Burs-IA Tools

io.github.soyeladice-svg/bursia-toolssoyeladice-svgstreamable-httpv0.2.1Scanned 39 minutes ago

Free read-only tools for agents: agent-readiness audit, TLS/DNS/header checks, MCP search, utils.

46 tools: 2 do something that can't be undone, 33 change things and 11 only read.

Reads private data · 1
Reads text others write · 14
Can send data out · 16
11 findings, 1 high

Anlyon alternative

35 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

46 tools

Can't be undone 2Sends, pays, publishes or merges: once done, it cannot be taken back.Claude Code: ask

bursia_case_convertConvert text to camelCase, snake_case, kebab-case, PascalCase, UPPER or lower.Can send data out1 finding
Why it is in this group
- The name "bursia_case_convert" says "convert": a word for a change.
- The input addresses people (input.to): what it sends cannot be taken back.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- outboundThe input takes a destination (input.to): what the tool writes goes there.
Findings
- Warn
  The server marks "bursia_case_convert" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
  Matched text
  annotations: {"readOnlyHint":true,"openWorldHint":false}; The name "bursia_case_convert" says "convert": a word for a change.
  What this check looks for
Description, as the server wrote it
Convert text to camelCase, snake_case, kebab-case, PascalCase, UPPER or lower. Pure computation, free.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
bursia_unit_convertConvert units of length, mass, volume, data size or temperature (c, f, k).Can send data out1 finding
Why it is in this group
- The name "bursia_unit_convert" says "convert": a word for a change.
- The input addresses people (input.to): what it sends cannot be taken back.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- outboundThe input takes a destination (input.to): what the tool writes goes there.
Findings
- Warn
  The server marks "bursia_unit_convert" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
  Matched text
  annotations: {"readOnlyHint":true,"openWorldHint":false}; The name "bursia_unit_convert" says "convert": a word for a change.
  What this check looks for
Description, as the server wrote it
Convert units of length, mass, volume, data size or temperature (c, f, k). Pure computation, free.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false

Changes things 33Creates or changes something that can be changed back.Claude Code: ask

bursia_agent_readinessAudit how ready a public website is for AI agents: checks agent card (A2A), llms.txt, MCP discovery, OpenAPI, robots.txt, agents.json, skills, x402 and sitemap.Reads text others writeCan send data outNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
Description, as the server wrote it
Audit how ready a public website is for AI agents: checks agent card (A2A), llms.txt, MCP discovery, OpenAPI, robots.txt, agents.json, skills, x402 and sitemap. Returns a 0-100 score, per-check notes and an evidence hash. Read-only, free, not a security certification.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: true
bursia_base64Encode text to base64 or decode base64 to text.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Encode text to base64 or decode base64 to text. Pure computation, free.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
bursia_check_agent_cardCheck one agent-readiness item on a public website: Ficha de agente A2A (/.well-known/agent-card.json or /.well-known/agent.json).Reads text others writeCan send data outNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
Description, as the server wrote it
Check one agent-readiness item on a public website: Ficha de agente A2A (/.well-known/agent-card.json or /.well-known/agent.json). Read-only, free.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: true
bursia_check_agents_jsonCheck one agent-readiness item on a public website: Directorio de agentes (agents.json) (/.well-known/agents.json or /.well-known/agent-directory.json).Reads text others writeCan send data outNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
Description, as the server wrote it
Check one agent-readiness item on a public website: Directorio de agentes (agents.json) (/.well-known/agents.json or /.well-known/agent-directory.json). Read-only, free.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: true
bursia_check_llms_txtCheck one agent-readiness item on a public website: llms.txt (/llms.txt).Reads text others writeCan send data outNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
Description, as the server wrote it
Check one agent-readiness item on a public website: llms.txt (/llms.txt). Read-only, free.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: true
bursia_check_mcp_discoveryCheck one agent-readiness item on a public website: Descubrimiento MCP (/.well-known/mcp.json or /.well-known/mcp/server-card.json or /mcp.json).Reads text others writeCan send data out1 finding
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
Findings
- High
  The description refers to "/.well-known/mcp.json".
  Matched text
  description: "...n a public website: Descubrimiento MCP (/.well-known/mcp.json or /.well-known/mcp/server-card.json or..."
  What this check looks for
Description, as the server wrote it
Check one agent-readiness item on a public website: Descubrimiento MCP (/.well-known/mcp.json or /.well-known/mcp/server-card.json or /mcp.json). Read-only, free.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: true
bursia_check_openapiCheck one agent-readiness item on a public website: OpenAPI (/openapi.json or /.well-known/openapi.json).Reads text others writeCan send data outNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
Description, as the server wrote it
Check one agent-readiness item on a public website: OpenAPI (/openapi.json or /.well-known/openapi.json). Read-only, free.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: true
bursia_check_robotsCheck one agent-readiness item on a public website: robots.txt para agentes (/robots.txt).Reads text others writeCan send data outNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
Description, as the server wrote it
Check one agent-readiness item on a public website: robots.txt para agentes (/robots.txt). Read-only, free.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: true
bursia_check_sitemapCheck one agent-readiness item on a public website: sitemap.xml (/sitemap.xml).Reads text others writeCan send data outNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
Description, as the server wrote it
Check one agent-readiness item on a public website: sitemap.xml (/sitemap.xml). Read-only, free.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: true
bursia_check_skillsCheck one agent-readiness item on a public website: Habilidades (SKILL.md) (/.well-known/skills/index.json or /.well-known/agent-skills/index.json).Reads text others writeCan send data outNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
Description, as the server wrote it
Check one agent-readiness item on a public website: Habilidades (SKILL.md) (/.well-known/skills/index.json or /.well-known/agent-skills/index.json). Read-only, free.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: true
bursia_check_x402Check one agent-readiness item on a public website: Pagos x402 (/.well-known/x402 or /.well-known/x402.json).Reads text others writeCan send data outNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
Description, as the server wrote it
Check one agent-readiness item on a public website: Pagos x402 (/.well-known/x402 or /.well-known/x402.json). Read-only, free.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: true
bursia_cidr_infoNetwork, broadcast, first/last host and size of an IPv4 CIDR block.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Network, broadcast, first/last host and size of an IPv4 CIDR block. Pure computation, free.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
bursia_color_convertConvert a hex color to RGB and HSL, with relative luminance.1 finding
Why it is in this group
- The name "bursia_color_convert" says "convert": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
  The server marks "bursia_color_convert" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
  Matched text
  annotations: {"readOnlyHint":true,"openWorldHint":false}; The name "bursia_color_convert" says "convert": a word for a change.
  What this check looks for
Description, as the server wrote it
Convert a hex color to RGB and HSL, with relative luminance. Pure computation, free.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
bursia_contrast_ratioWCAG contrast ratio between two hex colors, with AA/AAA pass flags.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
WCAG contrast ratio between two hex colors, with AA/AAA pass flags. Pure computation, free.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
bursia_csv_to_jsonConvert CSV (first row = headers) into JSON rows.1 finding
Why it is in this group
- The description's first verb is "convert": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
  The server marks "bursia_csv_to_json" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
  Matched text
  annotations: {"readOnlyHint":true,"openWorldHint":false}; The description's first verb is "convert": a word for a change.
  What this check looks for
Description, as the server wrote it
Convert CSV (first row = headers) into JSON rows. Max 5,000 rows. Pure computation, free.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
bursia_dns_recordsLook up public DNS records (A, AAAA, MX, TXT, NS, CAA) of a domain.Reads text others writeCan send data outNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
Description, as the server wrote it
Look up public DNS records (A, AAAA, MX, TXT, NS, CAA) of a domain. Free.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: true
bursia_email_syntaxCheck the syntax of an email address (no mailbox lookup, nothing is sent).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Check the syntax of an email address (no mailbox lookup, nothing is sent). Pure computation, free.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
bursia_hashHash a text with sha256, sha1, sha512 or md5 (hex).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Hash a text with sha256, sha1, sha512 or md5 (hex). Pure computation, free.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
bursia_hmacCompute an HMAC (sha256 or sha512, hex) of a message with a key.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Compute an HMAC (sha256 or sha512, hex) of a message with a key. Use test keys only; nothing is stored or logged. Pure computation, free.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
bursia_html_escapeEscape or unescape HTML special characters.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Escape or unescape HTML special characters. Pure computation, free.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
bursia_ip_classifyClassify an IP address: version and whether it is public, private, loopback, link-local or reserved.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Classify an IP address: version and whether it is public, private, loopback, link-local or reserved. Pure computation, free.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
bursia_json_formatPretty-print or minify JSON.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Pretty-print or minify JSON. Pure computation, free.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
bursia_json_to_csvConvert a JSON array of objects into CSV.1 finding
Why it is in this group
- The description's first verb is "convert": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
  The server marks "bursia_json_to_csv" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
  Matched text
  annotations: {"readOnlyHint":true,"openWorldHint":false}; The description's first verb is "convert": a word for a change.
  What this check looks for
Description, as the server wrote it
Convert a JSON array of objects into CSV. Pure computation, free.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
bursia_jwt_decodeDecode a JWT header and payload WITHOUT verifying its signature.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Decode a JWT header and payload WITHOUT verifying its signature. Do not paste live secrets. Pure computation, free.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
bursia_levenshteinEdit distance and similarity between two texts (max 2,000 chars each).1 finding
Why it is in this group
- The description's first verb is "edit": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
  The server marks "bursia_levenshtein" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
  Matched text
  annotations: {"readOnlyHint":true,"openWorldHint":false}; The description's first verb is "edit": a word for a change.
  What this check looks for
Description, as the server wrote it
Edit distance and similarity between two texts (max 2,000 chars each). Pure computation, free.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
bursia_password_generateGenerate a random password (8-128 chars) using a cryptographic generator.1 finding
Why it is in this group
- The name "bursia_password_generate" says "generate": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
  The server marks "bursia_password_generate" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
  Matched text
  annotations: {"readOnlyHint":true,"openWorldHint":false}; The name "bursia_password_generate" says "generate": a word for a change.
  What this check looks for
Description, as the server wrote it
Generate a random password (8-128 chars) using a cryptographic generator. Nothing is stored. Pure computation, free.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
bursia_security_headersAudit HTTP security headers of a public HTTPS page (HSTS, CSP, X-Content-Type-Options, frame protection, Referrer-Policy, Permissions-Policy).Reads text others writeCan send data outNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
Description, as the server wrote it
Audit HTTP security headers of a public HTTPS page (HSTS, CSP, X-Content-Type-Options, frame protection, Referrer-Policy, Permissions-Policy). Read-only GET, no redirects followed. Free.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: true
bursia_slugifyTurn a text into a URL-safe slug.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Turn a text into a URL-safe slug. Pure computation, free.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
bursia_timestamp_convertConvert between Unix seconds/milliseconds and ISO 8601 dates.1 finding
Why it is in this group
- The name "bursia_timestamp_convert" says "convert": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
  The server marks "bursia_timestamp_convert" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
  Matched text
  annotations: {"readOnlyHint":true,"openWorldHint":false}; The name "bursia_timestamp_convert" says "convert": a word for a change.
  What this check looks for
Description, as the server wrote it
Convert between Unix seconds/milliseconds and ISO 8601 dates. Pure computation, free.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
bursia_timezone_convertShow a date/time in another IANA time zone (e.g.1 finding
Why it is in this group
- The name "bursia_timezone_convert" says "convert": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
  The server marks "bursia_timezone_convert" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
  Matched text
  annotations: {"readOnlyHint":true,"openWorldHint":false}; The name "bursia_timezone_convert" says "convert": a word for a change.
  What this check looks for
Description, as the server wrote it
Show a date/time in another IANA time zone (e.g. America/Bogota). Pure computation, free.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
bursia_url_encodePercent-encode or decode a text for URLs.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Percent-encode or decode a text for URLs. Pure computation, free.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
bursia_url_parseSplit a URL into its parts and query parameters.Can send data outNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
Description, as the server wrote it
Split a URL into its parts and query parameters. Pure computation, free.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
bursia_uuidGenerate one or more random UUID v4 values.1 finding
Why it is in this group
- The description's first verb is "generate": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
  The server marks "bursia_uuid" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
  Matched text
  annotations: {"readOnlyHint":true,"openWorldHint":false}; The description's first verb is "generate": a word for a change.
  What this check looks for
Description, as the server wrote it
Generate one or more random UUID v4 values. Pure computation, free.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false

Only reads 11Looks things up and changes nothing.Show 11 read-only tools

bursia_cron_explainExplain a 5-field cron expression in plain English and list the next 5 run times (UTC).No findings
Why it is in this group
- The name "bursia_cron_explain" says "explain": a word for reading.
Description, as the server wrote it
Explain a 5-field cron expression in plain English and list the next 5 run times (UTC). Pure computation, free.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
bursia_date_diffDifference between two dates in days, hours and minutes.No findings
Why it is in this group
- The name "bursia_date_diff" says "diff": a word for reading.
Description, as the server wrote it
Difference between two dates in days, hours and minutes. Pure computation, free.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
bursia_iban_validateValidate an IBAN checksum and report its country.No findings
Why it is in this group
- The name "bursia_iban_validate" says "validate": a word for reading.
Description, as the server wrote it
Validate an IBAN checksum and report its country. Pure computation, free.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
bursia_json_diffCompare two JSON documents and list added, removed and changed paths (max 500).Reads private dataNo findings
Why it is in this group
- The name "bursia_json_diff" says "diff": a word for reading.
What it can reach
- private-dataThe description's first sentence says "compare" and "document": it reads documents.
Description, as the server wrote it
Compare two JSON documents and list added, removed and changed paths (max 500). Pure computation, free.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
bursia_json_pathRead a value from JSON by a dot path like "a.b[0].c".No findings
Why it is in this group
- The description's first verb is "read": a word for reading.
Description, as the server wrote it
Read a value from JSON by a dot path like "a.b[0].c". Pure computation, free.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
bursia_json_validateCheck whether a text is valid JSON; returns the error position or the top-level type and size.No findings
Why it is in this group
- The name "bursia_json_validate" says "validate": a word for reading.
Description, as the server wrote it
Check whether a text is valid JSON; returns the error position or the top-level type and size. Pure computation, free.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
bursia_luhn_checkValidate a number with the Luhn checksum (cards, IMEI).No findings
Why it is in this group
- The description's first verb is "validate": a word for reading.
Description, as the server wrote it
Validate a number with the Luhn checksum (cards, IMEI). Do not send real card numbers. Pure computation, free.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
bursia_mcp_registry_searchSearch the official MCP Registry (registry.modelcontextprotocol.io) for servers matching a text.Reads text others writeNo findings
Why it is in this group
- The name "bursia_mcp_registry_search" says "search": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Search the official MCP Registry (registry.modelcontextprotocol.io) for servers matching a text. Returns names, descriptions and remote URLs. Free.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: true
bursia_semver_compareCompare two semantic versions (returns -1, 0 or 1).No findings
Why it is in this group
- The name "bursia_semver_compare" says "compare": a word for reading.
Description, as the server wrote it
Compare two semantic versions (returns -1, 0 or 1). Pure computation, free.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
bursia_text_statsCount characters, words, lines and estimate tokens (~4 chars/token) of a text.No findings
Why it is in this group
- The description's first verb is "count": a word for reading.
Description, as the server wrote it
Count characters, words, lines and estimate tokens (~4 chars/token) of a text. Pure computation, free.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
bursia_tls_certificateRead the TLS certificate of a public HTTPS host: issuer, subject, validity dates, days left, SANs and protocol.Reads text others writeCan send data outNo findings
Why it is in this group
- The description's first verb is "read": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe description's first sentence says "read" and "http": it reads web pages, which anyone can write.
- untrusted-inputThe input takes a URL (input.url), and the tool reads it: it reads web pages, which anyone can write.
- outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
Claude Code: ask, because it is tagged outbound.
Description, as the server wrote it
Read the TLS certificate of a public HTTPS host: issuer, subject, validity dates, days left, SANs and protocol. Connects to the verified public IP only. Free.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

224 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 1 private-data tool breaks every one.

Reads private data1: Reads files, mail, messages, databases, secrets, calendars or repositories.; bursia_json_diff
Reads text others write14: Brings in text someone else can write: web pages, inbound email, messages, issues and comments.; bursia_agent_readiness
bursia_check_agent_card
bursia_check_agents_json
bursia_check_llms_txt
bursia_check_mcp_discovery
bursia_check_openapi
bursia_check_robots
bursia_check_sitemap
bursia_check_skills
bursia_check_x402
bursia_dns_records
bursia_mcp_registry_search
and 2 more
Can send data out16: Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.; bursia_agent_readiness
bursia_case_convert
bursia_check_agent_card
bursia_check_agents_json
bursia_check_llms_txt
bursia_check_mcp_discovery
bursia_check_openapi
bursia_check_robots
bursia_check_sitemap
bursia_check_skills
bursia_check_x402
bursia_dns_records
and 4 more

deny to break every path

{
  "permissions": {
    "deny": [
      "mcp__bursia-tools__bursia_json_diff"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

1 high10 warn

Highbursia_check_mcp_discovery
The description refers to "/.well-known/mcp.json".
Matched text
description: "...n a public website: Descubrimiento MCP (/.well-known/mcp.json or /.well-known/mcp/server-card.json or..."
What this check looks for
Warnbursia_uuid
The server marks "bursia_uuid" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
Matched text
annotations: {"readOnlyHint":true,"openWorldHint":false}; The description's first verb is "generate": a word for a change.
What this check looks for
Warnbursia_timestamp_convert
The server marks "bursia_timestamp_convert" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
Matched text
annotations: {"readOnlyHint":true,"openWorldHint":false}; The name "bursia_timestamp_convert" says "convert": a word for a change.
What this check looks for
Warnbursia_csv_to_json
The server marks "bursia_csv_to_json" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
Matched text
annotations: {"readOnlyHint":true,"openWorldHint":false}; The description's first verb is "convert": a word for a change.
What this check looks for
Warnbursia_json_to_csv
The server marks "bursia_json_to_csv" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
Matched text
annotations: {"readOnlyHint":true,"openWorldHint":false}; The description's first verb is "convert": a word for a change.
What this check looks for
Warnbursia_case_convert
The server marks "bursia_case_convert" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
Matched text
annotations: {"readOnlyHint":true,"openWorldHint":false}; The name "bursia_case_convert" says "convert": a word for a change.
What this check looks for

Show 5 more findings

Warnbursia_color_convert
The server marks "bursia_color_convert" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
Matched text
annotations: {"readOnlyHint":true,"openWorldHint":false}; The name "bursia_color_convert" says "convert": a word for a change.
What this check looks for
Warnbursia_unit_convert
The server marks "bursia_unit_convert" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
Matched text
annotations: {"readOnlyHint":true,"openWorldHint":false}; The name "bursia_unit_convert" says "convert": a word for a change.
What this check looks for
Warnbursia_timezone_convert
The server marks "bursia_timezone_convert" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
Matched text
annotations: {"readOnlyHint":true,"openWorldHint":false}; The name "bursia_timezone_convert" says "convert": a word for a change.
What this check looks for
Warnbursia_password_generate
The server marks "bursia_password_generate" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
Matched text
annotations: {"readOnlyHint":true,"openWorldHint":false}; The name "bursia_password_generate" says "generate": a word for a change.
What this check looks for
Warnbursia_levenshtein
The server marks "bursia_levenshtein" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
Matched text
annotations: {"readOnlyHint":true,"openWorldHint":false}; The description's first verb is "edit": a word for a change.
What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 0.2.1. Values in angle brackets are yours to fill in.

claude mcp add --transport http bursia-tools https://bursia-tools-production.up.railway.app/mcp

claude mcp add --transport http bursia-tools https://bursia-tools-production.up.railway.app/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__bursia-tools__bursia_json_validate",
      "mcp__bursia-tools__bursia_cron_explain",
      "mcp__bursia-tools__bursia_text_stats",
      "mcp__bursia-tools__bursia_json_diff",
      "mcp__bursia-tools__bursia_json_path",
      "mcp__bursia-tools__bursia_semver_compare",
      "mcp__bursia-tools__bursia_luhn_check",
      "mcp__bursia-tools__bursia_iban_validate",
      "mcp__bursia-tools__bursia_date_diff",
      "mcp__bursia-tools__bursia_mcp_registry_search"
    ],
    "ask": [
      "mcp__bursia-tools__bursia_agent_readiness",
      "mcp__bursia-tools__bursia_check_agent_card",
      "mcp__bursia-tools__bursia_check_llms_txt",
      "mcp__bursia-tools__bursia_check_mcp_discovery",
      "mcp__bursia-tools__bursia_check_openapi",
      "mcp__bursia-tools__bursia_check_robots",
      "mcp__bursia-tools__bursia_check_agents_json",
      "mcp__bursia-tools__bursia_check_skills",
      "mcp__bursia-tools__bursia_check_x402",
      "mcp__bursia-tools__bursia_check_sitemap",
      "mcp__bursia-tools__bursia_jwt_decode",
      "mcp__bursia-tools__bursia_hash",
      "mcp__bursia-tools__bursia_base64",
      "mcp__bursia-tools__bursia_url_parse",
      "mcp__bursia-tools__bursia_uuid",
      "mcp__bursia-tools__bursia_timestamp_convert",
      "mcp__bursia-tools__bursia_slugify",
      "mcp__bursia-tools__bursia_json_format",
      "mcp__bursia-tools__bursia_csv_to_json",
      "mcp__bursia-tools__bursia_json_to_csv",
      "mcp__bursia-tools__bursia_url_encode",
      "mcp__bursia-tools__bursia_html_escape",
      "mcp__bursia-tools__bursia_case_convert",
      "mcp__bursia-tools__bursia_ip_classify",
      "mcp__bursia-tools__bursia_cidr_info",
      "mcp__bursia-tools__bursia_email_syntax",
      "mcp__bursia-tools__bursia_color_convert",
      "mcp__bursia-tools__bursia_contrast_ratio",
      "mcp__bursia-tools__bursia_unit_convert",
      "mcp__bursia-tools__bursia_timezone_convert",
      "mcp__bursia-tools__bursia_password_generate",
      "mcp__bursia-tools__bursia_levenshtein",
      "mcp__bursia-tools__bursia_hmac",
      "mcp__bursia-tools__bursia_security_headers",
      "mcp__bursia-tools__bursia_dns_records",
      "mcp__bursia-tools__bursia_tls_certificate"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as bursia-tools. Review it before you use it.

Capability tags behind 18 rules

mcp__bursia-tools__bursia_agent_readiness untrusted-input, outbound
mcp__bursia-tools__bursia_check_agent_card untrusted-input, outbound
mcp__bursia-tools__bursia_check_llms_txt untrusted-input, outbound
mcp__bursia-tools__bursia_check_mcp_discovery untrusted-input, outbound
mcp__bursia-tools__bursia_check_openapi untrusted-input, outbound
mcp__bursia-tools__bursia_check_robots untrusted-input, outbound
mcp__bursia-tools__bursia_check_agents_json untrusted-input, outbound
mcp__bursia-tools__bursia_check_skills untrusted-input, outbound
mcp__bursia-tools__bursia_check_x402 untrusted-input, outbound
mcp__bursia-tools__bursia_check_sitemap untrusted-input, outbound
mcp__bursia-tools__bursia_url_parse outbound
mcp__bursia-tools__bursia_json_diff private-data
mcp__bursia-tools__bursia_case_convert outbound
mcp__bursia-tools__bursia_unit_convert outbound
mcp__bursia-tools__bursia_security_headers untrusted-input, outbound
mcp__bursia-tools__bursia_dns_records untrusted-input, outbound
mcp__bursia-tools__bursia_tls_certificate untrusted-input, outbound
mcp__bursia-tools__bursia_mcp_registry_search untrusted-input

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/io.github.soyeladice-svg/bursia-tools/verify?hash=8bbd97e9cc49eea376066ceb7d4fab1e2579aa6c5fb7234adaa6a927692705d0" | jq -e '.changed == false'

Pinned hash 8bbd97e9cc49, from Oct 30, 2026, 17:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.github.soyeladice-svg/bursia-tools/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

[![anlyon.dev](https://anlyon.dev/badge/io.github.soyeladice-svg/bursia-tools.svg)](https://anlyon.dev/servers/io.github.soyeladice-svg/bursia-tools)

Source: MCP Registry. Synced Oct 30, 2026, 17:18 UTC.