# Cleanor (remote · mcp.cleanor.app)

Zero-auth MCP: image optimize, cited storage/format data, and dev utilities LLMs get wrong.

- Trust score: 62/100 (medium)
- Change this week: 0
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- remote · `mcp.cleanor.app`: 62/100 (this document), [markdown](https://verifymcp.io/servers/app-cleanor-cleanor/mcp.md), [page](https://verifymcp.io/servers/app-cleanor-cleanor/mcp)
- npm · `@cleanor/mcp`: 63/100, [markdown](https://verifymcp.io/servers/app-cleanor-cleanor/cleanor-mcp.md), [page](https://verifymcp.io/servers/app-cleanor-cleanor/cleanor-mcp)

## Channel facts

- Endpoint: `https://mcp.cleanor.app/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `0.6.1`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Endpoint Security**: 46/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation not fully verified: no authorisation is required to call this server, and 22 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe.
  - HTTPS not yet verified: we couldn't determine whether a plaintext access path exists.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 81/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 2309 tokens (~104/item across 22 items; 22 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
  - Structured output schemas are declared (100% of tools); any adoption earns full credit.
- **Capabilities**: 60/100
  - Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add --transport http app-cleanor-cleanor https://mcp.cleanor.app/mcp
```

### Codex

```toml
[mcp_servers.app-cleanor-cleanor]
url = "https://mcp.cleanor.app/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "app-cleanor-cleanor": {
      "type": "remote",
      "url": "https://mcp.cleanor.app/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add app-cleanor-cleanor --url https://mcp.cleanor.app/mcp --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  app-cleanor-cleanor:
    url: "https://mcp.cleanor.app/mcp"
```

### Other

```json
{
  "mcpServers": {
    "app-cleanor-cleanor": {
      "type": "http",
      "url": "https://mcp.cleanor.app/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 62, +1)

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-01 (score 61, +1)

No change was recorded against any check on this day. Stability & Change Management went from 17 to 20. That category is still filling its 30-day observation window: 5 days of observed history at the previous scan, 6 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-31 (score 60, −2)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 62, −2)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-29 (score 64, +1)

No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-28 (score 63, +1)

No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-27 (score 62, 0)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-26 (score 62)

First indexed and scored.

## MCP tools (22)

### `optimize_image` (~165 tokens)

Optimize / convert an image for the web

Fetch an image from a public URL and re-encode it smaller (WebP/AVIF/JPEG), optionally resizing to a target width. Returns the optimized image plus before/after byte sizes. Use this when an AI-generated or dropped-in asset (hero image, screenshot, illustration) is too large to ship.

Input parameters:

- `format` (string): Output format. webp = best browser support; avif = smallest; jpeg = universal.
- `image_url` (string, required): Public URL of the source image (PNG/JPEG/WebP/AVIF/GIF).
- `quality` (integer): Encode quality 1-100 (80 is a good default).
- `width` (integer): Resize to this width in px, preserving aspect ratio. Omit to keep original size.

Output parameters:

- `format` (string): Output image format.
- `mime_type` (string)
- `optimized_bytes` (number)
- `original_bytes` (number)
- `saved_pct` (number): Percent smaller than the original.

### `storage_capacity` (~103 tokens)

How much fits in a phone storage tier

How many photos or minutes of video actually fit in a given storage size, corrected for real OS/filesystem overhead. Backed by Cleanor Labs measured per-item sizes. Use for realistic sample copy, dashboards, or "how many photos fit in 128 GB" answers.

Input parameters:

- `content` (string): What to count.
- `storage_gb` (number, required): Advertised storage size in GB (e.g. 64, 128, 256, 512).

Output parameters:

- `breakdown` (array): How many of each item fit.
- `content` (string)
- `storage_gb` (number)
- `usable_gb` (number): Usable GB after OS/filesystem overhead.

### `image_format_savings` (~121 tokens)

Real storage savings of next-gen image formats

How much smaller WebP, AVIF or JPEG XL are than JPEG at matched perceptual quality, from Cleanor Labs’ controlled benchmark. Also reports the "HEIC conversion tax" (converting an iPhone HEIC to JPG/PNG makes it bigger). Use to justify a format choice when building a site or app.

Input parameters:

- `format` (string): Target format to compare against JPEG.
- `quality` (string): web = typical web quality (SSIM 0.95); high = near-lossless (SSIM 0.98).

Output parameters:

- `all_formats` (object)
- `format` (string)
- `percent_smaller_than_jpeg` (number)
- `quality` (string)
- `source` (string)

### `qr_code` (~89 tokens)

Generate a QR code (SVG)

Encode text or a URL as a QR code and return a crisp, dependency-free SVG you can paste straight into a page, deck or doc.

Input parameters:

- `ecc` (string): Error-correction level: L=7%, M=15%, Q=25%, H=30% recoverable.
- `size` (integer): SVG pixel size.
- `text` (string, required): Text or URL to encode.

Output parameters:

- `svg` (string): The QR code as SVG markup.

### `hash` (~111 tokens)

Hash text (SHA family)

Compute a cryptographic hash of text (SHA-1, SHA-256, SHA-384 or SHA-512) and return the hex digest. Use for checksums, cache keys, or verifying content. MD5 is intentionally not offered (broken, and unavailable in Web Crypto). LLMs cannot compute these reliably by hand, so always use this tool instead of guessing.

Input parameters:

- `algorithm` (string): Hash algorithm. Default sha-256.
- `input` (string, required): Text to hash (UTF-8).

Output parameters:

- `algorithm` (string): The hash algorithm used.
- `hex` (string): The hex-encoded digest.

### `uuid` (~80 tokens)

Generate UUIDs

Generate one or more UUIDs. v4 is fully random; v7 is time-sortable (recommended for database keys). LLMs cannot produce cryptographically random or correctly-formatted UUIDs, so always use this tool.

Input parameters:

- `count` (integer): How many to generate.
- `version` (string): UUID version. v7 = time-ordered.

Output parameters:

- `uuids` (array): The generated UUIDs.
- `version` (string): UUID version generated.

### `base64` (~98 tokens)

Base64 encode / decode

Encode text to Base64 or decode Base64 back to text (UTF-8 safe). Supports URL-safe alphabet. Use whenever you need to encode/decode data URIs, tokens, or config values instead of guessing the bytes.

Input parameters:

- `input` (string, required): Text to encode, or Base64 to decode.
- `mode` (string): Direction.
- `url_safe` (boolean): Use URL-safe alphabet (-_ instead of +/, no padding).

Output parameters:

- `mode` (string): encode or decode.
- `result` (string): The encoded or decoded text.

### `json_format` (~90 tokens)

Format / validate JSON

Validate JSON and pretty-print or minify it, optionally sorting object keys. Returns a precise parse error (with position) if invalid. Use to check and clean JSON instead of eyeballing it.

Input parameters:

- `input` (string, required): JSON text.
- `mode` (string): pretty = 2-space indent; minify = single line.
- `sort_keys` (boolean): Sort object keys alphabetically (deep).

Output parameters:

- `formatted` (string): The formatted JSON text.
- `valid` (boolean): Whether the input was valid JSON.

### `jwt_decode` (~67 tokens)

Decode a JWT (no verification)

Decode a JSON Web Token into its header and payload so you can inspect claims (iss, exp, sub, scopes). The signature is NOT verified and no secret is required or stored. Use to read a token during debugging.

Input parameters:

- `token` (string, required): The JWT (three dot-separated segments).

Output parameters:

- `exp_iso` (string): Expiry as ISO 8601, if present.
- `expired` (boolean): Whether the token is past its exp, if present.
- `header`: The decoded JWT header object.
- `payload`: The decoded JWT payload (claims).

### `color` (~82 tokens)

Convert a color between formats

Convert a color (hex, rgb() or hsl()) and return hex, RGB and HSL representations at once. Use when picking or translating colors for CSS, design tokens or themes.

Input parameters:

- `value` (string, required): A color: "#3b82f6", "rgb(59,130,246)" or "hsl(217,91%,60%)".

Output parameters:

- `hex` (string)
- `hsl` (string)
- `rgb` (string)

### `slugify` (~62 tokens)

Slugify text for URLs

Turn a title or phrase into a clean, URL-safe slug (lowercase, hyphenated, accents stripped). Use when generating page paths, filenames or anchor IDs.

Input parameters:

- `input` (string, required): Text to slugify.
- `separator` (string): Word separator.

Output parameters:

- `slug` (string): The URL-safe slug.

### `count` (~67 tokens)

Count characters, words, lines, bytes

Accurately count characters (Unicode code points), UTF-16 units, words, lines and UTF-8 bytes in text. LLMs are notoriously bad at counting, so always use this tool for "how many characters/words" questions.

Input parameters:

- `input` (string, required): Text to measure.

Output parameters:

- `bytes` (number): UTF-8 bytes.
- `characters` (number): Unicode code points.
- `lines` (number)
- `utf16_units` (number)
- `words` (number)

### `regex_test` (~111 tokens)

Test a regular expression

Test a JavaScript regular expression against sample text and return whether it matches, plus every match with its captured groups and index. Use to verify a pattern instead of reasoning about it in your head. Input and pattern are length-capped to keep it fast and safe.

Input parameters:

- `flags` (string): Regex flags, e.g. "gi". Allowed: g i m s u y d.
- `input` (string, required): Text to test against.
- `pattern` (string, required): The regex pattern (without slashes).

Output parameters:

- `match_count` (number)
- `matched` (boolean): Whether the pattern matched at all.
- `matches` (array): Each match with its start index and captured groups.
- `truncated` (boolean): True if results were capped at 100.

### `cron_describe` (~83 tokens)

Explain a cron expression

Parse a standard 5-field cron expression (minute hour day-of-month month day-of-week) into a plain-English breakdown and the next few run times in UTC. Use to sanity-check a schedule instead of guessing what the fields mean.

Input parameters:

- `expression` (string, required): A 5-field cron expression, e.g. "30 2 * * 1-5".

Output parameters:

- `day_of_month` (string)
- `day_of_week` (string)
- `hour` (string)
- `minute` (string)
- `month` (string)
- `next_runs` (array): Next run times in UTC ISO 8601.

### `unit_convert` (~177 tokens)

Convert between units

Convert a value between units of length, mass, data size, time, speed or temperature. Supported units: mm, cm, m, km, in, ft, yd, mi, nmi, mg, g, kg, t, oz, lb, st, bit, byte, kb, kib, mb, mib, gb, gib, tb, tib, ms, s, min, h, day, week, mps, kph, mph, fps, knot, c, f, k. Use for exact conversions instead of approximating.

Input parameters:

- `from` (string, required): Source unit (e.g. "km", "lb", "mib", "c").
- `to` (string, required): Target unit (must be the same category as "from").
- `value` (number, required): The numeric value to convert.

Output parameters:

- `category` (string)
- `from` (string)
- `result` (number)
- `to` (string)
- `value` (number)

### `datetime` (~124 tokens)

Current or parsed date/time

Get the current date/time, or convert a given timestamp, into a target IANA timezone with ISO, Unix and human-readable forms. Pass a Unix timestamp (seconds or ms) or an ISO string as input; omit it for "now". LLMs cannot know the real current time, so use this instead of guessing.

Input parameters:

- `input` (string): Optional: a Unix timestamp (s or ms) or ISO date string. Omit for the current time.
- `timezone` (string): IANA timezone, e.g. "America/New_York" or "UTC".

Output parameters:

- `iso_utc` (string)
- `local` (string): Human-readable local time in the timezone.
- `timezone` (string)
- `unix_ms` (number)
- `unix_s` (number)

### `url_parse` (~59 tokens)

Parse a URL into parts

Break a URL into its components: scheme, host, port, path, decoded query parameters and fragment. Use to inspect or debug a URL instead of parsing it by eye.

Input parameters:

- `url` (string, required): The URL to parse (absolute, with scheme).

Output parameters:

- `fragment` (string)
- `host` (string)
- `path` (string)
- `port` (string): Port, or empty if the scheme default.
- `query` (array)
- `scheme` (string)
- `username` (string)

### `base_convert` (~114 tokens)

Convert a number between bases

Convert an integer between number bases 2–36 (e.g. hex to binary, decimal to base-36). Arbitrary precision via BigInt, so large values stay exact. Use for radix conversions instead of doing them by hand.

Input parameters:

- `from_base` (integer): Base of the input (2–36).
- `to_base` (integer): Base to convert to (2–36).
- `value` (string, required): The number, in from_base (e.g. "ff", "1010", "255").

Output parameters:

- `decimal` (string): The value in base 10.
- `from_base` (number)
- `input` (string)
- `result` (string): The value in to_base.
- `to_base` (number)

### `diff` (~84 tokens)

Line diff between two texts

Compute a line-by-line diff between two texts, marking removed lines with "-", added with "+" and unchanged with two spaces, plus a change count. Use to see exactly what changed instead of comparing by eye. Capped at 1000 lines per side.

Input parameters:

- `a` (string, required): The original ("before") text.
- `b` (string, required): The updated ("after") text.

Output parameters:

- `added` (number)
- `changed` (boolean)
- `diff` (string): The line diff (+/-/space prefixed), empty if identical.
- `removed` (number)

### `hmac` (~113 tokens)

HMAC signature of a message

Compute an HMAC (keyed hash) of a message with a secret, using SHA-1/256/384/512, returned as hex or Base64. Use to sign webhook payloads or verify a signature instead of guessing. LLMs cannot compute this by hand.

Input parameters:

- `algorithm` (string): Hash algorithm.
- `encoding` (string): Output encoding.
- `message` (string, required): The message to sign (UTF-8).
- `secret` (string, required): The shared secret key (UTF-8).

Output parameters:

- `algorithm` (string)
- `encoding` (string)
- `signature` (string): The HMAC in the requested encoding.

### `placeholder_image` (~127 tokens)

Generate a placeholder image (SVG)

Generate a lightweight SVG placeholder image at any size, with an optional label and custom background/text colors. Dependency-free, pastes straight into a page or mockup. Use for wireframes and design stubs instead of hotlinking a placeholder service.

Input parameters:

- `bg` (string): Background color (hex, rgb() or hsl()).
- `color` (string): Text color.
- `height` (integer): Height in pixels.
- `text` (string): Label text. Defaults to the dimensions, e.g. "600×400".
- `width` (integer): Width in pixels.

Output parameters:

- `height` (number)
- `svg` (string): The SVG markup.
- `width` (number)

### `color_palette` (~99 tokens)

Generate a color palette

Build a harmonious color palette from a base color using color-theory rules (complementary, analogous, triadic, tetradic, or monochromatic). Returns each color as hex and HSL. Use to derive a theme or design tokens from one brand color.

Input parameters:

- `color` (string, required): Base color: "#3b82f6", "rgb(...)" or "hsl(...)".
- `harmony` (string): Color-harmony rule.

Output parameters:

- `base` (string): The base color as hex.
- `colors` (array)
- `harmony` (string)

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/app-cleanor-cleanor/mcp#diagnostics

## Score history

- 2026-08-03: 62
- 2026-08-02: 61
- 2026-08-01: 61
- 2026-07-31: 60
- 2026-07-30: 62
- 2026-07-29: 64
- 2026-07-28: 63
- 2026-07-27: 62
- 2026-07-26: 62

## Links

- Remote endpoint: https://mcp.cleanor.app/mcp
- Repository: https://github.com/cleanor-app/cleanor-mcp
- Website: https://mcp.cleanor.app/
- Changelog RSS feed: https://verifymcp.io/servers/app-cleanor-cleanor/mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/app-cleanor-cleanor/mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/app-cleanor-cleanor/mcp