# ToolAPI

> Free public MCP for AI agents — 193 tools, 44 workflows. No API key.

- name: org.toolapi/hub
- version: 2.8.2
- connection class: R0 (autonomous)
- trust: 88/100
- quality: 73/100 (needs work)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/org.toolapi%2Fhub
- tools: https://api.protogrid.dev/v1/servers/org.toolapi%2Fhub/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "hub": {
      "type": "http",
      "url": "https://toolapi.org/mcp"
    }
  }
}
```


## Trust

- hygiene: 100
- liveness: 98
- freshness: 65
- provenance: 85
- drivers: +repository +dns-namespace +website +reachable +uptime-96% ~updated-103d-ago
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 73/100 (needs work)

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2024-11-05; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 57 (weight 30)

- warn `tools.descriptions`: 2 of 193 tools have a description under 20 characters
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- fail `tools.annotations`: no tool declares readOnlyHint or destructiveHint, so clients cannot tell safe calls from risky ones
- fail `tools.directory_hints`: no tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: json_format (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); graphql_schema_diff (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); cidr_contains (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); …
- warn `tools.token_cost`: about 9,890 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 100 (weight 15)

- pass `stability.changes`: no tool changes in 30 days
- pass `stability.rug_pull`: no tool changed its meaning under the same name

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 193, about 9,890 tokens to load them all
- tool set hash: 4b767f817639413b860bfc440b94fafa
- badge: [![protogrid quality](https://protogrid.dev/badge/org.toolapi/hub.svg)](https://protogrid.dev/servers/org.toolapi/hub)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

_No tool definition changes recorded._

## Remotes

- https://toolapi.org/sse (sse, auth unknown, reachable false, uptime30d 0)
- https://toolapi.org/mcp (streamable-http, auth none, reachable true, uptime30d 0.95614034)

## Packages

_none_

## Tools (193)

- `base64_decode`: Base64-decode to UTF-8.
- `base64_encode`: Base64-encode UTF-8.
- `base64url_decode`: Base64url-decode to UTF-8.
- `base64url_encode`: Base64url-encode UTF-8 (no padding, URL-safe).
- `bcrypt_hash`: Bcrypt-hash a password for storage.
- `bcrypt_verify`: Verify password against bcrypt hash.
- `changelog_parse`: Parse Keep-a-Changelog style markdown into version sections.
- `cidr_calc`: Calculate IPv4/IPv6 network info from CIDR (hosts, broadcast, private).
- `cidr_contains`: Check if IP address falls within a CIDR range.
- `code_fence_extract`: Extract fenced code blocks from markdown (language + code).
- `color_contrast`: WCAG contrast ratio between two hex colors (AA/AAA). When: WCAG contrast ratio for UI color pairs.
- `color_convert`: Convert color between hex, rgb(), and hsl().
- `compose_validate`: Validate docker-compose YAML and flag privileged/host-network/secret env issues.
- `content_type_parse`: Parse Content-Type header into mime/charset/params.
- `conventional_commit_lint`: Lint Conventional Commits message (feat/fix/chore…).
- `cookie_header_parse`: Parse Cookie request header into name/value map. When: Parse Cookie request headers.
- `cors_check`: Check CORS Allow-Origin vs credentials for unsafe combinations.
- `cron_describe`: Human-readable natural language description of cron expression (EN + ZH).
- `cron_matches`: Check if a cron expression matches a specific datetime (ISO-8601).
- `cron_next_runs`: Preview next N execution times for a 5-field cron expression.
- `cron_parse`: Parse 5-field cron into named fields (minute hour dom month dow).
- `cron_semantic_validate`: Validate cron field syntax and value ranges (minute 0-59, hour 0-23, etc.).
- `cron_validate`: Check cron string has exactly five fields.
- `cron_validate_batch`: Batch semantic validate of 5-field cron expressions.
- `csp_parse`: Parse Content-Security-Policy header and flag unsafe directives.
- `csv_to_json`: Convert CSV text to JSON array of row objects. When: Convert CSV rows → JSON array of objects.
- `csv_validate`: Validate CSV structure — consistent column counts / header. When: Check CSV column consistency before import.
- `currency_convert`: Convert amount between currencies using latest ECB rates.
- `currency_list`: List supported fiat currencies (Frankfurter/ECB, no API key).
- `currency_rates`: Latest exchange rates (Frankfurter ECB data, no API key).
- `datetime_parse`: Parse unix timestamp or ISO-8601 into UTC ISO + unix.
- `dependency_versions_extract`: Extract name@version from requirements/lockfile/go.mod/Cargo snippets. When: Extract name@version from lock/requirements snippets (best-effort).
- `dns_lookup`: DNS lookup for domain (A, AAAA, MX, TXT, NS, CNAME, SOA).
- `dockerfile_lint`: Lint Dockerfile for common security/style issues (root user, curl|sh, secrets).
- `domain_parse`: Parse domain into labels, TLD, registrable domain, subdomain. When: Split domain into subdomain/registrable/TLD (best-effort eTLD).
- `duration_parse`: Parse duration (ISO-8601 PnDTnHnMnS or human 1h30m / 90s) to seconds. When: Parse ISO-8601 / human durations to seconds.
- `editorconfig_validate`: Validate .editorconfig syntax and common keys.
- `email_validate`: Validate email address format. When: Syntax-check a single email address.
- `env_diff`: Diff two .env files — only_in_a / only_in_b / changed values. When: Diff two .env files for missing/changed keys.
- `env_parse`: Parse .env / dotenv text into key-value variables.
- `env_required_check`: Check .env text contains required keys (and non-empty values).
- `extract_emails`: Extract email addresses from text. When: Pull email addresses from free text / logs.
- `extract_urls`: Extract HTTP/HTTPS URLs from arbitrary text.
- `frontmatter_parse`: Parse YAML frontmatter from markdown (--- ... ---). When: Split YAML frontmatter from markdown body.
- `github_actions_lint`: Lint GitHub Actions workflow YAML (triggers, unpinned actions, curl|bash).
- `gitignore_check`: Review .gitignore for common missing ignores (.env, node_modules, keys).
- `gitignore_match`: Match paths against .gitignore rules (ignore / negate). When: Test paths against .gitignore rules (best-effort).
- `git_url_parse`: Parse git remote URL (ssh/https) into host/owner/repo. When: Parse git@ / https remotes into owner/repo.
- `glob_match_batch`: Match paths against glob patterns (gitignore-style fnmatch).
- `graphql_operations_list`: List GraphQL query/mutation/subscription names and type defs. When: List GraphQL ops/types from a document (best-effort).
- `graphql_schema_diff`: Diff two GraphQL schemas for removed types/fields (breaking changes).
- `graphql_validate`: Validate GraphQL query or schema SDL syntax (parse only).
- `hash_compare`: Compare two hash digests (case-insensitive).
- `hash_md5`: MD5 hex digest of UTF-8 text. When: MD5 digest (non-crypto integrity / legacy checksums).
- `hash_sha256`: SHA256 hex digest.
- `hash_sha512`: SHA512 hex digest.
- `hex_decode`: Hex string to UTF-8 text.
- `hex_encode`: UTF-8 text to hex string.
- `hmac_sign`: HMAC sign message (sha1/sha256/sha512); hex or base64 output.
- `hmac_verify`: Verify HMAC signature (hex or base64).
- `hosts_file_parse`: Parse /etc/hosts style file into IP → hostnames entries. When: Parse /etc/hosts style IP→hostname maps.
- `html_decode`: Unescape HTML entities.
- `html_encode`: Escape HTML entities.
- `html_security_scan`: Scan HTML for XSS-prone patterns (javascript: URLs, inline handlers, eval). Note: best-effort / heuristic — not a full language parser.
- `html_to_markdown`: Convert HTML to Markdown text. When: Convert HTML → markdown for docs the agent edits.
- `http_headers_fetch`: Fetch HTTP response headers (HEAD/GET) for URL.
- `http_headers_parse`: Parse raw HTTP request/response header block into map. When: Parse raw HTTP header blocks.
- `http_status_classify`: Classify HTTP status codes into 2xx/3xx/4xx/5xx buckets.
- `http_status_lookup`: Explain HTTP status code (e.g. 404, 429, 503).
- `human_bytes`: Format bytes to human size, or parse '1.5 GB' to bytes. When: Format or parse human byte sizes (1.5 GB).
- `identifier_validate`: Validate identifier for python/javascript/typescript (keywords + syntax).
- `import_list_analyze`: List imports from python/js source and flag duplicates. Note: best-effort / heuristic — not a full language parser.
- `ini_parse`: Parse INI / simple key=value config into sections. When: Parse INI/section configs into structured maps.
- `ip_geolocation`: Geolocate public IP: country, city, lat/lon, timezone, ISP.
- `ipv4_private_check`: Classify IP as private/loopback/link-local/global (SSRF helper).
- `ip_version_detect`: Detect IPv4/IPv6 and classify private/loopback/global. When: Classify IPv4/IPv6 and private/global.
- `json_assert_paths`: Assert JSONPath expressions against JSON (exists/equals/type) — agent self-check.
- `json_equal`: Deep-compare two JSON documents and list differing paths.
- `json_flatten`: Flatten nested JSON to dot-key map. When: Flatten nested JSON keys before comparing or exporting.
- `json_format`: Pretty-print JSON with indent. When: Pretty-print JSON when the agent needs readable output.
- `jsonl_validate`: Validate JSON Lines (NDJSON); optional per-line JSON Schema. When: Validate NDJSON / JSON Lines logs or datasets.
- `json_merge`: Deep-merge two JSON objects (second overlays first).
- `json_merge_patch`: Apply RFC 7396 JSON Merge Patch (null deletes keys). When: RFC 7396 merge patch — use when patching JSON configs.
- `json_minify`: Minify JSON (remove whitespace). When: Minify JSON for compact payloads or size checks.
- `json_patch_apply`: Apply RFC 6902 JSON Patch ops (add/remove/replace/test/move/copy). When: Apply RFC 6902 ops (add/remove/replace/test/move/copy).
- `jsonpath_query`: Query JSON with JSONPath expression; returns matching values.
- `json_pointer_get`: Get value by RFC 6901 JSON Pointer (e.g. /user/id). When: Read one field by RFC 6901 pointer without full walk in the agent.
- `json_pretty_diff`: Unified diff of two JSON documents (pretty-printed).
- `json_schema_infer`: Infer a Draft-7 JSON Schema from a sample JSON document (agent favorite).
- `json_schema_validate`: Validate JSON data against JSON Schema (Draft 7).
- `json_schema_validate_batch`: Batch JSON Schema (Draft 7) validation — up to 25 documents (agent favorite).
- `json_sort_keys`: Recursively sort JSON object keys. When: Canonicalize JSON key order for stable diffs/hashes.
- `json_to_csv`: Convert JSON array of objects to CSV text.
- `json_to_toml`: Convert JSON object text to TOML string.
- `json_to_yaml`: Convert JSON text to YAML string. When: Convert JSON → YAML for config files agents write.
- `json_type_summary`: Summarize JSON value types (counts per type in tree).
- `json_validate`: Validate JSON text; return parsed object or error.
- `jwt_claims_audit`: Decode JWT header/claims (no verify) and flag alg=none, missing exp, privileged roles.
- `jwt_decode`: Decode JWT payload and header (no signature verification).
- `jwt_sign`: Sign JWT payload (HS* with secret, RS* with private_key PEM).
- `jwt_verify`: Verify JWT signature (HS* with secret, RS* with public_key PEM).
- `line_ending_normalize`: Detect and normalize line endings to lf/crlf/cr. When: Detect/normalize CRLF vs LF.
- `list_unique`: Deduplicate list items preserving order.
- `mail_inbox_create`: Create disposable receive-only inbox @mail.toolapi.org (24h TTL). Returns address + secret token.
- `mail_inbox_list`: List messages in a temp inbox (requires token from mail_inbox_create).
- `mail_inbox_read`: Read full message body from temp inbox.
- `markdown_link_extract`: Extract markdown/bare links and flag javascript: URLs.
- `markdown_toc`: Build a table of contents from markdown headings. When: Build heading TOC from markdown docs.
- `markdown_to_html`: Convert Markdown text to HTML. When: Render markdown → HTML for previews or emails.
- `mime_lookup`: Lookup MIME type by file extension/path, or extensions by MIME. When: Map file extension ↔ MIME type.
- `nanoid_generate`: Generate URL-friendly nanoid (like npm nanoid).
- `nginx_config_lint`: Lint nginx config snippets (braces, SSLv3, server_tokens, HSTS hints).
- `openapi_diff`: Compare two OpenAPI specs and flag breaking vs non-breaking API changes.
- `openapi_operations_list`: List OpenAPI path operations (method, path, operationId, tags). When: List OpenAPI operations before validate/diff.
- `openapi_validate`: Validate OpenAPI 3.x document (JSON or YAML snippet).
- `package_manifest_audit`: Audit package.json or pyproject.toml — license, risky scripts, loose ranges; emit semver_checks for batch. Note: best-effort / heuristic — not a full language parser.
- `package_scripts_list`: List scripts from package.json or pyproject.toml (poetry/PEP 621). When: List npm/poetry/PEP 621 scripts from manifests.
- `password_generate`: Cryptographically secure random password.
- `password_strength`: Offline password strength heuristic (length/classes/common). When: Offline password strength heuristic (not a cracker).
- `path_normalize`: Normalize filesystem path (resolve . and ..) for posix or windows. When: Resolve . and .. in filesystem paths.
- `path_safety_check`: Check filesystem path for traversal / absolute / sensitive system paths.
- `pem_decode`: List PEM blocks in text (label, DER size, SHA256 fingerprint).
- `pick_choice`: Pick one item from a list (optional seed for reproducibility).
- `port_check`: TCP port open/closed check with latency ms.
- `properties_parse`: Parse Java .properties key=value file. When: Parse Java .properties key=value configs (best-effort).
- `qr_generate`: Generate QR code as SVG (base64 data URI included).
- `query_string_build`: Build URL query string from params object. When: Build query strings from param objects.
- `query_string_parse`: Parse URL query string into key/value map (supports multi-values). When: Parse URL query strings into maps.
- `radix_convert`: Convert number between bases 2-36 (binary, octal, decimal, hex).
- `random_int`: Random integer in inclusive range (optional seed).
- `random_string`: Random string (alphanumeric, hex, base64 charset or custom).
- `regex_replace`: Replace regex matches in text (supports backreferences in replacement).
- `regex_test`: Test regex pattern; returns match, groups, span.
- `remote_matrix`: Remote desktop tools comparison JSON for AI citation.
- `requirements_audit`: Audit Python requirements.txt for unpinned/VCS/deprecated packages.
- `reverse_dns`: Reverse DNS (PTR) lookup for IP address.
- `robots_txt_validate`: Validate robots.txt syntax and User-agent rules.
- `secrets_scan`: Scan text for hardcoded secrets (API keys, tokens, private keys). Returns redacted findings.
- `semver_compare`: Compare two semver strings (less / equal / greater).
- `semver_inc`: Bump a semver version by major/minor/patch. When: Bump major/minor/patch when cutting a release.
- `semver_max_satisfying`: Pick the highest version that satisfies a semver range (npm-style).
- `semver_parse`: Parse semver string into major, minor, patch, prerelease.
- `semver_range_intersects`: Heuristic check whether two semver ranges share any sample versions (conflict hint).
- `semver_satisfies`: Check if version satisfies npm-style range (^ ~ >= <= > <).
- `semver_satisfies_batch`: Batch semver range checks for dependency audits (max 50).
- `semver_sort`: Sort a list of semver versions ascending or descending. When: Sort semver lists before picking latest/oldest.
- `shebang_parse`: Parse #! shebang line — interpreter and args. When: Parse #! interpreter lines in scripts.
- `shell_escape`: Shell-escape a string for posix/powershell/cmd (safe quoting). When: Safely quote strings for posix/powershell/cmd.
- `spdx_license_check`: Validate SPDX license expression against common license IDs.
- `sql_danger_scan`: Scan SQL text for dangerous patterns (DROP/TRUNCATE/DELETE without WHERE). Note: best-effort / heuristic — not a full language parser.
- `sql_format`: Format SQL text (never executed; reindent + keyword case).
- `sql_tables_extract`: Extract table names from SQL (FROM/JOIN/INTO/UPDATE/TABLE). When: Heuristic extract of SQL table names (best-effort).
- `ssl_cert_fetch`: Fetch live TLS certificate from host:port (expiry, issuer, SAN).
- `string_truncate`: Truncate text with ellipsis. When: Truncate long strings with ellipsis for UI/logs.
- `template_fill`: Fill {{variable}} placeholders in a template string.
- `text_case_convert`: Convert case: lower, upper, title, snake, kebab, camel, pascal.
- `text_diff`: Unified line diff between two texts (like git diff).
- `text_lorem`: Generate lorem ipsum placeholder paragraphs.
- `text_similarity`: SequenceMatcher similarity ratio between two texts.
- `text_slugify`: URL-safe slug from title or heading. When: Make URL-safe slugs from titles/filenames.
- `text_stats`: Count chars, words, lines, sentences; estimate reading time.
- `text_wrap`: Wrap text to a maximum line width. When: Hard-wrap text to a column width.
- `time_convert`: Convert unix seconds or ISO-8601 to both formats.
- `time_now`: Current UTC unix timestamp and ISO-8601.
- `timezone_convert`: Convert datetime between IANA timezones (e.g. UTC to Asia/Shanghai).
- `timezone_list`: List common IANA timezone names for conversion.
- `todo_comment_extract`: Extract TODO/FIXME/HACK/XXX comments with line numbers.
- `toml_schema_validate`: Validate TOML config against JSON Schema (Draft 7) in one step.
- `toml_to_json`: Parse TOML and return JSON-compatible object.
- `toml_validate`: Validate TOML text; return parsed object or error.
- `trailing_whitespace_scan`: Scan text for trailing whitespace and tab characters. Note: best-effort / heuristic — not a full language parser.
- `tsconfig_lint`: Lint tsconfig.json structure (compilerOptions, strict hints).
- `unicode_normalize`: Unicode normalization (NFC/NFD/NFKC/NFKD).
- `unified_diff_parse`: Parse unified diff — files changed, lines added/removed.
- `unit_convert`: Convert units: length, weight, temperature, data, speed, time.
- `unit_list`: List supported units per category for unit_convert.
- `url_decode`: Decode percent-encoded string.
- `url_encode`: Percent-encode URL component.
- `url_join`: Join base URL with relative path (urllib urljoin). When: Join base URL + relative path correctly.
- `url_normalize`: Normalize URL (lowercase host, sort query, drop fragment).
- `url_parse`: Parse URL into scheme, host, path, query components.
- `url_ssrf_check`: Check URL for SSRF risk (localhost, private IP, metadata hosts).
- `user_agent_parse`: Parse User-Agent string into browser, OS, and device hints.
- `uuid_generate`: Generate UUID v1/v3/v4/v5 (batch supported). v3/v5 need name + namespace.
- `uuid_parse`: Parse UUID string: version, variant, hex bytes.
- `whois_lookup`: Domain registration lookup via RDAP (registrar, dates, nameservers).
- `x509_parse`: Parse X.509 certificate PEM: subject, issuer, validity, SAN, fingerprint.
- `xml_format`: Pretty-print XML with indentation. When: Pretty-print XML after the agent edits markup.
- `xml_to_json`: Convert XML document to JSON (attributes as @attr). When: Convert XML → JSON for agents that prefer JSON tools.
- `xml_validate`: Validate XML markup (well-formed check).
- `yaml_schema_validate`: Parse YAML then validate against JSON Schema (Draft 7).
- `yaml_to_json`: Parse YAML and return JSON-compatible object.
- `yaml_validate`: Validate YAML text; return parsed object or error.