# Cleanor

> Zero-auth MCP: image optimize, cited storage/format data, and dev utilities LLMs get wrong.

- name: app.cleanor/cleanor
- version: 0.6.1
- connection class: R0 (autonomous)
- trust: 89/100
- quality: 79/100 (good)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/app.cleanor%2Fcleanor
- tools: https://api.protogrid.dev/v1/servers/app.cleanor%2Fcleanor/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "cleanor": {
      "type": "http",
      "url": "https://mcp.cleanor.app/mcp"
    }
  }
}
```


## Trust

- hygiene: 100
- liveness: 100
- freshness: 65
- provenance: 85
- drivers: +repository +dns-namespace +website +reachable +uptime-99% ~updated-98d-ago
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 79/100 (good)

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2025-06-18; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 86 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 22 of 22 tools declare readOnlyHint or destructiveHint
- fail `tools.directory_hints`: no tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: storage_capacity (destructiveHint, idempotentHint); hash (destructiveHint); datetime (destructiveHint); …
- pass `tools.token_cost`: about 3,860 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 100 (weight 15)

- pass `stability.changes`: no tool changes in 30 days
- pass `stability.rug_pull`: no tool changed its meaning under the same name

### dependencies: 50 (weight 15)

- fail `deps.known_vulns`: 3 advisories to act on (malicious, or rated high or critical with a fix available): GHSA-f88m-g3jw-g9cj in sharp@0.34.5 (direct, fixed in 0.35.0), GHSA-rgj7-g3m4-5g8c in sharp@0.34.5 (direct, fixed in 0.35.4), GHSA-wq5f-xc86-pv6w in sharp@0.34.5 (direct, fixed in 0.35.5)
- n/a `deps.mcp_sdk_version`: the official MCP SDK is not in the dependency graph
- pass `deps.resolvable`: @cleanor/mcp@0.6.1 resolved: 31 packages

- tools: 22, about 3,860 tokens to load them all
- tool set hash: a9520b8e3f826088b8323f61d8667826
- badge: [![protogrid quality](https://protogrid.dev/badge/app.cleanor/cleanor.svg)](https://protogrid.dev/servers/app.cleanor/cleanor)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

_No tool definition changes recorded._

## Dependencies

- npm @cleanor/mcp@0.6.1: resolved, 30 dependencies
  - GHSA-f88m-g3jw-g9cj (high) in `` sharp@0.34.5 ``, direct, fixed in `` 0.35.0 ``, advisory summary: "sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591" https://osv.dev/vulnerability/GHSA-f88m-g3jw-g9cj
  - GHSA-rgj7-g3m4-5g8c (high) in `` sharp@0.34.5 ``, direct, fixed in `` 0.35.4 ``, advisory summary: "sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545" https://osv.dev/vulnerability/GHSA-rgj7-g3m4-5g8c
  - GHSA-wq5f-xc86-pv6w (high) in `` sharp@0.34.5 ``, direct, fixed in `` 0.35.5 ``, advisory summary: "sharp : Vulnerability in librsvg dependency CVE-2026-96889" https://osv.dev/vulnerability/GHSA-wq5f-xc86-pv6w

Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0.

## Remotes

- https://mcp.cleanor.app/mcp (streamable-http, auth none, reachable true, uptime30d 0.99159664)

## Packages

- npm @cleanor/mcp@0.6.1

## Tools (22)

- `base64`: Encode text to Base64 or decode Base64 back to text (UTF-8 safe). Supports URL-safe alphabet. Use whenever you need to encode/decode data URIs, tokens, or config values instead of guessing the bytes.
- `base_convert`: Convert an integer between number bases 2–36 (e.g. hex to binary, decimal to base-36). Arbitrary precision via BigInt, so large values stay exact. Use for radix conversions instead of doing them by hand.
- `color`: Convert a color (hex, rgb() or hsl()) and return hex, RGB and HSL representations at once. Use when picking or translating colors for CSS, design tokens or themes.
- `color_palette`: Build a harmonious color palette from a base color using color-theory rules (complementary, analogous, triadic, tetradic, or monochromatic). Returns each color as hex and HSL. Use to derive a theme or design tokens from one brand color.
- `count`: Accurately count characters (Unicode code points), UTF-16 units, words, lines and UTF-8 bytes in text. LLMs are notoriously bad at counting, so always use this tool for "how many characters/words" questions.
- `cron_describe`: Parse a standard 5-field cron expression (minute hour day-of-month month day-of-week) into a plain-English breakdown and the next few run times in UTC. Use to sanity-check a schedule instead of guessing what the fields mean.
- `datetime`: Get the current date/time, or convert a given timestamp, into a target IANA timezone with ISO, Unix and human-readable forms. Pass a Unix timestamp (seconds or ms) or an ISO string as input; omit it for "now". LLMs cannot know the real current time, so use this instead of guessing.
- `diff`: Compute a line-by-line diff between two texts, marking removed lines with "-", added with "+" and unchanged with two spaces, plus a change count. Use to see exactly what changed instead of comparing by eye. Capped at 1000 lines per side.
- `hash`: Compute a cryptographic hash of text (SHA-1, SHA-256, SHA-384 or SHA-512) and return the hex digest. Use for checksums, cache keys, or verifying content. MD5 is intentionally not offered (broken, and unavailable in Web Crypto). LLMs cannot compute these reliably by hand, so always use this tool instead of guessing.
- `hmac`: Compute an HMAC (keyed hash) of a message with a secret, using SHA-1/256/384/512, returned as hex or Base64. Use to sign webhook payloads or verify a signature instead of guessing. LLMs cannot compute this by hand.
- `image_format_savings`: How much smaller WebP, AVIF or JPEG XL are than JPEG at matched perceptual quality, from Cleanor Labs’ controlled benchmark. Also reports the "HEIC conversion tax" (converting an iPhone HEIC to JPG/PNG makes it bigger). Use to justify a format choice when building a site or app.
- `json_format`: Validate JSON and pretty-print or minify it, optionally sorting object keys. Returns a precise parse error (with position) if invalid. Use to check and clean JSON instead of eyeballing it.
- `jwt_decode`: Decode a JSON Web Token into its header and payload so you can inspect claims (iss, exp, sub, scopes). The signature is NOT verified and no secret is required or stored. Use to read a token during debugging.
- `optimize_image`: Fetch an image from a public URL and re-encode it smaller (WebP/AVIF/JPEG), optionally resizing to a target width. Returns the optimized image plus before/after byte sizes. Use this when an AI-generated or dropped-in asset (hero image, screenshot, illustration) is too large to ship.
- `placeholder_image`: Generate a lightweight SVG placeholder image at any size, with an optional label and custom background/text colors. Dependency-free, pastes straight into a page or mockup. Use for wireframes and design stubs instead of hotlinking a placeholder service.
- `qr_code`: Encode text or a URL as a QR code and return a crisp, dependency-free SVG you can paste straight into a page, deck or doc.
- `regex_test`: Test a JavaScript regular expression against sample text and return whether it matches, plus every match with its captured groups and index. Use to verify a pattern instead of reasoning about it in your head. Input and pattern are length-capped to keep it fast and safe.
- `slugify`: Turn a title or phrase into a clean, URL-safe slug (lowercase, hyphenated, accents stripped). Use when generating page paths, filenames or anchor IDs.
- `storage_capacity`: How many photos or minutes of video actually fit in a given storage size, corrected for real OS/filesystem overhead. Backed by Cleanor Labs measured per-item sizes. Use for realistic sample copy, dashboards, or "how many photos fit in 128 GB" answers.
- `unit_convert`: Convert a value between units of length, mass, data size, time, speed or temperature. Supported units: mm, cm, m, km, in, ft, yd, mi, nmi, mg, g, kg, t, oz, lb, st, bit, byte, kb, kib, mb, mib, gb, gib, tb, tib, ms, s, min, h, day, week, mps, kph, mph, fps, knot, c, f, k. Use for exact conversions instead of approximating.
- `url_parse`: Break a URL into its components: scheme, host, port, path, decoded query parameters and fragment. Use to inspect or debug a URL instead of parsing it by eye.
- `uuid`: Generate one or more UUIDs. v4 is fully random; v7 is time-sortable (recommended for database keys). LLMs cannot produce cryptographically random or correctly-formatted UUIDs, so always use this tool.