Connect

8 clients · secrets stay placeholders

JSON (mcpServers)Claude CodeCodexOpenCodeCursorVS CodeGemini CLIGoose

{
  "mcpServers": {
    "hub": {
      "type": "http",
      "url": "https://toolapi.org/mcp"
    }
  }
}

claude mcp add --transport http hub https://toolapi.org/mcp

[mcp_servers.hub]
url = "https://toolapi.org/mcp"

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "hub": {
      "type": "remote",
      "url": "https://toolapi.org/mcp",
      "enabled": true
    }
  }
}

{
  "mcpServers": {
    "hub": {
      "type": "http",
      "url": "https://toolapi.org/mcp"
    }
  },
  "deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=hub&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vdG9vbGFwaS5vcmcvbWNwIn0%3D"
}

{
  "servers": {
    "hub": {
      "type": "http",
      "url": "https://toolapi.org/mcp"
    }
  }
}

{
  "mcpServers": {
    "hub": {
      "httpUrl": "https://toolapi.org/mcp"
    }
  }
}

extensions:
  "hub":
    enabled: true
    name: "hub"
    type: streamable_http
    uri: "https://toolapi.org/mcp"
    timeout: 300

Quality 73 / 100needs work

protocol75 · weight 25

warn
protocol.modernnewest supported version is 2024-11-05; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
n/a
protocol.statelessonly applies to 2026-07-28 servers
pass
protocol.transportstreamable HTTP
n/a
protocol.list_ttlonly applies to 2026-07-28 servers

authorizationn/a · weight 15

n/a
auth.prm, auth.as_metadata, auth.cimdno remote uses OAuth
n/a
auth.secret_in_urlno templated URL

tool hygiene57 · weight 30

warn
tools.descriptions2 of 193 tools have a description under 20 characters
pass
tools.description_lengthdescriptions are concise
pass
tools.schemasevery tool has an object input schema
fail
tools.annotationsno tool declares readOnlyHint or destructiveHint, so clients cannot tell safe calls from risky ones
fail
tools.directory_hintsno tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: json_format (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); graphql_schema_diff (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); json_pointer_get (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); …
warn
tools.token_costabout 9,890 tokens to load every tool
pass
tools.api_dumptools are not a one-to-one API dump

stability100 · weight 15

pass
stability.changesno tool changes in 30 days
pass
stability.rug_pullno tool changed its meaning under the same name

dependenciesn/a · weight 15

n/a
deps.known_vulns, deps.mcp_sdk_version, deps.resolvableno npm or PyPI package

193 tools, about 9,890 tokens to load them all · tool set 4b767f817639 · checked 2026-10-19 13:37 UTC

Tool changes

No tool definition changes recorded. A server's first observation is its baseline; later probes record what changes.

Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.

Trust 88 / 100

provenance85

liveness99

freshness65

hygiene100

+repository +dns-namespace +website +reachable +uptime-96% ~updated-102d-ago

Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.

Endpoints

remote	auth	reachable	uptime 30d	p50	protocol	last ok
`https://toolapi.org/sse` sse	unknown	no (13 failures)	0%	–	–	–
`https://toolapi.org/mcp` streamable-http	none	yes	96%	494 ms	2024-11-05	2026-10-19

Tools (193)

`base64_decode`	Base64-decode to UTF-8.
`base64_encode`	Base64-encode UTF-8.
`base64url_decode`	Base64url-decode to UTF-8.
`base64url_encode`	Base64url-encode UTF-8 (no padding, URL-safe).
`bcrypt_hash`	Bcrypt-hash a password for storage.
`bcrypt_verify`	Verify password against bcrypt hash.
`changelog_parse`	Parse Keep-a-Changelog style markdown into version sections.
`cidr_calc`	Calculate IPv4/IPv6 network info from CIDR (hosts, broadcast, private).
`cidr_contains`	Check if IP address falls within a CIDR range.
`code_fence_extract`	Extract fenced code blocks from markdown (language + code).
`color_contrast`	WCAG contrast ratio between two hex colors (AA/AAA). When: WCAG contrast ratio for UI color pairs.
`color_convert`	Convert color between hex, rgb(), and hsl().
`compose_validate`	Validate docker-compose YAML and flag privileged/host-network/secret env issues.
`content_type_parse`	Parse Content-Type header into mime/charset/params.
`conventional_commit_lint`	Lint Conventional Commits message (feat/fix/chore…).
`cookie_header_parse`	Parse Cookie request header into name/value map. When: Parse Cookie request headers.
`cors_check`	Check CORS Allow-Origin vs credentials for unsafe combinations.
`cron_describe`	Human-readable natural language description of cron expression (EN + ZH).
`cron_matches`	Check if a cron expression matches a specific datetime (ISO-8601).
`cron_next_runs`	Preview next N execution times for a 5-field cron expression.
`cron_parse`	Parse 5-field cron into named fields (minute hour dom month dow).
`cron_semantic_validate`	Validate cron field syntax and value ranges (minute 0-59, hour 0-23, etc.).
`cron_validate`	Check cron string has exactly five fields.
`cron_validate_batch`	Batch semantic validate of 5-field cron expressions.
`csp_parse`	Parse Content-Security-Policy header and flag unsafe directives.
`csv_to_json`	Convert CSV text to JSON array of row objects. When: Convert CSV rows → JSON array of objects.
`csv_validate`	Validate CSV structure — consistent column counts / header. When: Check CSV column consistency before import.
`currency_convert`	Convert amount between currencies using latest ECB rates.
`currency_list`	List supported fiat currencies (Frankfurter/ECB, no API key).
`currency_rates`	Latest exchange rates (Frankfurter ECB data, no API key).
`datetime_parse`	Parse unix timestamp or ISO-8601 into UTC ISO + unix.
`dependency_versions_extract`	Extract name@version from requirements/lockfile/go.mod/Cargo snippets. When: Extract name@version from lock/requirements snippets (best-effort).
`dns_lookup`	DNS lookup for domain (A, AAAA, MX, TXT, NS, CNAME, SOA).
`dockerfile_lint`	Lint Dockerfile for common security/style issues (root user, curl\|sh, secrets).
`domain_parse`	Parse domain into labels, TLD, registrable domain, subdomain. When: Split domain into subdomain/registrable/TLD (best-effort eTLD).
`duration_parse`	Parse duration (ISO-8601 PnDTnHnMnS or human 1h30m / 90s) to seconds. When: Parse ISO-8601 / human durations to seconds.
`editorconfig_validate`	Validate .editorconfig syntax and common keys.
`email_validate`	Validate email address format. When: Syntax-check a single email address.
`env_diff`	Diff two .env files — only_in_a / only_in_b / changed values. When: Diff two .env files for missing/changed keys.
`env_parse`	Parse .env / dotenv text into key-value variables.
`env_required_check`	Check .env text contains required keys (and non-empty values).
`extract_emails`	Extract email addresses from text. When: Pull email addresses from free text / logs.
`extract_urls`	Extract HTTP/HTTPS URLs from arbitrary text.
`frontmatter_parse`	Parse YAML frontmatter from markdown (--- ... ---). When: Split YAML frontmatter from markdown body.
`github_actions_lint`	Lint GitHub Actions workflow YAML (triggers, unpinned actions, curl\|bash).
`gitignore_check`	Review .gitignore for common missing ignores (.env, node_modules, keys).
`gitignore_match`	Match paths against .gitignore rules (ignore / negate). When: Test paths against .gitignore rules (best-effort).
`git_url_parse`	Parse git remote URL (ssh/https) into host/owner/repo. When: Parse git@ / https remotes into owner/repo.
`glob_match_batch`	Match paths against glob patterns (gitignore-style fnmatch).
`graphql_operations_list`	List GraphQL query/mutation/subscription names and type defs. When: List GraphQL ops/types from a document (best-effort).
`graphql_schema_diff`	Diff two GraphQL schemas for removed types/fields (breaking changes).
`graphql_validate`	Validate GraphQL query or schema SDL syntax (parse only).
`hash_compare`	Compare two hash digests (case-insensitive).
`hash_md5`	MD5 hex digest of UTF-8 text. When: MD5 digest (non-crypto integrity / legacy checksums).
`hash_sha256`	SHA256 hex digest.
`hash_sha512`	SHA512 hex digest.
`hex_decode`	Hex string to UTF-8 text.
`hex_encode`	UTF-8 text to hex string.
`hmac_sign`	HMAC sign message (sha1/sha256/sha512); hex or base64 output.
`hmac_verify`	Verify HMAC signature (hex or base64).
`hosts_file_parse`	Parse /etc/hosts style file into IP → hostnames entries. When: Parse /etc/hosts style IP→hostname maps.
`html_decode`	Unescape HTML entities.
`html_encode`	Escape HTML entities.
`html_security_scan`	Scan HTML for XSS-prone patterns (javascript: URLs, inline handlers, eval). Note: best-effort / heuristic — not a full language parser.
`html_to_markdown`	Convert HTML to Markdown text. When: Convert HTML → markdown for docs the agent edits.
`http_headers_fetch`	Fetch HTTP response headers (HEAD/GET) for URL.
`http_headers_parse`	Parse raw HTTP request/response header block into map. When: Parse raw HTTP header blocks.
`http_status_classify`	Classify HTTP status codes into 2xx/3xx/4xx/5xx buckets.
`http_status_lookup`	Explain HTTP status code (e.g. 404, 429, 503).
`human_bytes`	Format bytes to human size, or parse '1.5 GB' to bytes. When: Format or parse human byte sizes (1.5 GB).
`identifier_validate`	Validate identifier for python/javascript/typescript (keywords + syntax).
`import_list_analyze`	List imports from python/js source and flag duplicates. Note: best-effort / heuristic — not a full language parser.
`ini_parse`	Parse INI / simple key=value config into sections. When: Parse INI/section configs into structured maps.
`ip_geolocation`	Geolocate public IP: country, city, lat/lon, timezone, ISP.
`ipv4_private_check`	Classify IP as private/loopback/link-local/global (SSRF helper).
`ip_version_detect`	Detect IPv4/IPv6 and classify private/loopback/global. When: Classify IPv4/IPv6 and private/global.
`json_assert_paths`	Assert JSONPath expressions against JSON (exists/equals/type) — agent self-check.
`json_equal`	Deep-compare two JSON documents and list differing paths.
`json_flatten`	Flatten nested JSON to dot-key map. When: Flatten nested JSON keys before comparing or exporting.
`json_format`	Pretty-print JSON with indent. When: Pretty-print JSON when the agent needs readable output.
`jsonl_validate`	Validate JSON Lines (NDJSON); optional per-line JSON Schema. When: Validate NDJSON / JSON Lines logs or datasets.
`json_merge`	Deep-merge two JSON objects (second overlays first).
`json_merge_patch`	Apply RFC 7396 JSON Merge Patch (null deletes keys). When: RFC 7396 merge patch — use when patching JSON configs.
`json_minify`	Minify JSON (remove whitespace). When: Minify JSON for compact payloads or size checks.
`json_patch_apply`	Apply RFC 6902 JSON Patch ops (add/remove/replace/test/move/copy). When: Apply RFC 6902 ops (add/remove/replace/test/move/copy).
`jsonpath_query`	Query JSON with JSONPath expression; returns matching values.
`json_pointer_get`	Get value by RFC 6901 JSON Pointer (e.g. /user/id). When: Read one field by RFC 6901 pointer without full walk in the agent.
`json_pretty_diff`	Unified diff of two JSON documents (pretty-printed).
`json_schema_infer`	Infer a Draft-7 JSON Schema from a sample JSON document (agent favorite).
`json_schema_validate`	Validate JSON data against JSON Schema (Draft 7).
`json_schema_validate_batch`	Batch JSON Schema (Draft 7) validation — up to 25 documents (agent favorite).
`json_sort_keys`	Recursively sort JSON object keys. When: Canonicalize JSON key order for stable diffs/hashes.
`json_to_csv`	Convert JSON array of objects to CSV text.
`json_to_toml`	Convert JSON object text to TOML string.
`json_to_yaml`	Convert JSON text to YAML string. When: Convert JSON → YAML for config files agents write.
`json_type_summary`	Summarize JSON value types (counts per type in tree).
`json_validate`	Validate JSON text; return parsed object or error.
`jwt_claims_audit`	Decode JWT header/claims (no verify) and flag alg=none, missing exp, privileged roles.
`jwt_decode`	Decode JWT payload and header (no signature verification).
`jwt_sign`	Sign JWT payload (HS* with secret, RS* with private_key PEM).
`jwt_verify`	Verify JWT signature (HS* with secret, RS* with public_key PEM).
`line_ending_normalize`	Detect and normalize line endings to lf/crlf/cr. When: Detect/normalize CRLF vs LF.
`list_unique`	Deduplicate list items preserving order.
`mail_inbox_create`	Create disposable receive-only inbox @mail.toolapi.org (24h TTL). Returns address + secret token.
`mail_inbox_list`	List messages in a temp inbox (requires token from mail_inbox_create).
`mail_inbox_read`	Read full message body from temp inbox.
`markdown_link_extract`	Extract markdown/bare links and flag javascript: URLs.
`markdown_toc`	Build a table of contents from markdown headings. When: Build heading TOC from markdown docs.
`markdown_to_html`	Convert Markdown text to HTML. When: Render markdown → HTML for previews or emails.
`mime_lookup`	Lookup MIME type by file extension/path, or extensions by MIME. When: Map file extension ↔ MIME type.
`nanoid_generate`	Generate URL-friendly nanoid (like npm nanoid).
`nginx_config_lint`	Lint nginx config snippets (braces, SSLv3, server_tokens, HSTS hints).
`openapi_diff`	Compare two OpenAPI specs and flag breaking vs non-breaking API changes.
`openapi_operations_list`	List OpenAPI path operations (method, path, operationId, tags). When: List OpenAPI operations before validate/diff.
`openapi_validate`	Validate OpenAPI 3.x document (JSON or YAML snippet).
`package_manifest_audit`	Audit package.json or pyproject.toml — license, risky scripts, loose ranges; emit semver_checks for batch. Note: best-effort / heuristic — not a full language parser.
`package_scripts_list`	List scripts from package.json or pyproject.toml (poetry/PEP 621). When: List npm/poetry/PEP 621 scripts from manifests.
`password_generate`	Cryptographically secure random password.
`password_strength`	Offline password strength heuristic (length/classes/common). When: Offline password strength heuristic (not a cracker).
`path_normalize`	Normalize filesystem path (resolve . and ..) for posix or windows. When: Resolve . and .. in filesystem paths.
`path_safety_check`	Check filesystem path for traversal / absolute / sensitive system paths.
`pem_decode`	List PEM blocks in text (label, DER size, SHA256 fingerprint).
`pick_choice`	Pick one item from a list (optional seed for reproducibility).
`port_check`	TCP port open/closed check with latency ms.
`properties_parse`	Parse Java .properties key=value file. When: Parse Java .properties key=value configs (best-effort).
`qr_generate`	Generate QR code as SVG (base64 data URI included).
`query_string_build`	Build URL query string from params object. When: Build query strings from param objects.
`query_string_parse`	Parse URL query string into key/value map (supports multi-values). When: Parse URL query strings into maps.
`radix_convert`	Convert number between bases 2-36 (binary, octal, decimal, hex).
`random_int`	Random integer in inclusive range (optional seed).
`random_string`	Random string (alphanumeric, hex, base64 charset or custom).
`regex_replace`	Replace regex matches in text (supports backreferences in replacement).
`regex_test`	Test regex pattern; returns match, groups, span.
`remote_matrix`	Remote desktop tools comparison JSON for AI citation.
`requirements_audit`	Audit Python requirements.txt for unpinned/VCS/deprecated packages.
`reverse_dns`	Reverse DNS (PTR) lookup for IP address.
`robots_txt_validate`	Validate robots.txt syntax and User-agent rules.
`secrets_scan`	Scan text for hardcoded secrets (API keys, tokens, private keys). Returns redacted findings.
`semver_compare`	Compare two semver strings (less / equal / greater).
`semver_inc`	Bump a semver version by major/minor/patch. When: Bump major/minor/patch when cutting a release.
`semver_max_satisfying`	Pick the highest version that satisfies a semver range (npm-style).
`semver_parse`	Parse semver string into major, minor, patch, prerelease.
`semver_range_intersects`	Heuristic check whether two semver ranges share any sample versions (conflict hint).
`semver_satisfies`	Check if version satisfies npm-style range (^ ~ >= <= > <).
`semver_satisfies_batch`	Batch semver range checks for dependency audits (max 50).
`semver_sort`	Sort a list of semver versions ascending or descending. When: Sort semver lists before picking latest/oldest.
`shebang_parse`	Parse #! shebang line — interpreter and args. When: Parse #! interpreter lines in scripts.
`shell_escape`	Shell-escape a string for posix/powershell/cmd (safe quoting). When: Safely quote strings for posix/powershell/cmd.
`spdx_license_check`	Validate SPDX license expression against common license IDs.
`sql_danger_scan`	Scan SQL text for dangerous patterns (DROP/TRUNCATE/DELETE without WHERE). Note: best-effort / heuristic — not a full language parser.
`sql_format`	Format SQL text (never executed; reindent + keyword case).
`sql_tables_extract`	Extract table names from SQL (FROM/JOIN/INTO/UPDATE/TABLE). When: Heuristic extract of SQL table names (best-effort).
`ssl_cert_fetch`	Fetch live TLS certificate from host:port (expiry, issuer, SAN).
`string_truncate`	Truncate text with ellipsis. When: Truncate long strings with ellipsis for UI/logs.
`template_fill`	Fill {{variable}} placeholders in a template string.
`text_case_convert`	Convert case: lower, upper, title, snake, kebab, camel, pascal.
`text_diff`	Unified line diff between two texts (like git diff).
`text_lorem`	Generate lorem ipsum placeholder paragraphs.
`text_similarity`	SequenceMatcher similarity ratio between two texts.
`text_slugify`	URL-safe slug from title or heading. When: Make URL-safe slugs from titles/filenames.
`text_stats`	Count chars, words, lines, sentences; estimate reading time.
`text_wrap`	Wrap text to a maximum line width. When: Hard-wrap text to a column width.
`time_convert`	Convert unix seconds or ISO-8601 to both formats.
`time_now`	Current UTC unix timestamp and ISO-8601.
`timezone_convert`	Convert datetime between IANA timezones (e.g. UTC to Asia/Shanghai).
`timezone_list`	List common IANA timezone names for conversion.
`todo_comment_extract`	Extract TODO/FIXME/HACK/XXX comments with line numbers.
`toml_schema_validate`	Validate TOML config against JSON Schema (Draft 7) in one step.
`toml_to_json`	Parse TOML and return JSON-compatible object.
`toml_validate`	Validate TOML text; return parsed object or error.
`trailing_whitespace_scan`	Scan text for trailing whitespace and tab characters. Note: best-effort / heuristic — not a full language parser.
`tsconfig_lint`	Lint tsconfig.json structure (compilerOptions, strict hints).
`unicode_normalize`	Unicode normalization (NFC/NFD/NFKC/NFKD).
`unified_diff_parse`	Parse unified diff — files changed, lines added/removed.
`unit_convert`	Convert units: length, weight, temperature, data, speed, time.
`unit_list`	List supported units per category for unit_convert.
`url_decode`	Decode percent-encoded string.
`url_encode`	Percent-encode URL component.
`url_join`	Join base URL with relative path (urllib urljoin). When: Join base URL + relative path correctly.
`url_normalize`	Normalize URL (lowercase host, sort query, drop fragment).
`url_parse`	Parse URL into scheme, host, path, query components.
`url_ssrf_check`	Check URL for SSRF risk (localhost, private IP, metadata hosts).
`user_agent_parse`	Parse User-Agent string into browser, OS, and device hints.
`uuid_generate`	Generate UUID v1/v3/v4/v5 (batch supported). v3/v5 need name + namespace.
`uuid_parse`	Parse UUID string: version, variant, hex bytes.
`whois_lookup`	Domain registration lookup via RDAP (registrar, dates, nameservers).
`x509_parse`	Parse X.509 certificate PEM: subject, issuer, validity, SAN, fingerprint.
`xml_format`	Pretty-print XML with indentation. When: Pretty-print XML after the agent edits markup.
`xml_to_json`	Convert XML document to JSON (attributes as @attr). When: Convert XML → JSON for agents that prefer JSON tools.
`xml_validate`	Validate XML markup (well-formed check).
`yaml_schema_validate`	Parse YAML then validate against JSON Schema (Draft 7).
`yaml_to_json`	Parse YAML and return JSON-compatible object.
`yaml_validate`	Validate YAML text; return parsed object or error.

Schemas: list_tools.

Similar MCP servers

Official server.json

{
  "name": "org.toolapi/hub",
  "_meta": {
    "io.modelcontextprotocol.registry/publisher-provided": {
      "serverCard": "https://toolapi.org/.well-known/mcp/server-card.json",
      "toolsCount": 193,
      "documentation": "https://toolapi.org/MCP-REGISTRY.md",
      "forAiManifest": "https://toolapi.org/for-ai.json",
      "authentication": "none",
      "workflowsCount": 44,
      "discoverManifest": "https://toolapi.org/discover.json"
    }
  },
  "title": "ToolAPI",
  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
  "remotes": [
    {
      "url": "https://toolapi.org/sse",
      "type": "sse"
    },
    {
      "url": "https://toolapi.org/mcp",
      "type": "streamable-http"
    }
  ],
  "version": "2.8.2",
  "repository": {
    "url": "https://github.com/baohuiwb/toolapi",
    "source": "github"
  },
  "websiteUrl": "https://toolapi.org",
  "description": "Free public MCP for AI agents — 193 tools, 44 workflows. No API key."
}