# com.formatho/runtime

> Self-hosted MCP server: 26 deterministic dev, security, and EVM tools.

- name: com.formatho/runtime
- version: 0.3.0
- connection class: unknown (unknown)
- trust: 75/100 flags: no-repository
- quality: 71/100 (needs work)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/com.formatho%2Fruntime
- tools: https://api.protogrid.dev/v1/servers/com.formatho%2Fruntime/tools

**Not classified yet.** The remote endpoints have not been probed successfully, or the listing has nothing to connect to.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "runtime": {
      "type": "http",
      "url": "https://mcp.formatho.com/mcp"
    }
  }
}
```


## Trust

- hygiene: 75
- liveness: 99
- freshness: 85
- provenance: 45
- drivers: +dns-namespace +reachable +uptime-96% ~updated-38d-ago -no-repository -unpinned-packages(1)
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 71/100 (needs work)

### protocol: n/a (weight 25)

- n/a `protocol.modern`, `protocol.stateless`, `protocol.transport`, `protocol.list_ttl`: no remote answered a protocol handshake (not probed yet, unreachable, or local-only)

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 71 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- fail `tools.annotations`: no tool declares readOnlyHint or destructiveHint, so clients cannot tell safe calls from risky ones
- fail `tools.directory_hints`: no tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: formatho.registry (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); hex.encode (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); json.format (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); …
- pass `tools.token_cost`: about 2,556 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: n/a (weight 15)

- n/a `stability.changes`, `stability.rug_pull`: tool history not recorded yet

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 26, about 2,556 tokens to load them all
- badge: [![protogrid quality](https://protogrid.dev/badge/com.formatho/runtime.svg)](https://protogrid.dev/servers/com.formatho/runtime)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

_No tool definition changes recorded._

## Remotes

- https://mcp.formatho.com/mcp (streamable-http, auth unknown, reachable true, uptime30d 0.9649123)

## Packages

- oci docker.io/formatho/formatho-runtime:0.3.0

## Tools (26)

- `base64.decode`: Base64-decode to text. [data · v1.0.0 · deterministic: true · permissions: none]
- `base64.encode`: Base64-encode text (standard alphabet). [data · v1.0.0 · deterministic: true · permissions: none]
- `case.convert`: Convert an identifier between camelCase, snake_case, kebab-case, CONSTANT_CASE, and Title Case. [dev · v1.0.0 · deterministic: true · permissions: none]
- `erc4626.math`: Exact EIP-4626 vault math in BigInt: convert assets to shares (round down) and shares to assets (round down), with optional virtual offsets. [defi · v1.0.0 · deterministic: true · permissions: none]
- `evm.checksum_address`: EIP-55 checksum an Ethereum address, or verify a checksummed one. [web3 · v1.0.0 · deterministic: true · permissions: none]
- `evm.create2_address`: Compute the deterministic CREATE2 address: keccak256(0xff ‖ factory ‖ salt ‖ initCodeHash)[12:]. [web3 · v1.0.0 · deterministic: true · permissions: none]
- `evm.decode_calldata`: Extract the 4-byte selector from raw calldata, match it against common signatures, and decode static (word-based) arguments: address, uint256, int256, bytes32, bool. [web3 · v1.0.0 · deterministic: true · permissions: none]
- `evm.function_selector`: Compute the 4-byte function selector from a canonical signature, with reverse lookup against common signatures. [web3 · v1.0.0 · deterministic: true · permissions: none]
- `evm.keccak256`: Keccak-256 (Ethereum flavor, NOT NIST SHA3-256) of arbitrary hex or text. [web3 · v1.0.0 · deterministic: true · permissions: none]
- `evm.storage_slot`: Compute Solidity storage slots: simple variables, mapping values (keccak(key ‖ p)), and dynamic array elements (keccak(p) + index). [web3 · v1.0.0 · deterministic: true · permissions: none]
- `evm.unit_convert`: Convert EVM amounts between wei, gwei, and ether with exact BigInt math. [web3 · v1.0.0 · deterministic: true · permissions: none]
- `evm.v4_hook_permissions`: Uniswap v4 hook permissions: compute the 14-bit permission field from hook-call names, or decode the field from a hook address (bits live in the LOW 14 bits: address & 0x3FFF). [web3 · v1.0.0 · deterministic: true · permissions: none]
- `formatho.registry`: List every registered Formatho tool with version, category, deterministic flag, permissions, and Formatho Verified status. [meta · v1.0.0 · deterministic: true · permissions: none]
- `hash.text`: Hash text with md5/sha1/sha256/sha384/sha512 (hex output). MD5/SHA1 are for compatibility checks only, not security. [security · v1.0.0 · deterministic: true · permissions: none]
- `hex.encode`: Encode text to hex, or decode hex (with or without 0x) to text. [data · v1.0.0 · deterministic: true · permissions: none]
- `json.format`: Validate and pretty-print JSON with a configurable indent level. [data · v1.0.0 · deterministic: true · permissions: none]
- `json.minify`: Validate JSON and strip all insignificant whitespace. [data · v1.0.0 · deterministic: true · permissions: none]
- `json.validate`: Validate JSON and report the parse error position if invalid. [data · v1.0.0 · deterministic: true · permissions: none]
- `jwt.decode`: Decode a JWT (JWS compact serialization) header and claims WITHOUT verifying the signature. Reports expiry status from the exp claim. [security · v1.0.0 · deterministic: true · permissions: none]
- `random.string`: Generate a cryptographically random alphanumeric string. [security · v1.0.0 · deterministic: false · permissions: none]
- `regex.test`: Test a regular expression against text: match result plus all capture groups. [dev · v1.0.0 · deterministic: true · permissions: none]
- `slug.generate`: Convert text to a URL-safe kebab-case slug. [dev · v1.0.0 · deterministic: true · permissions: none]
- `timestamp.convert`: Convert Unix seconds/milliseconds to ISO 8601 (UTC) and back. [dev · v1.0.0 · deterministic: true · permissions: none]
- `url.decode`: Decode percent-encoded text. [network · v1.0.0 · deterministic: true · permissions: none]
- `url.encode`: Percent-encode text (component encoding). [network · v1.0.0 · deterministic: true · permissions: none]
- `uuid.v4`: Generate random UUID v4 values. [security · v1.0.0 · deterministic: false · permissions: none]