# Clawhard Studio (remote · mcp.clawhard.com)

Token counts, contrast, time zones, JSON repair, Supabase RLS, leaked API keys, AI-bot access.

- Trust score: 69/100 (medium)
- Change this week: +2
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- remote · `mcp.clawhard.com`: 69/100 (this document), [markdown](https://verifymcp.io/servers/com-clawhard-studio/mcp.md), [page](https://verifymcp.io/servers/com-clawhard-studio/mcp)

## Channel facts

- Endpoint: `https://mcp.clawhard.com/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `1.9.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Endpoint Security**: 63/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one.
  - HTTPS check failed: the endpoint is reachable over plaintext HTTP.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 87/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 5988 tokens (~112/item across 53 items; 28 tools + 25 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability check failed: schema churn in the 8 days we've observed: 9 tool removals, 0 breaking changes, 0 auth/transport breaks, 27 additions.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 28 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 30 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.
  - Supports UI / widget rendering.

## Install

### How do I install the Clawhard Studio MCP server?

Clawhard Studio is a hosted endpoint at https://mcp.clawhard.com/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http com-clawhard-studio 'https://mcp.clawhard.com/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "com-clawhard-studio": {
      "url": "https://mcp.clawhard.com/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "com-clawhard-studio": {
      "type": "http",
      "url": "https://mcp.clawhard.com/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.com-clawhard-studio]
url = "https://mcp.clawhard.com/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "com-clawhard-studio": {
      "type": "remote",
      "url": "https://mcp.clawhard.com/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add com-clawhard-studio --url 'https://mcp.clawhard.com/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  com-clawhard-studio:
    url: "https://mcp.clawhard.com/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "com-clawhard-studio": {
      "Transport": "http",
      "Url": "https://mcp.clawhard.com/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add com-clawhard-studio -t streamable-http -u 'https://mcp.clawhard.com/mcp'
```

### Other

```json
{
  "mcpServers": {
    "com-clawhard-studio": {
      "type": "http",
      "url": "https://mcp.clawhard.com/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-04 (score 69, 0)

- [security] The server rewrote its instructions, which are the text every model session reads
- [functional] New prompt “spill_check_for_secrets”
- [functional] New resource “spill-llms-txt”
- [functional] New resource “spill-result-view”
- [functional] Server version: 1.8.0 → 1.9.0
- [functional] New tool “spill_scan_secrets”

### 2026-11-03 (score 69, 0)

- [security] The server rewrote its instructions, which are the text every model session reads
- [security] Tool “mend_outline_json” rewrote its description, which is the text the model reads
- [security] Tool “meridian_convert_time” rewrote its description, which is the text the model reads
- [security] Tool “meridian_meeting_slots” rewrote its description, which is the text the model reads
- [security] Tool “meridian_now” rewrote its description, which is the text the model reads
- [security] Tool “meridian_zone_info” rewrote its description, which is the text the model reads
- [functional regression] Schema quality: 4876 → 5454
- [functional] New prompt “deadbolt_audit_supabase”
- [functional] New resource “deadbolt-llms-txt”
- [functional] New resource “deadbolt-result-view”
- [functional] Server version: 1.4.0 → 1.8.0
- [functional] New tool “deadbolt_catalog_query”
- [functional] New tool “deadbolt_check_supabase_access”

### 2026-11-02 (score 69, +1)

- [security regression] Stability: 0.13 → fail
- [security regression] Tool “aitab_list_plans” was removed
- [security regression] Tool “aitab_total” was removed
- [security regression] Tool “doorman_build_robots” was removed
- [security regression] Tool “doorman_check_robots” was removed
- [security regression] Tool “doorman_check_site” was removed
- [security regression] Tool “fluff_check_text” was removed
- [security regression] Tool “fluff_gist_text” was removed
- [security regression] Tool “halves_create_group” was removed
- [security regression] Tool “lingo_brief” was removed
- [security regression] Tool “lingo_list_terms” was removed
- [security regression] Tool “lingo_translate” was removed
- [security regression] Tool “runsheet_create” was removed
- [security regression] Tool “runsheet_list_templates” was removed
- [security regression] Tool “slopscore_check_site” was removed
- [security regression] Tool “tells_fix_text” was removed
- [security regression] Tool “tells_score_text” was removed
- [security regression] Tool “tokendiet_trim_text” was removed
- [security] The server rewrote its instructions, which are the text every model session reads
- [security] Tool “halves_settle_up” rewrote its description, which is the text the model reads
- [functional regression] Schema quality: 1965 → 2467
- [functional improvement] Schema quality: 131 → 106
- [functional] The server now declares the “prompts” capability
- [functional] The server now declares the “resources” capability
- [functional] First check of Capabilities: pass
- [functional] First check of Schema quality: 100
- [functional] New prompt “aitab_audit_my_subscriptions”
- [functional] New prompt “doorman_audit_ai_access”
- [functional] New prompt “halves_split_the_bill”
- [functional] New prompt “mend_fix_my_json”
- [functional] New prompt “meridian_plan_a_call”
- [functional] New prompt “runsheet_plan_event_day”
- [functional] New prompt “slopscore_review_my_site”
- [functional] New prompt “swatch_audit_my_colors”
- [functional] New prompt “tells_humanize_draft”
- [functional] New prompt “tokendiet_will_it_fit”
- [functional] New resource “aitab-llms-txt”
- [functional] New resource “aitab-result-view”
- [functional] New resource “clawhard-llms-txt”
- [functional] New resource “doorman-llms-txt”
- [functional] New resource “doorman-result-view”
- [functional] New resource “halves-llms-txt”
- [functional] New resource “halves-result-view”
- [functional] New resource “mend-llms-txt”
- [functional] New resource “mend-result-view”
- [functional] New resource “meridian-llms-txt”
- [functional] New resource “meridian-result-view”
- [functional] New resource “runsheet-llms-txt”
- [functional] New resource “runsheet-result-view”
- [functional] New resource “slopscore-llms-txt”
- [functional] New resource “slopscore-result-view”
- [functional] New resource “swatch-llms-txt”
- [functional] New resource “swatch-result-view”
- [functional] New resource “tells-llms-txt”
- [functional] New resource “tells-result-view”
- [functional] New resource “tokendiet-llms-txt”
- [functional] New resource “tokendiet-result-view”
- [functional] Server version: 1.0.0 → 1.4.0
- [functional] New tool “aitab_list_ai_plans”
- [functional] New tool “aitab_total_ai_subscriptions”
- [functional] New tool “doorman_check_ai_bot_access”
- [functional] New tool “doorman_check_robots_txt”
- [functional] New tool “doorman_write_robots_txt”
- [functional] New tool “halves_create_group_link”
- [functional] New tool “mend_check_json”
- [functional] New tool “mend_outline_json”
- [functional] New tool “mend_query_json”
- [functional] New tool “mend_repair_json”
- [functional] New tool “meridian_convert_time”
- [functional] New tool “meridian_meeting_slots”
- [functional] New tool “meridian_now”
- [functional] New tool “meridian_zone_info”
- [functional] New tool “runsheet_create_schedule”
- [functional] New tool “slopscore_check_website”
- [functional] New tool “swatch_check_contrast”
- [functional] New tool “swatch_check_pairs”
- [functional] New tool “swatch_convert_color”
- [functional] New tool “swatch_fix_contrast”
- [functional] New tool “swatch_make_scale”
- [functional] New tool “swatch_pick_text_color”
- [functional] New tool “tells_check_writing”
- [functional] New tool “tokendiet_count_tokens”
- [functional] New tool “doorman_build_robots”
- [functional] New tool “doorman_check_robots”
- [functional] New tool “doorman_check_site”
- [cosmetic] Tool “halves_settle_up” changed its title: Work out who owes whom, in the fewest payments → Work out who owes whom in the fewest payments

### 2026-10-31 (score 68, +1)

No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-30 (score 67, 0)

- [functional regression] Schema quality: 1711 → 1965
- [functional] Schema quality: good → excellent
- [functional] New tool “fluff_check_text”
- [functional] New tool “fluff_gist_text”

### 2026-10-29 (score 67, +1)

- [security] The server rewrote its instructions, which are the text every model session reads
- [functional regression] Schema quality: 1334 → 1711
- [functional improvement] Stability: unverified → 0.03
- [functional] New tool “lingo_brief”
- [functional] New tool “lingo_list_terms”
- [functional] New tool “lingo_translate”

### 2026-10-28 (score 66)

First indexed and scored.

## MCP tools (28)

### `tokendiet_count_tokens` (~153 tokens)

Count the exact tokens in a text

Use when the user asks how many tokens a text, prompt, log, document or code paste is, whether it fits a context window (128K, 200K, 1M), or how big something is before they send it to an AI. Returns the exact o200k token count (GPT-4o family and later; Claude and Gemini usually within about 15%), plus words, characters and how much of each window it uses. Language models cannot count their own tokens, so call this instead of estimating. Example: {"text": "<the text to measure>"}. Not for shortening text.

Input parameters:

- `text` (string, required): The text to count (up to 200,000 characters).

### `slopscore_check_website` (~171 tokens)

Score a live website for AI-made design habits

Use when the user asks whether a website, landing page or app looks AI-generated or generic, wants a design critique of a live URL, or asks "does my site look like AI slop?". Fetches the page and checks 19 habits (purple-blue gradients, buzzword copy, glassmorphism, icon-card grids, template headlines, app-builder fingerprints and more), then returns a 0-100 score, a verdict, each habit found with the evidence and how to fix it, and the habits that were not found. It is a habit check, not an AI detector. Public http(s) pages only. Example: {"url": "https://example.com"}.

Input parameters:

- `url` (string, required): Public website address, for example example.com or https://example.com/pricing

### `aitab_list_ai_plans` (~108 tokens)

List AI subscription plans with list prices

Use when the user asks what AI plans cost (ChatGPT, Claude, Gemini, Perplexity, Cursor, Copilot, Midjourney and others), or before aitab_total_ai_subscriptions to look up plan keys. Returns each service with its plans, USD monthly and yearly list prices and the key to pass on. Prices were checked on official pages and carry a checked date; plans marked estimate are unconfirmed. No input. Prefer this over remembering prices, which change often.

### `aitab_total_ai_subscriptions` (~200 tokens)

Total what you pay for AI subscriptions

Use when the user lists the AI tools they pay for and asks what they spend per month or year, whether they are paying for overlapping tools, or what a stack of AI subscriptions costs. Returns the monthly, yearly and daily total, overlaps between plans, plans already included in another plan they pay for (could_cut, safe to drop), plans that merely overlap in kind (consider_dropping, ask before recommending a cut), and a link to a shareable receipt. Get plan keys from aitab_list_ai_plans. Example: {"plans": ["chatgpt.plus", "claude.pro", "cursor.pro"]}. Add ":y" to a key for yearly billing.

Input parameters:

- `billing` (string): Which total the shared receipt shows first. Default monthly.
- `plans` (array, required): Plan keys, e.g. ["chatgpt.plus","claude.pro","cursor.pro"]. In a GET query use a comma-separated list.

### `tells_check_writing` (~178 tokens)

Check writing for AI-sounding habits

Use when the user asks whether a piece of writing sounds like AI, wants an email, post, essay or cover letter checked for chatbot habits before sending, or wants to know which phrases to fix. Returns a 0-100 score, a verdict, and each habit found (chatbot words like "delve" and "tapestry", "not X, it's Y" framing, em-dash overuse, assistant filler, fake suspense, stiff transitions, markdown leftovers and more) with examples and why readers notice it. It is a habit check, not an AI detector, and short texts give rough scores. Example: {"text": "<the draft to check>"}. To rewrite, use your own judgment on the flagged habits.

Input parameters:

- `text` (string, required): The writing to check (up to 60,000 characters).

### `runsheet_create_schedule` (~244 tokens)

Create a live day-of schedule page

Use when the user wants a shareable run-of-show or day-of schedule for a wedding, conference, shoot or other event that guests or crew can open on their phone and that updates live when edited. Creates the page and returns a view link to share with everyone and a private edit link to keep. Start from a template (wedding, conf, shoot, blank) or pass your own items. Example: {"name": "Maya and Sam wedding", "date": "2026-09-12", "timezone": "America/New_York", "template": "wedding"} or {"name": "Offsite", "items": [{"time": "09:00", "title": "Welcome", "duration_minutes": 30}]}. Creates a saved page, so only call it when the user wants one.

Input parameters:

- `date` (string): YYYY-MM-DD
- `items` (array): Schedule slots.
- `name` (string): Event name.
- `template` (string): Starter schedule. Ignored if items are given.
- `timezone` (string): IANA time zone, e.g. America/New_York. Default UTC.

### `halves_settle_up` (~221 tokens)

Work out who owes whom in the fewest payments

Use when the user shares a trip, dinner, household or group expense list and asks who owes whom, how to split costs, or how to settle up. Returns each person's paid, share and net balance, and the smallest set of payments that squares everyone up. Handles equal splits, splits among a subset, exact amounts and payments already made, with correct rounding. Nothing is saved. Example: {"people": ["Ana", "Ben", "Cy"], "expenses": [{"what": "Dinner", "amount": 90, "paid_by": "Ana"}, {"what": "Taxi", "amount": 24, "paid_by": "Ben", "split_between": ["Ben", "Cy"]}]}. Do the arithmetic here instead of by hand.

Input parameters:

- `currency` (string): ISO currency code, default USD.
- `expenses` (array, required): What was paid.
- `payments` (array): Payments already made between people to settle up.
- `people` (array, required): Names of everyone in the group (2 to 40, unique).

### `halves_create_group_link` (~201 tokens)

Create a shared expense group link

Use when the user wants a shared place for a group (trip, flat, event) to keep adding expenses and see who owes whom, not just a one-time calculation. Creates a group and returns a link anyone can open without signing up to add and edit expenses. Anyone with the link can edit it, so share it only with the group. Creates a saved page, so only call it when the user wants a shared group. For a one-off answer use halves_settle_up. Example: {"name": "Lisbon trip", "currency": "EUR", "people": ["Ana", "Ben", "Cy"]}.

Input parameters:

- `currency` (string): Main currency, default USD.
- `expenses` (array): Optional starting expenses (up to 50), same shape as the settle tool.
- `name` (string): Group name, e.g. "Lisbon trip".
- `people` (array, required): Names (2 to 40).

### `doorman_check_ai_bot_access` (~160 tokens)

See which AI bots a website lets in

Use when the user asks whether their site (or any public site) blocks ChatGPT, Claude, Google AI, Perplexity or other AI crawlers, whether AI can read or train on their content, or why AI search does not mention their site. Fetches the live robots.txt and reports, for 22 named AI bots in four groups (AI training, AI search, assistants, search engines), which are let in, kept out or partly blocked, plus the site's content-signal preference and fixes. Example: {"url": "example.com"}. Read-only. To write a new robots.txt use doorman_write_robots_txt.

Input parameters:

- `url` (string, required): Website address or domain, e.g. nytimes.com

### `doorman_check_robots_txt` (~143 tokens)

Check a pasted robots.txt for AI bot access

Use when the user pastes the text of a robots.txt (or you have drafted one) and asks which AI bots it lets in or blocks, or whether a change does what they want. Parses it the way crawlers do (groups, wildcards, longest-match) and reports each of 22 named AI bots as let in, kept out or partly blocked, with notes and a suggested choice. Pure parsing, no network. Example: {"robots_txt": "User-agent: GPTBot\nDisallow: /"}.

Input parameters:

- `robots_txt` (string, required): The full robots.txt text (up to 512 KB). Empty means no robots.txt.

### `doorman_write_robots_txt` (~204 tokens)

Write a robots.txt with your AI bot choices

Use when the user wants to allow or block AI training, AI search or assistant bots on their site and needs the robots.txt lines. Takes an optional existing robots.txt plus a choice of "in" or "out" for each of three groups (training, ai_search, assistants) and returns a complete robots.txt that keeps existing rules, adds one clean group per choice and a shared content-signal line. Example: {"training": "out", "ai_search": "in", "assistants": "in"}. Returns text to paste at /robots.txt; it does not change any site.

Input parameters:

- `ai_search` (string): AI search and answer engines (default in).
- `assistants` (string): Assistants that open a page because a person asked (default in).
- `robots_txt` (string): Current robots.txt text to keep (optional).
- `training` (string): Let AI training bots in or keep them out (default out).

### `swatch_check_contrast` (~177 tokens)

Check the WCAG contrast of a text and background color

Use when the user asks whether a color combination is readable or accessible, passes WCAG AA or AAA, or has enough contrast (text on a background, button, badge, link color). Returns the exact contrast ratio, pass or fail for normal text, large text and UI components at AA and AAA, the APCA lightness contrast and a plain note. Colors can be hex, rgb(), hsl() or CSS names. Example: {"foreground": "#777777", "background": "#ffffff"}. Language models cannot compute this reliably, so call it instead of guessing.

Input parameters:

- `background` (string, required): Background color, e.g. "#ffffff".
- `foreground` (string, required): Text (or icon) color, e.g. "#767676" or "rgb(20 20 20)" or "tomato".

### `swatch_fix_contrast` (~139 tokens)

Find the nearest accessible color that passes contrast

Use when a color pair fails contrast and the user wants the smallest change that makes it pass, such as "make this gray text accessible without changing the look". Returns the closest text color on that background that reaches the target (AA, AAA, AA-large or ui), and separately the closest background, keeping the hue. Example: {"foreground": "#777777", "background": "#ffffff", "target": "AA"}. Returns already_passes if nothing needs to change.

Input parameters:

- `background` (string, required): Current background color.
- `foreground` (string, required): Current text color.
- `target` (string): Contrast target. Default AA.

### `swatch_pick_text_color` (~90 tokens)

Pick black or white text for a background

Use when the user asks what text color (black or white) to put on a given background, button or brand color so it is readable. Returns the better of black or white with both contrast ratios, the WCAG grade and a softer near-black option. Example: {"background": "#ff5a1f"}.

Input parameters:

- `background` (string, required): The surface color the text sits on.

### `swatch_make_scale` (~132 tokens)

Build a 50-950 color palette from one color

Use when the user asks for a palette, shades, tints, a design-token scale or a Tailwind-style 50 to 950 ramp from a brand color. Returns 11 steps that keep the hue, with the hex, contrast on white and on black, and the best text color for each step. Example: {"color": "#ff5a1f", "name": "brand"}.

Input parameters:

- `color` (string, required): Base color, e.g. "#ff5a1f".
- `name` (string): Token name used in the CSS and Tailwind output. Default "brand".

### `swatch_convert_color` (~93 tokens)

Convert a color between hex, rgb, hsl and oklch

Use when the user asks to convert a color between hex, RGB, HSL and OKLCH, or asks what a color is called or how light it is. Returns all formats, the relative luminance and the nearest CSS color name. Example: {"color": "#ff5a1f"}. Exact math, so prefer it to converting by hand.

Input parameters:

- `color` (string, required): Any CSS color.

### `swatch_check_pairs` (~121 tokens)

Check contrast for many color pairs at once

Use when the user has a whole design system, theme or stylesheet and wants every text and background pair checked for accessibility in one go. Takes up to 50 pairs and returns the ratio and AA and AAA results for each, with a count of failures. Example: {"pairs": [{"foreground": "#777", "background": "#fff", "label": "muted text"}, {"foreground": "#fff", "background": "#ff5a1f", "label": "button"}]}.

Input parameters:

- `pairs` (array, required): Pairs to check.

### `meridian_now` (~116 tokens)

Current time in any places or time zones

Use when you need to know what time or date it is right now somewhere. You have no clock of your own, so never guess the current time. Returns the real current time, date, UTC offset, abbreviation and daylight saving status for each place. Places can be cities ("Tokyo"), IANA zones ("Europe/Paris"), abbreviations ("PST") or "UTC+5:30".

Input parameters:

- `places` (array, required): Cities, IANA zones or abbreviations, e.g. ["London","Asia/Tokyo"].

### `meridian_convert_time` (~282 tokens)

Convert a time between time zones, DST-correct

Use when you need to convert a specific wall-clock time from one place to others, for any date. It uses the real tz database, so daylight saving is right for that exact date (the US and Europe switch on different weeks), and it warns when the time does not exist (spring forward) or happens twice (fall back). Time accepts "15:00", "3:30pm", "noon", "now" or an ISO local time like 2026-11-05T15:00 (no Z). Date defaults to today in the source zone. Returns {input, utc, source:{...}, converted:[{place, zone, local, time_12h, date, utc_offset, abbreviation, day_note, hours_ahead_of_source}], warning?, summary, open_url}.

Input parameters:

- `date` (string): Optional date YYYY-MM-DD in the source zone. Default today.
- `from` (string, required): Source place or zone, e.g. "New York" or "America/New_York".
- `time` (string, required): Local time in the source place, e.g. "15:00", "3:30pm", "noon", "now", "2026-11-05T15:00".
- `to` (array, required): Destination places, e.g. ["London","Tokyo"].

### `meridian_meeting_slots` (~219 tokens)

Find meeting times that work across time zones

Use when you need to schedule a call across several places. Scans the day in 15-minute steps and ranks start times so the most people are inside working hours and nobody is at night, using each place's real offset and DST for that date. Returns up to 5 slots with each person's local start and end, and says plainly when no time works for everyone. Defaults: working hours 9 to 17, 60 minutes, date today in the first place.

Input parameters:

- `count` (integer): How many slots to return, default 5.
- `date` (string): Date YYYY-MM-DD, local to the first place. Default today.
- `duration_minutes` (integer): Meeting length in minutes, multiple of 15. Default 60.
- `end_hour` (integer): Working day end hour, default 17.
- `places` (array, required): Where each attendee is, e.g. ["San Francisco","London","Tokyo"].
- `start_hour` (integer): Working day start hour, default 9.

### `meridian_zone_info` (~135 tokens)

Offset, abbreviation and daylight saving changes for a zone

Use when you need to answer "what is the UTC offset of X", "does X observe daylight saving" and "when do the clocks change". Returns the current offset and abbreviation, whether the place observes DST, every clock change in the year with exact local before and after times, and the next change. Abbreviations like IST or CST are ambiguous, so the answer says which zone was used.

Input parameters:

- `place` (string, required): City, IANA zone or abbreviation, e.g. "London" or "America/Phoenix".
- `year` (integer): Year to list clock changes for. Default this year.

### `mend_repair_json` (~247 tokens)

Repair broken or LLM-generated JSON

Use when JSON from an LLM, API, log, config or copy-paste fails to parse (JSON.parse error, "Unexpected token", "Expecting property name"), or the user pastes JSON with trailing commas, single quotes, unquoted keys, comments, Python True/False/None, NaN, missing commas or brackets, a ```json fence, text around it, or output that was cut off. Deterministic repair: returns valid, formatted JSON plus a list of every fix with line and column. Values are never rewritten, so big numbers, number formatting and key order stay exactly as written (re-asking a model to "fix the JSON" changes data and costs tokens). If the text is already valid it says so. Up to 100,000 characters.

Input parameters:

- `indent` (integer): Spaces per indent level in the output. Default 2. Use 0 for one minified line.
- `sort_keys` (boolean): Sort object keys alphabetically. Default false (keep the original order).
- `text` (string, required): The broken JSON, or any text that contains JSON (a chat reply, a log line, a code block).

### `mend_check_json` (~93 tokens)

Validate JSON and locate the exact error

Use when you need to know whether text is strictly valid JSON, and if not, exactly where it breaks. Strict RFC 8259 check (the same accept/reject as JSON.parse). Returns line, column, the offending line with a caret and whether Mend can repair it. Use mend_repair_json to fix it. Up to 100,000 characters.

Input parameters:

- `text` (string, required): The text to validate.

### `mend_outline_json` (~146 tokens)

Outline the structure of a large JSON payload

Use when you are about to read a big JSON response, log or export into context, before loading it: returns a compact outline of the structure (keys, types, array lengths, one example per repeated shape) so you can plan a query without spending tokens on the whole document. Repairs the JSON first if needed. Follow with mend_query_json to pull only the values you need. Up to 100,000 characters.

Input parameters:

- `max_depth` (integer): How many levels to expand. Default 4.
- `max_items` (integer): How many array items to show when items differ. Default 6.
- `text` (string, required): The JSON (or JSON-ish text).

### `mend_query_json` (~155 tokens)

Extract values from JSON by path

Use when you need specific fields from a JSON document without reading all of it: $.users[0].name, $.items[*].id, $.a.b[-1], $.list[1:3], $..email (recursive). Returns each match with its exact path, type and value. Repairs the JSON first if needed, so broken input still works. Up to 100,000 characters.

Input parameters:

- `max` (integer): Maximum matches to return. Default 50.
- `path` (string, required): Path such as $.users[*].email, data.items[0], $..id, $.list[-1], $.list[1:3].
- `text` (string, required): The JSON (or JSON-ish text).

### `deadbolt_check_supabase_access` (~360 tokens)

Check who can read and write Supabase tables (RLS, policies, grants)

Use when you write, review or are about to apply Supabase / PostgreSQL migration SQL (CREATE TABLE, RLS, CREATE POLICY, GRANT, views, SECURITY DEFINER functions, storage buckets), or when a user asks whether their Supabase data is exposed, whether RLS is set up right, or why a query returns 42501 permission denied or no rows. Replays the SQL with real Postgres rules and returns, per table, what signed-out (anon) and signed-in (authenticated) users can SELECT/INSERT/UPDATE/DELETE (all rows, own rows, some rows, none, or denied for a missing grant), plus findings with severity and ready-to-run fix SQL: RLS off, policies written but RLS never enabled, using(true) writes, personal columns readable by anyone, views that bypass RLS, SECURITY DEFINER functions anyone can call, user_metadata in policies, public bucket listing, grants missing after the Oct 30 2026 default change. Also accepts the JSON produced by deadbolt_catalog_query for the live database. Deterministic; never connects to any database. Run it before telling a user their schema is safe. Up to 200,000 characters.

Input parameters:

- `project_created_before_2026_10_30` (boolean): Only for SQL input. true (default): the project grants new public tables to anon and authenticated automatically (projects created before Oct 30, 2026). false: new tables get no grants unless the SQL…
- `sql` (string, required): Migration SQL (one or many files concatenated, in order), or the single JSON value returned by the catalog query.

### `deadbolt_catalog_query` (~95 tokens)

Get the read-only SQL that snapshots a live Supabase database for Deadbolt

Use when you need to check a live Supabase project rather than migration files: returns a read-only SQL query that reads table RLS settings, grants for anon and authenticated, policies, SECURITY DEFINER functions and storage buckets (never row data) and returns one JSON value. Run it with the user's Supabase SQL Editor or a Supabase MCP execute_sql tool, then pass the JSON to deadbolt_check_supabase_access.

### `spill_scan_secrets` (~453 tokens)

Find and redact API keys, tokens, private keys and passwords in text

Use when the user asks whether some text contains secrets, or before you paste, commit, share, log or send code, a .env file, a diff, config, logs, a stack trace or a prompt that might contain credentials, for example "did I leak a key in this?", "is this safe to post?" or "redact the secrets in this log". Detects 48 services by exact key format (OpenAI, Anthropic, Gemini/Google, Groq, xAI, OpenRouter, Stripe, Supabase, AWS, GitHub, GitLab, npm, PyPI, Slack, Discord, Twilio, SendGrid, Resend, Shopify, Cloudflare and more) plus PEM private keys, database URLs with passwords, JWTs, Authorization headers and high-entropy values in variables named like secret, token, api_key or password. It verifies what it can deterministically: GitHub token CRC32 checksums, JWT and Supabase key role and expiry (service_role vs anon), documented example keys and placeholders, and NEXT_PUBLIC_/VITE_/EXPO_PUBLIC_ variables that ship to every browser. Returns findings with severity (critical, high, medium, public, info), line and column, a masked preview (never the full secret), why it matters, the fix and the provider's revoke URL, plus a redacted copy with labels like [STRIPE_SECRET_KEY_1]. Text is processed in memory to answer and is not stored. Limits: format-based, so a random secret with a neutral name can be missed; it never tests keys against providers; up to 200,000 characters. For secrets the user should not send anywhere, point them to https://spill.clawhard.com, which runs entirely in the browser.

Input parameters:

- `redact_public_keys` (boolean): false (default): keep keys that are meant to be public (Stripe pk_, Supabase anon or publishable, Mapbox pk.) in the redacted copy so the code still runs. true: hide them too.
- `text` (string, required): The text to scan: code, a diff, .env, config, logs, a stack trace, a chat or a prompt.

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/com-clawhard-studio/mcp#diagnostics

## Score history

- 2026-11-05: 69
- 2026-11-04: 69
- 2026-11-03: 69
- 2026-11-02: 69
- 2026-11-01: 68
- 2026-10-31: 68
- 2026-10-30: 67
- 2026-10-29: 67
- 2026-10-28: 66

## Common questions

### What is the Clawhard Studio MCP server?

Clawhard Studio is an MCP server listed in the public MCP registry as com.clawhard/studio. Token counts, contrast, time zones, JSON repair, Supabase RLS, leaked API keys, AI-bot access. This page covers its hosted endpoint (https://mcp.clawhard.com/mcp).

### Is the Clawhard Studio MCP server safe to use?

Clawhard Studio scores 69 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Clawhard Studio MCP server expose?

Clawhard Studio exposes 28 tools: tokendiet_count_tokens, slopscore_check_website, aitab_list_ai_plans, aitab_total_ai_subscriptions, tells_check_writing, and 23 more. Their descriptions and schemas cost roughly 5,036 tokens of context every time the server is loaded.

### Does the Clawhard Studio MCP server require authentication?

No. We connected to Clawhard Studio without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

### Is the Clawhard Studio MCP server still maintained?

Clawhard Studio is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Remote endpoint: https://mcp.clawhard.com/mcp
- Website: https://clawhard.com/
- Changelog RSS feed: https://verifymcp.io/servers/com-clawhard-studio/mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/com-clawhard-studio/mcp.json
- HTML version of this page: https://verifymcp.io/servers/com-clawhard-studio/mcp