ToolAPI

by toolapi.org · remote · no sign-in to list tools · v2.8.2 · published by org.toolapi

Free public MCP for AI agents — 193 tools, 44 workflows. No API key.

Deletes · 1Final · 2Changes · 1384 high findings

Compare Registry entry

193 tools: 1 can delete or cancel things, 2 do something that can't be undone, 138 change things and 52 only read.

Scanned Oct 21, 2026

Deletes or cancels1Claude Code: deny: see these tools
Can't be undone2Claude Code: ask: see these tools
Changes things138Claude Code: ask: see these tools
Only reads52Claude Code: allow: see these tools

5 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport sse hub https://toolapi.org/sse

Findings

Matches of fixed checks, with the text they matched.

4 high1 info

Highenv_required_check
The description refers to ".env".
Matched text
description: "Check .env text contains required keys (and non-em..."
What this check looks for
Highgitignore_check
The description refers to ".env".
Matched text
description: "....gitignore for common missing ignores (.env, node_modules, keys)."
What this check looks for
Highenv_diff
The description refers to ".env".
Matched text
description: "Diff two .env files — only_in_a / only_in_b / changed..."
What this check looks for
Highenv_parse
The description refers to ".env".
Matched text
description: "Parse .env / dotenv text into key-value variables."
What this check looks for
Infocors_check
The description mentions "credentials".
Matched text
description: "Check CORS Allow-Origin vs credentials for unsafe combinations."
What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

193 tools

Deletes or cancels 1Removes, cancels or revokes something.Claude Code: deny

string_truncateTruncate text with ellipsis.No findings
Why it is in this group
- The name "string_truncate" says "truncate": a word for removing or ending something.
Description, as the server wrote it
Truncate text with ellipsis. When: Truncate long strings with ellipsis for UI/logs.

Can't be undone 2Sends, pays, publishes or merges: once done, it cannot be taken back.Claude Code: ask

json_mergeDeep-merge two JSON objects (second overlays first).No findings
Why it is in this group
- The name "json_merge" says "merge": a word for a change that another call does not undo.
Description, as the server wrote it
Deep-merge two JSON objects (second overlays first).
json_merge_patchApply RFC 7396 JSON Merge Patch (null deletes keys).No findings
Why it is in this group
- The name "json_merge_patch" says "merge": a word for a change that another call does not undo.
Description, as the server wrote it
Apply RFC 7396 JSON Merge Patch (null deletes keys). When: RFC 7396 merge patch — use when patching JSON configs.

Changes things 138Creates or changes something that can be changed back.Claude Code: ask

base64_decodeBase64-decode to UTF-8.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Base64-decode to UTF-8.
base64_encodeBase64-encode UTF-8.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Base64-encode UTF-8.
base64url_decodeBase64url-decode to UTF-8.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Base64url-decode to UTF-8.
base64url_encodeBase64url-encode UTF-8 (no padding, URL-safe).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Base64url-encode UTF-8 (no padding, URL-safe).
bcrypt_hashBcrypt-hash a password for storage.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Bcrypt-hash a password for storage.
bcrypt_verifyVerify password against bcrypt hash.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Verify password against bcrypt hash.
changelog_parseParse Keep-a-Changelog style markdown into version sections.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Parse Keep-a-Changelog style markdown into version sections.
cidr_calcCalculate IPv4/IPv6 network info from CIDR (hosts, broadcast, private).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Calculate IPv4/IPv6 network info from CIDR (hosts, broadcast, private).
cidr_containsCheck if IP address falls within a CIDR range.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Check if IP address falls within a CIDR range.
code_fence_extractExtract fenced code blocks from markdown (language + code).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Extract fenced code blocks from markdown (language + code).
color_contrastWCAG contrast ratio between two hex colors (AA/AAA).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
WCAG contrast ratio between two hex colors (AA/AAA). When: WCAG contrast ratio for UI color pairs.
color_convertConvert color between hex, rgb(), and hsl().No findings
Why it is in this group
- The name "color_convert" says "convert": a word for a change.
Description, as the server wrote it
Convert color between hex, rgb(), and hsl().
content_type_parseParse Content-Type header into mime/charset/params.No findings
Why it is in this group
- The name "content_type_parse" says "type": a word for a change.
Description, as the server wrote it
Parse Content-Type header into mime/charset/params.
conventional_commit_lintLint Conventional Commits message (feat/fix/chore…).No findings
Why it is in this group
- The name "conventional_commit_lint" says "commit": a word for a change.
Description, as the server wrote it
Lint Conventional Commits message (feat/fix/chore…).
cookie_header_parseParse Cookie request header into name/value map.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Parse Cookie request header into name/value map. When: Parse Cookie request headers.
cors_checkCheck CORS Allow-Origin vs credentials for unsafe combinations.1 finding
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Findings
- Info
  The description mentions "credentials".
  Matched text
  description: "Check CORS Allow-Origin vs credentials for unsafe combinations."
  What this check looks for
Description, as the server wrote it
Check CORS Allow-Origin vs credentials for unsafe combinations.
cron_matchesCheck if a cron expression matches a specific datetime (ISO-8601).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Check if a cron expression matches a specific datetime (ISO-8601).
cron_next_runsPreview next N execution times for a 5-field cron expression.No findings
Why it is in this group
- The name "cron_next_runs" says "run": a word for a change.
Description, as the server wrote it
Preview next N execution times for a 5-field cron expression.
cron_parseParse 5-field cron into named fields (minute hour dom month dow).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Parse 5-field cron into named fields (minute hour dom month dow).
csp_parseParse Content-Security-Policy header and flag unsafe directives.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Parse Content-Security-Policy header and flag unsafe directives.
csv_to_jsonConvert CSV text to JSON array of row objects.No findings
Why it is in this group
- The description's first verb is "convert": a word for a change.
Description, as the server wrote it
Convert CSV text to JSON array of row objects. When: Convert CSV rows → JSON array of objects.
currency_convertConvert amount between currencies using latest ECB rates.No findings
Why it is in this group
- The name "currency_convert" says "convert": a word for a change.
Description, as the server wrote it
Convert amount between currencies using latest ECB rates.
currency_ratesLatest exchange rates (Frankfurter ECB data, no API key).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Latest exchange rates (Frankfurter ECB data, no API key).
datetime_parseParse unix timestamp or ISO-8601 into UTC ISO + unix.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Parse unix timestamp or ISO-8601 into UTC ISO + unix.
dependency_versions_extractExtract name@version from requirements/lockfile/go.mod/Cargo snippets.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Extract name@version from requirements/lockfile/go.mod/Cargo snippets. When: Extract name@version from lock/requirements snippets (best-effort).
dockerfile_lintLint Dockerfile for common security/style issues (root user, curl|sh, secrets).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Lint Dockerfile for common security/style issues (root user, curl|sh, secrets).
domain_parseParse domain into labels, TLD, registrable domain, subdomain.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Parse domain into labels, TLD, registrable domain, subdomain. When: Split domain into subdomain/registrable/TLD (best-effort eTLD).
duration_parseParse duration (ISO-8601 PnDTnHnMnS or human 1h30m / 90s) to seconds.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Parse duration (ISO-8601 PnDTnHnMnS or human 1h30m / 90s) to seconds. When: Parse ISO-8601 / human durations to seconds.
env_parseParse .env / dotenv text into key-value variables.1 finding
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Findings
- High
  The description refers to ".env".
  Matched text
  description: "Parse .env / dotenv text into key-value variables."
  What this check looks for
Description, as the server wrote it
Parse .env / dotenv text into key-value variables.
env_required_checkCheck .env text contains required keys (and non-empty values).1 finding
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Findings
- High
  The description refers to ".env".
  Matched text
  description: "Check .env text contains required keys (and non-em..."
  What this check looks for
Description, as the server wrote it
Check .env text contains required keys (and non-empty values).
extract_emailsExtract email addresses from text.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Extract email addresses from text. When: Pull email addresses from free text / logs.
extract_urlsExtract HTTP/HTTPS URLs from arbitrary text.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Extract HTTP/HTTPS URLs from arbitrary text.
frontmatter_parseParse YAML frontmatter from markdown (--- ...No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Parse YAML frontmatter from markdown (--- ... ---). When: Split YAML frontmatter from markdown body.
git_url_parseParse git remote URL (ssh/https) into host/owner/repo.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Parse git remote URL (ssh/https) into host/owner/repo. When: Parse git@ / https remotes into owner/repo.
github_actions_lintLint GitHub Actions workflow YAML (triggers, unpinned actions, curl|bash).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Lint GitHub Actions workflow YAML (triggers, unpinned actions, curl|bash).
gitignore_checkReview .gitignore for common missing ignores (.env, node_modules, keys).1 finding
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Findings
- High
  The description refers to ".env".
  Matched text
  description: "....gitignore for common missing ignores (.env, node_modules, keys)."
  What this check looks for
Description, as the server wrote it
Review .gitignore for common missing ignores (.env, node_modules, keys).
gitignore_matchMatch paths against .gitignore rules (ignore / negate).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Match paths against .gitignore rules (ignore / negate). When: Test paths against .gitignore rules (best-effort).
glob_match_batchMatch paths against glob patterns (gitignore-style fnmatch).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Match paths against glob patterns (gitignore-style fnmatch).
hash_md5MD5 hex digest of UTF-8 text.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
MD5 hex digest of UTF-8 text. When: MD5 digest (non-crypto integrity / legacy checksums).
hash_sha256SHA256 hex digest.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
SHA256 hex digest.
hash_sha512SHA512 hex digest.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
SHA512 hex digest.
hex_decodeHex string to UTF-8 text.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Hex string to UTF-8 text.
hex_encodeUTF-8 text to hex string.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
UTF-8 text to hex string.
hmac_signHMAC sign message (sha1/sha256/sha512); hex or base64 output.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
HMAC sign message (sha1/sha256/sha512); hex or base64 output.
hmac_verifyVerify HMAC signature (hex or base64).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Verify HMAC signature (hex or base64).
hosts_file_parseParse /etc/hosts style file into IP → hostnames entries.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Parse /etc/hosts style file into IP → hostnames entries. When: Parse /etc/hosts style IP→hostname maps.
html_decodeUnescape HTML entities.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Unescape HTML entities.
html_encodeEscape HTML entities.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Escape HTML entities.
html_security_scanScan HTML for XSS-prone patterns (javascript: URLs, inline handlers, eval).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Scan HTML for XSS-prone patterns (javascript: URLs, inline handlers, eval). Note: best-effort / heuristic — not a full language parser.
html_to_markdownConvert HTML to Markdown text.No findings
Why it is in this group
- The description's first verb is "convert": a word for a change.
Description, as the server wrote it
Convert HTML to Markdown text. When: Convert HTML → markdown for docs the agent edits.
http_headers_parseParse raw HTTP request/response header block into map.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Parse raw HTTP request/response header block into map. When: Parse raw HTTP header blocks.
human_bytesFormat bytes to human size, or parse '1.5 GB' to bytes.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Format bytes to human size, or parse '1.5 GB' to bytes. When: Format or parse human byte sizes (1.5 GB).
import_list_analyzeList imports from python/js source and flag duplicates.No findings
Why it is in this group
- The name "import_list_analyze" says "import": a word for a change.
Description, as the server wrote it
List imports from python/js source and flag duplicates. Note: best-effort / heuristic — not a full language parser.
ini_parseParse INI / simple key=value config into sections.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Parse INI / simple key=value config into sections. When: Parse INI/section configs into structured maps.
ip_geolocationGeolocate public IP: country, city, lat/lon, timezone, ISP.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Geolocate public IP: country, city, lat/lon, timezone, ISP.
ip_version_detectDetect IPv4/IPv6 and classify private/loopback/global.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Detect IPv4/IPv6 and classify private/loopback/global. When: Classify IPv4/IPv6 and private/global.
ipv4_private_checkClassify IP as private/loopback/link-local/global (SSRF helper).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Classify IP as private/loopback/link-local/global (SSRF helper).
json_assert_pathsAssert JSONPath expressions against JSON (exists/equals/type) — agent self-check.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Assert JSONPath expressions against JSON (exists/equals/type) — agent self-check.
json_equalDeep-compare two JSON documents and list differing paths.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Deep-compare two JSON documents and list differing paths.
json_flattenFlatten nested JSON to dot-key map.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Flatten nested JSON to dot-key map. When: Flatten nested JSON keys before comparing or exporting.
json_formatPretty-print JSON with indent.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Pretty-print JSON with indent. When: Pretty-print JSON when the agent needs readable output.
json_minifyMinify JSON (remove whitespace).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Minify JSON (remove whitespace). When: Minify JSON for compact payloads or size checks.
json_patch_applyApply RFC 6902 JSON Patch ops (add/remove/replace/test/move/copy).No findings
Why it is in this group
- The name "json_patch_apply" says "patch": a word for a change.
Description, as the server wrote it
Apply RFC 6902 JSON Patch ops (add/remove/replace/test/move/copy). When: Apply RFC 6902 ops (add/remove/replace/test/move/copy).
json_schema_inferInfer a Draft-7 JSON Schema from a sample JSON document (agent favorite).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Infer a Draft-7 JSON Schema from a sample JSON document (agent favorite).
json_sort_keysRecursively sort JSON object keys.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Recursively sort JSON object keys. When: Canonicalize JSON key order for stable diffs/hashes.
json_to_csvConvert JSON array of objects to CSV text.No findings
Why it is in this group
- The description's first verb is "convert": a word for a change.
Description, as the server wrote it
Convert JSON array of objects to CSV text.
json_to_tomlConvert JSON object text to TOML string.No findings
Why it is in this group
- The description's first verb is "convert": a word for a change.
Description, as the server wrote it
Convert JSON object text to TOML string.
json_to_yamlConvert JSON text to YAML string.No findings
Why it is in this group
- The description's first verb is "convert": a word for a change.
Description, as the server wrote it
Convert JSON text to YAML string. When: Convert JSON → YAML for config files agents write.
json_type_summarySummarize JSON value types (counts per type in tree).No findings
Why it is in this group
- The name "json_type_summary" says "type": a word for a change.
Description, as the server wrote it
Summarize JSON value types (counts per type in tree).
jwt_claims_auditDecode JWT header/claims (no verify) and flag alg=none, missing exp, privileged roles.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Decode JWT header/claims (no verify) and flag alg=none, missing exp, privileged roles.
jwt_decodeDecode JWT payload and header (no signature verification).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Decode JWT payload and header (no signature verification).
jwt_signSign JWT payload (HS* with secret, RS* with private_key PEM).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Sign JWT payload (HS* with secret, RS* with private_key PEM).
jwt_verifyVerify JWT signature (HS* with secret, RS* with public_key PEM).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Verify JWT signature (HS* with secret, RS* with public_key PEM).
line_ending_normalizeDetect and normalize line endings to lf/crlf/cr.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Detect and normalize line endings to lf/crlf/cr. When: Detect/normalize CRLF vs LF.
mail_inbox_createCreate disposable receive-only inbox @mail.toolapi.org (24h TTL).No findings
Why it is in this group
- The name "mail_inbox_create" says "create": a word for a change.
Description, as the server wrote it
Create disposable receive-only inbox @mail.toolapi.org (24h TTL). Returns address + secret token.
markdown_link_extractExtract markdown/bare links and flag javascript: URLs.No findings
Why it is in this group
- The name "markdown_link_extract" says "link": a word for a change.
Description, as the server wrote it
Extract markdown/bare links and flag javascript: URLs.
markdown_to_htmlConvert Markdown text to HTML.No findings
Why it is in this group
- The description's first verb is "convert": a word for a change.
Description, as the server wrote it
Convert Markdown text to HTML. When: Render markdown → HTML for previews or emails.
markdown_tocBuild a table of contents from markdown headings.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Build a table of contents from markdown headings. When: Build heading TOC from markdown docs.
nanoid_generateGenerate URL-friendly nanoid (like npm nanoid).No findings
Why it is in this group
- The name "nanoid_generate" says "generate": a word for a change.
Description, as the server wrote it
Generate URL-friendly nanoid (like npm nanoid).
nginx_config_lintLint nginx config snippets (braces, SSLv3, server_tokens, HSTS hints).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Lint nginx config snippets (braces, SSLv3, server_tokens, HSTS hints).
package_manifest_auditAudit package.json or pyproject.toml — license, risky scripts, loose ranges; emit semver_checks for batch.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Audit package.json or pyproject.toml — license, risky scripts, loose ranges; emit semver_checks for batch. Note: best-effort / heuristic — not a full language parser.
password_generateCryptographically secure random password.No findings
Why it is in this group
- The name "password_generate" says "generate": a word for a change.
Description, as the server wrote it
Cryptographically secure random password.
password_strengthOffline password strength heuristic (length/classes/common).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Offline password strength heuristic (length/classes/common). When: Offline password strength heuristic (not a cracker).
path_normalizeNormalize filesystem path (resolve .No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Normalize filesystem path (resolve . and ..) for posix or windows. When: Resolve . and .. in filesystem paths.
path_safety_checkCheck filesystem path for traversal / absolute / sensitive system paths.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Check filesystem path for traversal / absolute / sensitive system paths.
pick_choicePick one item from a list (optional seed for reproducibility).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Pick one item from a list (optional seed for reproducibility).
port_checkTCP port open/closed check with latency ms.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
TCP port open/closed check with latency ms.
properties_parseParse Java .properties key=value file.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Parse Java .properties key=value file. When: Parse Java .properties key=value configs (best-effort).
qr_generateGenerate QR code as SVG (base64 data URI included).No findings
Why it is in this group
- The name "qr_generate" says "generate": a word for a change.
Description, as the server wrote it
Generate QR code as SVG (base64 data URI included).
radix_convertConvert number between bases 2-36 (binary, octal, decimal, hex).No findings
Why it is in this group
- The name "radix_convert" says "convert": a word for a change.
Description, as the server wrote it
Convert number between bases 2-36 (binary, octal, decimal, hex).
random_intRandom integer in inclusive range (optional seed).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Random integer in inclusive range (optional seed).
random_stringRandom string (alphanumeric, hex, base64 charset or custom).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Random string (alphanumeric, hex, base64 charset or custom).
regex_replaceReplace regex matches in text (supports backreferences in replacement).No findings
Why it is in this group
- The name "regex_replace" says "replace": a word for a change.
Description, as the server wrote it
Replace regex matches in text (supports backreferences in replacement).
regex_testTest regex pattern; returns match, groups, span.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Test regex pattern; returns match, groups, span.
remote_matrixRemote desktop tools comparison JSON for AI citation.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Remote desktop tools comparison JSON for AI citation.
requirements_auditAudit Python requirements.txt for unpinned/VCS/deprecated packages.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Audit Python requirements.txt for unpinned/VCS/deprecated packages.
reverse_dnsReverse DNS (PTR) lookup for IP address.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Reverse DNS (PTR) lookup for IP address.
secrets_scanScan text for hardcoded secrets (API keys, tokens, private keys).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Scan text for hardcoded secrets (API keys, tokens, private keys). Returns redacted findings.
semver_incBump a semver version by major/minor/patch.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Bump a semver version by major/minor/patch. When: Bump major/minor/patch when cutting a release.
semver_max_satisfyingPick the highest version that satisfies a semver range (npm-style).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Pick the highest version that satisfies a semver range (npm-style).
semver_parseParse semver string into major, minor, patch, prerelease.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Parse semver string into major, minor, patch, prerelease.
semver_range_intersectsHeuristic check whether two semver ranges share any sample versions (conflict hint).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Heuristic check whether two semver ranges share any sample versions (conflict hint).
semver_satisfiesCheck if version satisfies npm-style range (^ ~ >= <= > <).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Check if version satisfies npm-style range (^ ~ >= <= > <).
semver_satisfies_batchBatch semver range checks for dependency audits (max 50).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Batch semver range checks for dependency audits (max 50).
semver_sortSort a list of semver versions ascending or descending.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Sort a list of semver versions ascending or descending. When: Sort semver lists before picking latest/oldest.
shebang_parseParse #!No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Parse #! shebang line — interpreter and args. When: Parse #! interpreter lines in scripts.
shell_escapeShell-escape a string for posix/powershell/cmd (safe quoting).No findings
Why it is in this group
- The input takes a statement or command to run (input.shell), which can change anything it can reach.
Description, as the server wrote it
Shell-escape a string for posix/powershell/cmd (safe quoting). When: Safely quote strings for posix/powershell/cmd.
sql_danger_scanScan SQL text for dangerous patterns (DROP/TRUNCATE/DELETE without WHERE).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Scan SQL text for dangerous patterns (DROP/TRUNCATE/DELETE without WHERE). Note: best-effort / heuristic — not a full language parser.
sql_formatFormat SQL text (never executed; reindent + keyword case).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Format SQL text (never executed; reindent + keyword case).
sql_tables_extractExtract table names from SQL (FROM/JOIN/INTO/UPDATE/TABLE).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Extract table names from SQL (FROM/JOIN/INTO/UPDATE/TABLE). When: Heuristic extract of SQL table names (best-effort).
template_fillFill {{variable}} placeholders in a template string.No findings
Why it is in this group
- The name "template_fill" says "fill": a word for a change.
Description, as the server wrote it
Fill {{variable}} placeholders in a template string.
text_case_convertConvert case: lower, upper, title, snake, kebab, camel, pascal.No findings
Why it is in this group
- The name "text_case_convert" says "convert": a word for a change.
Description, as the server wrote it
Convert case: lower, upper, title, snake, kebab, camel, pascal.
text_loremGenerate lorem ipsum placeholder paragraphs.No findings
Why it is in this group
- The description's first verb is "generate": a word for a change.
Description, as the server wrote it
Generate lorem ipsum placeholder paragraphs.
text_similaritySequenceMatcher similarity ratio between two texts.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
SequenceMatcher similarity ratio between two texts.
text_slugifyURL-safe slug from title or heading.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
URL-safe slug from title or heading. When: Make URL-safe slugs from titles/filenames.
text_wrapWrap text to a maximum line width.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Wrap text to a maximum line width. When: Hard-wrap text to a column width.
time_convertConvert unix seconds or ISO-8601 to both formats.No findings
Why it is in this group
- The name "time_convert" says "convert": a word for a change.
Description, as the server wrote it
Convert unix seconds or ISO-8601 to both formats.
time_nowCurrent UTC unix timestamp and ISO-8601.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Current UTC unix timestamp and ISO-8601.
timezone_convertConvert datetime between IANA timezones (e.g.No findings
Why it is in this group
- The name "timezone_convert" says "convert": a word for a change.
Description, as the server wrote it
Convert datetime between IANA timezones (e.g. UTC to Asia/Shanghai).
todo_comment_extractExtract TODO/FIXME/HACK/XXX comments with line numbers.No findings
Why it is in this group
- The name "todo_comment_extract" says "comment": a word for a change.
Description, as the server wrote it
Extract TODO/FIXME/HACK/XXX comments with line numbers.
toml_to_jsonParse TOML and return JSON-compatible object.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Parse TOML and return JSON-compatible object.
trailing_whitespace_scanScan text for trailing whitespace and tab characters.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Scan text for trailing whitespace and tab characters. Note: best-effort / heuristic — not a full language parser.
tsconfig_lintLint tsconfig.json structure (compilerOptions, strict hints).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Lint tsconfig.json structure (compilerOptions, strict hints).
unicode_normalizeUnicode normalization (NFC/NFD/NFKC/NFKD).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Unicode normalization (NFC/NFD/NFKC/NFKD).
unit_convertConvert units: length, weight, temperature, data, speed, time.No findings
Why it is in this group
- The name "unit_convert" says "convert": a word for a change.
Description, as the server wrote it
Convert units: length, weight, temperature, data, speed, time.
url_decodeDecode percent-encoded string.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Decode percent-encoded string.
url_encodePercent-encode URL component.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Percent-encode URL component.
url_joinJoin base URL with relative path (urllib urljoin).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Join base URL with relative path (urllib urljoin). When: Join base URL + relative path correctly.
url_normalizeNormalize URL (lowercase host, sort query, drop fragment).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Normalize URL (lowercase host, sort query, drop fragment).
url_parseParse URL into scheme, host, path, query components.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Parse URL into scheme, host, path, query components.
url_ssrf_checkCheck URL for SSRF risk (localhost, private IP, metadata hosts).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Check URL for SSRF risk (localhost, private IP, metadata hosts).
user_agent_parseParse User-Agent string into browser, OS, and device hints.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Parse User-Agent string into browser, OS, and device hints.
uuid_generateGenerate UUID v1/v3/v4/v5 (batch supported).No findings
Why it is in this group
- The name "uuid_generate" says "generate": a word for a change.
Description, as the server wrote it
Generate UUID v1/v3/v4/v5 (batch supported). v3/v5 need name + namespace.
uuid_parseParse UUID string: version, variant, hex bytes.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Parse UUID string: version, variant, hex bytes.
x509_parseParse X.509 certificate PEM: subject, issuer, validity, SAN, fingerprint.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Parse X.509 certificate PEM: subject, issuer, validity, SAN, fingerprint.
xml_formatPretty-print XML with indentation.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Pretty-print XML with indentation. When: Pretty-print XML after the agent edits markup.
xml_to_jsonConvert XML document to JSON (attributes as @attr).No findings
Why it is in this group
- The description's first verb is "convert": a word for a change.
Description, as the server wrote it
Convert XML document to JSON (attributes as @attr). When: Convert XML → JSON for agents that prefer JSON tools.
yaml_to_jsonParse YAML and return JSON-compatible object.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Parse YAML and return JSON-compatible object.

Only reads 52Looks things up and changes nothing.Claude Code: allow

compose_validateValidate docker-compose YAML and flag privileged/host-network/secret env issues.No findings
Why it is in this group
- The name "compose_validate" says "validate": a word for reading.
Description, as the server wrote it
Validate docker-compose YAML and flag privileged/host-network/secret env issues.
cron_describeHuman-readable natural language description of cron expression (EN + ZH).No findings
Why it is in this group
- The name "cron_describe" says "describe": a word for reading.
Description, as the server wrote it
Human-readable natural language description of cron expression (EN + ZH).
cron_semantic_validateValidate cron field syntax and value ranges (minute 0-59, hour 0-23, etc.).No findings
Why it is in this group
- The name "cron_semantic_validate" says "validate": a word for reading.
Description, as the server wrote it
Validate cron field syntax and value ranges (minute 0-59, hour 0-23, etc.).
cron_validateCheck cron string has exactly five fields.No findings
Why it is in this group
- The name "cron_validate" says "validate": a word for reading.
Description, as the server wrote it
Check cron string has exactly five fields.
cron_validate_batchBatch semantic validate of 5-field cron expressions.No findings
Why it is in this group
- The name "cron_validate_batch" says "validate": a word for reading.
Description, as the server wrote it
Batch semantic validate of 5-field cron expressions.
csv_validateValidate CSV structure — consistent column counts / header.No findings
Why it is in this group
- The name "csv_validate" says "validate": a word for reading.
Description, as the server wrote it
Validate CSV structure — consistent column counts / header. When: Check CSV column consistency before import.
currency_listList supported fiat currencies (Frankfurter/ECB, no API key).No findings
Why it is in this group
- The name "currency_list" says "list": a word for reading.
Description, as the server wrote it
List supported fiat currencies (Frankfurter/ECB, no API key).
dns_lookupDNS lookup for domain (A, AAAA, MX, TXT, NS, CNAME, SOA).No findings
Why it is in this group
- The name "dns_lookup" says "lookup": a word for reading.
Description, as the server wrote it
DNS lookup for domain (A, AAAA, MX, TXT, NS, CNAME, SOA).
editorconfig_validateValidate .editorconfig syntax and common keys.No findings
Why it is in this group
- The name "editorconfig_validate" says "validate": a word for reading.
Description, as the server wrote it
Validate .editorconfig syntax and common keys.
email_validateValidate email address format.No findings
Why it is in this group
- The name "email_validate" says "validate": a word for reading.
Description, as the server wrote it
Validate email address format. When: Syntax-check a single email address.
env_diffDiff two .env files — only_in_a / only_in_b / changed values.1 finding
Why it is in this group
- The name "env_diff" says "diff": a word for reading.
Findings
- High
  The description refers to ".env".
  Matched text
  description: "Diff two .env files — only_in_a / only_in_b / changed..."
  What this check looks for
Description, as the server wrote it
Diff two .env files — only_in_a / only_in_b / changed values. When: Diff two .env files for missing/changed keys.
graphql_operations_listList GraphQL query/mutation/subscription names and type defs.No findings
Why it is in this group
- The name "graphql_operations_list" says "list": a word for reading.
Description, as the server wrote it
List GraphQL query/mutation/subscription names and type defs. When: List GraphQL ops/types from a document (best-effort).
graphql_schema_diffDiff two GraphQL schemas for removed types/fields (breaking changes).No findings
Why it is in this group
- The name "graphql_schema_diff" says "diff": a word for reading.
Description, as the server wrote it
Diff two GraphQL schemas for removed types/fields (breaking changes).
graphql_validateValidate GraphQL query or schema SDL syntax (parse only).No findings
Why it is in this group
- The name "graphql_validate" says "validate": a word for reading.
Description, as the server wrote it
Validate GraphQL query or schema SDL syntax (parse only).
hash_compareCompare two hash digests (case-insensitive).No findings
Why it is in this group
- The name "hash_compare" says "compare": a word for reading.
Description, as the server wrote it
Compare two hash digests (case-insensitive).
http_headers_fetchFetch HTTP response headers (HEAD/GET) for URL.No findings
Why it is in this group
- The name "http_headers_fetch" says "fetch": a word for reading.
Description, as the server wrote it
Fetch HTTP response headers (HEAD/GET) for URL.
http_status_classifyClassify HTTP status codes into 2xx/3xx/4xx/5xx buckets.No findings
Why it is in this group
- The name "http_status_classify" says "status": a word for reading.
Description, as the server wrote it
Classify HTTP status codes into 2xx/3xx/4xx/5xx buckets.
http_status_lookupExplain HTTP status code (e.g.No findings
Why it is in this group
- The name "http_status_lookup" says "status": a word for reading.
Description, as the server wrote it
Explain HTTP status code (e.g. 404, 429, 503).
identifier_validateValidate identifier for python/javascript/typescript (keywords + syntax).No findings
Why it is in this group
- The name "identifier_validate" says "validate": a word for reading.
Description, as the server wrote it
Validate identifier for python/javascript/typescript (keywords + syntax).
json_pointer_getGet value by RFC 6901 JSON Pointer (e.g.No findings
Why it is in this group
- The name "json_pointer_get" says "get": a word for reading.
Description, as the server wrote it
Get value by RFC 6901 JSON Pointer (e.g. /user/id). When: Read one field by RFC 6901 pointer without full walk in the agent.
json_pretty_diffUnified diff of two JSON documents (pretty-printed).No findings
Why it is in this group
- The name "json_pretty_diff" says "diff": a word for reading.
Description, as the server wrote it
Unified diff of two JSON documents (pretty-printed).
json_schema_validateValidate JSON data against JSON Schema (Draft 7).No findings
Why it is in this group
- The name "json_schema_validate" says "validate": a word for reading.
Description, as the server wrote it
Validate JSON data against JSON Schema (Draft 7).
json_schema_validate_batchBatch JSON Schema (Draft 7) validation — up to 25 documents (agent favorite).No findings
Why it is in this group
- The name "json_schema_validate_batch" says "validate": a word for reading.
Description, as the server wrote it
Batch JSON Schema (Draft 7) validation — up to 25 documents (agent favorite).
json_validateValidate JSON text; return parsed object or error.No findings
Why it is in this group
- The name "json_validate" says "validate": a word for reading.
Description, as the server wrote it
Validate JSON text; return parsed object or error.
jsonl_validateValidate JSON Lines (NDJSON); optional per-line JSON Schema.No findings
Why it is in this group
- The name "jsonl_validate" says "validate": a word for reading.
Description, as the server wrote it
Validate JSON Lines (NDJSON); optional per-line JSON Schema. When: Validate NDJSON / JSON Lines logs or datasets.
jsonpath_queryQuery JSON with JSONPath expression; returns matching values.No findings
Why it is in this group
- The name "jsonpath_query" says "query": a word for reading.
Description, as the server wrote it
Query JSON with JSONPath expression; returns matching values.
list_uniqueDeduplicate list items preserving order.No findings
Why it is in this group
- The name "list_unique" says "list": a word for reading.
Description, as the server wrote it
Deduplicate list items preserving order.
mail_inbox_listList messages in a temp inbox (requires token from mail_inbox_create).No findings
Why it is in this group
- The name "mail_inbox_list" says "list": a word for reading.
Description, as the server wrote it
List messages in a temp inbox (requires token from mail_inbox_create).
mail_inbox_readRead full message body from temp inbox.No findings
Why it is in this group
- The name "mail_inbox_read" says "read": a word for reading.
Description, as the server wrote it
Read full message body from temp inbox.
mime_lookupLookup MIME type by file extension/path, or extensions by MIME.No findings
Why it is in this group
- The name "mime_lookup" says "lookup": a word for reading.
Description, as the server wrote it
Lookup MIME type by file extension/path, or extensions by MIME. When: Map file extension ↔ MIME type.
openapi_diffCompare two OpenAPI specs and flag breaking vs non-breaking API changes.No findings
Why it is in this group
- The name "openapi_diff" says "diff": a word for reading.
Description, as the server wrote it
Compare two OpenAPI specs and flag breaking vs non-breaking API changes.
openapi_operations_listList OpenAPI path operations (method, path, operationId, tags).No findings
Why it is in this group
- The name "openapi_operations_list" says "list": a word for reading.
Description, as the server wrote it
List OpenAPI path operations (method, path, operationId, tags). When: List OpenAPI operations before validate/diff.
openapi_validateValidate OpenAPI 3.x document (JSON or YAML snippet).No findings
Why it is in this group
- The name "openapi_validate" says "validate": a word for reading.
Description, as the server wrote it
Validate OpenAPI 3.x document (JSON or YAML snippet).
package_scripts_listList scripts from package.json or pyproject.toml (poetry/PEP 621).No findings
Why it is in this group
- The name "package_scripts_list" says "list": a word for reading.
Description, as the server wrote it
List scripts from package.json or pyproject.toml (poetry/PEP 621). When: List npm/poetry/PEP 621 scripts from manifests.
pem_decodeList PEM blocks in text (label, DER size, SHA256 fingerprint).No findings
Why it is in this group
- The description's first verb is "list": a word for reading.
Description, as the server wrote it
List PEM blocks in text (label, DER size, SHA256 fingerprint).
query_string_buildBuild URL query string from params object.No findings
Why it is in this group
- The name "query_string_build" says "query": a word for reading.
Description, as the server wrote it
Build URL query string from params object. When: Build query strings from param objects.
query_string_parseParse URL query string into key/value map (supports multi-values).No findings
Why it is in this group
- The name "query_string_parse" says "query": a word for reading.
Description, as the server wrote it
Parse URL query string into key/value map (supports multi-values). When: Parse URL query strings into maps.
robots_txt_validateValidate robots.txt syntax and User-agent rules.No findings
Why it is in this group
- The name "robots_txt_validate" says "validate": a word for reading.
Description, as the server wrote it
Validate robots.txt syntax and User-agent rules.
semver_compareCompare two semver strings (less / equal / greater).No findings
Why it is in this group
- The name "semver_compare" says "compare": a word for reading.
Description, as the server wrote it
Compare two semver strings (less / equal / greater).
spdx_license_checkValidate SPDX license expression against common license IDs.No findings
Why it is in this group
- The description's first verb is "validate": a word for reading.
Description, as the server wrote it
Validate SPDX license expression against common license IDs.
ssl_cert_fetchFetch live TLS certificate from host:port (expiry, issuer, SAN).No findings
Why it is in this group
- The name "ssl_cert_fetch" says "fetch": a word for reading.
Description, as the server wrote it
Fetch live TLS certificate from host:port (expiry, issuer, SAN).
text_diffUnified line diff between two texts (like git diff).No findings
Why it is in this group
- The name "text_diff" says "diff": a word for reading.
Description, as the server wrote it
Unified line diff between two texts (like git diff).
text_statsCount chars, words, lines, sentences; estimate reading time.No findings
Why it is in this group
- The description's first verb is "count": a word for reading.
Description, as the server wrote it
Count chars, words, lines, sentences; estimate reading time.
timezone_listList common IANA timezone names for conversion.No findings
Why it is in this group
- The name "timezone_list" says "list": a word for reading.
Description, as the server wrote it
List common IANA timezone names for conversion.
toml_schema_validateValidate TOML config against JSON Schema (Draft 7) in one step.No findings
Why it is in this group
- The name "toml_schema_validate" says "validate": a word for reading.
Description, as the server wrote it
Validate TOML config against JSON Schema (Draft 7) in one step.
toml_validateValidate TOML text; return parsed object or error.No findings
Why it is in this group
- The name "toml_validate" says "validate": a word for reading.
Description, as the server wrote it
Validate TOML text; return parsed object or error.
unified_diff_parseParse unified diff — files changed, lines added/removed.No findings
Why it is in this group
- The name "unified_diff_parse" says "diff": a word for reading.
Description, as the server wrote it
Parse unified diff — files changed, lines added/removed.
unit_listList supported units per category for unit_convert.No findings
Why it is in this group
- The name "unit_list" says "list": a word for reading.
Description, as the server wrote it
List supported units per category for unit_convert.
whois_lookupDomain registration lookup via RDAP (registrar, dates, nameservers).No findings
Why it is in this group
- The name "whois_lookup" says "lookup": a word for reading.
Description, as the server wrote it
Domain registration lookup via RDAP (registrar, dates, nameservers).
xml_validateValidate XML markup (well-formed check).No findings
Why it is in this group
- The name "xml_validate" says "validate": a word for reading.
Description, as the server wrote it
Validate XML markup (well-formed check).
yaml_schema_validateParse YAML then validate against JSON Schema (Draft 7).No findings
Why it is in this group
- The name "yaml_schema_validate" says "validate": a word for reading.
Description, as the server wrote it
Parse YAML then validate against JSON Schema (Draft 7).
yaml_validateValidate YAML text; return parsed object or error.No findings
Why it is in this group
- The name "yaml_validate" says "validate": a word for reading.
Description, as the server wrote it
Validate YAML text; return parsed object or error.

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 2.8.2. Values in angle brackets are yours to fill in.

claude mcp add --transport sse hub https://toolapi.org/sse

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__hub__json_validate",
      "mcp__hub__yaml_validate",
      "mcp__hub__xml_validate",
      "mcp__hub__jsonpath_query",
      "mcp__hub__json_pretty_diff",
      "mcp__hub__json_schema_validate",
      "mcp__hub__toml_validate",
      "mcp__hub__toml_schema_validate",
      "mcp__hub__graphql_validate",
      "mcp__hub__openapi_validate",
      "mcp__hub__openapi_diff",
      "mcp__hub__graphql_schema_diff",
      "mcp__hub__compose_validate",
      "mcp__hub__json_schema_validate_batch",
      "mcp__hub__yaml_schema_validate",
      "mcp__hub__json_pointer_get",
      "mcp__hub__jsonl_validate",
      "mcp__hub__csv_validate",
      "mcp__hub__openapi_operations_list",
      "mcp__hub__graphql_operations_list",
      "mcp__hub__timezone_list",
      "mcp__hub__text_diff",
      "mcp__hub__text_stats",
      "mcp__hub__unit_list",
      "mcp__hub__email_validate",
      "mcp__hub__list_unique",
      "mcp__hub__spdx_license_check",
      "mcp__hub__robots_txt_validate",
      "mcp__hub__editorconfig_validate",
      "mcp__hub__unified_diff_parse",
      "mcp__hub__identifier_validate",
      "mcp__hub__env_diff",
      "mcp__hub__package_scripts_list",
      "mcp__hub__hash_compare",
      "mcp__hub__http_status_lookup",
      "mcp__hub__semver_compare",
      "mcp__hub__pem_decode",
      "mcp__hub__dns_lookup",
      "mcp__hub__whois_lookup",
      "mcp__hub__ssl_cert_fetch",
      "mcp__hub__http_headers_fetch",
      "mcp__hub__currency_list",
      "mcp__hub__http_status_classify",
      "mcp__hub__query_string_parse",
      "mcp__hub__query_string_build",
      "mcp__hub__mime_lookup",
      "mcp__hub__cron_validate",
      "mcp__hub__cron_semantic_validate",
      "mcp__hub__cron_describe",
      "mcp__hub__cron_validate_batch",
      "mcp__hub__mail_inbox_list",
      "mcp__hub__mail_inbox_read"
    ],
    "ask": [
      "mcp__hub__json_format",
      "mcp__hub__json_minify",
      "mcp__hub__csv_to_json",
      "mcp__hub__json_to_csv",
      "mcp__hub__yaml_to_json",
      "mcp__hub__json_to_yaml",
      "mcp__hub__xml_format",
      "mcp__hub__json_merge",
      "mcp__hub__json_flatten",
      "mcp__hub__json_sort_keys",
      "mcp__hub__json_type_summary",
      "mcp__hub__toml_to_json",
      "mcp__hub__json_to_toml",
      "mcp__hub__sql_format",
      "mcp__hub__package_manifest_audit",
      "mcp__hub__github_actions_lint",
      "mcp__hub__requirements_audit",
      "mcp__hub__json_assert_paths",
      "mcp__hub__json_equal",
      "mcp__hub__tsconfig_lint",
      "mcp__hub__json_patch_apply",
      "mcp__hub__json_schema_infer",
      "mcp__hub__xml_to_json",
      "mcp__hub__json_merge_patch",
      "mcp__hub__ini_parse",
      "mcp__hub__properties_parse",
      "mcp__hub__time_now",
      "mcp__hub__time_convert",
      "mcp__hub__timezone_convert",
      "mcp__hub__datetime_parse",
      "mcp__hub__duration_parse",
      "mcp__hub__regex_test",
      "mcp__hub__regex_replace",
      "mcp__hub__text_slugify",
      "mcp__hub__text_case_convert",
      "mcp__hub__text_lorem",
      "mcp__hub__color_convert",
      "mcp__hub__unit_convert",
      "mcp__hub__markdown_to_html",
      "mcp__hub__html_to_markdown",
      "mcp__hub__pick_choice",
      "mcp__hub__extract_urls",
      "mcp__hub__extract_emails",
      "mcp__hub__text_wrap",
      "mcp__hub__template_fill",
      "mcp__hub__unicode_normalize",
      "mcp__hub__user_agent_parse",
      "mcp__hub__secrets_scan",
      "mcp__hub__dockerfile_lint",
      "mcp__hub__env_required_check",
      "mcp__hub__path_safety_check",
      "mcp__hub__csp_parse",
      "mcp__hub__cors_check",
      "mcp__hub__markdown_link_extract",
      "mcp__hub__gitignore_check",
      "mcp__hub__nginx_config_lint",
      "mcp__hub__sql_danger_scan",
      "mcp__hub__html_security_scan",
      "mcp__hub__conventional_commit_lint",
      "mcp__hub__changelog_parse",
      "mcp__hub__todo_comment_extract",
      "mcp__hub__code_fence_extract",
      "mcp__hub__glob_match_batch",
      "mcp__hub__text_similarity",
      "mcp__hub__import_list_analyze",
      "mcp__hub__frontmatter_parse",
      "mcp__hub__markdown_toc",
      "mcp__hub__gitignore_match",
      "mcp__hub__shell_escape",
      "mcp__hub__path_normalize",
      "mcp__hub__line_ending_normalize",
      "mcp__hub__shebang_parse",
      "mcp__hub__trailing_whitespace_scan",
      "mcp__hub__sql_tables_extract",
      "mcp__hub__dependency_versions_extract",
      "mcp__hub__color_contrast",
      "mcp__hub__human_bytes",
      "mcp__hub__password_strength",
      "mcp__hub__hosts_file_parse",
      "mcp__hub__hash_md5",
      "mcp__hub__hash_sha256",
      "mcp__hub__hash_sha512",
      "mcp__hub__base64_encode",
      "mcp__hub__base64_decode",
      "mcp__hub__base64url_encode",
      "mcp__hub__base64url_decode",
      "mcp__hub__url_encode",
      "mcp__hub__url_decode",
      "mcp__hub__html_encode",
      "mcp__hub__html_decode",
      "mcp__hub__hex_encode",
      "mcp__hub__hex_decode",
      "mcp__hub__uuid_generate",
      "mcp__hub__uuid_parse",
      "mcp__hub__nanoid_generate",
      "mcp__hub__password_generate",
      "mcp__hub__jwt_decode",
      "mcp__hub__jwt_verify",
      "mcp__hub__jwt_sign",
      "mcp__hub__hmac_sign",
      "mcp__hub__hmac_verify",
      "mcp__hub__bcrypt_hash",
      "mcp__hub__bcrypt_verify",
      "mcp__hub__radix_convert",
      "mcp__hub__qr_generate",
      "mcp__hub__random_int",
      "mcp__hub__random_string",
      "mcp__hub__jwt_claims_audit",
      "mcp__hub__remote_matrix",
      "mcp__hub__url_parse",
      "mcp__hub__semver_parse",
      "mcp__hub__semver_satisfies",
      "mcp__hub__semver_satisfies_batch",
      "mcp__hub__semver_range_intersects",
      "mcp__hub__semver_sort",
      "mcp__hub__semver_max_satisfying",
      "mcp__hub__semver_inc",
      "mcp__hub__cidr_calc",
      "mcp__hub__cidr_contains",
      "mcp__hub__ip_geolocation",
      "mcp__hub__env_parse",
      "mcp__hub__x509_parse",
      "mcp__hub__reverse_dns",
      "mcp__hub__port_check",
      "mcp__hub__currency_rates",
      "mcp__hub__currency_convert",
      "mcp__hub__url_ssrf_check",
      "mcp__hub__ipv4_private_check",
      "mcp__hub__url_normalize",
      "mcp__hub__content_type_parse",
      "mcp__hub__cookie_header_parse",
      "mcp__hub__url_join",
      "mcp__hub__domain_parse",
      "mcp__hub__git_url_parse",
      "mcp__hub__http_headers_parse",
      "mcp__hub__ip_version_detect",
      "mcp__hub__cron_parse",
      "mcp__hub__cron_next_runs",
      "mcp__hub__cron_matches",
      "mcp__hub__mail_inbox_create"
    ],
    "deny": [
      "mcp__hub__string_truncate"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as hub. Review it before you use it.

Keep track

Get told when this server's tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/org.toolapi/hub/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Anlyon alternative

141 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Compare with other servers for the same product.

Source: MCP Registry · repository. Synced Oct 21, 2026, 18:54 UTC.

For agents: Markdown · JSON · report this listing