# ReplyNodes

> Web MCP: scrape/crawl sites, web search, brand assets, app stores, YouTube, Reddit, Hacker News.

- name: com.replynodes/mcp
- version: 1.0.3
- connection class: R1 (autonomous)
- trust: 75/100
- quality: 58/100 (needs work)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/com.replynodes%2Fmcp
- tools: https://api.protogrid.dev/v1/servers/com.replynodes%2Fmcp/tools

**An agent can connect on its own if it already holds `REPLYNODES_TOKEN`.** Remote endpoint behind a static API key or header. The registry never sees the value; the agent fills the placeholder.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "replynodes": {
      "type": "http",
      "url": "https://mcp.replynodes.com/mcp",
      "headers": {
        "Authorization": "Bearer ${REPLYNODES_TOKEN}"
      }
    }
  }
}
```

Placeholders to fill: `${REPLYNODES_TOKEN}`.

## Trust

- hygiene: 100
- liveness: 26
- freshness: 85
- provenance: 100
- drivers: +repository +namespace-matches-repo +dns-namespace +website -unreachable(1 failures) ~updated-35d-ago
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 58/100 (needs work)

### protocol: 88 (weight 25)

- pass `protocol.modern`: supports 2026-07-28 (server/discover)
- pass `protocol.stateless`: answers without a session
- pass `protocol.transport`: streamable HTTP
- warn `protocol.list_ttl`: tools/list declares ttlMs 0, so clients re-fetch it on every use

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 50 (weight 30)

- pass `tools.descriptions`: every tool has a description
- warn `tools.description_length`: 1 tools have descriptions over 1,024 characters, which crowds the context
- pass `tools.schemas`: every tool has an object input schema
- fail `tools.annotations`: no tool declares readOnlyHint or destructiveHint, so clients cannot tell safe calls from risky ones
- fail `tools.directory_hints`: no tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: user_activity (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); youtube_comments (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); brand_fonts (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); …
- fail `tools.token_cost`: about 584,771 tokens to load every tool, a large share of an agent's context
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 25 (weight 15)

- warn `stability.changes`: 399 tool changes in 30 days
- fail `stability.rug_pull`: 2 tools kept their name but changed most of their description in 30 days; review before trusting them

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 71, about 584,771 tokens to load them all
- tool set hash: 4546081f1e37a2c38f9686a1a1c759b4
- tools last changed: 2026-10-18T14:39:32.141Z
- badge: [![protogrid quality](https://protogrid.dev/badge/com.replynodes/mcp.svg)](https://protogrid.dev/servers/com.replynodes/mcp)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

- 2026-10-18 `read_document` changed (inputSchema)
- 2026-10-18 `monitor_runs` changed (inputSchema)
- 2026-10-18 `monitor_changes` changed (inputSchema)
- 2026-10-18 `monitor_update` changed (inputSchema)
- 2026-10-18 `monitor_get` changed (inputSchema)
- 2026-10-18 `monitor_create` changed (inputSchema)
- 2026-10-18 `monitor_list` changed (inputSchema)
- 2026-10-18 `get_company_intelligence` changed (inputSchema)
- 2026-10-18 `get_recent_company_events` changed (inputSchema)
- 2026-10-18 `get_company_history` changed (inputSchema)

Full history: https://api.protogrid.dev/v1/servers/com.replynodes%2Fmcp/changes

## Remotes

- https://mcp.replynodes.com/mcp (streamable-http, auth api_key ${REPLYNODES_TOKEN}, reachable false, uptime30d 0.9074074)

## Packages

_none_

## Tools (71)

- `anonymous_brand`: Read public brand intelligence

Already-anonymous Brand gateway route for canonical capability brand-kit (fixed Tier A: 20 valid requests per trusted client-IP bucket per UTC calendar day). Domain validation occurs before admission; cache hits and upstream failures consume one unit. X-RateLimit-Limit is the effective fixed tier limit, X-RateLimit-Remaining is the capability bucket balance, and X-RateLimit-Reset is the next UTC midnight Unix timestamp.

HTTP: GET /{domain}
- `anonymous_company_research`: Run the anonymous company-research workflow

Top-level anonymous company-research workflow for canonical capability company-research (fixed Tier C: 3 valid requests per trusted client-IP bucket per UTC calendar day). A valid request is admitted once, before the read-only server-side fan-out; the url-to-markdown, brand-kit, and brand-logo primitives composed inside the workflow are server-owned and never charged a second anonymous bucket. Malformed input is rejected before admission; admitted provider failures consume one unit. X-RateLimit-Limit is 3, X-RateLimit-Remaining is the Tier C bucket balance, and X-RateLimit-Reset is the next UTC midnight Unix timestamp. Redis failure returns 503 degraded.

HTTP: GET /v1/company-research
- `anonymous_competitor_research`: Run the anonymous competitor-research workflow

Top-level anonymous competitor-research workflow for canonical capability competitor-research (fixed Tier C: 3 valid requests per trusted client-IP bucket per UTC calendar day). One admitted request fans out read-only to the company domain plus up to 5 competitor domains; the whole composition is charged once and primitives are never charged a second anonymous bucket. Malformed input (missing/invalid domain, empty/invalid/oversized competitor list) is rejected before admission. See /v1/company-research for the shared quota-header contract.

HTTP: GET /v1/competitor-research
- `anonymous_markdown`: Read a public URL as Markdown

Already-anonymous Markdown gateway route for canonical capability url-to-markdown (dedicated Markdown tier: 100 valid requests per trusted client-IP bucket per UTC calendar day). Admission occurs after method and target/SSRF validation and before cache/upstream work; cache hits and upstream failures consume one unit. X-RateLimit-Limit is the effective fixed tier limit, X-RateLimit-Remaining is the capability bucket balance, and X-RateLimit-Reset is the next UTC midnight Unix timestamp. Redis failure returns 503 degraded. Output format is chosen with request headers because the whole path and query string belong to the target URL: no Accept header, Accept: */*, text/markdown or text/plain returns Markdown (default); Accept: application/json (JSON preferred with q>0) returns the {data, meta} envelope with the same data shape as GET /v1/webcontext/scrape; X-Format: frontmatter returns Markdown preceded by a fixed seven-key YAML front-matter block; an unknown X-Format value, or application/json together with X-Format: frontmatter, returns 400 invalid_request with reason bad_option before any quota is spent. X-Include-Selectors and X-Exclude-Selectors (comma-separated CSS selectors, at most 10 entries and 512 bytes per header, duplicates removed, no control characters or { } ; < >) filter the page; they are part of the cache key; with selectors set, a page that returns an access-check page returns 502 upstream_blocked (no crawl fallback). A page main heading may remain even when it matches an exclude selector. Every error response of this host carries error.reason (a stable value from the closed set in the MarkdownHostError schema) and error.retryable in addition to error.code, error.message and error.request_id. Successful responses set Vary: Accept, X-Format.

HTTP: GET /md/{target}
- `app`: Look up one public App Store application

Look up one public App Store application. Returns the normalized public contract; raw provider records are internal to the runtime boundary and never cross the public gateway.

HTTP: GET /v1/appstore/app
- `brand_fonts`: Get Fonts

Extract the typography and font stack of a website by domain or URL.

HTTP: GET /v1/brand/fonts
- `brand_logo`: Get Brand Logo

Fetch the brand logo kit for one company domain: primary logo URL, candidate logo variants, favicon, and og_image.

HTTP: GET /v1/brand/logo
- `brand_retrieve`: Retrieve Brand

Resolve the full brand profile of a company by domain, or extract brand details from one specific page URL: name, description, primary logo, logos, colors, fonts, social links, favicon, and og_image.

HTTP: GET /v1/brand/retrieve
- `brand_search`: Search Brand

Fuzzy brand or company search by name or domain; returns up to 10 lightweight matches with domain, name, and logo.

HTTP: GET /v1/brand/search
- `brand_styleguide`: Get Styleguide

Extract the design system of a website by domain or URL: colors, typography, spacing, and more.

HTTP: GET /v1/brand/styleguide
- `developer`: List applications by developer

List applications by developer. Returns the normalized public contract; raw provider records are internal to the runtime boundary and never cross the public gateway.

HTTP: GET /v1/appstore/developer
- `get_company_events`: List Company Changes events for an Entity

Lists Events for a domain when the organization has a current or retained Watch topic subscription; unentitled Entities return 404.

HTTP: GET /v1/entities/{domain}/events
- `get_company_history`: Retrieve entitled Entity topic history

Returns retained canonical topic history for an entitled Entity, including history older than a Watch; unentitled access returns 404.

HTTP: GET /v1/entities/{domain}/history/{topic}
- `get_company_intelligence`: Retrieve entitled Company Changes intelligence

Returns only entitled topic state and recent events plus shared coverage, never internal Entity scheduling.

HTTP: GET /v1/intelligence/{domain}
- `get_fetcher_healthz`: Health check

HTTP: GET /fetcher/healthz
- `get_fetcher_readyz`: Readiness (auth/db status)

HTTP: GET /fetcher/readyz
- `get_gateway_capabilities`: Get gateway capabilities

Unauthenticated, read-only discovery of the gateway-wide provider inventory, routes currently callable under their provider manifests, and the embedded OpenAPI document. Callable discovery is a runtime snapshot, not authorization or billing state.

HTTP: GET /v1/capabilities
- `get_recent_company_events`: List entitled Company Changes events

Lists canonical Events covered by the organization's current or retained Watch topic subscriptions.

HTTP: GET /v1/events
- `get_v1_hackernews_capabilities`: List available operations

HTTP: GET /v1/hackernews/capabilities
- `googleplay_app_details`: Fetch a single Google Play app's public detail record

Fetch a single Google Play app's public detail record. Returns the normalized public contract; raw provider records are internal to the runtime boundary and never cross the public gateway.

HTTP: GET /v1/googleplay/app_details/{id}
- `googleplay_availability`: Fetch a Google Play app's per-storefront availability

Fetch a Google Play app's per-storefront availability. Returns the normalized public contract; raw provider records are internal to the runtime boundary and never cross the public gateway.

HTTP: GET /v1/googleplay/availability/{id}
- `googleplay_categories`: List available Google Play category identifiers

List available Google Play category identifiers. Returns the normalized public contract; raw provider records are internal to the runtime boundary and never cross the public gateway.

HTTP: GET /v1/googleplay/categories
- `googleplay_category_apps`: Fetch top public apps in a Google Play category

Fetch top public apps in a Google Play category. Returns the normalized public contract; raw provider records are internal to the runtime boundary and never cross the public gateway.

HTTP: GET /v1/googleplay/category_apps/{category}
- `googleplay_data_safety`: Fetch a Google Play app's declared data-safety disclosure

Fetch a Google Play app's declared data-safety disclosure. Returns the normalized public contract; raw provider records are internal to the runtime boundary and never cross the public gateway.

HTTP: GET /v1/googleplay/data_safety/{id}
- `googleplay_developer`: Fetch public apps published by a Google Play developer

Fetch public apps published by a Google Play developer. Returns the normalized public contract; raw provider records are internal to the runtime boundary and never cross the public gateway.

HTTP: GET /v1/googleplay/developer
- `googleplay_permissions`: Fetch a Google Play app's declared permissions

Fetch a Google Play app's declared permissions. Returns the normalized public contract; raw provider records are internal to the runtime boundary and never cross the public gateway.

HTTP: GET /v1/googleplay/permissions/{id}
- `googleplay_reviews`: Fetch public reviews for a Google Play app

Fetch public reviews for a Google Play app. Returns the normalized public contract; raw provider records are internal to the runtime boundary and never cross the public gateway.

HTTP: GET /v1/googleplay/reviews/{id}
- `googleplay_search`: Search public Google Play applications by term

Search public Google Play applications by term. Returns the normalized public contract; raw provider records are internal to the runtime boundary and never cross the public gateway.

HTTP: GET /v1/googleplay/search
- `googleplay_similar_apps`: Fetch apps similar to a given Google Play package

Fetch apps similar to a given Google Play package. Returns the normalized public contract; raw provider records are internal to the runtime boundary and never cross the public gateway.

HTTP: GET /v1/googleplay/similar_apps/{id}
- `googleplay_suggest`: Fetch Google Play search-term suggestions

Fetch Google Play search-term suggestions. Returns the normalized public contract; raw provider records are internal to the runtime boundary and never cross the public gateway.

HTTP: GET /v1/googleplay/suggest
- `hackernews_item`: Fetch a single Hacker News item and its comment tree

Fetch a single Hacker News item and its comment tree. Returns the normalized public contract; raw provider records are internal to the runtime boundary and never cross the public gateway.

HTTP: GET /v1/hackernews/item/{id}
- `hackernews_search`: Search Hacker News via Algolia

Search Hacker News via Algolia. Returns the normalized public contract; raw provider records are internal to the runtime boundary and never cross the public gateway.

HTTP: GET /v1/hackernews/search
- `hackernews_stories_ask`: Fetch current Ask HN stories

Fetch current Ask HN stories. Returns the normalized public contract; raw provider records are internal to the runtime boundary and never cross the public gateway.

HTTP: GET /v1/hackernews/stories_ask
- `hackernews_stories_best`: Fetch current Hacker News best stories

Fetch current Hacker News best stories. Returns the normalized public contract; raw provider records are internal to the runtime boundary and never cross the public gateway.

HTTP: GET /v1/hackernews/stories_best
- `hackernews_stories_job`: Fetch current Hacker News job postings

Fetch current Hacker News job postings. Returns the normalized public contract; raw provider records are internal to the runtime boundary and never cross the public gateway.

HTTP: GET /v1/hackernews/stories_job
- `hackernews_stories_new`: Fetch current Hacker News new stories

Fetch current Hacker News new stories. Returns the normalized public contract; raw provider records are internal to the runtime boundary and never cross the public gateway.

HTTP: GET /v1/hackernews/stories_new
- `hackernews_stories_show`: Fetch current Show HN stories

Fetch current Show HN stories. Returns the normalized public contract; raw provider records are internal to the runtime boundary and never cross the public gateway.

HTTP: GET /v1/hackernews/stories_show
- `hackernews_stories_top`: Fetch current Hacker News top stories

Fetch current Hacker News top stories. Returns the normalized public contract; raw provider records are internal to the runtime boundary and never cross the public gateway.

HTTP: GET /v1/hackernews/stories_top
- `hackernews_user`: Fetch a public Hacker News user profile

Fetch a public Hacker News user profile. Returns the normalized public contract; raw provider records are internal to the runtime boundary and never cross the public gateway.

HTTP: GET /v1/hackernews/user/{handle}
- `list`: List applications from an iTunes collection

List applications from an iTunes collection. Returns the normalized public contract; raw provider records are internal to the runtime boundary and never cross the public gateway.

HTTP: GET /v1/appstore/list
- `monitor_changes`: List monitor changes

HTTP: GET /v1/monitors/{id}/changes
- `monitor_create`: Create a monitor asynchronously

HTTP: POST /v1/monitors
- `monitor_get`: Get a monitor

HTTP: GET /v1/monitors/{id}
- `monitor_list`: List monitors for the authenticated organization

HTTP: GET /v1/monitors
- `monitor_runs`: List monitor runs

HTTP: GET /v1/monitors/{id}/runs
- `monitor_update`: Update frequency, pause state, or webhook

Update frequency, pause state, or webhook configuration. The change is recorded immediately in the monitor service database (scheduling authority) and the external changedetection watch is reconciled asynchronously and with bounded retries; the response monitor object carries sync_state/sync_next_retry_at/sync_error_reason so a degraded engine (for example, a failed pause) is truthful and visible rather than silently dropped.

HTTP: PATCH /v1/monitors/{id}
- `post_by_id`: HTTP: GET /v1/reddit/post_by_id/{id}
- `post_by_permalink`: HTTP: GET /v1/reddit/post_by_permalink
- `privacy`: Read public App Store privacy details

Read public App Store privacy details. Returns the normalized public contract; raw provider records are internal to the runtime boundary and never cross the public gateway.

HTTP: GET /v1/appstore/privacy
- `ratings`: Read public app ratings

Read public app ratings. Returns the normalized public contract; raw provider records are internal to the runtime boundary and never cross the public gateway.

HTTP: GET /v1/appstore/ratings
- `read_document`: Read a public PDF as Markdown for AI agents

Direct public HTTP POST to https://pdf.replynodes.com/ requires no account, API key, or cookie. POST converts one public PDF URL to Markdown. GET and HEAD on the root are documentation-only; allowed methods are GET, HEAD, POST. This PDF to Markdown response is designed for read PDF, PDF for AI agents, extract PDF text, and PDF context workflows. The MCP read_document / tools/call at https://mcp.replynodes.com/mcp requires the existing MCP authorization boundary; MCP is not anonymous. Limits: 10 MiB source/download, 50 pages, 60 seconds, 20 conversions/IP/hour, 2 active conversions/IP, and a maximum encoded JSON response of 1 MiB including the trailing newline. MCP discovery identifies the sole read_document tool at https://mcp.replynodes.com/mcp.

HTTP: POST https://pdf.replynodes.com/
- `reviews`: Read a page of public app reviews

Read a page of public app reviews. Returns the normalized public contract; raw provider records are internal to the runtime boundary and never cross the public gateway.

HTTP: GET /v1/appstore/reviews
- `search`: Search public App Store applications by term

Search public App Store applications by term. Returns the normalized public contract; raw provider records are internal to the runtime boundary and never cross the public gateway.

HTTP: GET /v1/appstore/search
- `search_posts`: HTTP: GET /v1/reddit/search_posts
- `similar`: List apps related to an application

List apps related to an application. Returns the normalized public contract; raw provider records are internal to the runtime boundary and never cross the public gateway.

HTTP: GET /v1/appstore/similar
- `subreddit_posts`: HTTP: GET /v1/reddit/subreddit_posts/{subreddit}
- `suggest`: Suggest public App Store search terms

Suggest public App Store search terms. Returns the normalized public contract; raw provider records are internal to the runtime boundary and never cross the public gateway.

HTTP: GET /v1/appstore/suggest
- `user_activity`: HTTP: GET /v1/reddit/user_activity/{username}
- `user_posts`: HTTP: GET /v1/reddit/user_posts/{username}
- `webcontext_brand`: Extract public brand identity for a site

Lightweight brand snapshot for one site URL: logos, colors, fonts, and basic public metadata. Prefer brand_retrieve for a fuller normalized brand profile or brand_search for fuzzy company-name discovery.

HTTP: GET /v1/webcontext/brand
- `webcontext_crawl`: Crawl same-origin links from a URL

Crawl same-origin links starting from a URL and return normalized page results. max_pages/max_depth are clamped server-side regardless of the requested value.

HTTP: GET /v1/webcontext/crawl
- `webcontext_map`: Discover URLs belonging to a site

Discover URLs belonging to a site without extracting page content. Results are deduplicated.

HTTP: GET /v1/webcontext/map
- `webcontext_scrape`: Fetch one URL as clean Markdown

Fetch one URL and return clean, main-content Markdown plus normalized metadata, links, and images. Backed by a privately deployed webclaw-server instance; upstream implementation details are never exposed.

HTTP: GET /v1/webcontext/scrape
- `web_search`: Search the public web

Search the public web through the normalized Web Search provider contract.

HTTP: GET /v1/web/search
- `youtube_channel`: HTTP: GET /v1/youtube/channel/{id}
- `youtube_comments`: HTTP: GET /v1/youtube/comments/{id}
- `youtube_playlist`: HTTP: GET /v1/youtube/playlist/{id}
- `youtube_related`: HTTP: GET /v1/youtube/related/{id}
- `youtube_search`: HTTP: GET /v1/youtube/search
- `youtube_transcript`: HTTP: GET /v1/youtube/transcript/{id}
- `youtube_video`: HTTP: GET /v1/youtube/video/{id}