Cleanor
NPM · @CLEANOR/MCP · 2 COMPONENTS · SCANNED AUG 3
Zero-auth MCP: image optimize, cited storage/format data, and dev utilities LLMs get wrong.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →
Supply Chain Security70
- No malware found by supply-chain analysis.Pass
- CVE check failed: a known high-severity CVE affects sharp 0.34.5, a direct dependency. A fixed version is available. View diagnostics → Fail
- No install/post-install scripts declared.Pass
- 30 of 30 dependencies flagged as unhealthy (30 deprecated). View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 19 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability81
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 2309 tokens (~104/item across 22 items; 22 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management27
- Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Capabilities60
- Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28. See how to fix → Fail
Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.
npm · @cleanor/mcp
claude mcp add app-cleanor-cleanor -- npx -y @cleanor/mcp
codex mcp add app-cleanor-cleanor -- npx -y @cleanor/mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"app-cleanor-cleanor": {
"type": "local",
"command": [
"npx",
"-y",
"@cleanor/mcp"
],
"enabled": true
}
}
} openclaw mcp add app-cleanor-cleanor --command npx --arg -y --arg @cleanor/mcp
mcp_servers:
app-cleanor-cleanor:
command: "npx"
args: ["-y", "@cleanor/mcp"] {
"mcpServers": {
"app-cleanor-cleanor": {
"command": "npx",
"args": [
"-y",
"@cleanor/mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 3 Aug 26 −4
- Dependency health: 1.00 → 0.00 ▼ functional
- 2 Aug 26 +14
- Stability: unverified → 0.23 ▲ functional
- Schema quality: unverified → excellent ▲ functional
- 1 Aug 26 +32
- GHSA-f88m-g3jw-g9cj affects this package: high ▼ security
- Provenance: unverified → fail ▼ security
- Known CVEs: unverified → fail ▼ security
- Malware scan: unverified → pass ▲ security
- Install scripts: unverified → pass ▲ security
- Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
- MCP protocol: unverified → fail ▼ functional
- License: unverified → pass ▲ functional
- Maintenance: unverified → pass ▲ functional
- Dependency health: unverified → 1.00 ▲ functional
- Licence: MIT functional
- 31 Jul 26 −25
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 27 Jul 26 46
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 3 Aug 2026 · Analysed npm/@cleanor/[email protected]
Provenance none
Ecosystem: npm · Outcome: none
Vulnerabilities 1 finding
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-f88m-g3jw-g9cj | high | yes |
Dependencies 30 packages
30 packages in the resolved dependency tree · 30 deprecated.
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.
base_convert Convert a number between bases ~114
Convert an integer between number bases 2–36 (e.g. hex to binary, decimal to base-36). Arbitrary precision via BigInt, so large values stay exact. Use for radix conversions instead of doing them by hand.
| Name | Type | Req | Description |
|---|---|---|---|
| from_base | integer | — | Base of the input (2–36). |
| to_base | integer | — | Base to convert to (2–36). |
| value | string | yes | The number, in from_base (e.g. "ff", "1010", "255"). |
| Name | Type | Req | Description |
|---|---|---|---|
| decimal | string | yes | The value in base 10. |
| from_base | number | yes | — |
| input | string | yes | — |
| result | string | yes | The value in to_base. |
| to_base | number | yes | — |
No examples provided.
base64 Base64 encode / decode ~98
Encode text to Base64 or decode Base64 back to text (UTF-8 safe). Supports URL-safe alphabet. Use whenever you need to encode/decode data URIs, tokens, or config values instead of guessing the bytes.
| Name | Type | Req | Description |
|---|---|---|---|
| input | string | yes | Text to encode, or Base64 to decode. |
| mode | string | — | Direction. |
| url_safe | boolean | — | Use URL-safe alphabet (-_ instead of +/, no padding). |
| Name | Type | Req | Description |
|---|---|---|---|
| mode | string | yes | encode or decode. |
| result | string | yes | The encoded or decoded text. |
No examples provided.
color Convert a color between formats ~82
Convert a color (hex, rgb() or hsl()) and return hex, RGB and HSL representations at once. Use when picking or translating colors for CSS, design tokens or themes.
| Name | Type | Req | Description |
|---|---|---|---|
| value | string | yes | A color: "#3b82f6", "rgb(59,130,246)" or "hsl(217,91%,60%)". |
| Name | Type | Req | Description |
|---|---|---|---|
| hex | string | yes | — |
| hsl | string | yes | — |
| rgb | string | yes | — |
No examples provided.
color_palette Generate a color palette ~99
Build a harmonious color palette from a base color using color-theory rules (complementary, analogous, triadic, tetradic, or monochromatic). Returns each color as hex and HSL. Use to derive a theme or design tokens from one brand color.
| Name | Type | Req | Description |
|---|---|---|---|
| color | string | yes | Base color: "#3b82f6", "rgb(...)" or "hsl(...)". |
| harmony | string | — | Color-harmony rule. |
| Name | Type | Req | Description |
|---|---|---|---|
| base | string | yes | The base color as hex. |
| colors | array | yes | — |
| harmony | string | yes | — |
No examples provided.
count Count characters, words, lines, bytes ~67
Accurately count characters (Unicode code points), UTF-16 units, words, lines and UTF-8 bytes in text. LLMs are notoriously bad at counting, so always use this tool for "how many characters/words" questions.
| Name | Type | Req | Description |
|---|---|---|---|
| input | string | yes | Text to measure. |
| Name | Type | Req | Description |
|---|---|---|---|
| bytes | number | yes | UTF-8 bytes. |
| characters | number | yes | Unicode code points. |
| lines | number | yes | — |
| utf16_units | number | yes | — |
| words | number | yes | — |
No examples provided.
cron_describe Explain a cron expression ~83
Parse a standard 5-field cron expression (minute hour day-of-month month day-of-week) into a plain-English breakdown and the next few run times in UTC. Use to sanity-check a schedule instead of guessing what the fields mean.
| Name | Type | Req | Description |
|---|---|---|---|
| expression | string | yes | A 5-field cron expression, e.g. "30 2 * * 1-5". |
| Name | Type | Req | Description |
|---|---|---|---|
| day_of_month | string | yes | — |
| day_of_week | string | yes | — |
| hour | string | yes | — |
| minute | string | yes | — |
| month | string | yes | — |
| next_runs | array | yes | Next run times in UTC ISO 8601. |
No examples provided.
datetime Current or parsed date/time ~124
Get the current date/time, or convert a given timestamp, into a target IANA timezone with ISO, Unix and human-readable forms. Pass a Unix timestamp (seconds or ms) or an ISO string as input; omit it for "now". LLMs cannot know the real current time, so use this instead of guessing.
| Name | Type | Req | Description |
|---|---|---|---|
| input | string | — | Optional: a Unix timestamp (s or ms) or ISO date string. Omit for the current time. |
| timezone | string | — | IANA timezone, e.g. "America/New_York" or "UTC". |
| Name | Type | Req | Description |
|---|---|---|---|
| iso_utc | string | yes | — |
| local | string | yes | Human-readable local time in the timezone. |
| timezone | string | yes | — |
| unix_ms | number | yes | — |
| unix_s | number | yes | — |
No examples provided.
diff Line diff between two texts ~84
Compute a line-by-line diff between two texts, marking removed lines with "-", added with "+" and unchanged with two spaces, plus a change count. Use to see exactly what changed instead of comparing by eye. Capped at 1000 lines per side.
| Name | Type | Req | Description |
|---|---|---|---|
| a | string | yes | The original ("before") text. |
| b | string | yes | The updated ("after") text. |
| Name | Type | Req | Description |
|---|---|---|---|
| added | number | yes | — |
| changed | boolean | yes | — |
| diff | string | yes | The line diff (+/-/space prefixed), empty if identical. |
| removed | number | yes | — |
No examples provided.
hash Hash text (SHA family) ~111
Compute a cryptographic hash of text (SHA-1, SHA-256, SHA-384 or SHA-512) and return the hex digest. Use for checksums, cache keys, or verifying content. MD5 is intentionally not offered (broken, and unavailable in Web Crypto). LLMs cannot compute these reliably by hand, so always use this tool instead of guessing.
| Name | Type | Req | Description |
|---|---|---|---|
| algorithm | string | — | Hash algorithm. Default sha-256. |
| input | string | yes | Text to hash (UTF-8). |
| Name | Type | Req | Description |
|---|---|---|---|
| algorithm | string | yes | The hash algorithm used. |
| hex | string | yes | The hex-encoded digest. |
No examples provided.
hmac HMAC signature of a message ~113
Compute an HMAC (keyed hash) of a message with a secret, using SHA-1/256/384/512, returned as hex or Base64. Use to sign webhook payloads or verify a signature instead of guessing. LLMs cannot compute this by hand.
| Name | Type | Req | Description |
|---|---|---|---|
| algorithm | string | — | Hash algorithm. |
| encoding | string | — | Output encoding. |
| message | string | yes | The message to sign (UTF-8). |
| secret | string | yes | The shared secret key (UTF-8). |
| Name | Type | Req | Description |
|---|---|---|---|
| algorithm | string | yes | — |
| encoding | string | yes | — |
| signature | string | yes | The HMAC in the requested encoding. |
No examples provided.
image_format_savings Real storage savings of next-gen image formats ~121
How much smaller WebP, AVIF or JPEG XL are than JPEG at matched perceptual quality, from Cleanor Labs’ controlled benchmark. Also reports the "HEIC conversion tax" (converting an iPhone HEIC to JPG/PNG makes it bigger). Use to justify a format choice when building a site or app.
| Name | Type | Req | Description |
|---|---|---|---|
| format | string | — | Target format to compare against JPEG. |
| quality | string | — | web = typical web quality (SSIM 0.95); high = near-lossless (SSIM 0.98). |
| Name | Type | Req | Description |
|---|---|---|---|
| all_formats | object | yes | — |
| format | string | yes | — |
| percent_smaller_than_jpeg | number | yes | — |
| quality | string | yes | — |
| source | string | yes | — |
No examples provided.
json_format Format / validate JSON ~90
Validate JSON and pretty-print or minify it, optionally sorting object keys. Returns a precise parse error (with position) if invalid. Use to check and clean JSON instead of eyeballing it.
| Name | Type | Req | Description |
|---|---|---|---|
| input | string | yes | JSON text. |
| mode | string | — | pretty = 2-space indent; minify = single line. |
| sort_keys | boolean | — | Sort object keys alphabetically (deep). |
| Name | Type | Req | Description |
|---|---|---|---|
| formatted | string | yes | The formatted JSON text. |
| valid | boolean | yes | Whether the input was valid JSON. |
No examples provided.
jwt_decode Decode a JWT (no verification) ~67
Decode a JSON Web Token into its header and payload so you can inspect claims (iss, exp, sub, scopes). The signature is NOT verified and no secret is required or stored. Use to read a token during debugging.
| Name | Type | Req | Description |
|---|---|---|---|
| token | string | yes | The JWT (three dot-separated segments). |
| Name | Type | Req | Description |
|---|---|---|---|
| exp_iso | string | — | Expiry as ISO 8601, if present. |
| expired | boolean | — | Whether the token is past its exp, if present. |
| header | — | — | The decoded JWT header object. |
| payload | — | — | The decoded JWT payload (claims). |
No examples provided.
optimize_image Optimize / convert an image for the web ~165
Fetch an image from a public URL and re-encode it smaller (WebP/AVIF/JPEG), optionally resizing to a target width. Returns the optimized image plus before/after byte sizes. Use this when an AI-generated or dropped-in asset (hero image, screenshot, illustration) is too large to ship.
| Name | Type | Req | Description |
|---|---|---|---|
| format | string | — | Output format. webp = best browser support; avif = smallest; jpeg = universal. |
| image_url | string | yes | Public URL of the source image (PNG/JPEG/WebP/AVIF/GIF). |
| quality | integer | — | Encode quality 1-100 (80 is a good default). |
| width | integer | — | Resize to this width in px, preserving aspect ratio. Omit to keep original size. |
| Name | Type | Req | Description |
|---|---|---|---|
| format | string | yes | Output image format. |
| mime_type | string | yes | — |
| optimized_bytes | number | yes | — |
| original_bytes | number | yes | — |
| saved_pct | number | yes | Percent smaller than the original. |
No examples provided.
placeholder_image Generate a placeholder image (SVG) ~127
Generate a lightweight SVG placeholder image at any size, with an optional label and custom background/text colors. Dependency-free, pastes straight into a page or mockup. Use for wireframes and design stubs instead of hotlinking a placeholder service.
| Name | Type | Req | Description |
|---|---|---|---|
| bg | string | — | Background color (hex, rgb() or hsl()). |
| color | string | — | Text color. |
| height | integer | — | Height in pixels. |
| text | string | — | Label text. Defaults to the dimensions, e.g. "600×400". |
| width | integer | — | Width in pixels. |
| Name | Type | Req | Description |
|---|---|---|---|
| height | number | yes | — |
| svg | string | yes | The SVG markup. |
| width | number | yes | — |
No examples provided.
qr_code Generate a QR code (SVG) ~89
Encode text or a URL as a QR code and return a crisp, dependency-free SVG you can paste straight into a page, deck or doc.
| Name | Type | Req | Description |
|---|---|---|---|
| ecc | string | — | Error-correction level: L=7%, M=15%, Q=25%, H=30% recoverable. |
| size | integer | — | SVG pixel size. |
| text | string | yes | Text or URL to encode. |
| Name | Type | Req | Description |
|---|---|---|---|
| svg | string | yes | The QR code as SVG markup. |
No examples provided.
regex_test Test a regular expression ~111
Test a JavaScript regular expression against sample text and return whether it matches, plus every match with its captured groups and index. Use to verify a pattern instead of reasoning about it in your head. Input and pattern are length-capped to keep it fast and safe.
| Name | Type | Req | Description |
|---|---|---|---|
| flags | string | — | Regex flags, e.g. "gi". Allowed: g i m s u y d. |
| input | string | yes | Text to test against. |
| pattern | string | yes | The regex pattern (without slashes). |
| Name | Type | Req | Description |
|---|---|---|---|
| match_count | number | yes | — |
| matched | boolean | yes | Whether the pattern matched at all. |
| matches | array | yes | Each match with its start index and captured groups. |
| truncated | boolean | yes | True if results were capped at 100. |
No examples provided.
slugify Slugify text for URLs ~62
Turn a title or phrase into a clean, URL-safe slug (lowercase, hyphenated, accents stripped). Use when generating page paths, filenames or anchor IDs.
| Name | Type | Req | Description |
|---|---|---|---|
| input | string | yes | Text to slugify. |
| separator | string | — | Word separator. |
| Name | Type | Req | Description |
|---|---|---|---|
| slug | string | yes | The URL-safe slug. |
No examples provided.
storage_capacity How much fits in a phone storage tier ~103
How many photos or minutes of video actually fit in a given storage size, corrected for real OS/filesystem overhead. Backed by Cleanor Labs measured per-item sizes. Use for realistic sample copy, dashboards, or "how many photos fit in 128 GB" answers.
| Name | Type | Req | Description |
|---|---|---|---|
| content | string | — | What to count. |
| storage_gb | number | yes | Advertised storage size in GB (e.g. 64, 128, 256, 512). |
| Name | Type | Req | Description |
|---|---|---|---|
| breakdown | array | yes | How many of each item fit. |
| content | string | yes | — |
| storage_gb | number | yes | — |
| usable_gb | number | yes | Usable GB after OS/filesystem overhead. |
No examples provided.
unit_convert Convert between units ~177
Convert a value between units of length, mass, data size, time, speed or temperature. Supported units: mm, cm, m, km, in, ft, yd, mi, nmi, mg, g, kg, t, oz, lb, st, bit, byte, kb, kib, mb, mib, gb, gib, tb, tib, ms, s, min, h, day, week, mps, kph, mph, fps, knot, c, f, k. Use for exact conversions instead of approximating.
| Name | Type | Req | Description |
|---|---|---|---|
| from | string | yes | Source unit (e.g. "km", "lb", "mib", "c"). |
| to | string | yes | Target unit (must be the same category as "from"). |
| value | number | yes | The numeric value to convert. |
| Name | Type | Req | Description |
|---|---|---|---|
| category | string | yes | — |
| from | string | yes | — |
| result | number | yes | — |
| to | string | yes | — |
| value | number | yes | — |
No examples provided.
url_parse Parse a URL into parts ~59
Break a URL into its components: scheme, host, port, path, decoded query parameters and fragment. Use to inspect or debug a URL instead of parsing it by eye.
| Name | Type | Req | Description |
|---|---|---|---|
| url | string | yes | The URL to parse (absolute, with scheme). |
| Name | Type | Req | Description |
|---|---|---|---|
| fragment | string | yes | — |
| host | string | yes | — |
| path | string | yes | — |
| port | string | yes | Port, or empty if the scheme default. |
| query | array | yes | — |
| scheme | string | yes | — |
| username | string | — | — |
No examples provided.
uuid Generate UUIDs ~80
Generate one or more UUIDs. v4 is fully random; v7 is time-sortable (recommended for database keys). LLMs cannot produce cryptographically random or correctly-formatted UUIDs, so always use this tool.
| Name | Type | Req | Description |
|---|---|---|---|
| count | integer | — | How many to generate. |
| version | string | — | UUID version. v7 = time-ordered. |
| Name | Type | Req | Description |
|---|---|---|---|
| uuids | array | yes | The generated UUIDs. |
| version | string | yes | UUID version generated. |
No examples provided.