Connect

8 clients · secrets stay placeholders

JSON (mcpServers)Claude CodeCodexOpenCodeCursorVS CodeGemini CLIGoose

{
  "mcpServers": {
    "toolbox": {
      "type": "http",
      "url": "https://toolbox.allthepossibles.com/mcp"
    }
  }
}

claude mcp add --transport http toolbox https://toolbox.allthepossibles.com/mcp

[mcp_servers.toolbox]
url = "https://toolbox.allthepossibles.com/mcp"

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "toolbox": {
      "type": "remote",
      "url": "https://toolbox.allthepossibles.com/mcp",
      "enabled": true
    }
  }
}

{
  "mcpServers": {
    "toolbox": {
      "type": "http",
      "url": "https://toolbox.allthepossibles.com/mcp"
    }
  },
  "deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=toolbox&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vdG9vbGJveC5hbGx0aGVwb3NzaWJsZXMuY29tL21jcCJ9"
}

{
  "servers": {
    "toolbox": {
      "type": "http",
      "url": "https://toolbox.allthepossibles.com/mcp"
    }
  }
}

{
  "mcpServers": {
    "toolbox": {
      "httpUrl": "https://toolbox.allthepossibles.com/mcp"
    }
  }
}

extensions:
  "toolbox":
    enabled: true
    name: "toolbox"
    type: streamable_http
    uri: "https://toolbox.allthepossibles.com/mcp"
    timeout: 300

Quality 81 / 100new

protocol75 · weight 25

warn
protocol.modernnewest supported version is 2025-06-18; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
n/a
protocol.statelessonly applies to 2026-07-28 servers
pass
protocol.transportstreamable HTTP
n/a
protocol.list_ttlonly applies to 2026-07-28 servers

authorizationn/a · weight 15

n/a
auth.prm, auth.as_metadata, auth.cimdno remote uses OAuth
n/a
auth.secret_in_urlno templated URL

tool hygiene86 · weight 30

pass
tools.descriptionsevery tool has a description
pass
tools.description_lengthdescriptions are concise
pass
tools.schemasevery tool has an object input schema
pass
tools.annotations13 of 13 tools declare readOnlyHint or destructiveHint
fail
tools.directory_hintsno tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: lint_agent_md (idempotentHint); mcp_install_snippets (idempotentHint); check_ai_crawlers (idempotentHint); …
pass
tools.token_costabout 1,846 tokens to load every tool
pass
tools.api_dumptools are not a one-to-one API dump

stabilityn/a · weight 15

n/a
stability.changes, stability.rug_pulltool history recorded for 1 of the 7 days needed

dependenciesn/a · weight 15

n/a
deps.known_vulns, deps.mcp_sdk_version, deps.resolvableno npm or PyPI package

13 tools, about 1,846 tokens to load them all · tool set aca93c0f6922 · tools last changed 2026-10-19 · checked 2026-10-20 17:02 UTC

Tool changes

2026-10-19decode_jwtadded
Decode a JWT's header and payload without verifying the signature (it never takes a secret). Returns the claims with iat, nbf and exp as ISO times, a plain-text expiresIn, issuer, subject and audience, and findings: alg none, HS* with a URL-like kid, missing or distant exp, expired, nbf or iat in the future, payload over 4 KB, sensitive field names, and jku or x5u pointing off-site.
2026-10-19check_sitemapadded
Check a site's sitemaps: discovers them from robots.txt, /sitemap.xml and /sitemap_index.xml, reads index files one level deep (20 children max), counts URLs per file and per host, summarises lastmod, and fetches a sample of URLs (HEAD, then GET) to count the ones that are not 200. Flags a missing sitemap, no robots.txt entry, over 50,000 URLs, other hosts, http URLs on https sites and missing lastmod.
2026-10-19trace_redirectsadded
Trace a URL's redirect chain hop by hop (up to 10 hops, 8 s each) with status, location, timing and scheme per hop. Flags chains over two redirects, loops, HTTPS-to-HTTP downgrades, 302s used for www or https canonicalisation, dropped paths or query strings, cross-domain moves, meta-refresh or JS redirects on a 200, and a final page that is not 200.
2026-10-19scrub_envadded
Scrub a .env file into a safe .env.example: every value is blanked or replaced with a placeholder that keeps its shape (postgres://USER:PASSWORD@HOST/DB). Returns the example, the secrets found (AWS, GitHub, Stripe, Slack, Google, OpenAI, Anthropic, Resend, SendGrid, Twilio, Cloudflare, JWTs, private keys, database URLs, high-entropy strings) by key, kind and line with only the first 4 characters and the length, and findings for duplicate keys, non-UPPER_SNAKE names, unbalanced quotes, export prefixes and trailing spaces.
2026-10-19explain_cronadded
Explain a five-field cron expression in plain English, list the next runs in UTC, and warn about the cases Cloudflare Workers, GitHub Actions and crontab handle differently (nicknames, six fields, day-of-month plus day-of-week, sub-5-minute intervals, day 31).
2026-10-19json_to_schemaadded
Turn a JSON sample (or an array of samples of the same shape) into a JSON Schema draft 2020-12 and a TypeScript type. Infers required vs optional keys across samples, nullable fields, integer vs number, date/email/uri/uuid formats, and small enums. Use it to draft an MCP tool inputSchema from an example payload.
2026-10-19check_page_metaadded
Fetch a URL and report what crawlers and link unfurlers see: title and meta description with lengths, canonical, lang, viewport, robots meta, h1s, Open Graph and Twitter card tags, favicon, JSON-LD types, the resulting preview card, and findings for anything missing or too long.
2026-10-19check_headersadded
Fetch a URL once and grade its response headers: HSTS, Content-Security-Policy, X-Content-Type-Options, frame control, Referrer-Policy, Permissions-Policy, Cache-Control, cookie Secure/HttpOnly/SameSite flags, and server version leaks. Returns a grade, a score and the exact header to add for each gap.

Full history: list_changes · trend: quality JSON.

Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.

Trust 83 / 100

no-repository

provenance55

liveness100

freshness100

hygiene80

+dns-namespace +website +reachable +uptime-100% +updated-1d-ago -no-repository

Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.

Endpoints

remote	auth	reachable	uptime 30d	p50	protocol	last ok
`https://toolbox.allthepossibles.com/mcp` streamable-http	none	yes	100%	164 ms	2025-06-18	2026-10-20

Tools (13)

`check_ai_crawlers`read-only	Read a site's robots.txt and report which AI crawlers (GPTBot, ClaudeBot, Google-Extended, PerplexityBot, CCBot, Bytespider and more) are allowed, blocked or partially blocked; check for llms.txt and draft one from the site's metadata and sitemap.
`check_headers`read-only	Fetch a URL once and grade its response headers: HSTS, Content-Security-Policy, X-Content-Type-Options, frame control, Referrer-Policy, Permissions-Policy, Cache-Control, cookie Secure/HttpOnly/SameSite flags, and server version leaks. Returns a grade, a score and the exact header to add for each gap.
`check_page_meta`read-only	Fetch a URL and report what crawlers and link unfurlers see: title and meta description with lengths, canonical, lang, viewport, robots meta, h1s, Open Graph and Twitter card tags, favicon, JSON-LD types, the resulting preview card, and findings for anything missing or too long.
`check_sitemap`read-only	Check a site's sitemaps: discovers them from robots.txt, /sitemap.xml and /sitemap_index.xml, reads index files one level deep (20 children max), counts URLs per file and per host, summarises lastmod, and fetches a sample of URLs (HEAD, then GET) to count the ones that are not 200. Flags a missing sitemap, no robots.txt entry, over 50,000 URLs, other hosts, http URLs on https sites and missing lastmod.
`check_tells`read-only	Check text for AI-writing tells (em-dashes, 'not just X but Y', rule-of-three lists, stock vocabulary like delve or seamlessly, hedge words, smart quotes, hidden Unicode) and return a score, each tell with its position, and a cleaned copy. Run it on anything you are about to publish on a human's behalf.
`decode_jwt`read-only	Decode a JWT's header and payload without verifying the signature (it never takes a secret). Returns the claims with iat, nbf and exp as ISO times, a plain-text expiresIn, issuer, subject and audience, and findings: alg none, HS* with a URL-like kid, missing or distant exp, expired, nbf or iat in the future, payload over 4 KB, sensitive field names, and jku or x5u pointing off-site.
`explain_cron`read-only	Explain a five-field cron expression in plain English, list the next runs in UTC, and warn about the cases Cloudflare Workers, GitHub Actions and crontab handle differently (nicknames, six fields, day-of-month plus day-of-week, sub-5-minute intervals, day 31).
`json_to_schema`read-only	Turn a JSON sample (or an array of samples of the same shape) into a JSON Schema draft 2020-12 and a TypeScript type. Infers required vs optional keys across samples, nullable fields, integer vs number, date/email/uri/uuid formats, and small enums. Use it to draft an MCP tool inputSchema from an example payload.
`lint_agent_md`read-only	Lint a CLAUDE.md, AGENTS.md or MEMORY.md: line count against Claude Code's 200-line memory index cap, estimated tokens, duplicate lines, contradicting rules, leftover TODO markers, hidden characters, empty headings.
`manifest_cost`read-only	Estimate what an MCP server's tools/list costs in tokens on every session start, per tool, with the three most expensive tools and flags for oversized descriptions, base64 blobs and echoed schemas. Pass a live Streamable HTTP endpoint or a tools array.
`mcp_install_snippets`read-only	Generate install snippets for an MCP endpoint (Claude Code, Claude Desktop, Cursor, Codex, VS Code, curl) and probe the endpoint once to confirm it answers initialize and tools/list.
`scrub_env`read-only	Scrub a .env file into a safe .env.example: every value is blanked or replaced with a placeholder that keeps its shape (postgres://USER:PASSWORD@HOST/DB). Returns the example, the secrets found (AWS, GitHub, Stripe, Slack, Google, OpenAI, Anthropic, Resend, SendGrid, Twilio, Cloudflare, JWTs, private keys, database URLs, high-entropy strings) by key, kind and line with only the first 4 characters and the length, and findings for duplicate keys, non-UPPER_SNAKE names, unbalanced quotes, export prefixes and trailing spaces.
`trace_redirects`read-only	Trace a URL's redirect chain hop by hop (up to 10 hops, 8 s each) with status, location, timing and scheme per hop. Flags chains over two redirects, loops, HTTPS-to-HTTP downgrades, 302s used for www or https canonicalisation, dropped paths or query strings, cross-domain moves, meta-refresh or JS redirects on a 200, and a final page that is not 200.

Schemas: list_tools.

Similar MCP servers

More from com.allthepossibles

Official server.json

{
  "name": "com.allthepossibles/toolbox",
  "title": "Toolbox",
  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
  "remotes": [
    {
      "url": "https://toolbox.allthepossibles.com/mcp",
      "type": "streamable-http"
    }
  ],
  "version": "1.0.0",
  "websiteUrl": "https://toolbox.allthepossibles.com",
  "description": "Small tools for agent builders: AI-writing tells, tools/list token cost, CLAUDE.md lint, and more."
}