Skip to content

Agent Tools UK

by lexyholdcraft-source · remote · no sign-in to list tools · v1.1.0 · published by GitHub user lexyholdcraft-source

Pay-per-use agent tools: screenshots, web to Markdown, PDF tables, OCR, UK company checks

Final · 1Changes · 4
CompareRegistry entry

10 tools: 1 do something that can't be undone, 4 change things and 5 only read.

Scanned Oct 21, 2026

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http agent-tools-uk https://agent-tools-production-e6aa.up.railway.app/mcp

Findings

Matches of fixed checks, with the text they matched.

1 warn
  • Warnconvert_file

    The server marks "convert_file" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "convert_file" says "convert": a word for a change.

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

10 tools

Can't be undone 1Claude Code: ask
  • convert_fileConvert office documents and images between formats.Reads text others writeCan send data out1 finding

    Why it is in this group

    • The name "convert_file" says "convert": a word for a change.
    • The input addresses people (input.to): what it sends cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a destination (input.to): what the tool writes goes there.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.

    Findings

    • Warn

      The server marks "convert_file" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "convert_file" says "convert": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Convert office documents and images between formats. Documents (docx, doc, xlsx, xls, pptx, ppt, odt, rtf, html, txt, csv) to pdf, docx, odt, txt, xlsx or csv; images between png, jpg, webp and gif. Use when a user or system needs a file in a different format. Send {url} or {base64}, plus filename (with extension) and to. Returns the converted file. Errors: 400 unsupported pair, 422 conversion failed. Price: $0.02 USDC per call (x402).

    Annotations the server declares

    • title: Document and image file conversion
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
Changes things 4Claude Code: ask
  • html_to_pdfTurn HTML you write (an invoice, report, letter or certificate) or a public web page into a print-quality PDF, rendered by Chrome with backgrounds and CSS.Reads text others writeCan send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Turn HTML you write (an invoice, report, letter or certificate) or a public web page into a print-quality PDF, rendered by Chrome with backgrounds and CSS. Use when you need to hand a person a polished, printable document. Send {html} or {url}; optional format (A4, Letter, A3, A5, Legal) and landscape. Returns the PDF. Errors: 400 missing input or private URL, 413 HTML over 2 MB. Price: $0.01 USDC per call (x402).

    Annotations the server declares

    • title: HTML or web page to PDF
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • pdf_tables_to_jsonExtract every table from a PDF and return it as rows of cells in JSON, with the page number of each table.Reads text others writeCan send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Extract every table from a PDF and return it as rows of cells in JSON, with the page number of each table. Use when you need numbers from financial statements, invoices, price lists or reports that are locked in a PDF. Send {url} or {base64}. Max 20 MB, first 50 pages. Returns {pages, tables:[{page, rows}], truncated}. Errors: 400 not a PDF, 413 too large. Price: $0.01 USDC per call (x402).

    Annotations the server declares

    • title: PDF tables to JSON
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • transcribe_audioTranscribe speech from an audio or video file (mp3, m4a, wav, ogg, mp4, webm) up to 15 minutes, using Whisper.Reads text others writeCan send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Transcribe speech from an audio or video file (mp3, m4a, wav, ogg, mp4, webm) up to 15 minutes, using Whisper. Language is detected automatically. Use when you need the words from a voice note, meeting, podcast clip or video. Send {url} or {base64}, optional language (2-letter code). Returns {language, duration, text, segments with start/end times}. Errors: 413 over 15 minutes, 422 not audio. Price: $0.03 USDC per call (x402).

    Annotations the server declares

    • title: Audio to text transcription
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • uk_company_checkCheck a UK company on the official Companies House register by company number: name, status (active, dissolved, liquidation), type, incorporation date, registered address, SIC code…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Check a UK company on the official Companies House register by company number: name, status (active, dissolved, liquidation), type, incorporation date, registered address, SIC codes, accounts due or overdue, charges, insolvency history and current directors. Use for supplier checks, due diligence, or confirming a business is real and active. Errors: 400 invalid number, 404 not found. Price: $0.005 USDC per call (x402).

    Annotations the server declares

    • title: UK company check (Companies House)
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
Only reads 5Claude Code: allow, ask for 4 outbound
  • ocr_read_textRead the text from a photo, screenshot, scan or scanned PDF (OCR).Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "ocr_read_text" says "read": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe input takes a URL (input.url), and the tool reads it: it reads web pages, which anyone can write.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.

    Claude Code: ask, because it is tagged outbound.

    Description, as the server wrote it
    Read the text from a photo, screenshot, scan or scanned PDF (OCR). If the PDF already has real text, that is returned instead (faster and exact). Use when text is only available as an image: receipts, letters, forms, signs. Send {url} or {base64}, optional lang (default eng, e.g. eng+fra). Max 20 MB, 20 pages. Returns {text, method, pages}. Errors: 400 bad input, 413 too large. Price: $0.01 USDC per call (x402).

    Annotations the server declares

    • title: Read text from images and scanned PDFs (OCR)
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • screenshot_webpageRender any public web page in a real Chrome browser and return a PNG screenshot.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "screenshot_webpage" says "screenshot": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe name "screenshot_webpage" says "screenshot" and "webpage": it reads web pages, which anyone can write.
    • untrusted-inputThe description's first sentence says "web": it reads web pages, which anyone can write.
    • untrusted-inputThe input takes a URL (input.url), and the tool reads it: it reads web pages, which anyone can write.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.

    Claude Code: ask, because it is tagged outbound.

    Description, as the server wrote it
    Render any public web page in a real Chrome browser and return a PNG screenshot. Use when you need to see how a page looks, check a layout, capture visual evidence, or read content that only appears after JavaScript runs. Options: width 320-2560 (default 1280), full=true for the whole page. Errors: 400 bad or private URL, 504 page took over 30s. Price: $0.01 USDC per call (x402).

    Annotations the server declares

    • title: Web page screenshot
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • uk_postcode_lookupLook up any UK postcode and get latitude/longitude, local council, county, ward, parish, parliamentary constituency, region and country, from official ONS data.Reads text others writeNo findings

    Why it is in this group

    • The name "uk_postcode_lookup" says "lookup": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Look up any UK postcode and get latitude/longitude, local council, county, ward, parish, parliamentary constituency, region and country, from official ONS data. Use when you need to place a UK address on a map, work out which council or MP covers it, or check a postcode is real. Spaces optional. Errors: 400 invalid format, 404 postcode not found. Price: $0.001 USDC per call (x402).

    Annotations the server declares

    • title: UK postcode lookup
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • webpage_to_markdownFetch a public web page and return just the main article as clean Markdown, with title, byline and excerpt.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The description's first verb is "fetch": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe name "webpage_to_markdown" says "webpage": it reads web pages, which anyone can write.
    • untrusted-inputThe description's first sentence says "fetch" and "web": it reads web pages, which anyone can write.
    • untrusted-inputThe input takes a URL (input.url), and the tool reads it: it reads web pages, which anyone can write.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.

    Claude Code: ask, because it is tagged outbound.

    Description, as the server wrote it
    Fetch a public web page and return just the main article as clean Markdown, with title, byline and excerpt. Menus, ads and footers are removed. Use when you need to read, summarise or quote a web page cheaply without parsing HTML yourself. Returns JSON {title, byline, siteName, excerpt, markdown}. Errors: 400 bad or private URL, 422 no readable article, 502 site returned an error. Price: $0.003 USDC per call (x402).

    Annotations the server declares

    • title: Web page to clean text
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • website_status_checkCheck whether a website is up right now: HTTP status, response time in ms, full redirect chain, and the SSL certificate's validity, issuer and days until expiry.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "website_status_check" says "status": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe name "website_status_check" says "status" and "website": it reads web pages, which anyone can write.
    • untrusted-inputThe description's first sentence says "website": it reads web pages, which anyone can write.
    • untrusted-inputThe input takes a URL (input.url), and the tool reads it: it reads web pages, which anyone can write.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.

    Claude Code: ask, because it is tagged outbound.

    Description, as the server wrote it
    Check whether a website is up right now: HTTP status, response time in ms, full redirect chain, and the SSL certificate's validity, issuer and days until expiry. Use when monitoring a site, diagnosing a broken link, or warning that a certificate is about to expire. A site that is down still returns 200 with up:false and the error. Errors: 400 bad or private URL. Price: $0.002 USDC per call (x402).

    Annotations the server declares

    • title: Website up and SSL check
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data.

Reads private data0
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write10
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out8
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Looked at Oct 22, 2026, 15:01 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable
yes
HTTP status of an anonymous initialize
200
tools/list served without credentials
yes
Tools that change things, listed without credentials
5
Protocol version
2025-06-18
WWW-Authenticate on 401
not observed
resource_metadata in WWW-Authenticate
none
RFC 9728 protected resource metadata
none
Authorization servers
none
Legacy HTTP+SSE transport
no
Dynamic client registration
not observed
Client ID metadata documents
not observed
  • HighThe whole server

    The endpoint served tools/list without credentials, and the list has 5 tools that change things (1 irreversible, 4 write). Whether a call also works without credentials was not tested: tools are never called.

    Matched text

    https://agent-tools-production-e6aa.up.railway.app/mcp: tools/list returned 10 tools to an anonymous client, including convert_file (irreversible), pdf_tables_to_json (write), html_to_pdf (write), transcribe_audio (write), uk_company_check (write)

    What this check looks for

Install

Pinned to version 1.1.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http agent-tools-uk https://agent-tools-production-e6aa.up.railway.app/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__agent-tools-uk__uk_postcode_lookup"
    ],
    "ask": [
      "mcp__agent-tools-uk__screenshot_webpage",
      "mcp__agent-tools-uk__webpage_to_markdown",
      "mcp__agent-tools-uk__pdf_tables_to_json",
      "mcp__agent-tools-uk__ocr_read_text",
      "mcp__agent-tools-uk__convert_file",
      "mcp__agent-tools-uk__html_to_pdf",
      "mcp__agent-tools-uk__transcribe_audio",
      "mcp__agent-tools-uk__uk_company_check",
      "mcp__agent-tools-uk__website_status_check"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as agent-tools-uk. Review it before you use it.

Capability tags behind 10 rules
  • mcp__agent-tools-uk__screenshot_webpage untrusted-input, outbound
  • mcp__agent-tools-uk__webpage_to_markdown untrusted-input, outbound
  • mcp__agent-tools-uk__pdf_tables_to_json untrusted-input, outbound
  • mcp__agent-tools-uk__ocr_read_text untrusted-input, outbound
  • mcp__agent-tools-uk__convert_file untrusted-input, outbound
  • mcp__agent-tools-uk__html_to_pdf untrusted-input, outbound
  • mcp__agent-tools-uk__transcribe_audio untrusted-input, outbound
  • mcp__agent-tools-uk__uk_postcode_lookup untrusted-input
  • mcp__agent-tools-uk__uk_company_check untrusted-input
  • mcp__agent-tools-uk__website_status_check untrusted-input, outbound