Not reviewed
No score, grade or rank. This listing is facts from the official MCP registry and our own checks, and it stays out of the rankings until the panel reviews it.
Free public MCP for AI agents — 193 tools, 44 workflows. No API key.
Facts
- MCP registry
org.toolapi/hub· 2.8.2- Endpoint
https://toolapi.org/mcp- Also hosted
https://toolapi.org/ssesse- Website
- toolapi.org
- GitHub stars
- 2
- Registry entry
- updated 10 Jul 2026
From the official MCP registry, the package registries and our own checks. JSON · Markdown
Why it's listed
- It's published in the registry under toolapi.org, a namespace the registry only gives to whoever proves they control that domain.
Being indexed says nothing about quality, and nobody can pay for it. Is this yours? Ask for a review.
Tools it lists 193 · about 11,783 tokens of context · checked 23 hours ago
| Tool | What it does | Hint |
|---|---|---|
json_validate | Validate JSON text; return parsed object or error. | |
json_format | Pretty-print JSON with indent. When: Pretty-print JSON when the agent needs readable output. | |
json_minify | Minify JSON (remove whitespace). When: Minify JSON for compact payloads or size checks. | |
csv_to_json | Convert CSV text to JSON array of row objects. When: Convert CSV rows → JSON array of objects. | |
json_to_csv | Convert JSON array of objects to CSV text. | |
yaml_validate | Validate YAML text; return parsed object or error. | |
yaml_to_json | Parse YAML and return JSON-compatible object. | |
json_to_yaml | Convert JSON text to YAML string. When: Convert JSON → YAML for config files agents write. | |
xml_validate | Validate XML markup (well-formed check). | |
xml_format | Pretty-print XML with indentation. When: Pretty-print XML after the agent edits markup. | |
jsonpath_query | Query JSON with JSONPath expression; returns matching values. | |
json_merge | Deep-merge two JSON objects (second overlays first). | |
json_flatten | Flatten nested JSON to dot-key map. When: Flatten nested JSON keys before comparing or exporting. | |
json_pretty_diff | Unified diff of two JSON documents (pretty-printed). | |
json_sort_keys | Recursively sort JSON object keys. When: Canonicalize JSON key order for stable diffs/hashes. | |
json_type_summary | Summarize JSON value types (counts per type in tree). | |
json_schema_validate | Validate JSON data against JSON Schema (Draft 7). | |
toml_validate | Validate TOML text; return parsed object or error. | |
toml_to_json | Parse TOML and return JSON-compatible object. | |
json_to_toml | Convert JSON object text to TOML string. | |
toml_schema_validate | Validate TOML config against JSON Schema (Draft 7) in one step. | |
sql_format | Format SQL text (never executed; reindent + keyword case). | |
graphql_validate | Validate GraphQL query or schema SDL syntax (parse only). | |
openapi_validate | Validate OpenAPI 3.x document (JSON or YAML snippet). | |
openapi_diff | Compare two OpenAPI specs and flag breaking vs non-breaking API changes. | |
package_manifest_audit | Audit package.json or pyproject.toml — license, risky scripts, loose ranges; emit semver_checks for batch. Note: best-effort / heuristic — not a full language parser. | |
graphql_schema_diff | Diff two GraphQL schemas for removed types/fields (breaking changes). | |
compose_validate | Validate docker-compose YAML and flag privileged/host-network/secret env issues. | |
github_actions_lint | Lint GitHub Actions workflow YAML (triggers, unpinned actions, curl|bash). | |
requirements_audit | Audit Python requirements.txt for unpinned/VCS/deprecated packages. | |
json_schema_validate_batch | Batch JSON Schema (Draft 7) validation — up to 25 documents (agent favorite). | |
json_assert_paths | Assert JSONPath expressions against JSON (exists/equals/type) — agent self-check. | |
json_equal | Deep-compare two JSON documents and list differing paths. | |
yaml_schema_validate | Parse YAML then validate against JSON Schema (Draft 7). | |
tsconfig_lint | Lint tsconfig.json structure (compilerOptions, strict hints). | |
json_pointer_get | Get value by RFC 6901 JSON Pointer (e.g. /user/id). When: Read one field by RFC 6901 pointer without full walk in the agent. | |
json_patch_apply | Apply RFC 6902 JSON Patch ops (add/remove/replace/test/move/copy). When: Apply RFC 6902 ops (add/remove/replace/test/move/copy). | |
json_schema_infer | Infer a Draft-7 JSON Schema from a sample JSON document (agent favorite). | |
jsonl_validate | Validate JSON Lines (NDJSON); optional per-line JSON Schema. When: Validate NDJSON / JSON Lines logs or datasets. | |
xml_to_json | Convert XML document to JSON (attributes as @attr). When: Convert XML → JSON for agents that prefer JSON tools. | |
json_merge_patch | Apply RFC 7396 JSON Merge Patch (null deletes keys). When: RFC 7396 merge patch — use when patching JSON configs. | |
csv_validate | Validate CSV structure — consistent column counts / header. When: Check CSV column consistency before import. | |
ini_parse | Parse INI / simple key=value config into sections. When: Parse INI/section configs into structured maps. | |
openapi_operations_list | List OpenAPI path operations (method, path, operationId, tags). When: List OpenAPI operations before validate/diff. | |
graphql_operations_list | List GraphQL query/mutation/subscription names and type defs. When: List GraphQL ops/types from a document (best-effort). | |
properties_parse | Parse Java .properties key=value file. When: Parse Java .properties key=value configs (best-effort). | |
time_now | Current UTC unix timestamp and ISO-8601. | |
time_convert | Convert unix seconds or ISO-8601 to both formats. | |
timezone_convert | Convert datetime between IANA timezones (e.g. UTC to Asia/Shanghai). | |
timezone_list | List common IANA timezone names for conversion. | |
datetime_parse | Parse unix timestamp or ISO-8601 into UTC ISO + unix. | |
duration_parse | Parse duration (ISO-8601 PnDTnHnMnS or human 1h30m / 90s) to seconds. When: Parse ISO-8601 / human durations to seconds. | |
regex_test | Test regex pattern; returns match, groups, span. | |
regex_replace | Replace regex matches in text (supports backreferences in replacement). | |
text_diff | Unified line diff between two texts (like git diff). | |
text_slugify | URL-safe slug from title or heading. When: Make URL-safe slugs from titles/filenames. | |
text_stats | Count chars, words, lines, sentences; estimate reading time. | |
text_case_convert | Convert case: lower, upper, title, snake, kebab, camel, pascal. | |
text_lorem | Generate lorem ipsum placeholder paragraphs. | |
color_convert | Convert color between hex, rgb(), and hsl(). | |
unit_convert | Convert units: length, weight, temperature, data, speed, time. | |
unit_list | List supported units per category for unit_convert. | |
markdown_to_html | Convert Markdown text to HTML. When: Render markdown → HTML for previews or emails. | |
html_to_markdown | Convert HTML to Markdown text. When: Convert HTML → markdown for docs the agent edits. | |
pick_choice | Pick one item from a list (optional seed for reproducibility). | |
string_truncate | Truncate text with ellipsis. When: Truncate long strings with ellipsis for UI/logs. | |
extract_urls | Extract HTTP/HTTPS URLs from arbitrary text. | |
extract_emails | Extract email addresses from text. When: Pull email addresses from free text / logs. | |
email_validate | Validate email address format. When: Syntax-check a single email address. | |
text_wrap | Wrap text to a maximum line width. When: Hard-wrap text to a column width. | |
list_unique | Deduplicate list items preserving order. | |
template_fill | Fill {{variable}} placeholders in a template string. | |
unicode_normalize | Unicode normalization (NFC/NFD/NFKC/NFKD). | |
user_agent_parse | Parse User-Agent string into browser, OS, and device hints. | |
secrets_scan | Scan text for hardcoded secrets (API keys, tokens, private keys). Returns redacted findings. | |
dockerfile_lint | Lint Dockerfile for common security/style issues (root user, curl|sh, secrets). | |
env_required_check | Check .env text contains required keys (and non-empty values). | |
path_safety_check | Check filesystem path for traversal / absolute / sensitive system paths. | |
spdx_license_check | Validate SPDX license expression against common license IDs. | |
robots_txt_validate | Validate robots.txt syntax and User-agent rules. | |
csp_parse | Parse Content-Security-Policy header and flag unsafe directives. | |
cors_check | Check CORS Allow-Origin vs credentials for unsafe combinations. | |
markdown_link_extract | Extract markdown/bare links and flag javascript: URLs. | |
gitignore_check | Review .gitignore for common missing ignores (.env, node_modules, keys). | |
editorconfig_validate | Validate .editorconfig syntax and common keys. | |
nginx_config_lint | Lint nginx config snippets (braces, SSLv3, server_tokens, HSTS hints). | |
sql_danger_scan | Scan SQL text for dangerous patterns (DROP/TRUNCATE/DELETE without WHERE). Note: best-effort / heuristic — not a full language parser. | |
html_security_scan | Scan HTML for XSS-prone patterns (javascript: URLs, inline handlers, eval). Note: best-effort / heuristic — not a full language parser. | |
conventional_commit_lint | Lint Conventional Commits message (feat/fix/chore…). | |
changelog_parse | Parse Keep-a-Changelog style markdown into version sections. | |
todo_comment_extract | Extract TODO/FIXME/HACK/XXX comments with line numbers. | |
code_fence_extract | Extract fenced code blocks from markdown (language + code). | |
unified_diff_parse | Parse unified diff — files changed, lines added/removed. | |
glob_match_batch | Match paths against glob patterns (gitignore-style fnmatch). | |
identifier_validate | Validate identifier for python/javascript/typescript (keywords + syntax). | |
text_similarity | SequenceMatcher similarity ratio between two texts. | |
import_list_analyze | List imports from python/js source and flag duplicates. Note: best-effort / heuristic — not a full language parser. | |
frontmatter_parse | Parse YAML frontmatter from markdown (--- ... ---). When: Split YAML frontmatter from markdown body. | |
markdown_toc | Build a table of contents from markdown headings. When: Build heading TOC from markdown docs. | |
gitignore_match | Match paths against .gitignore rules (ignore / negate). When: Test paths against .gitignore rules (best-effort). | |
shell_escape | Shell-escape a string for posix/powershell/cmd (safe quoting). When: Safely quote strings for posix/powershell/cmd. | |
path_normalize | Normalize filesystem path (resolve . and ..) for posix or windows. When: Resolve . and .. in filesystem paths. | |
env_diff | Diff two .env files — only_in_a / only_in_b / changed values. When: Diff two .env files for missing/changed keys. | |
package_scripts_list | List scripts from package.json or pyproject.toml (poetry/PEP 621). When: List npm/poetry/PEP 621 scripts from manifests. | |
line_ending_normalize | Detect and normalize line endings to lf/crlf/cr. When: Detect/normalize CRLF vs LF. | |
shebang_parse | Parse #! shebang line — interpreter and args. When: Parse #! interpreter lines in scripts. | |
trailing_whitespace_scan | Scan text for trailing whitespace and tab characters. Note: best-effort / heuristic — not a full language parser. | |
sql_tables_extract | Extract table names from SQL (FROM/JOIN/INTO/UPDATE/TABLE). When: Heuristic extract of SQL table names (best-effort). | |
dependency_versions_extract | Extract name@version from requirements/lockfile/go.mod/Cargo snippets. When: Extract name@version from lock/requirements snippets (best-effort). | |
color_contrast | WCAG contrast ratio between two hex colors (AA/AAA). When: WCAG contrast ratio for UI color pairs. | |
human_bytes | Format bytes to human size, or parse '1.5 GB' to bytes. When: Format or parse human byte sizes (1.5 GB). | |
password_strength | Offline password strength heuristic (length/classes/common). When: Offline password strength heuristic (not a cracker). | |
hosts_file_parse | Parse /etc/hosts style file into IP → hostnames entries. When: Parse /etc/hosts style IP→hostname maps. | |
hash_md5 | MD5 hex digest of UTF-8 text. When: MD5 digest (non-crypto integrity / legacy checksums). | |
hash_sha256 | SHA256 hex digest. | |
hash_sha512 | SHA512 hex digest. | |
base64_encode | Base64-encode UTF-8. | |
base64_decode | Base64-decode to UTF-8. | |
base64url_encode | Base64url-encode UTF-8 (no padding, URL-safe). | |
base64url_decode | Base64url-decode to UTF-8. | |
url_encode | Percent-encode URL component. | |
url_decode | Decode percent-encoded string. | |
html_encode | Escape HTML entities. | |
html_decode | Unescape HTML entities. | |
hex_encode | UTF-8 text to hex string. | |
hex_decode | Hex string to UTF-8 text. | |
uuid_generate | Generate UUID v1/v3/v4/v5 (batch supported). v3/v5 need name + namespace. | |
uuid_parse | Parse UUID string: version, variant, hex bytes. | |
nanoid_generate | Generate URL-friendly nanoid (like npm nanoid). | |
password_generate | Cryptographically secure random password. | |
jwt_decode | Decode JWT payload and header (no signature verification). | |
jwt_verify | Verify JWT signature (HS* with secret, RS* with public_key PEM). | |
jwt_sign | Sign JWT payload (HS* with secret, RS* with private_key PEM). | |
hmac_sign | HMAC sign message (sha1/sha256/sha512); hex or base64 output. | |
hmac_verify | Verify HMAC signature (hex or base64). | |
bcrypt_hash | Bcrypt-hash a password for storage. | |
bcrypt_verify | Verify password against bcrypt hash. | |
radix_convert | Convert number between bases 2-36 (binary, octal, decimal, hex). | |
qr_generate | Generate QR code as SVG (base64 data URI included). | |
random_int | Random integer in inclusive range (optional seed). | |
random_string | Random string (alphanumeric, hex, base64 charset or custom). | |
hash_compare | Compare two hash digests (case-insensitive). | |
jwt_claims_audit | Decode JWT header/claims (no verify) and flag alg=none, missing exp, privileged roles. | |
remote_matrix | Remote desktop tools comparison JSON for AI citation. | |
url_parse | Parse URL into scheme, host, path, query components. | |
http_status_lookup | Explain HTTP status code (e.g. 404, 429, 503). | |
semver_parse | Parse semver string into major, minor, patch, prerelease. | |
semver_compare | Compare two semver strings (less / equal / greater). | |
semver_satisfies | Check if version satisfies npm-style range (^ ~ >= <= > <). | |
semver_satisfies_batch | Batch semver range checks for dependency audits (max 50). | |
semver_range_intersects | Heuristic check whether two semver ranges share any sample versions (conflict hint). | |
semver_sort | Sort a list of semver versions ascending or descending. When: Sort semver lists before picking latest/oldest. | |
semver_max_satisfying | Pick the highest version that satisfies a semver range (npm-style). | |
semver_inc | Bump a semver version by major/minor/patch. When: Bump major/minor/patch when cutting a release. | |
cidr_calc | Calculate IPv4/IPv6 network info from CIDR (hosts, broadcast, private). | |
cidr_contains | Check if IP address falls within a CIDR range. | |
ip_geolocation | Geolocate public IP: country, city, lat/lon, timezone, ISP. | |
env_parse | Parse .env / dotenv text into key-value variables. | |
pem_decode | List PEM blocks in text (label, DER size, SHA256 fingerprint). | |
x509_parse | Parse X.509 certificate PEM: subject, issuer, validity, SAN, fingerprint. | |
dns_lookup | DNS lookup for domain (A, AAAA, MX, TXT, NS, CNAME, SOA). | |
whois_lookup | Domain registration lookup via RDAP (registrar, dates, nameservers). | |
ssl_cert_fetch | Fetch live TLS certificate from host:port (expiry, issuer, SAN). | |
reverse_dns | Reverse DNS (PTR) lookup for IP address. | |
port_check | TCP port open/closed check with latency ms. | |
http_headers_fetch | Fetch HTTP response headers (HEAD/GET) for URL. | |
currency_list | List supported fiat currencies (Frankfurter/ECB, no API key). | |
currency_rates | Latest exchange rates (Frankfurter ECB data, no API key). | |
currency_convert | Convert amount between currencies using latest ECB rates. | |
url_ssrf_check | Check URL for SSRF risk (localhost, private IP, metadata hosts). | |
ipv4_private_check | Classify IP as private/loopback/link-local/global (SSRF helper). | |
url_normalize | Normalize URL (lowercase host, sort query, drop fragment). | |
content_type_parse | Parse Content-Type header into mime/charset/params. | |
http_status_classify | Classify HTTP status codes into 2xx/3xx/4xx/5xx buckets. | |
query_string_parse | Parse URL query string into key/value map (supports multi-values). When: Parse URL query strings into maps. | |
query_string_build | Build URL query string from params object. When: Build query strings from param objects. | |
cookie_header_parse | Parse Cookie request header into name/value map. When: Parse Cookie request headers. | |
mime_lookup | Lookup MIME type by file extension/path, or extensions by MIME. When: Map file extension ↔ MIME type. | |
url_join | Join base URL with relative path (urllib urljoin). When: Join base URL + relative path correctly. | |
domain_parse | Parse domain into labels, TLD, registrable domain, subdomain. When: Split domain into subdomain/registrable/TLD (best-effort eTLD). | |
git_url_parse | Parse git remote URL (ssh/https) into host/owner/repo. When: Parse git@ / https remotes into owner/repo. | |
http_headers_parse | Parse raw HTTP request/response header block into map. When: Parse raw HTTP header blocks. | |
ip_version_detect | Detect IPv4/IPv6 and classify private/loopback/global. When: Classify IPv4/IPv6 and private/global. | |
cron_parse | Parse 5-field cron into named fields (minute hour dom month dow). | |
cron_validate | Check cron string has exactly five fields. | |
cron_semantic_validate | Validate cron field syntax and value ranges (minute 0-59, hour 0-23, etc.). | |
cron_next_runs | Preview next N execution times for a 5-field cron expression. | |
cron_describe | Human-readable natural language description of cron expression (EN + ZH). | |
cron_matches | Check if a cron expression matches a specific datetime (ISO-8601). | |
cron_validate_batch | Batch semantic validate of 5-field cron expressions. | |
mail_inbox_create | Create disposable receive-only inbox @mail.toolapi.org (24h TTL). Returns address + secret token. | |
mail_inbox_list | List messages in a temp inbox (requires token from mail_inbox_create). | |
mail_inbox_read | Read full message body from temp inbox. |
What https://toolapi.org/mcp answered to tools/list, asked without credentials. answered without the initialize handshake. The token figure is the size of the list as sent, divided by four; a model sees about that much before it calls anything. Full definitions, input schemas included, are in the listing's JSON under mcpTools.
How its tools read to an agent 0 errors · 394 warnings · 1 note
- warnTC06base64_decodethe description is "Base64-decode to UTF-8."
- warnTC06base64_encodethe description is "Base64-encode UTF-8."
- warnTC06base64url_decodethe description is "Base64url-decode to UTF-8."
- warnTC06hash_sha256the description is "SHA256 hex digest."
- warnTC06hash_sha512the description is "SHA512 hex digest."
- warnTC06html_decodethe description is "Unescape HTML entities."
- warnTC06html_encodethe description is "Escape HTML entities."
- warnTC06unicode_normalizethe description is "Unicode normalization (NFC/NFD/NFKC/NFKD)."
- warnTC06url_decodethe description is "Decode percent-encoded string."
- warnTC06url_encodethe description is "Percent-encode URL component."
- warnTC11base64_decodeits one parameter, text, has no description
- warnTC11base64_encodeits one parameter, text, has no description
- warnTC11base64url_decodeits one parameter, text, has no description
- warnTC11base64url_encodeits one parameter, text, has no description
- warnTC11bcrypt_hashnone of its 2 parameters has a description
- warnTC11bcrypt_verifynone of its 2 parameters has a description
- warnTC11changelog_parseits one parameter, text, has no description
- warnTC11cidr_containsnone of its 2 parameters has a description
- warnTC11code_fence_extractits one parameter, text, has no description
- warnTC11color_contrastnone of its 2 parameters has a description
- warnTC11color_convert1 parameter without a description: to_format
- warnTC11compose_validateits one parameter, text, has no description
- warnTC11content_type_parseits one parameter, header, has no description
- warnTC11conventional_commit_lintits one parameter, message, has no description
The first 24 of 395; every finding is in the listing's JSON under mcpTools.check.
The checks from /check and anchor check, run each day on the list above: about 11,783 tokens of definitions. Not part of the score yet. Check your own server.