Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

Cleanor

REMOTE · MCP.CLEANOR.APP · 2 COMPONENTS · SCANNED SEP 24

Zero-auth MCP: image optimize, cited storage/format data, and dev utilities LLMs get wrong.

0 this week 74 Trust /100
Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →

Endpoint Security46
Transport & Reachability100
Schema Quality & AI Usability82
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 2309 tokens (~104/item across 22 items; 22 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
  • No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
  • Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • We read all 22 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
  • An AI judge read all 23 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities60
  • Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28. See how to fix → Fail
Install

How do I install the Cleanor MCP server?

Cleanor is a hosted endpoint at https://mcp.cleanor.app/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

remote · mcp.cleanor.app

# add to Claude Code
claude mcp add --transport http app-cleanor-cleanor 'https://mcp.cleanor.app/mcp'
// .cursor/mcp.json
{
  "mcpServers": {
    "app-cleanor-cleanor": {
      "url": "https://mcp.cleanor.app/mcp"
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "app-cleanor-cleanor": {
      "type": "http",
      "url": "https://mcp.cleanor.app/mcp"
    }
  }
}
# ~/.codex/config.toml
[mcp_servers.app-cleanor-cleanor]
url = "https://mcp.cleanor.app/mcp"
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "app-cleanor-cleanor": {
      "type": "remote",
      "url": "https://mcp.cleanor.app/mcp",
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add app-cleanor-cleanor --url 'https://mcp.cleanor.app/mcp' --transport streamable-http
# ~/.hermes/config.yaml
mcp_servers:
  app-cleanor-cleanor:
    url: "https://mcp.cleanor.app/mcp"
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "app-cleanor-cleanor": {
      "Transport": "http",
      "Url": "https://mcp.cleanor.app/mcp"
    }
  }
}
# add to Vellum
assistant mcp add app-cleanor-cleanor -t streamable-http -u 'https://mcp.cleanor.app/mcp'
// mcp.json
{
  "mcpServers": {
    "app-cleanor-cleanor": {
      "type": "http",
      "url": "https://mcp.cleanor.app/mcp"
    }
  }
}

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 26 Aug 26 74
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 25 Aug 26 0
    • Stability: 0.97 → pass security
  • 11 Aug 26 0
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 31 Jul 26 0
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 30 Jul 26 0
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 27 Jul 26 0
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 26 Jul 26 0

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 24 Sept 2026 · Probed https://mcp.cleanor.app/mcp

TLS valid

Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .

Subject Issuer Valid from Valid until Key Signature Serial
CN=cleanor.app CN=WE1,O=Google Trust Services,C=US 2 Sept 2026 1 Dec 2026 ECDSA 256 ECDSA-SHA256 d933b141b12ac99113a4507b386ce492
SANs: cleanor.app, mcp.cleanor.app, *.mcp.cleanor.app
CN=WE1,O=Google Trust Services,C=US (CA) CN=GTS Root R4,O=Google Trust Services LLC,C=US 13 Dec 2023 20 Feb 2029 ECDSA 256 ECDSA-SHA384 7ff31977972c224a76155d13b6d685e3
CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE 15 Nov 2023 28 Jan 2028 ECDSA 384 SHA256-RSA 7fe530bf331343bedd821610493d8a1b

Background: What to check on a remote MCP endpoint →

DNSSEC insecure

Validation of mcp.cleanor.app. — Not signed

Zone DS Keys Algorithms Outcome
. trust_anchor 20326, 38696 8, 8 Verified
app. present 23684 8 Verified
cleanor.app. absent Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation
Authentication No authorisation required

The endpoint answered without asking for a token. Anyone who knows the URL can reach it.

Result No authorisation required
HTTP status 200

Background: How OAuth 2.1 works in the 2026 MCP spec →

Transports 2 probes
Transport URL Outcome Status Location
streamable-http https://mcp.cleanor.app/mcp Verified 200
http (plaintext) http://mcp.cleanor.app/mcp Inconclusive 406
MCP tools · 22 exposed · ~2,226 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
base_convert ~114

Convert an integer between number bases 2–36 (e.g. hex to binary, decimal to base-36). Arbitrary precision via BigInt, so large values stay exact. Use for radix conversions instead of doing them by hand.

NameTypeReqDescription
from_baseinteger–Base of the input (2–36).
to_baseinteger–Base to convert to (2–36).
valuestringyesThe number, in from_base (e.g. "ff", "1010", "255").
NameTypeReqDescription
decimalstringyesThe value in base 10.
from_basenumberyes–
inputstringyes–
resultstringyesThe value in to_base.
to_basenumberyes–

No examples provided.

base64 ~98

Encode text to Base64 or decode Base64 back to text (UTF-8 safe). Supports URL-safe alphabet. Use whenever you need to encode/decode data URIs, tokens, or config values instead of guessing the bytes.

NameTypeReqDescription
inputstringyesText to encode, or Base64 to decode.
modestring–Direction.
url_safeboolean–Use URL-safe alphabet (-_ instead of +/, no padding).
NameTypeReqDescription
modestringyesencode or decode.
resultstringyesThe encoded or decoded text.

No examples provided.

color ~82

Convert a color (hex, rgb() or hsl()) and return hex, RGB and HSL representations at once. Use when picking or translating colors for CSS, design tokens or themes.

NameTypeReqDescription
valuestringyesA color: "#3b82f6", "rgb(59,130,246)" or "hsl(217,91%,60%)".
NameTypeReqDescription
hexstringyes–
hslstringyes–
rgbstringyes–

No examples provided.

color_palette ~99

Build a harmonious color palette from a base color using color-theory rules (complementary, analogous, triadic, tetradic, or monochromatic). Returns each color as hex and HSL. Use to derive a theme or design tokens from one brand color.

NameTypeReqDescription
colorstringyesBase color: "#3b82f6", "rgb(...)" or "hsl(...)".
harmonystring–Color-harmony rule.
NameTypeReqDescription
basestringyesThe base color as hex.
colorsarrayyes–
harmonystringyes–

No examples provided.

count ~67

Accurately count characters (Unicode code points), UTF-16 units, words, lines and UTF-8 bytes in text. LLMs are notoriously bad at counting, so always use this tool for "how many characters/words" questions.

NameTypeReqDescription
inputstringyesText to measure.
NameTypeReqDescription
bytesnumberyesUTF-8 bytes.
charactersnumberyesUnicode code points.
linesnumberyes–
utf16_unitsnumberyes–
wordsnumberyes–

No examples provided.

cron_describe ~83

Parse a standard 5-field cron expression (minute hour day-of-month month day-of-week) into a plain-English breakdown and the next few run times in UTC. Use to sanity-check a schedule instead of guessing what the fields mean.

NameTypeReqDescription
expressionstringyesA 5-field cron expression, e.g. "30 2 * * 1-5".
NameTypeReqDescription
day_of_monthstringyes–
day_of_weekstringyes–
hourstringyes–
minutestringyes–
monthstringyes–
next_runsarrayyesNext run times in UTC ISO 8601.

No examples provided.

datetime ~124

Get the current date/time, or convert a given timestamp, into a target IANA timezone with ISO, Unix and human-readable forms. Pass a Unix timestamp (seconds or ms) or an ISO string as input; omit it for "now". LLMs cannot know the real current time, so use this instead of guessing.

NameTypeReqDescription
inputstring–Optional: a Unix timestamp (s or ms) or ISO date string. Omit for the current time.
timezonestring–IANA timezone, e.g. "America/New_York" or "UTC".
NameTypeReqDescription
iso_utcstringyes–
localstringyesHuman-readable local time in the timezone.
timezonestringyes–
unix_msnumberyes–
unix_snumberyes–

No examples provided.

diff ~84

Compute a line-by-line diff between two texts, marking removed lines with "-", added with "+" and unchanged with two spaces, plus a change count. Use to see exactly what changed instead of comparing by eye. Capped at 1000 lines per side.

NameTypeReqDescription
astringyesThe original ("before") text.
bstringyesThe updated ("after") text.
NameTypeReqDescription
addednumberyes–
changedbooleanyes–
diffstringyesThe line diff (+/-/space prefixed), empty if identical.
removednumberyes–

No examples provided.

hash ~111

Compute a cryptographic hash of text (SHA-1, SHA-256, SHA-384 or SHA-512) and return the hex digest. Use for checksums, cache keys, or verifying content. MD5 is intentionally not offered (broken, and unavailable in Web Crypto). LLMs cannot compute these reliably by hand, so always use this tool instead of guessing.

NameTypeReqDescription
algorithmstring–Hash algorithm. Default sha-256.
inputstringyesText to hash (UTF-8).
NameTypeReqDescription
algorithmstringyesThe hash algorithm used.
hexstringyesThe hex-encoded digest.

No examples provided.

hmac ~113

Compute an HMAC (keyed hash) of a message with a secret, using SHA-1/256/384/512, returned as hex or Base64. Use to sign webhook payloads or verify a signature instead of guessing. LLMs cannot compute this by hand.

NameTypeReqDescription
algorithmstring–Hash algorithm.
encodingstring–Output encoding.
messagestringyesThe message to sign (UTF-8).
secretstringyesThe shared secret key (UTF-8).
NameTypeReqDescription
algorithmstringyes–
encodingstringyes–
signaturestringyesThe HMAC in the requested encoding.

No examples provided.

image_format_savings ~121

How much smaller WebP, AVIF or JPEG XL are than JPEG at matched perceptual quality, from Cleanor Labs’ controlled benchmark. Also reports the "HEIC conversion tax" (converting an iPhone HEIC to JPG/PNG makes it bigger). Use to justify a format choice when building a site or app.

NameTypeReqDescription
formatstring–Target format to compare against JPEG.
qualitystring–web = typical web quality (SSIM 0.95); high = near-lossless (SSIM 0.98).
NameTypeReqDescription
all_formatsobjectyes–
formatstringyes–
percent_smaller_than_jpegnumberyes–
qualitystringyes–
sourcestringyes–

No examples provided.

json_format ~90

Validate JSON and pretty-print or minify it, optionally sorting object keys. Returns a precise parse error (with position) if invalid. Use to check and clean JSON instead of eyeballing it.

NameTypeReqDescription
inputstringyesJSON text.
modestring–pretty = 2-space indent; minify = single line.
sort_keysboolean–Sort object keys alphabetically (deep).
NameTypeReqDescription
formattedstringyesThe formatted JSON text.
validbooleanyesWhether the input was valid JSON.

No examples provided.

jwt_decode ~67

Decode a JSON Web Token into its header and payload so you can inspect claims (iss, exp, sub, scopes). The signature is NOT verified and no secret is required or stored. Use to read a token during debugging.

NameTypeReqDescription
tokenstringyesThe JWT (three dot-separated segments).
NameTypeReqDescription
exp_isostring–Expiry as ISO 8601, if present.
expiredboolean–Whether the token is past its exp, if present.
header––The decoded JWT header object.
payload––The decoded JWT payload (claims).

No examples provided.

optimize_image ~165

Fetch an image from a public URL and re-encode it smaller (WebP/AVIF/JPEG), optionally resizing to a target width. Returns the optimized image plus before/after byte sizes. Use this when an AI-generated or dropped-in asset (hero image, screenshot, illustration) is too large to ship.

NameTypeReqDescription
formatstring–Output format. webp = best browser support; avif = smallest; jpeg = universal.
image_urlstringyesPublic URL of the source image (PNG/JPEG/WebP/AVIF/GIF).
qualityinteger–Encode quality 1-100 (80 is a good default).
widthinteger–Resize to this width in px, preserving aspect ratio. Omit to keep original size.
NameTypeReqDescription
formatstringyesOutput image format.
mime_typestringyes–
optimized_bytesnumberyes–
original_bytesnumberyes–
saved_pctnumberyesPercent smaller than the original.

No examples provided.

placeholder_image ~127

Generate a lightweight SVG placeholder image at any size, with an optional label and custom background/text colors. Dependency-free, pastes straight into a page or mockup. Use for wireframes and design stubs instead of hotlinking a placeholder service.

NameTypeReqDescription
bgstring–Background color (hex, rgb() or hsl()).
colorstring–Text color.
heightinteger–Height in pixels.
textstring–Label text. Defaults to the dimensions, e.g. "600×400".
widthinteger–Width in pixels.
NameTypeReqDescription
heightnumberyes–
svgstringyesThe SVG markup.
widthnumberyes–

No examples provided.

qr_code ~89

Encode text or a URL as a QR code and return a crisp, dependency-free SVG you can paste straight into a page, deck or doc.

NameTypeReqDescription
eccstring–Error-correction level: L=7%, M=15%, Q=25%, H=30% recoverable.
sizeinteger–SVG pixel size.
textstringyesText or URL to encode.
NameTypeReqDescription
svgstringyesThe QR code as SVG markup.

No examples provided.

regex_test ~111

Test a JavaScript regular expression against sample text and return whether it matches, plus every match with its captured groups and index. Use to verify a pattern instead of reasoning about it in your head. Input and pattern are length-capped to keep it fast and safe.

NameTypeReqDescription
flagsstring–Regex flags, e.g. "gi". Allowed: g i m s u y d.
inputstringyesText to test against.
patternstringyesThe regex pattern (without slashes).
NameTypeReqDescription
match_countnumberyes–
matchedbooleanyesWhether the pattern matched at all.
matchesarrayyesEach match with its start index and captured groups.
truncatedbooleanyesTrue if results were capped at 100.

No examples provided.

slugify ~62

Turn a title or phrase into a clean, URL-safe slug (lowercase, hyphenated, accents stripped). Use when generating page paths, filenames or anchor IDs.

NameTypeReqDescription
inputstringyesText to slugify.
separatorstring–Word separator.
NameTypeReqDescription
slugstringyesThe URL-safe slug.

No examples provided.

storage_capacity ~103

How many photos or minutes of video actually fit in a given storage size, corrected for real OS/filesystem overhead. Backed by Cleanor Labs measured per-item sizes. Use for realistic sample copy, dashboards, or "how many photos fit in 128 GB" answers.

NameTypeReqDescription
contentstring–What to count.
storage_gbnumberyesAdvertised storage size in GB (e.g. 64, 128, 256, 512).
NameTypeReqDescription
breakdownarrayyesHow many of each item fit.
contentstringyes–
storage_gbnumberyes–
usable_gbnumberyesUsable GB after OS/filesystem overhead.

No examples provided.

unit_convert ~177

Convert a value between units of length, mass, data size, time, speed or temperature. Supported units: mm, cm, m, km, in, ft, yd, mi, nmi, mg, g, kg, t, oz, lb, st, bit, byte, kb, kib, mb, mib, gb, gib, tb, tib, ms, s, min, h, day, week, mps, kph, mph, fps, knot, c, f, k. Use for exact conversions instead of approximating.

NameTypeReqDescription
fromstringyesSource unit (e.g. "km", "lb", "mib", "c").
tostringyesTarget unit (must be the same category as "from").
valuenumberyesThe numeric value to convert.
NameTypeReqDescription
categorystringyes–
fromstringyes–
resultnumberyes–
tostringyes–
valuenumberyes–

No examples provided.

url_parse ~59

Break a URL into its components: scheme, host, port, path, decoded query parameters and fragment. Use to inspect or debug a URL instead of parsing it by eye.

NameTypeReqDescription
urlstringyesThe URL to parse (absolute, with scheme).
NameTypeReqDescription
fragmentstringyes–
hoststringyes–
pathstringyes–
portstringyesPort, or empty if the scheme default.
queryarrayyes–
schemestringyes–
usernamestring––

No examples provided.

uuid ~80

Generate one or more UUIDs. v4 is fully random; v7 is time-sortable (recommended for database keys). LLMs cannot produce cryptographically random or correctly-formatted UUIDs, so always use this tool.

NameTypeReqDescription
countinteger–How many to generate.
versionstring–UUID version. v7 = time-ordered.
NameTypeReqDescription
uuidsarrayyesThe generated UUIDs.
versionstringyesUUID version generated.

No examples provided.

Common questions

What is the Cleanor MCP server?

Cleanor is an MCP server listed in the public MCP registry as app.cleanor/cleanor. Zero-auth MCP: image optimize, cited storage/format data, and dev utilities LLMs get wrong. This page covers its hosted endpoint (https://mcp.cleanor.app/mcp).

Is the Cleanor MCP server safe to use?

Cleanor scores 74 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the Cleanor MCP server expose?

Cleanor exposes 22 tools: optimize_image, storage_capacity, image_format_savings, qr_code, hash, and 17 more. Their descriptions and schemas cost roughly 2,226 tokens of context every time the server is loaded.

Does the Cleanor MCP server require authentication?

No. We connected to Cleanor without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

Is the Cleanor MCP server still maintained?

Cleanor is still listed as active in the MCP registry. We last reached this channel on 24 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.