets are yours to fill in.
claude mcp add --transport http benchline https://benchline.fabwaseem.com/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__benchline__score_ai_seo",
"mcp__benchline__list_og_templates",
"mcp__benchline__check_robots_txt",
"mcp__benchline__inspect_meta_tags",
"mcp__benchline__count_tokens",
"mcp__benchline__explain_cron",
"mcp__benchline__diff_text",
"mcp__benchline__date_difference",
"mcp__benchline__extract_pdf_text",
"mcp__benchline__fetch_page_markdown",
"mcp__benchline__read_barcode",
"mcp__benchline__read_exif",
"mcp__benchline__read_image_text",
"mcp__benchline__count_text",
"mcp__benchline__validate_json_schema",
"mcp__benchline__lookup_dns",
"mcp__benchline__calculate_cidr",
"mcp__benchline__validate_sitemap",
"mcp__benchline__check_http_headers",
"mcp__benchline__analyze_har",
"mcp__benchline__validate_websocket_url"
],
"ask": [
"mcp__benchline__generate_llms_txt",
"mcp__benchline__build_open_graph",
"mcp__benchline__decode_jwt",
"mcp__benchline__build_json_ld",
"mcp__benchline__build_nextjs_dockerfile",
"mcp__benchline__format_json",
"mcp__benchline__convert_data_format",
"mcp__benchline__convert_csv_json",
"mcp__benchline__base64_codec",
"mcp__benchline__convert_image",
"mcp__benchline__compress_image",
"mcp__benchline__resize_image",
"mcp__benchline__convert_color",
"mcp__benchline__convert_unix_timestamp",
"mcp__benchline__hash_data",
"mcp__benchline__generate_uuid",
"mcp__benchline__url_codec",
"mcp__benchline__generate_password",
"mcp__benchline__explain_chmod",
"mcp__benchline__merge_pdf",
"mcp__benchline__split_pdf",
"mcp__benchline__compress_pdf",
"mcp__benchline__images_to_pdf",
"mcp__benchline__generate_qr_code",
"mcp__benchline__organize_pdf",
"mcp__benchline__render_pdf_pages",
"mcp__benchline__protect_pdf",
"mcp__benchline__convert_markdown_html",
"mcp__benchline__optimize_svg",
"mcp__benchline__crop_image",
"mcp__benchline__generate_favicon",
"mcp__benchline__convert_case",
"mcp__benchline__generate_fake_data",
"mcp__benchline__test_regex",
"mcp__benchline__format_sql",
"mcp__benchline__calculate_emi",
"mcp__benchline__calculate_percentage",
"mcp__benchline__convert_units",
"mcp__benchline__hash_password",
"mcp__benchline__generate_keypair",
"mcp__benchline__build_csp",
"mcp__benchline__check_ssl",
"mcp__benchline__generate_totp",
"mcp__benchline__query_jsonpath",
"mcp__benchline__calculate_programmer",
"mcp__benchline__aes_crypt",
"mcp__benchline__convert_json_to_types",
"mcp__benchline__minify_code",
"mcp__benchline__convert_curl",
"mcp__benchline__execute_graphql",
"mcp__benchline__generate_resume",
"mcp__benchline__generate_invoice",
"mcp__benchline__sign_pdf",
"mcp__benchline__resize_social_image",
"mcp__benchline__trim_audio",
"mcp__benchline__convert_currency",
"mcp__benchline__generate_meme",
"mcp__benchline__zip_files",
"mcp__benchline__make_collage",
"mcp__benchline__fill_pdf_form"
],
"deny": [
"mcp__benchline__remove_background"
]
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as benchline. Review it before you use it.