# Stackhal (remote · stackhal.com)

Outside-in DNS, email security, SEO, GEO and app-link checks plus developer utilities.

- Trust score: 87/100 (high trust)
- Change this week: +4
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-04

## Components

- remote · `stackhal.com`: 87/100 (this document), [markdown](https://verifymcp.io/servers/bahdanhal-stackhal/stackhal.md), [page](https://verifymcp.io/servers/bahdanhal-stackhal/stackhal)

## Channel facts

- Endpoint: `https://stackhal.com/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `1.2.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-04.

- **Endpoint Security**: 77/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one.
  - HTTPS is enforced; there's no plaintext access path.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC is configured correctly; the domain's records validate against the full chain to the root.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 77/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 1673 tokens (~128/item across 13 items; 13 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 100/100
  - No destabilizing schema changes in the last 30 days.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 13 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 14 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a current MCP spec version (2026-07-28).

## Install

### How do I install the Stackhal MCP server?

Stackhal is a hosted endpoint at https://stackhal.com/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http bahdanhal-stackhal 'https://stackhal.com/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "bahdanhal-stackhal": {
      "url": "https://stackhal.com/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "bahdanhal-stackhal": {
      "type": "http",
      "url": "https://stackhal.com/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.bahdanhal-stackhal]
url = "https://stackhal.com/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "bahdanhal-stackhal": {
      "type": "remote",
      "url": "https://stackhal.com/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add bahdanhal-stackhal --url 'https://stackhal.com/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  bahdanhal-stackhal:
    url: "https://stackhal.com/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "bahdanhal-stackhal": {
      "Transport": "http",
      "Url": "https://stackhal.com/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add bahdanhal-stackhal -t streamable-http -u 'https://stackhal.com/mcp'
```

### Other

```json
{
  "mcpServers": {
    "bahdanhal-stackhal": {
      "type": "http",
      "url": "https://stackhal.com/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-04 (score 87, +1)

- [security] Stability: 0.97 → pass

### 2026-11-02 (score 86, +1)

No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-31 (score 85, +1)

No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-29 (score 84, +1)

No change was recorded against any check on this day. Stability & Change Management went from 77 to 80. That category is still filling its 30-day observation window: 23 days of observed history at the previous scan, 24 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-27 (score 83, +1)

No change was recorded against any check on this day. Stability & Change Management went from 70 to 73. That category is still filling its 30-day observation window: 21 days of observed history at the previous scan, 22 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-25 (score 82, +1)

No change was recorded against any check on this day. Stability & Change Management went from 63 to 67. That category is still filling its 30-day observation window: 19 days of observed history at the previous scan, 20 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-22 (score 81, +1)

No change was recorded against any check on this day. Stability & Change Management went from 53 to 57. That category is still filling its 30-day observation window: 16 days of observed history at the previous scan, 17 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-20 (score 80, +1)

No change was recorded against any check on this day. Stability & Change Management went from 47 to 50. That category is still filling its 30-day observation window: 14 days of observed history at the previous scan, 15 at this one. The score rises as the window fills, whether or not the server changes.

## MCP tools (13)

### `validate_app_links` (~108 tokens)

Validate Universal Links and App Links

Inspect and validate Apple App Site Association (apple-app-site-association) and Android Digital Asset Links (assetlinks.json) files, HTTPS hosting rules, and test URL path routing, and compare the origin AASA with the copy on Apple's CDN.

Input parameters:

- `domain` (string, required): The target domain name (e.g. "example.com") hosting universal link and asset link files.
- `test_url` (null|string): Optional web URL path to test against Apple AASA components and exclusion routing patterns.

### `audit_website_seo` (~69 tokens)

Technical SEO Audit

Run a deterministic technical SEO audit for a public website URL. Checks canonicals, title tags, headings, robots.txt, sitemaps, redirects, crawl traps, and indexability.

Input parameters:

- `url` (string, required): The public website URL to audit (e.g. https://example.com).

### `transpile_to_caddyfile` (~114 tokens)

Convert Nginx or Apache Config to Caddyfile

Transpile Nginx (nginx.conf, server blocks) or Apache (.htaccess, VirtualHost) web server configuration to clean, idiomatic Caddyfile with migration advisories.

Input parameters:

- `config_content` (string, required): The raw web server configuration string (nginx.conf, server block, .htaccess, or VirtualHost) to transpile.
- `server_type` (null|string): Optional source server type: "nginx" or "apache". If omitted, auto-detected from content syntax.

### `calculate_cidr_overlap` (~136 tokens)

Calculate CIDR Overlap

Analyze IPv4/IPv6 CIDR subnets for range collisions, full containment, 2D bit-tree matrix partition, and available free subnet allocation.

Input parameters:

- `cidrs` (array, required): Array of IPv4 or IPv6 CIDR strings to analyze for collisions and tree partition.
- `parent_cidr` (null|string): Optional parent CIDR string (e.g. 10.0.0.0/16) to constrain free subnet allocation search.
- `requested_free_prefix` (null|integer): Optional target prefix length (e.g. 20, 24) to find available free subnet block inside parent range.

### `diagnose_cors_policy` (~111 tokens)

Diagnose CORS Policy

Analyze CORS HTTP request and response headers for wildcard/credential security violations, missing Vary: Origin, preflight OPTIONS handling, and header exposure.

Input parameters:

- `request_origin` (string, required): The incoming HTTP request Origin header (e.g. "https://app.example.com").
- `response_headers` (array, required): The server HTTP response headers (as key-value map or list of "Header: Value" strings).
- `with_credentials` (null|boolean): Whether the cross-origin request includes cookies or authorization credentials.

### `trace_dns_delegation` (~95 tokens)

Trace DNS Delegation

Query live DNS records and inspect the authoritative nameservers returned for a domain.

Input parameters:

- `domain` (string, required): The target domain name (e.g. "example.com") to query using the application host resolver.
- `query_type` (null|string): Optional DNS record type: "A" (default), "AAAA", "CNAME", "TXT", "MX", "NS", "SOA", or "CAA".

### `inspect_domain_security` (~80 tokens)

Inspect Domain Email Security

Inspect domain email security and deliverability standards: DMARC (BIMI compliance), BIMI DNS & SVG reachability, MTA-STS (RFC 8461), SMTP TLS-RPT (RFC 8460), SPF and MX records.

Input parameters:

- `domain` (string, required): The domain name to inspect (e.g. stripe.com, example.com).

### `generate_favicon_suite` (~104 tokens)

Generate Favicon Suite

Generate modern multi-platform favicon bundle (adaptive dark-mode SVG, multi-resolution ICO, Apple Touch Icon, Android PWA icons, webmanifest) and minimal HTML tags from SVG or image input.

Input parameters:

- `dark_mode_strategy` (null|string): Optional dark mode strategy: "css_invert_fill" (default), "css_class_swap", or "preserve_colors".
- `svg_content` (string, required): The raw SVG XML markup string to convert into modern multi-platform favicon suite.

### `analyze_geo_readiness` (~63 tokens)

Analyze GEO Readiness

Analyze Generative Engine Optimization (GEO) signals and AI crawler readiness for a web page (schema, citations, provenance, answer structure, llms.txt, AI bot robots rules).

Input parameters:

- `url` (string, required): The web page URL to analyze for GEO readiness.

### `inspect_apple_pkpass` (~73 tokens)

Inspect Apple Wallet Pass

Inspect and validate Apple Wallet .pkpass JSON structure (pass.json) or package manifests: checks required keys, pass styles, dates, ISO 8601 timezones, transit types, barcodes, and color contrast.

Input parameters:

- `pass_json` (string, required): The raw pass.json JSON string to inspect and validate.

### `generate_apple_pkpass_spec` (~405 tokens)

Generate Apple Wallet pass.json

Generate a production-ready, fully compliant Apple Wallet pass.json specification based on pass type, metadata, colors, barcode, and field values.

Input parameters:

- `background_color` (null|string): Background color as CSS rgb(r, g, b), e.g. "rgb(15, 23, 42)".
- `barcode_format` (null|string): Barcode format: "PKBarcodeFormatQR", "PKBarcodeFormatPDF417", "PKBarcodeFormatAztec", "PKBarcodeFormatCode128".
- `barcode_message` (null|string): Barcode message payload, e.g. "M1HAL/BAHDAN ELO027".
- `description` (string, required): Human-readable description of the pass, e.g. "Flight from SFO to WAW".
- `foreground_color` (null|string): Foreground text color as CSS rgb(r, g, b), e.g. "rgb(255, 255, 255)".
- `label_color` (null|string): Label text color as CSS rgb(r, g, b), e.g. "rgb(148, 163, 184)".
- `organization_name` (string, required): Name of the pass issuing organization, e.g. "Acme Airlines".
- `pass_type` (string, required): Pass style type: "boardingPass", "eventTicket", "storeCard", "coupon", or "generic".
- `pass_type_identifier` (null|string): Apple Pass Type Identifier starting with "pass.", e.g. "pass.com.example.ticket".
- `serial_number` (null|string): Unique pass serial number, e.g. "LOT-89421".
- `team_identifier` (null|string): Apple Developer 10-character Team ID, e.g. "BAHDAN9988".
- `transit_type` (null|string): Transit type for boardingPass: "PKTransitTypeAir", "PKTransitTypeTrain", "PKTransitTypeBus", "PKTransitTypeBoat", "PKTransitTypeGeneric".

### `repair_apple_pkpass_spec` (~78 tokens)

Repair Apple Wallet pass.json

Automatically repair and sanitize broken Apple Wallet pass.json manifests: fixes missing formatVersion, prefixes passTypeIdentifier, ensures 10-character team ID, normalizes dates to ISO 8601 with timezones, and auto-corrects low contrast.

Input parameters:

- `pass_json` (string, required): The raw, broken pass.json JSON string to repair.

### `transpile_regex_engine` (~128 tokens)

Convert Regex Between Engines

Transpile and analyze regular expressions across engines (PCRE, Go RE2, JavaScript, Python re, Rust regex) with compatibility checks and ReDoS safety analysis.

Input parameters:

- `pattern` (string, required): The regular expression pattern string to analyze and transpile.
- `source_engine` (null|string): Optional source engine: "pcre" (default), "go_re2", "javascript", "python", "rust".
- `target_engine` (null|string): Optional target engine: "go_re2" (default), "pcre", "javascript", "python", "rust".

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/bahdanhal-stackhal/stackhal#diagnostics

## Score history

- 2026-11-04: 87
- 2026-11-03: 86
- 2026-11-02: 86
- 2026-11-01: 85
- 2026-10-31: 85
- 2026-10-30: 84
- 2026-10-29: 84
- 2026-10-28: 83
- 2026-10-27: 83
- 2026-10-26: 82
- 2026-10-25: 82
- 2026-10-24: 81
- 2026-10-23: 81
- 2026-10-22: 81
- 2026-10-21: 80
- 2026-10-20: 80
- 2026-10-19: 79
- 2026-10-18: 79
- 2026-10-17: 78
- 2026-10-16: 78
- 2026-10-15: 77
- 2026-10-14: 77
- 2026-10-13: 76
- 2026-10-12: 76
- 2026-10-10: 75
- 2026-10-07: 74
- 2026-10-04: 34

## Common questions

### What is the Stackhal MCP server?

Stackhal is an MCP server listed in the public MCP registry as io.github.bahdanhal/stackhal. Outside-in DNS, email security, SEO, GEO and app-link checks plus developer utilities. This page covers its hosted endpoint (https://stackhal.com/mcp).

### Is the Stackhal MCP server safe to use?

Stackhal scores 87 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Stackhal MCP server expose?

Stackhal exposes 13 tools: validate_app_links, audit_website_seo, transpile_to_caddyfile, calculate_cidr_overlap, diagnose_cors_policy, and 8 more. Their descriptions and schemas cost roughly 1,564 tokens of context every time the server is loaded.

### Does the Stackhal MCP server require authentication?

No. We connected to Stackhal without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

### Is the Stackhal MCP server still maintained?

Stackhal is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Remote endpoint: https://stackhal.com/mcp
- Repository: https://github.com/bahdanhal/stackhal
- Website: https://stackhal.com/
- Changelog RSS feed: https://verifymcp.io/servers/bahdanhal-stackhal/stackhal.xml
- Changelog JSON feed: https://verifymcp.io/servers/bahdanhal-stackhal/stackhal.json
- HTML version of this page: https://verifymcp.io/servers/bahdanhal-stackhal/stackhal