Connect

8 clients · secrets stay placeholders

JSON (mcpServers)Claude CodeCodexOpenCodeCursorVS CodeGemini CLIGoose

{
  "mcpServers": {
    "cleanor": {
      "type": "http",
      "url": "https://mcp.cleanor.app/mcp"
    }
  }
}

claude mcp add --transport http cleanor https://mcp.cleanor.app/mcp

[mcp_servers.cleanor]
url = "https://mcp.cleanor.app/mcp"

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "cleanor": {
      "type": "remote",
      "url": "https://mcp.cleanor.app/mcp",
      "enabled": true
    }
  }
}

{
  "mcpServers": {
    "cleanor": {
      "type": "http",
      "url": "https://mcp.cleanor.app/mcp"
    }
  },
  "deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=cleanor&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vbWNwLmNsZWFub3IuYXBwL21jcCJ9"
}

{
  "servers": {
    "cleanor": {
      "type": "http",
      "url": "https://mcp.cleanor.app/mcp"
    }
  }
}

{
  "mcpServers": {
    "cleanor": {
      "httpUrl": "https://mcp.cleanor.app/mcp"
    }
  }
}

extensions:
  "cleanor":
    enabled: true
    name: "cleanor"
    type: streamable_http
    uri: "https://mcp.cleanor.app/mcp"
    timeout: 300

Quality 79 / 100good

protocol75 · weight 25

warn
protocol.modernnewest supported version is 2025-06-18; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
n/a
protocol.statelessonly applies to 2026-07-28 servers
pass
protocol.transportstreamable HTTP
n/a
protocol.list_ttlonly applies to 2026-07-28 servers

authorizationn/a · weight 15

n/a
auth.prm, auth.as_metadata, auth.cimdno remote uses OAuth
n/a
auth.secret_in_urlno templated URL

tool hygiene86 · weight 30

pass
tools.descriptionsevery tool has a description
pass
tools.description_lengthdescriptions are concise
pass
tools.schemasevery tool has an object input schema
pass
tools.annotations22 of 22 tools declare readOnlyHint or destructiveHint
fail
tools.directory_hintsno tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: color (destructiveHint); storage_capacity (destructiveHint, idempotentHint); image_format_savings (destructiveHint, idempotentHint); …
pass
tools.token_costabout 3,860 tokens to load every tool
pass
tools.api_dumptools are not a one-to-one API dump

stability100 · weight 15

pass
stability.changesno tool changes in 30 days
pass
stability.rug_pullno tool changed its meaning under the same name

dependencies50 · weight 15

fail
deps.known_vulns3 advisories to act on (malicious, or rated high or critical with a fix available): GHSA-f88m-g3jw-g9cj in [email protected] (direct, fixed in 0.35.0), GHSA-rgj7-g3m4-5g8c in [email protected] (direct, fixed in 0.35.4), GHSA-wq5f-xc86-pv6w in [email protected] (direct, fixed in 0.35.5)
n/a
deps.mcp_sdk_versionthe official MCP SDK is not in the dependency graph
pass
deps.resolvable@cleanor/[email protected] resolved: 31 packages

22 tools, about 3,860 tokens to load them all · tool set a9520b8e3f82 · checked 2026-10-20 02:01 UTC

Tool changes

No tool definition changes recorded. A server's first observation is its baseline; later probes record what changes.

Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.

Trust 89 / 100

provenance85

liveness100

freshness65

hygiene100

+repository +dns-namespace +website +reachable +uptime-99% ~updated-97d-ago

Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.

Dependencies

@cleanor/[email protected] npm30 dependencies, resolved · advisories checked 2026-10-19

advisory	severity	package	fixed in
GHSA-f88m-g3jw-g9cjsharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591	high	`[email protected]`direct	fixed in `0.35.0`
GHSA-rgj7-g3m4-5g8csharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545	high	`[email protected]`direct	fixed in `0.35.4`
GHSA-wq5f-xc86-pv6wsharp : Vulnerability in librsvg dependency CVE-2026-96889	high	`[email protected]`direct	fixed in `0.35.5`

Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0. The graph is what a clean install of this version resolves today; nothing was installed or run. How it is checked.

Endpoints

remote	auth	reachable	uptime 30d	p50	protocol	last ok
`https://mcp.cleanor.app/mcp` streamable-http	none	yes	99%	446 ms	2025-06-18	2026-10-20

package	registry	version	runtime	secrets
`@cleanor/mcp`	npm	0.6.1	–

Tools (22)

`base64`read-only	Encode text to Base64 or decode Base64 back to text (UTF-8 safe). Supports URL-safe alphabet. Use whenever you need to encode/decode data URIs, tokens, or config values instead of guessing the bytes.
`base_convert`read-only	Convert an integer between number bases 2–36 (e.g. hex to binary, decimal to base-36). Arbitrary precision via BigInt, so large values stay exact. Use for radix conversions instead of doing them by hand.
`color`read-only	Convert a color (hex, rgb() or hsl()) and return hex, RGB and HSL representations at once. Use when picking or translating colors for CSS, design tokens or themes.
`color_palette`read-only	Build a harmonious color palette from a base color using color-theory rules (complementary, analogous, triadic, tetradic, or monochromatic). Returns each color as hex and HSL. Use to derive a theme or design tokens from one brand color.
`count`read-only	Accurately count characters (Unicode code points), UTF-16 units, words, lines and UTF-8 bytes in text. LLMs are notoriously bad at counting, so always use this tool for "how many characters/words" questions.
`cron_describe`read-only	Parse a standard 5-field cron expression (minute hour day-of-month month day-of-week) into a plain-English breakdown and the next few run times in UTC. Use to sanity-check a schedule instead of guessing what the fields mean.
`datetime`read-only	Get the current date/time, or convert a given timestamp, into a target IANA timezone with ISO, Unix and human-readable forms. Pass a Unix timestamp (seconds or ms) or an ISO string as input; omit it for "now". LLMs cannot know the real current time, so use this instead of guessing.
`diff`read-only	Compute a line-by-line diff between two texts, marking removed lines with "-", added with "+" and unchanged with two spaces, plus a change count. Use to see exactly what changed instead of comparing by eye. Capped at 1000 lines per side.
`hash`read-only	Compute a cryptographic hash of text (SHA-1, SHA-256, SHA-384 or SHA-512) and return the hex digest. Use for checksums, cache keys, or verifying content. MD5 is intentionally not offered (broken, and unavailable in Web Crypto). LLMs cannot compute these reliably by hand, so always use this tool instead of guessing.
`hmac`read-only	Compute an HMAC (keyed hash) of a message with a secret, using SHA-1/256/384/512, returned as hex or Base64. Use to sign webhook payloads or verify a signature instead of guessing. LLMs cannot compute this by hand.
`image_format_savings`read-only	How much smaller WebP, AVIF or JPEG XL are than JPEG at matched perceptual quality, from Cleanor Labs’ controlled benchmark. Also reports the "HEIC conversion tax" (converting an iPhone HEIC to JPG/PNG makes it bigger). Use to justify a format choice when building a site or app.
`json_format`read-only	Validate JSON and pretty-print or minify it, optionally sorting object keys. Returns a precise parse error (with position) if invalid. Use to check and clean JSON instead of eyeballing it.
`jwt_decode`read-only	Decode a JSON Web Token into its header and payload so you can inspect claims (iss, exp, sub, scopes). The signature is NOT verified and no secret is required or stored. Use to read a token during debugging.
`optimize_image`read-only	Fetch an image from a public URL and re-encode it smaller (WebP/AVIF/JPEG), optionally resizing to a target width. Returns the optimized image plus before/after byte sizes. Use this when an AI-generated or dropped-in asset (hero image, screenshot, illustration) is too large to ship.
`placeholder_image`read-only	Generate a lightweight SVG placeholder image at any size, with an optional label and custom background/text colors. Dependency-free, pastes straight into a page or mockup. Use for wireframes and design stubs instead of hotlinking a placeholder service.
`qr_code`read-only	Encode text or a URL as a QR code and return a crisp, dependency-free SVG you can paste straight into a page, deck or doc.
`regex_test`read-only	Test a JavaScript regular expression against sample text and return whether it matches, plus every match with its captured groups and index. Use to verify a pattern instead of reasoning about it in your head. Input and pattern are length-capped to keep it fast and safe.
`slugify`read-only	Turn a title or phrase into a clean, URL-safe slug (lowercase, hyphenated, accents stripped). Use when generating page paths, filenames or anchor IDs.
`storage_capacity`read-only	How many photos or minutes of video actually fit in a given storage size, corrected for real OS/filesystem overhead. Backed by Cleanor Labs measured per-item sizes. Use for realistic sample copy, dashboards, or "how many photos fit in 128 GB" answers.
`unit_convert`read-only	Convert a value between units of length, mass, data size, time, speed or temperature. Supported units: mm, cm, m, km, in, ft, yd, mi, nmi, mg, g, kg, t, oz, lb, st, bit, byte, kb, kib, mb, mib, gb, gib, tb, tib, ms, s, min, h, day, week, mps, kph, mph, fps, knot, c, f, k. Use for exact conversions instead of approximating.
`url_parse`read-only	Break a URL into its components: scheme, host, port, path, decoded query parameters and fragment. Use to inspect or debug a URL instead of parsing it by eye.
`uuid`read-only	Generate one or more UUIDs. v4 is fully random; v7 is time-sortable (recommended for database keys). LLMs cannot produce cryptographically random or correctly-formatted UUIDs, so always use this tool.

Schemas: list_tools.

Similar MCP servers

Official server.json

{
  "name": "app.cleanor/cleanor",
  "_meta": {
    "io.modelcontextprotocol.registry/publisher-provided": {
      "io.cleanor": {
        "auth": "none",
        "tools": [
          "optimize_image",
          "storage_capacity",
          "image_format_savings",
          "qr_code",
          "hash",
          "uuid",
          "base64",
          "json_format",
          "jwt_decode",
          "color",
          "slugify",
          "count",
          "regex_test",
          "cron_describe",
          "unit_convert",
          "datetime",
          "url_parse",
          "base_convert",
          "diff",
          "hmac",
          "placeholder_image",
          "color_palette"
        ],
        "endpoint": "https://mcp.cleanor.app/mcp"
      }
    }
  },
  "title": "Cleanor",
  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
  "remotes": [
    {
      "url": "https://mcp.cleanor.app/mcp",
      "type": "streamable-http"
    }
  ],
  "version": "0.6.1",
  "packages": [
    {
      "version": "0.6.1",
      "transport": {
        "type": "stdio"
      },
      "identifier": "@cleanor/mcp",
      "registryType": "npm"
    }
  ],
  "repository": {
    "url": "https://github.com/cleanor-app/cleanor-mcp",
    "source": "github"
  },
  "websiteUrl": "https://mcp.cleanor.app",
  "description": "Zero-auth MCP: image optimize, cited storage/format data, and dev utilities LLMs get wrong."
}