TidyData Tools
by tidydata-dev · remote · no sign-in to list tools · v1.0.0 · published by GitHub user tidydata-dev
Holidays, business days, currency, time zones, DNS/WHOIS, web page checks, geodata and text tools.
49 tools: 5 do something that can't be undone, 36 change things and 8 only read.
Scanned Oct 21, 2026
- Deletes or cancels0Claude Code: deny
- Can't be undone5Claude Code: ask: see these tools
- Changes things36Claude Code: ask: see these tools
- Only reads8Claude Code: allow: see these tools
13 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.
claude mcp add --transport http tidydata https://tidydata-api.tidydata.workers.dev/mcpFindings
Matches of fixed checks, with the text they matched.
The server marks "add_business_days" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":true}; The name "add_business_days" says "add": a word for a change.
- Warnconvert_currency
The server marks "convert_currency" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":true}; The name "convert_currency" says "convert": a word for a change.
The server marks "convert_time_zone" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":true}; The name "convert_time_zone" says "convert": a word for a change.
The server marks "convert_calendar_date" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":true}; The name "convert_calendar_date" says "convert": a word for a change.
- Warnlink_preview
The server marks "link_preview" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":true}; The name "link_preview" says "link": a word for a change.
- Warnextract_links
The server marks "extract_links" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":true}; The name "extract_links" says "link": a word for a change.
Show 7 more findingsShow fewer
- Warncountry_info
The server marks "country_info" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":true}; The input takes a statement or command to run (input.code), which can change anything it can reach.
- Warnairport_info
The server marks "airport_info" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":true}; The input takes a statement or command to run (input.code), which can change anything it can reach.
- Warnairport_distance
The server marks "airport_distance" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":true}; The input addresses people (input.to): what it sends cannot be taken back.
The server marks "distance_between_places" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":true}; The input addresses people (input.to): what it sends cannot be taken back.
The server marks "postal_code_lookup" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":true}; The name "postal_code_lookup" says "lookup": a word for reading.
- Warnconvert_units
The server marks "convert_units" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":true}; The name "convert_units" says "convert": a word for a change.
The server marks "generate_password" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":true}; The name "generate_password" says "generate": a word for a change.
Tools
Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.
49 tools
Can't be undone 5Claude Code: ask
airport_distanceDistance between two airports.Reads text others writeCan send data out1 finding
Why it is in this group
- The input addresses people (input.to): what it sends cannot be taken back.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a destination (input.to): what the tool writes goes there.
Findings
- Warn
The server marks "airport_distance" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":true}; The input addresses people (input.to): what it sends cannot be taken back.
Description, as the server wrote it Distance between two airports. Distance between airports. Airport lookup by IATA or ICAO code, search by name or city, nearest airports to any coordinates and great-circle distance and flight time between two airports. 9,500 airports with coordinates, elevation, country, region and city.
Annotations the server declares
- title: Distance between two airports
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
convert_currencyConvert currency (ECB rates).Reads text others writeCan send data out1 finding
Why it is in this group
- The name "convert_currency" says "convert": a word for a change.
- The input addresses people (input.to): what it sends cannot be taken back.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a destination (input.to): what the tool writes goes there.
Findings
- Warn
The server marks "convert_currency" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":true}; The name "convert_currency" says "convert": a word for a change.
Description, as the server wrote it Convert currency (ECB rates). Convert amount. Daily euro foreign exchange reference rates for 30+ currencies, any base currency, conversion and history of the last 90 days. Source: ECB statistics.
Annotations the server declares
- title: Convert currency (ECB rates)
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
convert_time_zoneTime zone converter / world clock.Reads text others writeCan send data out1 finding
Why it is in this group
- The name "convert_time_zone" says "convert": a word for a change.
- The input addresses people (input.to): what it sends cannot be taken back.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a destination (input.to): what the tool writes goes there.
Findings
- Warn
The server marks "convert_time_zone" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":true}; The name "convert_time_zone" says "convert": a word for a change.
Description, as the server wrote it Time zone converter / world clock. Time in zones. Current time or any date in any IANA time zone, UTC offset, weekday and Unix time, and convert one moment to many time zones at once.
Annotations the server declares
- title: Time zone converter / world clock
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
convert_unitsConvert units of measure.Reads text others writeCan send data out1 finding
Why it is in this group
- The name "convert_units" says "convert": a word for a change.
- The input addresses people (input.to): what it sends cannot be taken back.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a destination (input.to): what the tool writes goes there.
Findings
- Warn
The server marks "convert_units" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":true}; The name "convert_units" says "convert": a word for a change.
Description, as the server wrote it Convert units of measure. Convert units. Convert between 300+ units (length, weight, volume, temperature, speed, data, energy, time..) and evaluate math expressions safely (functions, constants, units, matrices).
Annotations the server declares
- title: Convert units of measure
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
distance_between_placesDistance between two places or coordinates.Reads text others writeCan send data out1 finding
Why it is in this group
- The input addresses people (input.to): what it sends cannot be taken back.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a destination (input.to): what the tool writes goes there.
Findings
- Warn
The server marks "distance_between_places" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":true}; The input addresses people (input.to): what it sends cannot be taken back.
Description, as the server wrote it Distance between two places or coordinates. Distance between two places. Distance between any two places: coordinates, cities ("Paris, FR") or airport codes (MAD, JFK). Ellipsoidal (Vincenty) km, miles and nautical miles, bearing, compass, midpoint, flight time estimate and distance matrices.
Annotations the server declares
- title: Distance between two places or coordinates
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
Changes things 36Claude Code: ask
add_business_daysAdd business days to a date.Reads text others write1 finding
Why it is in this group
- The name "add_business_days" says "add": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Findings
- Warn
The server marks "add_business_days" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":true}; The name "add_business_days" says "add": a word for a change.
Description, as the server wrote it Add business days to a date. Add business days. Count working days between two dates and add/subtract business days, skipping weekends and the public holidays of 100+ countries and regions. Custom weekend days.
Annotations the server declares
- title: Add business days to a date
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
airport_infoAirport by IATA/ICAO code.Reads text others write1 finding
Why it is in this group
- The input takes a statement or command to run (input.code), which can change anything it can reach.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Findings
- Warn
The server marks "airport_info" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":true}; The input takes a statement or command to run (input.code), which can change anything it can reach.
Description, as the server wrote it Airport by IATA/ICAO code. Airport by code. Airport lookup by IATA or ICAO code, search by name or city, nearest airports to any coordinates and great-circle distance and flight time between two airports. 9,500 airports with coordinates, elevation, country, region and city.
Annotations the server declares
- title: Airport by IATA/ICAO code
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
business_days_betweenBusiness days between two dates.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Business days between two dates. Business days between dates. Count working days between two dates and add/subtract business days, skipping weekends and the public holidays of 100+ countries and regions. Custom weekend days.
Annotations the server declares
- title: Business days between two dates
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
convert_calendar_dateConvert a date to Islamic, Hebrew, Chinese… calendars.Reads text others write1 finding
Why it is in this group
- The name "convert_calendar_date" says "convert": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Findings
- Warn
The server marks "convert_calendar_date" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":true}; The name "convert_calendar_date" says "convert": a word for a change.
Description, as the server wrote it Convert a date to Islamic, Hebrew, Chinese… calendars. Gregorian date in all calendars. Convert dates between 13 calendars (Gregorian, Islamic Umm al-Qura and tabular, Hebrew, Persian, Chinese, Korean, Japanese, Buddhist, Indian, Coptic, Ethiopian, Minguo) and get the dates of Islamic, Jewish, Chinese and Persian holidays for any year 1900-2100.
Annotations the server declares
- title: Convert a date to Islamic, Hebrew, Chinese… calendars
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
country_infoCountry data (capital, currency, languages…).Reads text others write1 finding
Why it is in this group
- The input takes a statement or command to run (input.code), which can change anything it can reach.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Findings
- Warn
The server marks "country_info" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":true}; The input takes a statement or command to run (input.code), which can change anything it can reach.
Description, as the server wrote it Country data (capital, currency, languages…). Country by code. All countries with ISO codes, names in any language, native name, capital, continent, calling codes, currencies, languages and emoji flag. Filter by continent, currency, language or search.
Annotations the server declares
- title: Country data (capital, currency, languages…)
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
decode_vinDecode a vehicle VIN.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Decode a vehicle VIN. Decode VIN. Decode any 17-character VIN: make, model, model year, trim, body, engine, fuel, transmission, drive type and plant, plus check digit validation, region and country of manufacture. Always answers, even when the upstream registry is slow.
Annotations the server declares
- title: Decode a vehicle VIN
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
detect_languageLanguage of a text.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Language of a text. Detect language. Detect the language of any text: ISO 639-3 code, English name, confidence, reliability flag and top 5 candidates. Fast, no AI costs, works offline.
Annotations the server declares
- title: Language of a text
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
dictionary_defineEnglish definitions of a word.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it English definitions of a word. Word definitions. English dictionary with 147,000 words: definitions by part of speech, usage examples, synonyms, antonyms, broader terms, IPA and ARPAbet pronunciation, syllable count, rhymes and prefix autocomplete. Inflected forms (running, cities) resolve automatically.
Annotations the server declares
- title: English definitions of a word
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
dns_propagationDNS propagation across global resolvers.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it DNS propagation across global resolvers. Check propagation. Check if a DNS change has propagated: queries Cloudflare, Google, AdGuard, NextDNS, AliDNS and DNS.SB at once and reports agreement, consensus answer and response times.
Annotations the server declares
- title: DNS propagation across global resolvers
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
domain_availabilityIs a domain name available?Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Is a domain name available? Check availability. Check if domain names are available across many extensions in one call, using each registry's official RDAP data (with DNS fallback). Creation and expiry dates, registrar and .com name suggestions.
Annotations the server declares
- title: Is a domain name available?
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
domain_whoisDomain registration info (WHOIS/RDAP).Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Domain registration info (WHOIS/RDAP). Domain info. Is a domain registered? Who is the registrar, when was it created, when does it expire, how old is it, its status and nameservers. Uses the official RDAP registry data (the modern WHOIS). No personal contact data.
Annotations the server declares
- title: Domain registration info (WHOIS/RDAP)
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
exchange_ratesLatest exchange rates.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Latest exchange rates. Latest rates. Daily euro foreign exchange reference rates for 30+ currencies, any base currency, conversion and history of the last 90 days. Source: ECB statistics.
Annotations the server declares
- title: Latest exchange rates
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
expand_short_urlExpand a shortened link.Reads text others writeCan send data outNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
Description, as the server wrote it Expand a shortened link. Expand short URL. Expand short links (bit.ly, t.co, tinyurl and any redirect) to their final destination, with every hop of the redirect chain. Check where a link really goes before clicking it.
Annotations the server declares
- title: Expand a shortened link
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
extract_html_tablesTables of a web page as JSON.Reads text others writeCan send data outNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
Description, as the server wrote it Tables of a web page as JSON. Extract tables. Turn the HTML tables of any web page into clean JSON (rows or objects with headers) or download a table as CSV.
Annotations the server declares
- title: Tables of a web page as JSON
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
extract_keywordsKeywords of a text (58 languages).Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Keywords of a text (58 languages). Extract keywords. Extract the key phrases and most frequent words of any text in 50+ languages (RAKE algorithm with language stopwords). Auto language detection, scores and counts.
Annotations the server declares
- title: Keywords of a text (58 languages)
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
extract_linksLinks found on a web page.Reads text others writeCan send data out1 finding
Why it is in this group
- The name "extract_links" says "link": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
Findings
- Warn
The server marks "extract_links" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":true}; The name "extract_links" says "link": a word for a change.
Description, as the server wrote it Links found on a web page. Extract links. Extract every link of a web page with anchor text, rel, nofollow flag and internal/external classification. Filter by type.
Annotations the server declares
- title: Links found on a web page
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
generate_passwordSecure random passwords.Reads text others write1 finding
Why it is in this group
- The name "generate_password" says "generate": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Findings
- Warn
The server marks "generate_password" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":true}; The name "generate_password" says "generate": a word for a change.
Description, as the server wrote it Secure random passwords. Passwords. Cryptographically secure random passwords (length, symbols, numbers, uppercase, entropy) and UUID v4, in bulk.
Annotations the server declares
- title: Secure random passwords
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
hash_textMD5 / SHA hashes of a text.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it MD5 / SHA hashes of a text. Hash text. Hash any text with MD5, SHA-1, SHA-256, SHA-384, SHA-512 and CRC32 in one call, sign messages with HMAC, and identify which algorithm produced a given hash.
Annotations the server declares
- title: MD5 / SHA hashes of a text
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
is_public_holidayIs this date a public holiday?Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Is this date a public holiday? Is it a holiday? Public and bank holidays for 100+ countries and their states/regions, any year, localized names, plus 'is this date a holiday?' check. Data: date-holidays (CC BY 3.0).
Annotations the server declares
- title: Is this date a public holiday?
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
link_previewTitle, description and image of a web page.Reads text others writeCan send data out1 finding
Why it is in this group
- The name "link_preview" says "link": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
Findings
- Warn
The server marks "link_preview" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":true}; The name "link_preview" says "link": a word for a change.
Description, as the server wrote it Title, description and image of a web page. Link preview. Everything you need to build link previews: title, description, image, favicon, site name, language, canonical URL, author, publish time, Twitter card and optional JSON-LD. Fast HTML streaming parser.
Annotations the server declares
- title: Title, description and image of a web page
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
loan_calculatorLoan / mortgage payments and schedule.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Loan / mortgage payments and schedule. Calculate loan or mortgage. Monthly payment, total interest and full amortization schedule for loans and mortgages. Down payment, extra payments, weekly/biweekly/monthly frequency and yearly summaries.
Annotations the server declares
- title: Loan / mortgage payments and schedule
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
moon_phaseMoon phase and illumination.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Moon phase and illumination. Moon phase and times. Sunrise, sunset, solar noon, day length, civil/nautical/astronomical twilight and golden hour for any coordinates and date, plus moon phase, illumination, moonrise/moonset and next full and new moon. Times are returned in the local time zone, detected automatically from the coordinates.
Annotations the server declares
- title: Moon phase and illumination
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
nutrition_calculateCalories and macros of a list of ingredients.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Calories and macros of a list of ingredients. Recipe / meal totals. Search 7,793 generic foods and get calories, protein, fat, carbohydrates, fiber, sugars, vitamins and minerals (36 nutrients) per 100 g or for any amount, with common portion sizes (cup, slice, piece). Calculate totals for a whole recipe or meal in one request.
Annotations the server declares
- title: Calories and macros of a list of ingredients
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
postal_code_lookupPlace of a postal / ZIP code.Reads text others write1 finding
Why it is in this group
- The name "postal_code_lookup" says "lookup": a word for reading.
- The input takes a statement or command to run (input.code), which can change anything it can reach.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Findings
- Warn
The server marks "postal_code_lookup" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":true}; The name "postal_code_lookup" says "lookup": a word for reading.
Description, as the server wrote it Place of a postal / ZIP code. Look up a postal code. Postal code lookup for 121 countries and 1.8 million codes: place name, region, province, coordinates; distance between two postal codes; and postal code validation. Accepts codes with or without spaces and dashes.
Annotations the server declares
- title: Place of a postal / ZIP code
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
public_holidaysPublic holidays of a country.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Public holidays of a country. Holidays of a year. Public and bank holidays for 100+ countries and their states/regions, any year, localized names, plus 'is this date a holiday?' check. Data: date-holidays (CC BY 3.0).
Annotations the server declares
- title: Public holidays of a country
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
reverse_geocodeNearest city to a latitude/longitude.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Nearest city to a latitude/longitude. Reverse geocode coordinates. Fast city-level geocoding for 171,000 places worldwide: reverse geocoding (coordinates to nearest town, region, country and time zone), place search by name and nearby places within a radius. No rate-limited upstream.
Annotations the server declares
- title: Nearest city to a latitude/longitude
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
rhymesRhymes of an English word.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Rhymes of an English word. Rhyming words. Rhymes, syllable counts and pronunciation for English words, plus syllable counting for whole texts (per word and per line, with haiku detection). Perfect for songwriting, poetry and readability tools.
Annotations the server declares
- title: Rhymes of an English word
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
robots_txt_checkIs a URL allowed by robots.txt?Reads text others writeCan send data outNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
Description, as the server wrote it Is a URL allowed by robots.txt? Check URL. Check whether a URL may be crawled according to the site's robots.txt for any user agent, with the matching rule, sitemaps and crawl-delay.
Annotations the server declares
- title: Is a URL allowed by robots.txt?
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
security_headers_checkSecurity headers grade of a website.Reads text others writeCan send data outNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
Description, as the server wrote it Security headers grade of a website. Check security headers. Check the HTTP security headers of any website (HSTS, CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy..) with a score, a grade and fixes to apply.
Annotations the server declares
- title: Security headers grade of a website
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
seo_auditOn-page SEO audit of a URL.Reads text others writeCan send data outNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
Description, as the server wrote it On-page SEO audit of a URL. Audit page. On-page SEO audit of any URL in one call: score 0-100 and a clear list of issues (title, meta description, H1, canonical, noindex, alt texts, lang, viewport, Open Graph, thin content, speed, HTTPS).
Annotations the server declares
- title: On-page SEO audit of a URL
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
sitemap_urlsURLs listed in a website's sitemap.Reads text others writeCan send data outNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
Description, as the server wrote it URLs listed in a website's sitemap. Extract sitemap URLs. Get all URLs of a website from its sitemaps (found via robots.txt), following sitemap indexes and .gz files, with lastmod, priority and changefreq. Filter by text.
Annotations the server declares
- title: URLs listed in a website's sitemap
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
spell_checkEnglish spell check with suggestions.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it English spell check with suggestions. Check spelling. Fast English spell checker (US and UK): flags misspellings with ranked suggestions, offsets and an auto-corrected text. Drop-in replacement for the retired Bing Spell Check API (format=bing).
Annotations the server declares
- title: English spell check with suggestions
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
sunrise_sunsetSunrise, sunset, twilight and golden hour.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Sunrise, sunset, twilight and golden hour. Sun times. Sunrise, sunset, solar noon, day length, civil/nautical/astronomical twilight and golden hour for any coordinates and date, plus moon phase, illumination, moonrise/moonset and next full and new moon. Times are returned in the local time zone, detected automatically from the coordinates.
Annotations the server declares
- title: Sunrise, sunset, twilight and golden hour
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
synonymsSynonyms of an English word.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Synonyms of an English word. Synonyms and antonyms. English thesaurus: synonyms, antonyms and related words for 147,000 words, ranked and grouped by meaning with part of speech and definitions. Handles inflected forms (running → run).
Annotations the server declares
- title: Synonyms of an English word
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
timezone_by_coordinatesTime zone of a latitude/longitude.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Time zone of a latitude/longitude. Time zone for coordinates. Get the IANA time zone for any latitude/longitude, with the current local time, UTC offset, abbreviation and whether daylight saving time is active. Optionally pass a datetime to get the offset at that moment.
Annotations the server declares
- title: Time zone of a latitude/longitude
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
website_technologiesTechnologies used by a website.Reads text others writeCan send data outNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
Description, as the server wrote it Technologies used by a website. Detect technologies. Detect 130+ technologies a website uses: CMS (WordPress, Shopify, Wix, Webflow), frameworks (React, Next.js, Vue), analytics and pixels, chat, CDN and hosting. Great for lead generation and competitor research.
Annotations the server declares
- title: Technologies used by a website
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
Only reads 8Claude Code: allow, ask for 2 outbound
airport_searchSearch airports by name or city.Reads text others writeNo findings
Why it is in this group
- The name "airport_search" says "search": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Search airports by name or city. Search airports. Airport lookup by IATA or ICAO code, search by name or city, nearest airports to any coordinates and great-circle distance and flight time between two airports. 9,500 airports with coordinates, elevation, country, region and city.
Annotations the server declares
- title: Search airports by name or city
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
check_url_statusHTTP status and redirect chain of a URL.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "check_url_status" says "status": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe name "check_url_status" says "status" and "url": it reads web pages, which anyone can write.
- untrusted-inputThe description's first sentence says "http": it reads web pages, which anyone can write.
- untrusted-inputThe input takes a URL (input.url), and the tool reads it: it reads web pages, which anyone can write.
- outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
Claude Code: ask, because it is tagged outbound.
Description, as the server wrote it HTTP status and redirect chain of a URL. Check URL. HTTP status, full redirect chain (301/302/307/308), final URL, server and response time for any link. Detects loops. POST up to 20 URLs per call. Find broken links fast.
Annotations the server declares
- title: HTTP status and redirect chain of a URL
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
city_searchFind a city (coordinates, population, country).Reads text others writeNo findings
Why it is in this group
- The name "city_search" says "search": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Find a city (coordinates, population, country). Search places by name. Fast city-level geocoding for 171,000 places worldwide: reverse geocoding (coordinates to nearest town, region, country and time zone), place search by name and nearby places within a radius. No rate-limited upstream.
Annotations the server declares
- title: Find a city (coordinates, population, country)
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
dns_lookupDNS records of a domain.Reads text others writeNo findings
Why it is in this group
- The name "dns_lookup" says "lookup": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it DNS records of a domain. DNS records. Look up DNS records of any domain in one call: A, AAAA, MX, NS, TXT, CNAME, SOA, CAA, SRV. Also tells you if the domain has mail servers and its SPF record. Fast, uses public resolvers.
Annotations the server declares
- title: DNS records of a domain
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
ip_lookupOwner, network and country of an IP address.Reads text others writeNo findings
Why it is in this group
- The name "ip_lookup" says "lookup": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Owner, network and country of an IP address. IP info. Who owns an IP address: network name, range, CIDR, organization, country and registration date from the Regional Internet Registries (RDAP). Without 'ip', returns the caller's IP, country, city and ASN.
Annotations the server declares
- title: Owner, network and country of an IP address
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
nutrition_searchNutrition facts of foods (USDA).Reads text others writeNo findings
Why it is in this group
- The name "nutrition_search" says "search": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Nutrition facts of foods (USDA). Search foods. Search 7,793 generic foods and get calories, protein, fat, carbohydrates, fiber, sugars, vitamins and minerals (36 nutrients) per 100 g or for any amount, with common portion sizes (cup, slice, piece). Calculate totals for a whole recipe or meal in one request.
Annotations the server declares
- title: Nutrition facts of foods (USDA)
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
summarizeSummarize a text or web page.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "summarize" says "summarize": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe description's first sentence says "summarize" and "web": it reads web pages, which anyone can write.
- untrusted-inputThe input takes a URL (input.url), and the tool reads it: it reads web pages, which anyone can write.
- outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
Claude Code: ask, because it is tagged outbound.
Description, as the server wrote it Summarize a text or web page. Summarize a text or URL. Summarize any text or article URL in 50+ languages: picks the most important sentences (TextRank), with keywords and reading-time saved. No AI costs and no invented content.
Annotations the server declares
- title: Summarize a text or web page
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
validate_ibanValidate and parse an IBAN.Reads text others writeNo findings
Why it is in this group
- The name "validate_iban" says "validate": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Validate and parse an IBAN. Validate IBAN. Validate any IBAN (checksum, length, country format, national check digits) and split it into bank code, branch code and account number. Formatted and electronic forms, SEPA flag. Offline algorithm, no account lookups.
Annotations the server declares
- title: Validate and parse an IBAN
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Exfil surface
Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.
No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data.
- Reads private data0
- Reads files, mail, messages, databases, secrets, calendars or repositories.
- Reads text others write49
- Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
- Can send data out16
- Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.
Install
Pinned to version 1.0.0. Values in angle brackets are yours to fill in.
claude mcp add --transport http tidydata https://tidydata-api.tidydata.workers.dev/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__tidydata__dns_lookup",
"mcp__tidydata__ip_lookup",
"mcp__tidydata__validate_iban",
"mcp__tidydata__airport_search",
"mcp__tidydata__city_search",
"mcp__tidydata__nutrition_search"
],
"ask": [
"mcp__tidydata__public_holidays",
"mcp__tidydata__is_public_holiday",
"mcp__tidydata__business_days_between",
"mcp__tidydata__add_business_days",
"mcp__tidydata__convert_currency",
"mcp__tidydata__exchange_rates",
"mcp__tidydata__convert_time_zone",
"mcp__tidydata__timezone_by_coordinates",
"mcp__tidydata__sunrise_sunset",
"mcp__tidydata__moon_phase",
"mcp__tidydata__convert_calendar_date",
"mcp__tidydata__dns_propagation",
"mcp__tidydata__domain_whois",
"mcp__tidydata__domain_availability",
"mcp__tidydata__check_url_status",
"mcp__tidydata__expand_short_url",
"mcp__tidydata__link_preview",
"mcp__tidydata__website_technologies",
"mcp__tidydata__seo_audit",
"mcp__tidydata__security_headers_check",
"mcp__tidydata__extract_links",
"mcp__tidydata__extract_html_tables",
"mcp__tidydata__sitemap_urls",
"mcp__tidydata__robots_txt_check",
"mcp__tidydata__country_info",
"mcp__tidydata__airport_info",
"mcp__tidydata__airport_distance",
"mcp__tidydata__reverse_geocode",
"mcp__tidydata__distance_between_places",
"mcp__tidydata__postal_code_lookup",
"mcp__tidydata__nutrition_calculate",
"mcp__tidydata__decode_vin",
"mcp__tidydata__dictionary_define",
"mcp__tidydata__synonyms",
"mcp__tidydata__rhymes",
"mcp__tidydata__spell_check",
"mcp__tidydata__summarize",
"mcp__tidydata__extract_keywords",
"mcp__tidydata__detect_language",
"mcp__tidydata__loan_calculator",
"mcp__tidydata__convert_units",
"mcp__tidydata__hash_text",
"mcp__tidydata__generate_password"
],
"deny": []
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as tidydata. Review it before you use it.
Capability tags behind 49 rules
- mcp__tidydata__public_holidays untrusted-input
- mcp__tidydata__is_public_holiday untrusted-input
- mcp__tidydata__business_days_between untrusted-input
- mcp__tidydata__add_business_days untrusted-input
- mcp__tidydata__convert_currency untrusted-input, outbound
- mcp__tidydata__exchange_rates untrusted-input
- mcp__tidydata__convert_time_zone untrusted-input, outbound
- mcp__tidydata__timezone_by_coordinates untrusted-input
- mcp__tidydata__sunrise_sunset untrusted-input
- mcp__tidydata__moon_phase untrusted-input
- mcp__tidydata__convert_calendar_date untrusted-input
- mcp__tidydata__dns_lookup untrusted-input
- mcp__tidydata__dns_propagation untrusted-input
- mcp__tidydata__domain_whois untrusted-input
- mcp__tidydata__domain_availability untrusted-input
- mcp__tidydata__check_url_status untrusted-input, outbound
- mcp__tidydata__expand_short_url untrusted-input, outbound
- mcp__tidydata__link_preview untrusted-input, outbound
- mcp__tidydata__website_technologies untrusted-input, outbound
- mcp__tidydata__seo_audit untrusted-input, outbound
- mcp__tidydata__security_headers_check untrusted-input, outbound
- mcp__tidydata__extract_links untrusted-input, outbound
- mcp__tidydata__extract_html_tables untrusted-input, outbound
- mcp__tidydata__sitemap_urls untrusted-input, outbound
- mcp__tidydata__robots_txt_check untrusted-input, outbound
- mcp__tidydata__ip_lookup untrusted-input
- mcp__tidydata__validate_iban untrusted-input
- mcp__tidydata__country_info untrusted-input
- mcp__tidydata__airport_info untrusted-input
- mcp__tidydata__airport_search untrusted-input
- mcp__tidydata__airport_distance untrusted-input, outbound
- mcp__tidydata__city_search untrusted-input
- mcp__tidydata__reverse_geocode untrusted-input
- mcp__tidydata__distance_between_places untrusted-input, outbound
- mcp__tidydata__postal_code_lookup untrusted-input
- mcp__tidydata__nutrition_search untrusted-input
- mcp__tidydata__nutrition_calculate untrusted-input
- mcp__tidydata__decode_vin untrusted-input
- mcp__tidydata__dictionary_define untrusted-input
- mcp__tidydata__synonyms untrusted-input
- mcp__tidydata__rhymes untrusted-input
- mcp__tidydata__spell_check untrusted-input
- mcp__tidydata__summarize untrusted-input, outbound
- mcp__tidydata__extract_keywords untrusted-input
- mcp__tidydata__detect_language untrusted-input
- mcp__tidydata__loan_calculator untrusted-input
- mcp__tidydata__convert_units untrusted-input, outbound
- mcp__tidydata__hash_text untrusted-input
- mcp__tidydata__generate_password untrusted-input
