# ToolAPI

> ToolAPI, an MCP server by toolapi.org, listed from the official MCP registry. Indexed, not reviewed: facts and our own checks, no score or ranking. Free public MCP for AI agents — 193 tools, 44 workflows. No API key.

- Canonical: https://www.anchorterminal.com/tools/toolapi-hub
- Markdown: https://www.anchorterminal.com/tools/toolapi-hub.md (~5,450 tokens)
- Slim: https://www.anchorterminal.com/tools/toolapi-hub.min.md (~5,380 tokens, same facts, less prose, for token-sensitive contexts)
- JSON: https://www.anchorterminal.com/tools/toolapi-hub.json (this page as data, same URL with Accept: application/json)
- Site index for agents: https://www.anchorterminal.com/llms.txt (full text: https://www.anchorterminal.com/llms-full.txt)
- API: https://www.anchorterminal.com/api/v1/index.json
- Updated: 2026-10-05

# ToolAPI

> Indexed, not reviewed: facts from the official MCP registry and our own checks. No score, grade or rank, and not in the rankings until the panel reviews it. How the index works: https://www.anchorterminal.com/indexed/

- Kind: MCP server, by toolapi.org (https://toolapi.org)
- Category: Workflow automation (https://www.anchorterminal.com/categories/workflow-automation.md)
- Listed because: It's published in the registry under toolapi.org, a namespace the registry only gives to whoever proves they control that domain.
- What the official MCP registry says: Free public MCP for AI agents — 193 tools, 44 workflows. No API key.

## Facts

- MCP registry: `org.toolapi/hub` 2.8.2
- Endpoint: https://toolapi.org/mcp (streamable HTTP)
- Source: https://github.com/baohuiwb/toolapi
- Website: https://toolapi.org
- GitHub stars: 2
- Registry entry updated: 2026-07-10

## Tools

- Tools it lists (193, about 11,783 tokens of context, `tools/list` without credentials, checked 2026-10-04 22:25 UTC):
  - `json_validate`: Validate JSON text; return parsed object or error.
  - `json_format`: Pretty-print JSON with indent. When: Pretty-print JSON when the agent needs readable output.
  - `json_minify`: Minify JSON (remove whitespace). When: Minify JSON for compact payloads or size checks.
  - `csv_to_json`: Convert CSV text to JSON array of row objects. When: Convert CSV rows → JSON array of objects.
  - `json_to_csv`: Convert JSON array of objects to CSV text.
  - `yaml_validate`: Validate YAML text; return parsed object or error.
  - `yaml_to_json`: Parse YAML and return JSON-compatible object.
  - `json_to_yaml`: Convert JSON text to YAML string. When: Convert JSON → YAML for config files agents write.
  - `xml_validate`: Validate XML markup (well-formed check).
  - `xml_format`: Pretty-print XML with indentation. When: Pretty-print XML after the agent edits markup.
  - `jsonpath_query`: Query JSON with JSONPath expression; returns matching values.
  - `json_merge`: Deep-merge two JSON objects (second overlays first).
  - `json_flatten`: Flatten nested JSON to dot-key map. When: Flatten nested JSON keys before comparing or exporting.
  - `json_pretty_diff`: Unified diff of two JSON documents (pretty-printed).
  - `json_sort_keys`: Recursively sort JSON object keys. When: Canonicalize JSON key order for stable diffs/hashes.
  - `json_type_summary`: Summarize JSON value types (counts per type in tree).
  - `json_schema_validate`: Validate JSON data against JSON Schema (Draft 7).
  - `toml_validate`: Validate TOML text; return parsed object or error.
  - `toml_to_json`: Parse TOML and return JSON-compatible object.
  - `json_to_toml`: Convert JSON object text to TOML string.
  - `toml_schema_validate`: Validate TOML config against JSON Schema (Draft 7) in one step.
  - `sql_format`: Format SQL text (never executed; reindent + keyword case).
  - `graphql_validate`: Validate GraphQL query or schema SDL syntax (parse only).
  - `openapi_validate`: Validate OpenAPI 3.x document (JSON or YAML snippet).
  - `openapi_diff`: Compare two OpenAPI specs and flag breaking vs non-breaking API changes.
  - `package_manifest_audit`: Audit package.json or pyproject.toml — license, risky scripts, loose ranges; emit semver_checks for batch. Note: best-effort / heuristic — not a full language…
  - `graphql_schema_diff`: Diff two GraphQL schemas for removed types/fields (breaking changes).
  - `compose_validate`: Validate docker-compose YAML and flag privileged/host-network/secret env issues.
  - `github_actions_lint`: Lint GitHub Actions workflow YAML (triggers, unpinned actions, curl|bash).
  - `requirements_audit`: Audit Python requirements.txt for unpinned/VCS/deprecated packages.
  - `json_schema_validate_batch`: Batch JSON Schema (Draft 7) validation — up to 25 documents (agent favorite).
  - `json_assert_paths`: Assert JSONPath expressions against JSON (exists/equals/type) — agent self-check.
  - `json_equal`: Deep-compare two JSON documents and list differing paths.
  - `yaml_schema_validate`: Parse YAML then validate against JSON Schema (Draft 7).
  - `tsconfig_lint`: Lint tsconfig.json structure (compilerOptions, strict hints).
  - `json_pointer_get`: Get value by RFC 6901 JSON Pointer (e.g. /user/id). When: Read one field by RFC 6901 pointer without full walk in the agent.
  - `json_patch_apply`: Apply RFC 6902 JSON Patch ops (add/remove/replace/test/move/copy). When: Apply RFC 6902 ops (add/remove/replace/test/move/copy).
  - `json_schema_infer`: Infer a Draft-7 JSON Schema from a sample JSON document (agent favorite).
  - `jsonl_validate`: Validate JSON Lines (NDJSON); optional per-line JSON Schema. When: Validate NDJSON / JSON Lines logs or datasets.
  - `xml_to_json`: Convert XML document to JSON (attributes as @attr). When: Convert XML → JSON for agents that prefer JSON tools.
  - `json_merge_patch`: Apply RFC 7396 JSON Merge Patch (null deletes keys). When: RFC 7396 merge patch — use when patching JSON configs.
  - `csv_validate`: Validate CSV structure — consistent column counts / header. When: Check CSV column consistency before import.
  - `ini_parse`: Parse INI / simple key=value config into sections. When: Parse INI/section configs into structured maps.
  - `openapi_operations_list`: List OpenAPI path operations (method, path, operationId, tags). When: List OpenAPI operations before validate/diff.
  - `graphql_operations_list`: List GraphQL query/mutation/subscription names and type defs. When: List GraphQL ops/types from a document (best-effort).
  - `properties_parse`: Parse Java .properties key=value file. When: Parse Java .properties key=value configs (best-effort).
  - `time_now`: Current UTC unix timestamp and ISO-8601.
  - `time_convert`: Convert unix seconds or ISO-8601 to both formats.
  - `timezone_convert`: Convert datetime between IANA timezones (e.g. UTC to Asia/Shanghai).
  - `timezone_list`: List common IANA timezone names for conversion.
  - `datetime_parse`: Parse unix timestamp or ISO-8601 into UTC ISO + unix.
  - `duration_parse`: Parse duration (ISO-8601 PnDTnHnMnS or human 1h30m / 90s) to seconds. When: Parse ISO-8601 / human durations to seconds.
  - `regex_test`: Test regex pattern; returns match, groups, span.
  - `regex_replace`: Replace regex matches in text (supports backreferences in replacement).
  - `text_diff`: Unified line diff between two texts (like git diff).
  - `text_slugify`: URL-safe slug from title or heading. When: Make URL-safe slugs from titles/filenames.
  - `text_stats`: Count chars, words, lines, sentences; estimate reading time.
  - `text_case_convert`: Convert case: lower, upper, title, snake, kebab, camel, pascal.
  - `text_lorem`: Generate lorem ipsum placeholder paragraphs.
  - `color_convert`: Convert color between hex, rgb(), and hsl().
  - `unit_convert`: Convert units: length, weight, temperature, data, speed, time.
  - `unit_list`: List supported units per category for unit_convert.
  - `markdown_to_html`: Convert Markdown text to HTML. When: Render markdown → HTML for previews or emails.
  - `html_to_markdown`: Convert HTML to Markdown text. When: Convert HTML → markdown for docs the agent edits.
  - `pick_choice`: Pick one item from a list (optional seed for reproducibility).
  - `string_truncate`: Truncate text with ellipsis. When: Truncate long strings with ellipsis for UI/logs.
  - `extract_urls`: Extract HTTP/HTTPS URLs from arbitrary text.
  - `extract_emails`: Extract email addresses from text. When: Pull email addresses from free text / logs.
  - `email_validate`: Validate email address format. When: Syntax-check a single email address.
  - `text_wrap`: Wrap text to a maximum line width. When: Hard-wrap text to a column width.
  - `list_unique`: Deduplicate list items preserving order.
  - `template_fill`: Fill {{variable}} placeholders in a template string.
  - `unicode_normalize`: Unicode normalization (NFC/NFD/NFKC/NFKD).
  - `user_agent_parse`: Parse User-Agent string into browser, OS, and device hints.
  - `secrets_scan`: Scan text for hardcoded secrets (API keys, tokens, private keys). Returns redacted findings.
  - `dockerfile_lint`: Lint Dockerfile for common security/style issues (root user, curl|sh, secrets).
  - `env_required_check`: Check .env text contains required keys (and non-empty values).
  - `path_safety_check`: Check filesystem path for traversal / absolute / sensitive system paths.
  - `spdx_license_check`: Validate SPDX license expression against common license IDs.
  - `robots_txt_validate`: Validate robots.txt syntax and User-agent rules.
  - `csp_parse`: Parse Content-Security-Policy header and flag unsafe directives.
  - `cors_check`: Check CORS Allow-Origin vs credentials for unsafe combinations.
  - `markdown_link_extract`: Extract markdown/bare links and flag javascript: URLs.
  - `gitignore_check`: Review .gitignore for common missing ignores (.env, node_modules, keys).
  - `editorconfig_validate`: Validate .editorconfig syntax and common keys.
  - `nginx_config_lint`: Lint nginx config snippets (braces, SSLv3, server_tokens, HSTS hints).
  - `sql_danger_scan`: Scan SQL text for dangerous patterns (DROP/TRUNCATE/DELETE without WHERE). Note: best-effort / heuristic — not a full language parser.
  - `html_security_scan`: Scan HTML for XSS-prone patterns (javascript: URLs, inline handlers, eval). Note: best-effort / heuristic — not a full language parser.
  - `conventional_commit_lint`: Lint Conventional Commits message (feat/fix/chore…).
  - `changelog_parse`: Parse Keep-a-Changelog style markdown into version sections.
  - `todo_comment_extract`: Extract TODO/FIXME/HACK/XXX comments with line numbers.
  - `code_fence_extract`: Extract fenced code blocks from markdown (language + code).
  - `unified_diff_parse`: Parse unified diff — files changed, lines added/removed.
  - `glob_match_batch`: Match paths against glob patterns (gitignore-style fnmatch).
  - `identifier_validate`: Validate identifier for python/javascript/typescript (keywords + syntax).
  - `text_similarity`: SequenceMatcher similarity ratio between two texts.
  - `import_list_analyze`: List imports from python/js source and flag duplicates. Note: best-effort / heuristic — not a full language parser.
  - `frontmatter_parse`: Parse YAML frontmatter from markdown (--- ... ---). When: Split YAML frontmatter from markdown body.
  - `markdown_toc`: Build a table of contents from markdown headings. When: Build heading TOC from markdown docs.
  - `gitignore_match`: Match paths against .gitignore rules (ignore / negate). When: Test paths against .gitignore rules (best-effort).
  - `shell_escape`: Shell-escape a string for posix/powershell/cmd (safe quoting). When: Safely quote strings for posix/powershell/cmd.
  - `path_normalize`: Normalize filesystem path (resolve . and ..) for posix or windows. When: Resolve . and .. in filesystem paths.
  - `env_diff`: Diff two .env files — only_in_a / only_in_b / changed values. When: Diff two .env files for missing/changed keys.
  - `package_scripts_list`: List scripts from package.json or pyproject.toml (poetry/PEP 621). When: List npm/poetry/PEP 621 scripts from manifests.
  - `line_ending_normalize`: Detect and normalize line endings to lf/crlf/cr. When: Detect/normalize CRLF vs LF.
  - `shebang_parse`: Parse #! shebang line — interpreter and args. When: Parse #! interpreter lines in scripts.
  - `trailing_whitespace_scan`: Scan text for trailing whitespace and tab characters. Note: best-effort / heuristic — not a full language parser.
  - `sql_tables_extract`: Extract table names from SQL (FROM/JOIN/INTO/UPDATE/TABLE). When: Heuristic extract of SQL table names (best-effort).
  - `dependency_versions_extract`: Extract name@version from requirements/lockfile/go.mod/Cargo snippets. When: Extract name@version from lock/requirements snippets (best-effort).
  - `color_contrast`: WCAG contrast ratio between two hex colors (AA/AAA). When: WCAG contrast ratio for UI color pairs.
  - `human_bytes`: Format bytes to human size, or parse '1.5 GB' to bytes. When: Format or parse human byte sizes (1.5 GB).
  - `password_strength`: Offline password strength heuristic (length/classes/common). When: Offline password strength heuristic (not a cracker).
  - `hosts_file_parse`: Parse /etc/hosts style file into IP → hostnames entries. When: Parse /etc/hosts style IP→hostname maps.
  - `hash_md5`: MD5 hex digest of UTF-8 text. When: MD5 digest (non-crypto integrity / legacy checksums).
  - `hash_sha256`: SHA256 hex digest.
  - `hash_sha512`: SHA512 hex digest.
  - `base64_encode`: Base64-encode UTF-8.
  - `base64_decode`: Base64-decode to UTF-8.
  - `base64url_encode`: Base64url-encode UTF-8 (no padding, URL-safe).
  - `base64url_decode`: Base64url-decode to UTF-8.
  - `url_encode`: Percent-encode URL component.
  - `url_decode`: Decode percent-encoded string.
  - `html_encode`: Escape HTML entities.
  - `html_decode`: Unescape HTML entities.
  - `hex_encode`: UTF-8 text to hex string.
  - `hex_decode`: Hex string to UTF-8 text.
  - `uuid_generate`: Generate UUID v1/v3/v4/v5 (batch supported). v3/v5 need name + namespace.
  - `uuid_parse`: Parse UUID string: version, variant, hex bytes.
  - `nanoid_generate`: Generate URL-friendly nanoid (like npm nanoid).
  - `password_generate`: Cryptographically secure random password.
  - `jwt_decode`: Decode JWT payload and header (no signature verification).
  - `jwt_verify`: Verify JWT signature (HS* with secret, RS* with public_key PEM).
  - `jwt_sign`: Sign JWT payload (HS* with secret, RS* with private_key PEM).
  - `hmac_sign`: HMAC sign message (sha1/sha256/sha512); hex or base64 output.
  - `hmac_verify`: Verify HMAC signature (hex or base64).
  - `bcrypt_hash`: Bcrypt-hash a password for storage.
  - `bcrypt_verify`: Verify password against bcrypt hash.
  - `radix_convert`: Convert number between bases 2-36 (binary, octal, decimal, hex).
  - `qr_generate`: Generate QR code as SVG (base64 data URI included).
  - `random_int`: Random integer in inclusive range (optional seed).
  - `random_string`: Random string (alphanumeric, hex, base64 charset or custom).
  - `hash_compare`: Compare two hash digests (case-insensitive).
  - `jwt_claims_audit`: Decode JWT header/claims (no verify) and flag alg=none, missing exp, privileged roles.
  - `remote_matrix`: Remote desktop tools comparison JSON for AI citation.
  - `url_parse`: Parse URL into scheme, host, path, query components.
  - `http_status_lookup`: Explain HTTP status code (e.g. 404, 429, 503).
  - `semver_parse`: Parse semver string into major, minor, patch, prerelease.
  - `semver_compare`: Compare two semver strings (less / equal / greater).
  - `semver_satisfies`: Check if version satisfies npm-style range (^ ~ >= <= > <).
  - `semver_satisfies_batch`: Batch semver range checks for dependency audits (max 50).
  - `semver_range_intersects`: Heuristic check whether two semver ranges share any sample versions (conflict hint).
  - `semver_sort`: Sort a list of semver versions ascending or descending. When: Sort semver lists before picking latest/oldest.
  - `semver_max_satisfying`: Pick the highest version that satisfies a semver range (npm-style).
  - `semver_inc`: Bump a semver version by major/minor/patch. When: Bump major/minor/patch when cutting a release.
  - `cidr_calc`: Calculate IPv4/IPv6 network info from CIDR (hosts, broadcast, private).
  - `cidr_contains`: Check if IP address falls within a CIDR range.
  - `ip_geolocation`: Geolocate public IP: country, city, lat/lon, timezone, ISP.
  - `env_parse`: Parse .env / dotenv text into key-value variables.
  - `pem_decode`: List PEM blocks in text (label, DER size, SHA256 fingerprint).
  - `x509_parse`: Parse X.509 certificate PEM: subject, issuer, validity, SAN, fingerprint.
  - `dns_lookup`: DNS lookup for domain (A, AAAA, MX, TXT, NS, CNAME, SOA).
  - `whois_lookup`: Domain registration lookup via RDAP (registrar, dates, nameservers).
  - `ssl_cert_fetch`: Fetch live TLS certificate from host:port (expiry, issuer, SAN).
  - `reverse_dns`: Reverse DNS (PTR) lookup for IP address.
  - `port_check`: TCP port open/closed check with latency ms.
  - `http_headers_fetch`: Fetch HTTP response headers (HEAD/GET) for URL.
  - `currency_list`: List supported fiat currencies (Frankfurter/ECB, no API key).
  - `currency_rates`: Latest exchange rates (Frankfurter ECB data, no API key).
  - `currency_convert`: Convert amount between currencies using latest ECB rates.
  - `url_ssrf_check`: Check URL for SSRF risk (localhost, private IP, metadata hosts).
  - `ipv4_private_check`: Classify IP as private/loopback/link-local/global (SSRF helper).
  - `url_normalize`: Normalize URL (lowercase host, sort query, drop fragment).
  - `content_type_parse`: Parse Content-Type header into mime/charset/params.
  - `http_status_classify`: Classify HTTP status codes into 2xx/3xx/4xx/5xx buckets.
  - `query_string_parse`: Parse URL query string into key/value map (supports multi-values). When: Parse URL query strings into maps.
  - `query_string_build`: Build URL query string from params object. When: Build query strings from param objects.
  - `cookie_header_parse`: Parse Cookie request header into name/value map. When: Parse Cookie request headers.
  - `mime_lookup`: Lookup MIME type by file extension/path, or extensions by MIME. When: Map file extension ↔ MIME type.
  - `url_join`: Join base URL with relative path (urllib urljoin). When: Join base URL + relative path correctly.
  - `domain_parse`: Parse domain into labels, TLD, registrable domain, subdomain. When: Split domain into subdomain/registrable/TLD (best-effort eTLD).
  - `git_url_parse`: Parse git remote URL (ssh/https) into host/owner/repo. When: Parse git@ / https remotes into owner/repo.
  - `http_headers_parse`: Parse raw HTTP request/response header block into map. When: Parse raw HTTP header blocks.
  - `ip_version_detect`: Detect IPv4/IPv6 and classify private/loopback/global. When: Classify IPv4/IPv6 and private/global.
  - `cron_parse`: Parse 5-field cron into named fields (minute hour dom month dow).
  - `cron_validate`: Check cron string has exactly five fields.
  - `cron_semantic_validate`: Validate cron field syntax and value ranges (minute 0-59, hour 0-23, etc.).
  - `cron_next_runs`: Preview next N execution times for a 5-field cron expression.
  - `cron_describe`: Human-readable natural language description of cron expression (EN + ZH).
  - `cron_matches`: Check if a cron expression matches a specific datetime (ISO-8601).
  - `cron_validate_batch`: Batch semantic validate of 5-field cron expressions.
  - `mail_inbox_create`: Create disposable receive-only inbox @mail.toolapi.org (24h TTL). Returns address + secret token.
  - `mail_inbox_list`: List messages in a temp inbox (requires token from mail_inbox_create).
  - `mail_inbox_read`: Read full message body from temp inbox.
- How its tools read to an agent (0 errors, 394 warnings, 1 note, about 11,783 tokens; rules at https://www.anchorterminal.com/check.md; not part of the score):
  - warn TC06 base64_decode: the description is "Base64-decode to UTF-8."
  - warn TC06 base64_encode: the description is "Base64-encode UTF-8."
  - warn TC06 base64url_decode: the description is "Base64url-decode to UTF-8."
  - warn TC06 hash_sha256: the description is "SHA256 hex digest."
  - warn TC06 hash_sha512: the description is "SHA512 hex digest."
  - warn TC06 html_decode: the description is "Unescape HTML entities."
  - warn TC06 html_encode: the description is "Escape HTML entities."
  - warn TC06 unicode_normalize: the description is "Unicode normalization (NFC/NFD/NFKC/NFKD)."
  - warn TC06 url_decode: the description is "Decode percent-encoded string."
  - warn TC06 url_encode: the description is "Percent-encode URL component."
  - warn TC11 base64_decode: its one parameter, text, has no description
  - warn TC11 base64_encode: its one parameter, text, has no description
  - warn TC11 base64url_decode: its one parameter, text, has no description
  - warn TC11 base64url_encode: its one parameter, text, has no description
  - warn TC11 bcrypt_hash: none of its 2 parameters has a description
  - warn TC11 bcrypt_verify: none of its 2 parameters has a description
  - warn TC11 changelog_parse: its one parameter, text, has no description
  - warn TC11 cidr_contains: none of its 2 parameters has a description
  - warn TC11 code_fence_extract: its one parameter, text, has no description
  - warn TC11 color_contrast: none of its 2 parameters has a description
  - warn TC11 color_convert: 1 parameter without a description: to_format
  - warn TC11 compose_validate: its one parameter, text, has no description
  - warn TC11 content_type_parse: its one parameter, header, has no description
  - warn TC11 conventional_commit_lint: its one parameter, message, has no description

- JSON: https://www.anchorterminal.com/api/v1/tools/toolapi-hub.json
- Being indexed says nothing about quality, and nobody can pay for it. Ask for a review: https://www.anchorterminal.com/builders/#claiming