ToolAPI MCP server

• base64_decodeFree

  Base64-decode to UTF-8.

• base64_encodeFree

  Base64-encode UTF-8.

• base64url_decodeFree

  Base64url-decode to UTF-8.

• base64url_encodeFree

  Base64url-encode UTF-8 (no padding, URL-safe).

• bcrypt_hashFree

  Bcrypt-hash a password for storage.

• bcrypt_verifyFree

  Verify password against bcrypt hash.

• changelog_parseFree

  Parse Keep-a-Changelog style markdown into version sections.

• cidr_calcFree

  Calculate IPv4/IPv6 network info from CIDR (hosts, broadcast, private).

• cidr_containsFree

  Check if IP address falls within a CIDR range.

• code_fence_extractFree

  Extract fenced code blocks from markdown (language + code).

• color_contrastFree

  WCAG contrast ratio between two hex colors (AA/AAA). When: WCAG contrast ratio for UI color pairs.

• color_convertFree

  Convert color between hex, rgb(), and hsl().

• compose_validateFree

  Validate docker-compose YAML and flag privileged/host-network/secret env issues.

• content_type_parseFree

  Parse Content-Type header into mime/charset/params.

• conventional_commit_lintFree

  Lint Conventional Commits message (feat/fix/chore…).

• cookie_header_parseFree

  Parse Cookie request header into name/value map. When: Parse Cookie request headers.

• cors_checkFree

  Check CORS Allow-Origin vs credentials for unsafe combinations.

• cron_describeFree

  Human-readable natural language description of cron expression (EN + ZH).

• cron_matchesFree

  Check if a cron expression matches a specific datetime (ISO-8601).

• cron_next_runsFree

  Preview next N execution times for a 5-field cron expression.

• cron_parseFree

  Parse 5-field cron into named fields (minute hour dom month dow).

• cron_semantic_validateFree

  Validate cron field syntax and value ranges (minute 0-59, hour 0-23, etc.).

• cron_validateFree

  Check cron string has exactly five fields.

• cron_validate_batchFree

  Batch semantic validate of 5-field cron expressions.

• csp_parseFree

  Parse Content-Security-Policy header and flag unsafe directives.

• csv_to_jsonFree

  Convert CSV text to JSON array of row objects. When: Convert CSV rows → JSON array of objects.

• csv_validateFree

  Validate CSV structure — consistent column counts / header. When: Check CSV column consistency before import.

• currency_convertFree

  Convert amount between currencies using latest ECB rates.

• currency_listFree

  List supported fiat currencies (Frankfurter/ECB, no API key).

• currency_ratesFree

  Latest exchange rates (Frankfurter ECB data, no API key).

• datetime_parseFree

  Parse unix timestamp or ISO-8601 into UTC ISO + unix.

• dependency_versions_extractFree

  Extract name@version from requirements/lockfile/go.mod/Cargo snippets. When: Extract name@version from lock/requirements snippets (best-effort).

• dns_lookupFree

  DNS lookup for domain (A, AAAA, MX, TXT, NS, CNAME, SOA).

• dockerfile_lintFree

  Lint Dockerfile for common security/style issues (root user, curl|sh, secrets).

• domain_parseFree

  Parse domain into labels, TLD, registrable domain, subdomain. When: Split domain into subdomain/registrable/TLD (best-effort eTLD).

• duration_parseFree

  Parse duration (ISO-8601 PnDTnHnMnS or human 1h30m / 90s) to seconds. When: Parse ISO-8601 / human durations to seconds.

• editorconfig_validateFree

  Validate .editorconfig syntax and common keys.

• email_validatewrite actionFree

  Validate email address format. When: Syntax-check a single email address.

• env_diffFree

  Diff two .env files — only_in_a / only_in_b / changed values. When: Diff two .env files for missing/changed keys.

• env_parseFree

  Parse .env / dotenv text into key-value variables.

• env_required_checkFree

  Check .env text contains required keys (and non-empty values).

• extract_emailsFree

  Extract email addresses from text. When: Pull email addresses from free text / logs.

• extract_urlsFree

  Extract HTTP/HTTPS URLs from arbitrary text.

• frontmatter_parseFree

  Parse YAML frontmatter from markdown (--- ... ---). When: Split YAML frontmatter from markdown body.

• git_url_parseFree

  Parse git remote URL (ssh/https) into host/owner/repo. When: Parse git@ / https remotes into owner/repo.

• github_actions_lintFree

  Lint GitHub Actions workflow YAML (triggers, unpinned actions, curl|bash).

• gitignore_checkFree

  Review .gitignore for common missing ignores (.env, node_modules, keys).

• gitignore_matchFree

  Match paths against .gitignore rules (ignore / negate). When: Test paths against .gitignore rules (best-effort).

• glob_match_batchFree

  Match paths against glob patterns (gitignore-style fnmatch).

• graphql_operations_listFree

  List GraphQL query/mutation/subscription names and type defs. When: List GraphQL ops/types from a document (best-effort).

• graphql_schema_diffFree

  Diff two GraphQL schemas for removed types/fields (breaking changes).

• graphql_validateFree

  Validate GraphQL query or schema SDL syntax (parse only).

• hash_compareFree

  Compare two hash digests (case-insensitive).

• hash_md5Free

  MD5 hex digest of UTF-8 text. When: MD5 digest (non-crypto integrity / legacy checksums).

• hash_sha256Free

  SHA256 hex digest.

• hash_sha512Free

  SHA512 hex digest.

• hex_decodeFree

  Hex string to UTF-8 text.

• hex_encodeFree

  UTF-8 text to hex string.

• hmac_signFree

  HMAC sign message (sha1/sha256/sha512); hex or base64 output.

• hmac_verifyFree

  Verify HMAC signature (hex or base64).

• hosts_file_parseFree

  Parse /etc/hosts style file into IP → hostnames entries. When: Parse /etc/hosts style IP→hostname maps.

• html_decodeFree

  Unescape HTML entities.

• html_encodeFree

  Escape HTML entities.

• html_security_scanFree

  Scan HTML for XSS-prone patterns (javascript: URLs, inline handlers, eval). Note: best-effort / heuristic — not a full language parser.

• html_to_markdownFree

  Convert HTML to Markdown text. When: Convert HTML → markdown for docs the agent edits.

• http_headers_fetchFree

  Fetch HTTP response headers (HEAD/GET) for URL.

• http_headers_parseFree

  Parse raw HTTP request/response header block into map. When: Parse raw HTTP header blocks.

• http_status_classifyFree

  Classify HTTP status codes into 2xx/3xx/4xx/5xx buckets.

• http_status_lookupFree

  Explain HTTP status code (e.g. 404, 429, 503).

• human_bytesFree

  Format bytes to human size, or parse '1.5 GB' to bytes. When: Format or parse human byte sizes (1.5 GB).

• identifier_validateFree

  Validate identifier for python/javascript/typescript (keywords + syntax).

• import_list_analyzeFree

  List imports from python/js source and flag duplicates. Note: best-effort / heuristic — not a full language parser.

• ini_parseFree

  Parse INI / simple key=value config into sections. When: Parse INI/section configs into structured maps.

• ip_geolocationFree

  Geolocate public IP: country, city, lat/lon, timezone, ISP.

• ip_version_detectFree

  Detect IPv4/IPv6 and classify private/loopback/global. When: Classify IPv4/IPv6 and private/global.

• ipv4_private_checkFree

  Classify IP as private/loopback/link-local/global (SSRF helper).

• json_assert_pathsFree

  Assert JSONPath expressions against JSON (exists/equals/type) — agent self-check.

• json_equalFree

  Deep-compare two JSON documents and list differing paths.

• json_flattenFree

  Flatten nested JSON to dot-key map. When: Flatten nested JSON keys before comparing or exporting.

• json_formatFree

  Pretty-print JSON with indent. When: Pretty-print JSON when the agent needs readable output.

• json_mergeFree

  Deep-merge two JSON objects (second overlays first).

• json_merge_patchwrite actionFree

  Apply RFC 7396 JSON Merge Patch (null deletes keys). When: RFC 7396 merge patch — use when patching JSON configs.

• json_minifyFree

  Minify JSON (remove whitespace). When: Minify JSON for compact payloads or size checks.

• json_patch_applywrite actionFree

  Apply RFC 6902 JSON Patch ops (add/remove/replace/test/move/copy). When: Apply RFC 6902 ops (add/remove/replace/test/move/copy).

• json_pointer_getFree

  Get value by RFC 6901 JSON Pointer (e.g. /user/id). When: Read one field by RFC 6901 pointer without full walk in the agent.

• json_pretty_diffFree

  Unified diff of two JSON documents (pretty-printed).

• json_schema_inferFree

  Infer a Draft-7 JSON Schema from a sample JSON document (agent favorite).

• json_schema_validateFree

  Validate JSON data against JSON Schema (Draft 7).

• json_schema_validate_batchFree

  Batch JSON Schema (Draft 7) validation — up to 25 documents (agent favorite).

• json_sort_keysFree

  Recursively sort JSON object keys. When: Canonicalize JSON key order for stable diffs/hashes.

• json_to_csvFree

  Convert JSON array of objects to CSV text.

• json_to_tomlFree

  Convert JSON object text to TOML string.

• json_to_yamlFree

  Convert JSON text to YAML string. When: Convert JSON → YAML for config files agents write.

• json_type_summaryFree

  Summarize JSON value types (counts per type in tree).

• json_validateFree

  Validate JSON text; return parsed object or error.

• jsonl_validateFree

  Validate JSON Lines (NDJSON); optional per-line JSON Schema. When: Validate NDJSON / JSON Lines logs or datasets.

• jsonpath_queryFree

  Query JSON with JSONPath expression; returns matching values.

• jwt_claims_auditFree

  Decode JWT header/claims (no verify) and flag alg=none, missing exp, privileged roles.

• jwt_decodeFree

  Decode JWT payload and header (no signature verification).

• jwt_signFree

  Sign JWT payload (HS* with secret, RS* with private_key PEM).

• jwt_verifyFree

  Verify JWT signature (HS* with secret, RS* with public_key PEM).

• line_ending_normalizeFree

  Detect and normalize line endings to lf/crlf/cr. When: Detect/normalize CRLF vs LF.

• list_uniqueFree

  Deduplicate list items preserving order.

• mail_inbox_createwrite actionFree

  Create disposable receive-only inbox @mail.toolapi.org (24h TTL). Returns address + secret token.

• mail_inbox_listFree

  List messages in a temp inbox (requires token from mail_inbox_create).

• mail_inbox_readFree

  Read full message body from temp inbox.

• markdown_link_extractFree

  Extract markdown/bare links and flag javascript: URLs.

• markdown_to_htmlFree

  Convert Markdown text to HTML. When: Render markdown → HTML for previews or emails.

• markdown_tocFree

  Build a table of contents from markdown headings. When: Build heading TOC from markdown docs.

• mime_lookupFree

  Lookup MIME type by file extension/path, or extensions by MIME. When: Map file extension ↔ MIME type.

• nanoid_generateFree

  Generate URL-friendly nanoid (like npm nanoid).

• nginx_config_lintFree

  Lint nginx config snippets (braces, SSLv3, server_tokens, HSTS hints).

• openapi_diffFree

  Compare two OpenAPI specs and flag breaking vs non-breaking API changes.

• openapi_operations_listFree

  List OpenAPI path operations (method, path, operationId, tags). When: List OpenAPI operations before validate/diff.

• openapi_validateFree

  Validate OpenAPI 3.x document (JSON or YAML snippet).

• package_manifest_auditFree

  Audit package.json or pyproject.toml — license, risky scripts, loose ranges; emit semver_checks for batch. Note: best-effort / heuristic — not a full language parser.

• package_scripts_listFree

  List scripts from package.json or pyproject.toml (poetry/PEP 621). When: List npm/poetry/PEP 621 scripts from manifests.

• password_generateFree

  Cryptographically secure random password.

• password_strengthFree

  Offline password strength heuristic (length/classes/common). When: Offline password strength heuristic (not a cracker).

• path_normalizeFree

  Normalize filesystem path (resolve . and ..) for posix or windows. When: Resolve . and .. in filesystem paths.

• path_safety_checkFree

  Check filesystem path for traversal / absolute / sensitive system paths.

• pem_decodeFree

  List PEM blocks in text (label, DER size, SHA256 fingerprint).

• pick_choiceFree

  Pick one item from a list (optional seed for reproducibility).

• port_checkFree

  TCP port open/closed check with latency ms.

• properties_parseFree

  Parse Java .properties key=value file. When: Parse Java .properties key=value configs (best-effort).

• qr_generateFree

  Generate QR code as SVG (base64 data URI included).

• query_string_buildFree

  Build URL query string from params object. When: Build query strings from param objects.

• query_string_parseFree

  Parse URL query string into key/value map (supports multi-values). When: Parse URL query strings into maps.

• radix_convertFree

  Convert number between bases 2-36 (binary, octal, decimal, hex).

• random_intFree

  Random integer in inclusive range (optional seed).

• random_stringFree

  Random string (alphanumeric, hex, base64 charset or custom).

• regex_replaceFree

  Replace regex matches in text (supports backreferences in replacement).

• regex_testFree

  Test regex pattern; returns match, groups, span.

• remote_matrixFree

  Remote desktop tools comparison JSON for AI citation.

• requirements_auditFree

  Audit Python requirements.txt for unpinned/VCS/deprecated packages.

• reverse_dnsFree

  Reverse DNS (PTR) lookup for IP address.

• robots_txt_validateFree

  Validate robots.txt syntax and User-agent rules.

• secrets_scanFree

  Scan text for hardcoded secrets (API keys, tokens, private keys). Returns redacted findings.

• semver_compareFree

  Compare two semver strings (less / equal / greater).

• semver_incFree

  Bump a semver version by major/minor/patch. When: Bump major/minor/patch when cutting a release.

• semver_max_satisfyingFree

  Pick the highest version that satisfies a semver range (npm-style).

• semver_parseFree

  Parse semver string into major, minor, patch, prerelease.

• semver_range_intersectsFree

  Heuristic check whether two semver ranges share any sample versions (conflict hint).

• semver_satisfiesFree

  Check if version satisfies npm-style range (^ ~ >= <= > <).

• semver_satisfies_batchFree

  Batch semver range checks for dependency audits (max 50).

• semver_sortFree

  Sort a list of semver versions ascending or descending. When: Sort semver lists before picking latest/oldest.

• shebang_parseFree

  Parse #! shebang line — interpreter and args. When: Parse #! interpreter lines in scripts.

• shell_escapeFree

  Shell-escape a string for posix/powershell/cmd (safe quoting). When: Safely quote strings for posix/powershell/cmd.

• spdx_license_checkFree

  Validate SPDX license expression against common license IDs.

• sql_danger_scanFree

  Scan SQL text for dangerous patterns (DROP/TRUNCATE/DELETE without WHERE). Note: best-effort / heuristic — not a full language parser.

• sql_formatFree

  Format SQL text (never executed; reindent + keyword case).

• sql_tables_extractFree

  Extract table names from SQL (FROM/JOIN/INTO/UPDATE/TABLE). When: Heuristic extract of SQL table names (best-effort).

• ssl_cert_fetchFree

  Fetch live TLS certificate from host:port (expiry, issuer, SAN).

• string_truncatewrite actionFree

  Truncate text with ellipsis. When: Truncate long strings with ellipsis for UI/logs.

• template_fillFree

  Fill {{variable}} placeholders in a template string.

• text_case_convertFree

  Convert case: lower, upper, title, snake, kebab, camel, pascal.

• text_diffFree

  Unified line diff between two texts (like git diff).

• text_loremFree

  Generate lorem ipsum placeholder paragraphs.

• text_similarityFree

  SequenceMatcher similarity ratio between two texts.

• text_slugifyFree

  URL-safe slug from title or heading. When: Make URL-safe slugs from titles/filenames.

• text_statsFree

  Count chars, words, lines, sentences; estimate reading time.

• text_wrapFree

  Wrap text to a maximum line width. When: Hard-wrap text to a column width.

• time_convertFree

  Convert unix seconds or ISO-8601 to both formats.

• time_nowFree

  Current UTC unix timestamp and ISO-8601.

• timezone_convertFree

  Convert datetime between IANA timezones (e.g. UTC to Asia/Shanghai).

• timezone_listFree

  List common IANA timezone names for conversion.

• todo_comment_extractFree

  Extract TODO/FIXME/HACK/XXX comments with line numbers.

• toml_schema_validateFree

  Validate TOML config against JSON Schema (Draft 7) in one step.

• toml_to_jsonFree

  Parse TOML and return JSON-compatible object.

• toml_validateFree

  Validate TOML text; return parsed object or error.

• trailing_whitespace_scanFree

  Scan text for trailing whitespace and tab characters. Note: best-effort / heuristic — not a full language parser.

• tsconfig_lintFree

  Lint tsconfig.json structure (compilerOptions, strict hints).

• unicode_normalizeFree

  Unicode normalization (NFC/NFD/NFKC/NFKD).

• unified_diff_parseFree

  Parse unified diff — files changed, lines added/removed.

• unit_convertFree

  Convert units: length, weight, temperature, data, speed, time.

• unit_listFree

  List supported units per category for unit_convert.

• url_decodeFree

  Decode percent-encoded string.

• url_encodeFree

  Percent-encode URL component.

• url_joinFree

  Join base URL with relative path (urllib urljoin). When: Join base URL + relative path correctly.

• url_normalizeFree

  Normalize URL (lowercase host, sort query, drop fragment).

• url_parseFree

  Parse URL into scheme, host, path, query components.

• url_ssrf_checkFree

  Check URL for SSRF risk (localhost, private IP, metadata hosts).

• user_agent_parseFree

  Parse User-Agent string into browser, OS, and device hints.

• uuid_generateFree

  Generate UUID v1/v3/v4/v5 (batch supported). v3/v5 need name + namespace.

• uuid_parseFree

  Parse UUID string: version, variant, hex bytes.

• whois_lookupFree

  Domain registration lookup via RDAP (registrar, dates, nameservers).

• x509_parseFree

  Parse X.509 certificate PEM: subject, issuer, validity, SAN, fingerprint.

• xml_formatFree

  Pretty-print XML with indentation. When: Pretty-print XML after the agent edits markup.

• xml_to_jsonFree

  Convert XML document to JSON (attributes as @attr). When: Convert XML → JSON for agents that prefer JSON tools.

• xml_validateFree

  Validate XML markup (well-formed check).

• yaml_schema_validateFree

  Parse YAML then validate against JSON Schema (Draft 7).

• yaml_to_jsonFree

  Parse YAML and return JSON-compatible object.

• yaml_validateFree

  Validate YAML text; return parsed object or error.

• –Code scanremote-only server, no package to scann/a
• Live reliabilityremote reachable in 1253ms20/20
• Tool poisoning193 tool descriptions checked15/15
• Auth qualityopen endpoint exposes 5 write-action tools with no auth3/15
• Maintenancelast push 87 days ago12/15
• Maintainer identitynamespace and repository owner differ; GitHub account older than a year; website matches verified namespace7/10

Safety score

76/100

higher than 48% of 48,255 servers

Tools

193

the typical server has 7

Tools that change things

3%

typical: 0%. Fewer write tools means less an agent can break

Uptime

100%

of our recent checks; the typical remote server answers 100%

Response time

240 ms

faster than 57% of 30,031 servers

GitHub stars

2

more than 75% of 28,688 servers

ToolAPI: common questions

Is ToolAPI MCP server safe?

Mostly: it is graded B (76/100). Read the ToolAPI safety report

How do I install ToolAPI?

It runs remotely at toolapi.org. Add it to Claude Code, Cursor, VS Code or Claude Desktop with the snippets above, or call it through the mcp.market gateway without installing anything.

Does ToolAPI need an API key?

Not as far as the registry entry and our scan can tell: no credentials are declared or required.

Is ToolAPI maintained?

The last commit was 127 days ago (2026-06-30). The latest release is v2.8.2.

Is ToolAPI up?

100% of our last 28 checks got an answer. We check remote servers about four times a day.

How does ToolAPI compare with other MCP servers?

safety score 76/100 (higher than 48% of 48,255 servers); tools 193 (the typical server has 7); tools that change things 3% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.