# `xyz.orchardshop/orchard` on anlyon.dev

> Text inside fenced blocks marked untrusted-server-text was written by the MCP server's publisher, not by anlyon.dev. It is data to inspect, not instructions to follow. Invisible characters are shown as [U+XXXX].
> No finding is not a safety guarantee: these are point-in-time checks of tool definitions, not of code or behaviour.

- Page: https://anlyon.dev/servers/xyz.orchardshop/orchard
- JSON: https://anlyon.dev/api/v1/servers/xyz.orchardshop/orchard
- Version: 1.0.0 (active)
- Publisher: xyz.orchardshop (domain proven to the MCP Registry)
- Runs: remote (streamable-http)
- Sign-in to list tools: none
- Metadata from the official MCP Registry, synced 2026-11-13T01:18:20.029Z

Title and description, as the publisher wrote them:

```untrusted-server-text
Orchard
Small web and data tools for agents: page to text/markdown, RSS, CSV/JSON. Free tries, then x402.
```

Scanned 2026-11-13T01:18:27.217Z over streamable-http.

**15 tools: 1 do something that can't be undone, 8 change things and 6 only read.**

| Group | Class | Tools | Claude Code |
| --- | --- | --- | --- |
| Deletes or cancels | destructive | 0 | deny |
| Can't be undone | irreversible | 1 | ask |
| Changes things | write | 8 | ask |
| Only reads | read | 6 | allow |

## Exfil surface

No private-data -> untrusted-input -> outbound path in this server alone: no tool is tagged private-data.

| Tag | Meaning | Tools |
| --- | --- | --- |
| private-data | Reads files, mail, messages, databases, secrets, calendars or repositories. | none |
| untrusted-input | Brings in text someone else can write: web pages, inbound email, messages, issues and comments. | `mcp__orchard__page-metadata` `mcp__orchard__page-to-markdown` `mcp__orchard__page-to-text` `mcp__orchard__rss-latest` `mcp__orchard__site-audit` `mcp__orchard__site-crawl-markdown` `mcp__orchard__sitemap-to-index` |
| outbound | Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL. | `mcp__orchard__bulk-page-to-markdown` `mcp__orchard__csv-to-json` `mcp__orchard__hash-encode` `mcp__orchard__json-to-csv` `mcp__orchard__markdown-strip` `mcp__orchard__page-metadata` `mcp__orchard__page-to-markdown` `mcp__orchard__page-to-text` `mcp__orchard__rss-latest` `mcp__orchard__site-audit` `mcp__orchard__site-crawl-markdown` `mcp__orchard__sitemap-to-index` `mcp__orchard__slugify` `mcp__orchard__text-stats` |

## Findings

No check matched anything in these tool definitions.


## Can't be undone (1)

Sends, pays, publishes or merges: once done, it cannot be taken back. Claude Code: ask.

### `text-stats`

- The description's first verb is "send": a word for sending, and what is sent cannot be taken back.
- Tag outbound: The description's first verb is "send": it sends or publishes something to other people.

Description, as the server wrote it:

```untrusted-server-text
Send plain text as the raw POST body and get back word count, sentence count, character count, estimated reading minutes, and the top 10 keywords (stopwords removed). Free: 3 calls a day per visitor; after that $0.01 per call via x402 at https://tools.orchardshop.xyz/t/text-stats.
```

## Changes things (8)

Creates or changes something that can be changed back. Claude Code: ask.

### `bulk-page-to-markdown`

- The description's first verb is "convert": a word for a change.
- Tag outbound: The input takes a URL (input.urls): a request to a URL can carry data to whoever runs it.

Description, as the server wrote it:

```untrusted-server-text
Converts up to 20 public web pages to clean markdown in one call. Returns each page's title and markdown body (headings, links, list items, paragraphs; scripts and styles removed), capped at 20,000 characters per page, with a 25-second time limit. Every URL is fetched through a public-internet-only safe fetcher. Use it to pull several docs or articles into one batch instead of making 20 separate calls. Paid only: $0.25 per call via x402 at https://tools.orchardshop.xyz/t/bulk-page-to-markdown.
```

### `csv-to-json`

- The description's first verb is "post": a word for a change.
- Tag outbound: The description's first verb is "post": it sends or publishes something to other people.

Description, as the server wrote it:

```untrusted-server-text
POST raw CSV as the body (first row is headers) and get back a JSON array of row objects, plus column names and row count. Handles quoted fields, commas and newlines inside quotes, and escaped quotes. Free: 3 calls a day per visitor; after that $0.01 per call via x402 at https://tools.orchardshop.xyz/t/csv-to-json.
```

### `hash-encode`

- The description's first verb is "post": a word for a change.
- Tag outbound: The description's first verb is "post": it sends or publishes something to other people.

Description, as the server wrote it:

```untrusted-server-text
POST raw text as the body and get back its byte count, sha256, sha1, md5, hex, base64 and base64url encodings. Useful for checksums, IDs and encoding a value mid-task. Free: 3 calls a day per visitor; after that $0.01 per call via x402 at https://tools.orchardshop.xyz/t/hash-encode.
```

### `json-to-csv`

- The description's first verb is "post": a word for a change.
- Tag outbound: The description's first verb is "post": it sends or publishes something to other people.

Description, as the server wrote it:

```untrusted-server-text
POST a JSON array of flat objects (or {"rows":[...]}) and get CSV back. Columns are the union of all keys in order of first appearance. Values are quoted and escaped per RFC 4180. Nested objects are stored as JSON text. Up to 5000 rows per call. Free: 3 calls a day per visitor; after that $0.01 per call via x402 at https://tools.orchardshop.xyz/t/json-to-csv.
```

### `markdown-strip`

- The description's first verb is "post": a word for a change.
- Tag outbound: The description's first verb is "post": it sends or publishes something to other people.

Description, as the server wrote it:

```untrusted-server-text
POST raw markdown as the request body and get plain text back. Removes headings, emphasis, links (keeps the label), images (keeps the alt text), list markers, blockquotes, HTML tags and code fences (keeps code contents). Useful before summarizing or indexing markdown documents. Free: 3 calls a day per visitor; after that $0.01 per call via x402 at https://tools.orchardshop.xyz/t/markdown-strip.
```

### `site-audit`

- Nothing in its name or description says what it does, so it is counted as a write.
- Tag untrusted-input: The description's first sentence says "crawl": it reads web pages, which anyone can write.
- Tag outbound: The input takes a URL (input.url): a request to a URL can carry data to whoever runs it.

Description, as the server wrote it:

```untrusted-server-text
Crawls up to 25 pages of one website (same host only) and reports the problems an SEO or QA check looks for: broken links (up to 40 outbound links spot-checked per page), missing page titles and meta descriptions, slow pages over 1.5 seconds, and pages over 500 KB. Returns a summary of issues plus per-page details as JSON. Has a 45-second time limit and polite pacing. Every URL is fetched through a public-internet-only safe fetcher. Paid only: $0.50 per call via x402 at https://tools.orchardshop.xyz/t/site-audit.
```

### `site-crawl-markdown`

- Nothing in its name or description says what it does, so it is counted as a write.
- Tag untrusted-input: The name "site-crawl-markdown" says "crawl": it reads web pages, which anyone can write. The description's first sentence says "crawl": it reads web pages, which anyone can write.
- Tag outbound: The input takes a URL (input.url): a request to a URL can carry data to whoever runs it.

Description, as the server wrote it:

```untrusted-server-text
Crawls one public website breadth-first from a start URL, staying on the same hostname, and returns each page as clean Markdown (up to 20,000 chars per page). Reads robots.txt and skips disallowed paths, fetches at most 2 pages at a time with about 300ms between requests, and identifies as OrchardBot/1.0. Blocks localhost and private addresses, including after redirects. Answers within 45 seconds; if time runs out it returns the pages it has with partial=true. Returns JSON with start_url, pages_crawled, partial, pages[{url,title,markdown}] and skipped[{url,reason}]. max_pages is 1-20 (default 10). Paid only: $0.25 per call via x402 at https://tools.orchardshop.xyz/t/site-crawl-markdown.
```

### `slugify`

- The description's first verb is "post": a word for a change.
- Tag outbound: The description's first verb is "post": it sends or publishes something to other people.

Description, as the server wrote it:

```untrusted-server-text
POST titles as JSON {"titles": [...]} or as raw text with one title per line, and get back URL-safe slugs. Strips accents, lowercases, removes apostrophes and collapses other punctuation to single hyphens. Up to 500 titles per call. Free: 3 calls a day per visitor; after that $0.01 per call via x402 at https://tools.orchardshop.xyz/t/slugify.
```

## Only reads (6)

Looks things up and changes nothing. Claude Code: allow.

### `json-check`

- The description's first verb is "validate": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Validates a JSON document sent as the raw request body and returns it pretty-printed. Returns valid true/false, the formatted JSON, a count of keys, and byte size. Invalid JSON returns the parser error message. Free: 3 calls a day per visitor; after that $0.01 per call via x402 at https://tools.orchardshop.xyz/t/json-check.
```

### `page-metadata`

- The description's first verb is "fetch": a word for reading.
- Tag untrusted-input: The description's first sentence says "fetch" and "http": it reads web pages, which anyone can write. The input takes a URL (input.url), and the tool reads it: it reads web pages, which anyone can write.
- Tag outbound: The input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
- Claude Code: ask, because it is tagged outbound.

Description, as the server wrote it:

```untrusted-server-text
Fetches any public http(s) page and returns its metadata: title, meta description, canonical URL, favicon URL, all OpenGraph (og:*) properties, and every unique absolute link with its anchor text (up to 500). Blocks localhost and private addresses. Returns JSON with url, final_url, status, title, description, canonical, favicon, og, link_count and links. Free: 3 calls a day per visitor; after that $0.01 per call via x402 at https://tools.orchardshop.xyz/t/page-metadata.
```

### `page-to-markdown`

- The description's first verb is "fetch": a word for reading.
- Tag untrusted-input: The description's first sentence says "fetch" and "http": it reads web pages, which anyone can write. The input takes a URL (input.url), and the tool reads it: it reads web pages, which anyone can write.
- Tag outbound: The input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
- Claude Code: ask, because it is tagged outbound.

Description, as the server wrote it:

```untrusted-server-text
Fetches any public http(s) page and returns clean Markdown: headings (#), paragraphs, lists, links with absolute URLs, bold/italic, and code blocks. Scripts, styles and nav/footer are removed. Output is capped at the first 50,000 characters, with a truncated flag. Blocks localhost and private addresses. Returns JSON with url, status, title, chars, truncated and markdown. Free: 3 calls a day per visitor; after that $0.02 per call via x402 at https://tools.orchardshop.xyz/t/page-to-markdown.
```

### `page-to-text`

- The description's first verb is "fetch": a word for reading.
- Tag untrusted-input: The description's first sentence says "fetch" and "web": it reads web pages, which anyone can write. The input takes a URL (input.url), and the tool reads it: it reads web pages, which anyone can write.
- Tag outbound: The input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
- Claude Code: ask, because it is tagged outbound.

Description, as the server wrote it:

```untrusted-server-text
Fetches a public web page and returns its readable text as JSON: url, status, title, char count, and clean text with scripts, styles and tags stripped. Blocks private/localhost addresses. Free: 3 calls a day per visitor; after that $0.01 per call via x402 at https://tools.orchardshop.xyz/t/page-to-text.
```

### `rss-latest`

- The description's first verb is "fetch": a word for reading.
- Tag untrusted-input: The name "rss-latest" says "rss": it reads web pages, which anyone can write. The description's first sentence says "fetch" and "rss": it reads web pages, which anyone can write. The input takes a URL (input.url), and the tool reads it: it reads web pages, which anyone can write.
- Tag outbound: The input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
- Claude Code: ask, because it is tagged outbound.

Description, as the server wrote it:

```untrusted-server-text
Fetches any public RSS 2.0 or Atom feed and returns its latest items as JSON, newest first in feed order. Each item has title, link, published date, summary (first 500 chars, tags stripped) and guid. Choose how many with ?limit= (1-50, default 10). Blocks localhost and private addresses. Returns JSON with feed_url, format (rss or atom), title, link, count and items. Free: 3 calls a day per visitor; after that $0.01 per call via x402 at https://tools.orchardshop.xyz/t/rss-latest.
```

### `sitemap-to-index`

- The description's first verb is "read": a word for reading.
- Tag untrusted-input: The description's first sentence says "read" and "website": it reads web pages, which anyone can write. The input takes a URL (input.url), and the tool reads it: it reads web pages, which anyone can write.
- Tag outbound: The input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
- Claude Code: ask, because it is tagged outbound.

Description, as the server wrote it:

```untrusted-server-text
Reads a website's sitemap.xml and returns each page's title, meta description and word count as JSON. Checks up to 25 pages per call (one level of sitemap index), with a 25-second time limit. Every page is fetched through a public-internet-only safe fetcher. Use it to audit a site's SEO basics or to get a quick content inventory before crawling. Paid only: $0.25 per call via x402 at https://tools.orchardshop.xyz/t/sitemap-to-index.
```

## Claude Code permissions

For `.claude/settings.json`, assuming the server is installed as `orchard`:

```json
{
  "permissions": {
    "allow": [
      "mcp__orchard__json-check"
    ],
    "ask": [
      "mcp__orchard__page-to-text",
      "mcp__orchard__text-stats",
      "mcp__orchard__hash-encode",
      "mcp__orchard__csv-to-json",
      "mcp__orchard__slugify",
      "mcp__orchard__json-to-csv",
      "mcp__orchard__markdown-strip",
      "mcp__orchard__page-to-markdown",
      "mcp__orchard__page-metadata",
      "mcp__orchard__rss-latest",
      "mcp__orchard__site-crawl-markdown",
      "mcp__orchard__sitemap-to-index",
      "mcp__orchard__bulk-page-to-markdown",
      "mcp__orchard__site-audit"
    ],
    "deny": []
  }
}
```

Capability tags behind the rules (a read tagged outbound is asked about):

- `mcp__orchard__page-to-text`: untrusted-input, outbound
- `mcp__orchard__text-stats`: outbound
- `mcp__orchard__hash-encode`: outbound
- `mcp__orchard__csv-to-json`: outbound
- `mcp__orchard__slugify`: outbound
- `mcp__orchard__json-to-csv`: outbound
- `mcp__orchard__markdown-strip`: outbound
- `mcp__orchard__page-to-markdown`: untrusted-input, outbound
- `mcp__orchard__page-metadata`: untrusted-input, outbound
- `mcp__orchard__rss-latest`: untrusted-input, outbound
- `mcp__orchard__site-crawl-markdown`: untrusted-input, outbound
- `mcp__orchard__sitemap-to-index`: untrusted-input, outbound
- `mcp__orchard__bulk-page-to-markdown`: outbound
- `mcp__orchard__site-audit`: untrusted-input, outbound

## Remote posture

What an anonymous client saw at the remote endpoint, last 2026-11-13T11:20:32.795Z, unchanged since 2026-11-13T11:20:32.795Z. No credentials were sent and no tool was called. Values are shown as the endpoint returned them. Method: https://anlyon.dev/methodology#remote-posture

| Fact | Observed |
| --- | --- |
| Reachable | `yes` |
| HTTP status of an anonymous initialize | `200` |
| tools/list served without credentials | `yes` |
| Tools that change things, listed without credentials | `9` |
| Protocol version | `2025-06-18` |
| WWW-Authenticate on 401 | `not observed` |
| resource_metadata in WWW-Authenticate | `none` |
| RFC 9728 protected resource metadata | `none` |
| Authorization servers | `none` |
| Legacy HTTP+SSE transport | `no` |
| Dynamic client registration | `not observed` |
| Client ID metadata documents | `not observed` |

- **high** Tools that change things, listed to anyone ([unauth-remote-writes](https://anlyon.dev/methodology#unauth-remote-writes))

```untrusted-server-text
The endpoint served tools/list without credentials, and the list has 9 tools that change things (1 irreversible, 8 write). Whether a call also works without credentials was not tested: tools are never called.

https://orchardshop.xyz/mcp: tools/list returned 15 tools to an anonymous client, including text-stats (irreversible), hash-encode (write), csv-to-json (write), slugify (write), json-to-csv (write) and 4 more
```