# APIShed

> Validates PESEL/NIP/REGON/IBAN/Luhn/ISBN/EAN/BIC/VAT; RPN, dates, hash, tokens, random, encode, time

- name: com.apished/apished
- version: 1.3.0
- connection class: unknown (unknown)
- trust: 61/100 flags: no-repository
- quality: 63/100 (needs work)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/com.apished%2Fapished
- tools: https://api.protogrid.dev/v1/servers/com.apished%2Fapished/tools

**Not classified yet.** The remote endpoints have not been probed successfully, or the listing has nothing to connect to.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "apished": {
      "type": "http",
      "url": "https://apished.com/mcp"
    }
  }
}
```


## Trust

- hygiene: 80
- liveness: 27
- freshness: 100
- provenance: 55
- drivers: +dns-namespace +website -unreachable(1 failures) +updated-23d-ago -no-repository
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 63/100 (needs work)

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 71 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- fail `tools.annotations`: no tool declares readOnlyHint or destructiveHint, so clients cannot tell safe calls from risky ones
- fail `tools.directory_hints`: no tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: text_count (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); csv_stats (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); datemath_leapyear (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); …
- pass `tools.token_cost`: about 5,086 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 25 (weight 15)

- warn `stability.changes`: 22 tool changes in 30 days
- fail `stability.rug_pull`: 1 tools kept their name but changed most of their description in 30 days; review before trusting them

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 52, about 5,086 tokens to load them all
- tool set hash: acaa92f6f2064e47ef57a81d0de73fee
- tools last changed: 2026-09-29T00:42:29.011Z
- badge: [![protogrid quality](https://protogrid.dev/badge/com.apished/apished.svg)](https://protogrid.dev/servers/com.apished/apished)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

- 2026-09-29 `uuid_validate` added
  - Parses value as a UUID and reports its version/variant if well-formed.
- 2026-09-29 `uuid_generate` added
  - Generates count (default 1, max 1000) random version-4 UUIDs from crypto/rand-backed entropy.
- 2026-09-29 `units_convert_temperature` added
  - Converts a temperature value (decimal string) between C, F, and K. Offset-aware, not a bare multiplier.
- 2026-09-29 `units_convert_datasize` added
  - Converts a data-size value (decimal string) between bit, Kbit, Mbit, Gbit, Tbit (SI bits), B, KB, MB, GB, TB, PB (SI bytes), and KiB, MiB, GiB, TiB, PiB (IEC bytes). Always exact.
- 2026-09-29 `regex_split` added
  - Splits input around regex matches of pattern, returning at most limit substrings (the last holds the unsplit remainder). limit<=0 means no limit.
- 2026-09-29 `regex_replace` added
  - Replaces every regex match of pattern in input with replacement, which may reference capture groups as $1, $name, etc. (Go's Regexp.Expand syntax).
- 2026-09-29 `regex_extract` added
  - Extracts up to maxMatches non-overlapping regex matches from input, using Go's RE2-based regexp engine (linear-time, no backreferences/lookaround). Named groups (?P<name>...) are reported in namedGroups.
- 2026-09-29 `pipe_run` added
  - Runs a short ordered chain of existing apished operations in one call (same as POST /v1/pipe/run), passing one named field of each step's result into the next step's args. Stops at the first failing step.
- 2026-09-29 `network_cidr_overlaps` added
  - Reports whether two CIDR blocks share any address.
- 2026-09-29 `network_cidr_info` added
  - Parses a CIDR block and reports its network address, address range, and address count. An address with host bits set (e.g. 10.14.32.17/21) is normalized to its network address in the result.

Full history: https://api.protogrid.dev/v1/servers/com.apished%2Fapished/changes

## Remotes

- https://apished.com/mcp (streamable-http, auth none, reachable false, uptime30d 0.92941177)

## Packages

_none_

## Tools (52)

- `color_contrast`: Computes the WCAG 2.1 contrast ratio between two hex colors. Alpha, if present, is composited over white first.
- `color_convert`: Converts a color between hex, rgb, hsl, and hsv. value's shape depends on from/to: a string for hex, an object ({r,g,b,a?} etc.) otherwise.
- `csv_from_json`: Converts JSON records to CSV text. columns is the explicit, ordered header — JSON object key order can't be relied on to infer it.
- `csv_parse`: Parses CSV text into rows of string fields (no type guessing). Ragged rows are tolerated — use csv_validate to detect them.
- `csv_stats`: Parses CSV text (header row required) and reports per-column non-empty/empty value counts across the data rows. No numeric aggregation.
- `csv_to_json`: Converts CSV text to JSON: header=true (default) returns one object per data row keyed by the header row; header=false returns raw rows. Every value is a string.
- `csv_validate`: Reports whether CSV text is structurally well-formed: every row has the same field count as the first.
- `datemath_add`: Adds years/months/days to date. years/months are applied together with end-of-month clamping — e.g. 2026-01-31 + 1 month = 2026-02-28, not an overflowed 2026-03-03. days is then applied as plain calendar-day arithmetic.
- `datemath_age`: Age in whole years as of asOf (optional, defaults to the current UTC date). A Feb-29 birthDate is treated as falling on March 1 in a non-leap asOf year.
- `datemath_businessdays`: Counts days in [from, to] (inclusive on both ends) whose weekday is in weekdays (default mon-fri) and which aren't in holidays.
- `datemath_dayofweek`: Day of the week for date: both the weekday name and its ISO 8601 weekday number (1=Monday..7=Sunday).
- `datemath_diff`: Day difference between two YYYY-MM-DD dates: to minus from, in whole days. Negative if to is before from.
- `datemath_leapyear`: Checks whether year is a leap year in the Gregorian calendar.
- `datetime_now`: Returns the actual current date/time — an LLM has a training cutoff and no live clock, so it can't know what time it actually is right now.
- `ean_validate`: Validates an 8-digit (EAN-8), 12-digit (UPC-A), 13-digit (EAN-13), or 14-digit (GTIN-14) barcode checksum: alternating weights 1 3 applied right-to-left, check digit is (10 - sum mod 10) mod 10.
- `email_validate`: Checks value is a single, bare RFC 5322 email address — syntax only, not a deliverability check. user@localhost is valid (no TLD required). "Name <email>" display syntax is rejected.
- `encode_decode`: Decodes rot13, base64, base64url, base32, hex, uuencode, urlcomponent, urlform, or html text back to the original. encoding in the result is "text" if the decoded bytes are valid UTF-8, or "base64" if they're binary.
- `encode_encode`: Encodes plain UTF-8 text into rot13, base64, base64url, base32, hex, uuencode, urlcomponent (RFC 3986 percent-encoding, space -> %20), urlform (application/x-www-form-urlencoded, space -> +), or html (entity-escapes < > & ' "). Returns plain ASCII.
- `hash_digest`: Computes a hash digest of input (decoded per encoding: "text" default, "base64", or "hex") using algo: md5, sha1, sha256, sha512, or crc32. Returns the digest as lowercase hex.
- `hash_hmac`: Computes an HMAC of input (decoded per encoding) using algo: md5, sha1, sha256, or sha512 (crc32 isn't offered — it's a checksum, not a cryptographic primitive HMAC composes with). key is used as its raw UTF-8 bytes, not decoded per encoding. Returns the MAC as lowercase hex.
- `iban_validate`: Validates an IBAN's length for its issuing country (per the SWIFT IBAN registry) and its mod-97 checksum. Does not decompose the BBAN into a bank code/account number or resolve a BIC.
- `isbn_validate`: Validates a 10- or 13-character ISBN. ISBN-10 uses weights 10..1 over 10 characters (last may be X, worth 10), sum mod 11 must be 0. ISBN-13 uses the same GTIN checksum as barcodes.
- `jsonschema_validate`: Validates document against schema (JSON Schema draft-07 or 2020-12). Reports one specific violation per call, not an aggregated list.
- `luhn_validate`: Validates a numeric string against the Luhn (mod-10) checksum — payment card numbers, IMEI numbers, and similar identifiers.
- `network_cidr_contains`: Reports whether a CIDR block contains an address. Different address families (IPv4 vs IPv6) never match.
- `network_cidr_info`: Parses a CIDR block and reports its network address, address range, and address count. An address with host bits set (e.g. 10.14.32.17/21) is normalized to its network address in the result.
- `network_cidr_overlaps`: Reports whether two CIDR blocks share any address.
- `nip_validate`: Validates the checksum of a 10-digit Polish tax identification number (NIP). Checksum uses weights 6 5 7 2 3 4 5 6 7 over the first 9 digits; sum mod 11 must equal the 10th digit. A sum mod 11 of 10 is itself invalid.
- `pesel_validate`: Validates the checksum of an 11-digit Polish national identification number (PESEL). Checksum uses weights 1 3 7 9 1 3 7 9 1 3 over the first 10 digits; control digit is (10 - sum mod 10) mod 10. On success also decodes the date of birth and sex embedded in the number; a checksum-valid number with an impossible calendar date (e.g. Feb 30) is still reported invalid.
- `pipe_run`: Runs a short ordered chain of existing apished operations in one call (same as POST /v1/pipe/run), passing one named field of each step's result into the next step's args. Stops at the first failing step.
- `random_int`: Generates cryptographically random integers in [min, max] (inclusive), using crypto/rand — an actual random value, not a guess. count defaults to 1, max 1000.
- `regex_extract`: Extracts up to maxMatches non-overlapping regex matches from input, using Go's RE2-based regexp engine (linear-time, no backreferences/lookaround). Named groups (?P<name>...) are reported in namedGroups.
- `regex_match`: Tests input against pattern (Go's regexp package: RE2 syntax, not PCRE — no backreferences or lookaround; use inline flags like (?i) for case-insensitive matching). Returns the full match and captured groups.
- `regex_replace`: Replaces every regex match of pattern in input with replacement, which may reference capture groups as $1, $name, etc. (Go's Regexp.Expand syntax).
- `regex_split`: Splits input around regex matches of pattern, returning at most limit substrings (the last holds the unsplit remainder). limit<=0 means no limit.
- `regon_validate`: Validates the checksum of a 9- or 14-digit Polish business registry number (REGON). 9-digit: weights 8 9 2 3 4 5 6 7 over the first 8 digits, sum mod 11 (10 mapped to 0) must equal the 9th digit. 14-digit: the first 9 digits must themselves be a valid 9-digit REGON, and weights 2 4 8 5 0 9 7 3 6 1 2 4 8 over the first 13 digits (sum mod 11, 10 mapped to 0) must equal the 14th digit.
- `rpncalc_eval`: Evaluates a Reverse Polish Notation (postfix) expression: whitespace-separated tokens, each a number or an operator/function that pops its operands off a stack and pushes the result. Supports arithmetic, exponentiation/modulo, roots, trigonometry, logarithms, rounding, bitwise ops, and constants (pi, e, phi). Always returns the decimal result — for hex/bin/oct rendering, convert the returned number yourself.
- `swiftbic_validate`: Structural format validation only for a SWIFT/BIC code: 8 or 11 characters (4 letters bank code + 2 letters country code + 2 alphanumeric location code + optional 3 alphanumeric branch code). The country code is not cross-checked against ISO 3166-1.
- `text_charat`: Returns the 0-indexed character (rune) at index in text.
- `text_count`: Counts non-overlapping occurrences of substring in text (rune-safe, not byte-based).
- `text_palindrome`: Checks whether text reads the same forwards and backwards. ignoreCase/ignoreNonAlnum default false (strict, literal comparison); set both true for phrase-style palindromes like "A man, a plan, a canal: Panama".
- `text_reverse`: Reverses text by Unicode code point (rune), not grapheme cluster.
- `text_sort`: Sorts text's characters or words alphabetically. by: "chars" (default, sorts runes, no separator) or "words" (splits on whitespace, rejoins with a single space).
- `text_stats`: Descriptive statistics for text: rune/byte/word/line counts, a unique-rune count, a letters/digits/spaces/punctuation/other breakdown, an exact per-character frequency table, and word-length min/max/average plus the actual shortest/longest word (ties resolve to the first occurrence).
- `text_wordcount`: Counts whitespace-delimited words in text.
- `tokens_count`: Counts tokens under an OpenAI-compatible (tiktoken) encoding. Provide exactly one of model (e.g. "gpt-4o") or encoding ("o200k_base" or "cl100k_base"). No Claude/Anthropic tokenizer.
- `units_convert_datasize`: Converts a data-size value (decimal string) between bit, Kbit, Mbit, Gbit, Tbit (SI bits), B, KB, MB, GB, TB, PB (SI bytes), and KiB, MiB, GiB, TiB, PiB (IEC bytes). Always exact.
- `units_convert_temperature`: Converts a temperature value (decimal string) between C, F, and K. Offset-aware, not a bare multiplier.
- `url_validate`: Checks value is a well-formed absolute URL (has both a scheme and a host) — syntax only, not a reachability check.
- `uuid_generate`: Generates count (default 1, max 1000) random version-4 UUIDs from crypto/rand-backed entropy.
- `uuid_validate`: Parses value as a UUID and reports its version/variant if well-formed.
- `vateu_validate`: Format validation only (no VIES lookup) for an EU VAT number: checks the 2-letter member-state prefix (EL for Greece, XI for Northern Ireland) against that country's digit/letter pattern. A format-valid result does not mean the number is actually registered.