# Highland Intel APIs (remote · api.highlnd-intel.group) 70 pay-per-call APIs: DNS, email auth, security headers, web search, scraping, AI. x402 USDC/Base - Trust score: 64/100 (medium) - Change this week: +3 - Registry status: active - Liveness: live - Owner verified: no - Last scored: 2026-11-05 ## Components - remote · `api.highlnd-intel.group`: 64/100 (this document), [markdown](https://verifymcp.io/servers/group-highlnd-intel-highland-apis/api.md), [page](https://verifymcp.io/servers/group-highlnd-intel-highland-apis/api) ## Channel facts - Endpoint: `https://api.highlnd-intel.group/mcp` - Transports: `streamable-http` - Auth: `none` - Version: `1.0.0` ## Trust breakdown How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog) Scored 2026-11-05. - **Endpoint Security**: 57/100 - The endpoint's TLS certificate is valid, in date, and uses a strong key. - Authorisation not fully verified: no authorisation is required to call this server, and 1 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe. - HTTPS is enforced; there's no plaintext access path. - HSTS check failed: the Strict-Transport-Security header is absent. - DNSSEC check failed: this domain isn't protected by DNSSEC. - **Transport & Reachability**: 100/100 - Verified streamable-http transport via a live MCP handshake. - **Schema Quality & AI Usability**: 70/100 - AI-judged instruction clarity (excellent). - Context-footprint check failed: tool/resource definitions use about 9785 tokens (~139/item across 70 items; 70 tools + 0 resources), over budget; trim descriptions and params. - Usage-examples check failed: none of the tools include examples. - **Stability & Change Management**: 27/100 - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses. - **Tool Coverage**: 100/100 - 100% of tools have a non-trivial description (not blank, and not just the tool's name). - 100% of tool parameters carry a description. - **Tool Safety**: 75/100 - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured. - 0 of 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "cors-check" implies "send" and declares readOnlyHint instead, contradicting what its own name says it does. - An AI judge read all 71 captured unit(s) of tool text and found none that tries to manipulate the model reading it. - **Capabilities**: 60/100 - Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28. ## Install ### How do I install the Highland Intel APIs MCP server? Highland Intel APIs is a hosted endpoint at https://api.highlnd-intel.group/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation. ### Claude ```bash claude mcp add --transport http group-highlnd-intel-highland-apis 'https://api.highlnd-intel.group/mcp' ``` ### Cursor ```json { "mcpServers": { "group-highlnd-intel-highland-apis": { "url": "https://api.highlnd-intel.group/mcp" } } } ``` ### VS Code ```json { "servers": { "group-highlnd-intel-highland-apis": { "type": "http", "url": "https://api.highlnd-intel.group/mcp" } } } ``` ### Codex ```toml [mcp_servers.group-highlnd-intel-highland-apis] url = "https://api.highlnd-intel.group/mcp" ``` ### opencode ```json { "$schema": "https://opencode.ai/config.json", "mcp": { "group-highlnd-intel-highland-apis": { "type": "remote", "url": "https://api.highlnd-intel.group/mcp", "enabled": true } } } ``` ### OpenClaw ```bash openclaw mcp add group-highlnd-intel-highland-apis --url 'https://api.highlnd-intel.group/mcp' --transport streamable-http ``` ### Hermes ```yaml mcp_servers: group-highlnd-intel-highland-apis: url: "https://api.highlnd-intel.group/mcp" ``` ### Netclaw ```json { "McpServers": { "group-highlnd-intel-highland-apis": { "Transport": "http", "Url": "https://api.highlnd-intel.group/mcp" } } } ``` ### Vellum ```bash assistant mcp add group-highlnd-intel-highland-apis -t streamable-http -u 'https://api.highlnd-intel.group/mcp' ``` ### Other ```json { "mcpServers": { "group-highlnd-intel-highland-apis": { "type": "http", "url": "https://api.highlnd-intel.group/mcp" } } } ``` The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs. ## Changelog Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims. ### 2026-11-04 (score 64, +1) No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes. ### 2026-11-02 (score 63, +1) No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes. ### 2026-10-31 (score 62, +1) No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes. ### 2026-10-29 (score 61, +1) - [functional improvement] Stability: unverified → 0.03 ### 2026-10-28 (score 60) First indexed and scored. ## MCP tools (70) ### `dns-lookup` (~124 tokens) DNS records A, AAAA, MX, NS and TXT records for a domain over DNS-over-HTTPS. Returns { domain, records: { A, AAAA, MX, NS, TXT } }: each record type as a list of strings. Price: 2 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `domain` (string, required): Public domain name, e.g. example.com; IP literals and private suffixes (.local, .internal, .lan, .corp) are refused. ### `mail-auth` (~122 tokens) Email authentication check SPF and DMARC presence and policy strength for a domain. Returns { domain, spf, dmarc, dmarcPolicy, findings, pass }: the SPF and DMARC records, the DMARC policy and finding codes. Price: 3 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `domain` (string, required): Public domain name, e.g. example.com; IP literals and private suffixes (.local, .internal, .lan, .corp) are refused. ### `header-audit` (~122 tokens) HTTP security header audit Which security headers a site's HTTPS front page sends, with a simple grade. Returns { domain, status, present, missing, grade, server }: security headers sent and missing, and a grade A, B, C or F. Price: 3 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `domain` (string, required): Public domain name, e.g. example.com; IP literals and private suffixes (.local, .internal, .lan, .corp) are refused. ### `https-redirect` (~120 tokens) HTTPS redirect check Whether plain HTTP redirects to HTTPS, and whether HSTS is set. Returns { domain, redirectsToHttps, hsts, hstsMaxAge, hstsStrong }: HTTP-to-HTTPS redirect and HSTS status. Price: 2 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `domain` (string, required): Public domain name, e.g. example.com; IP literals and private suffixes (.local, .internal, .lan, .corp) are refused. ### `security-txt` (~120 tokens) security.txt check Fetches /.well-known/security.txt and reports Contact and Expires (RFC 9116). Returns { domain, present, hasContact, expires, expired }: whether security.txt exists, has a Contact and has expired. Price: 2 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `domain` (string, required): Public domain name, e.g. example.com; IP literals and private suffixes (.local, .internal, .lan, .corp) are refused. ### `summarize` (~114 tokens) Summarize Three-bullet summary of up to 8,000 characters. Input is PII-redacted first. Returns { summary }: up to three short bullet points as one string. Price: 4 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `text` (string, required): Text to process, 1 to 8,000 characters. Emails, phone numbers, card numbers, SINs and IPv4s are redacted before the model sees it. ### `classify` (~156 tokens) Classify Picks one label from your list (2 to 20 labels) for a piece of text. Returns { label, labels }: the chosen label (one of yours, or null if none fit) and the labels sent. Price: 3 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `labels` (array, required): Candidate labels, 2 to 20, each 1 to 40 characters; the answer is always one of these or null. - `text` (string, required): Text to process, 1 to 8,000 characters. Emails, phone numbers, card numbers, SINs and IPv4s are redacted before the model sees it. ### `translate` (~156 tokens) Translate (EN/FR and more) Translates text between languages; defaults to English to French for NS/NB customers. Returns { translated, source, target }: the translated text and the language pair used. Price: 4 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `source` (string): ISO 639-1 two-letter lower-case language code of the input text. - `target` (string): ISO 639-1 two-letter lower-case language code to translate into. - `text` (string, required): Text to process, 1 to 8,000 characters. Emails, phone numbers, card numbers, SINs and IPv4s are redacted before the model sees it. ### `pii-redact` (~124 tokens) PII redaction Strips emails, phone numbers, card numbers, SINs and IPv4s. Runs locally, no model. Returns { text, counts }: the redacted text with [EMAIL]-style placeholders and a count per kind (email, card, sin, phone, ip). Price: 1 credit (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `ip` (boolean): Also redact IPv4 addresses. - `text` (string, required): Text to redact, up to 32,000 characters. ### `text-stats` (~92 tokens) Text statistics Word, sentence and character counts, reading time and a Flesch reading-ease score. Returns { characters, words, sentences, readingMinutes, fleschReadingEase }. Price: 1 credit (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `text` (string, required): Text to measure, up to 64,000 characters. ### `json-validate` (~135 tokens) JSON Schema validate Validates a JSON value against a JSON-Schema subset and lists every error path. Returns { valid, errors }: true when the value matches, and one message per error path (up to 50). Price: 1 credit (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `schema` (object, required): JSON Schema subset to check against: type, required, properties, items, enum, minimum, maximum, minLength, maxLength. - `value` (required): Any JSON value to validate (object, array, string, number, boolean or null). ### `regex-test` (~143 tokens) Regex tester Runs a JavaScript regex over sample text and returns matches and groups (capped sizes). Returns { count, matches }: up to 100 matches, each { match, index, groups }. Price: 1 credit (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `flags` (string): Regex flags from g, i, m, s, u, y; g is always added. - `pattern` (string, required): JavaScript regular expression source, without slashes, up to 200 characters. - `text` (string, required): Sample text to search, up to 2,000 characters. ### `cron-explain` (~106 tokens) Cron explainer Explains a 5-field cron expression in plain English (UTC, as Cloudflare runs it). Returns { cron, explanation }: the expression and a plain-English reading of it. Price: 1 credit (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `cron` (string, required): Five-field cron expression (minute hour day-of-month month day-of-week), read as UTC like Cloudflare Cron Triggers. ### `text-diff` (~119 tokens) Text diff Line-by-line diff of two texts (up to 500 lines each). Returns { added, removed, diff }: line counts and the diff lines prefixed with space, - or +. Price: 2 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `a` (string, required): Original text, up to 32,000 characters and 500 lines. - `b` (string, required): Changed text, up to 32,000 characters and 500 lines. ### `hash` (~97 tokens) Hash SHA-1/256/384/512 hex digest of UTF-8 text. Returns { algorithm, hex }: the lower-case hex digest. Price: 1 credit (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `algorithm` (string): Digest algorithm. - `text` (string, required): Text to hash as UTF-8, up to 64,000 characters. ### `hst-calc` (~153 tokens) Nova Scotia HST calculator Adds 14% NS HST to a subtotal, or splits a tax-included total. Confirm the rate with CRA. Returns { subtotalCents, hstCents, totalCents, rate }. Price: 1 credit (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `amountCents` (integer, required): Pre-tax subtotal, or the tax-included total when included is true. Integer CAD cents. - `included` (boolean): amountCents already includes HST: split it instead of adding to it. - `rate` (number): HST rate as a fraction (0.14 is the Nova Scotia rate). ### `quote-build` (~140 tokens) Quote builder Totals line items, applies a discount and HST, and computes a deposit. No customer details taken. Returns { lines, grossCents, discountCents, subtotalCents, hstCents, totalCents, rate, depositCents }. Price: 5 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `depositPct` (number): Deposit as a percent of the tax-included total. - `discountPct` (number): Discount on the gross total, in percent. - `items` (array, required): Line items, 1 to 100. ### `invoice-number` (~148 tokens) Invoice number Formats PREFIX-YYYYMM-NNNNN-C with a Luhn check digit, or validates one. Returns { invoice } when formatting, or { valid } when validating. Price: 1 credit (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `prefix` (string): Two to six upper-case letters. - `sequence` (integer): Invoice sequence number. Required unless validate is given. - `validate` (string): An invoice number to check instead of formatting one; when given, the other fields are ignored. - `yyyymm` (string): Year and month as YYYYMM; defaults to the current UTC month. ### `uptime-check` (~146 tokens) Uptime check One HTTPS probe of a public domain: status, latency and whether it looks up. Returns { domain, up, status, ms }: up is true for any status below 500; status is null when the host does not answer. Price: 2 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `domain` (string, required): Public domain name, e.g. example.com; IP literals and private suffixes (.local, .internal, .lan, .corp) are refused. - `path` (string): Path to probe, starting with /, letters, digits, _ . / - only. ### `web-search` (~210 tokens) Web search Neural or keyword web search with highlights, for agents. Up to 10 results, public URLs only. Returns { query, results: [{ title, url, publishedDate, score, highlights }] }: up to 10 results, each with up to 3 highlights of 500 characters. Price: 8 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `excludeDomains` (array): Never return results from these domains (up to 20). - `includeDomains` (array): Only return results from these domains (up to 20). - `numResults` (integer): Results to return, 1 to 10. - `query` (string, required): Search query, 1 to 500 characters. - `startPublishedDate` (string): Only pages published on or after this date (YYYY-MM-DD, UTC). - `type` (string): Search mode: auto (default), neural (semantic) or fast. ### `web-contents` (~122 tokens) Web page contents Clean text of up to 5 public pages, capped per page, for agents to read. Returns { results: [{ url, title, publishedDate, text, characters }] }: one entry per page the provider could read. Price: 6 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `maxCharacters` (integer): Text kept per page, 500 to 10,000 characters. - `urls` (array, required): 1 to 5 public http(s) URLs. ### `find-similar` (~152 tokens) Find similar pages Pages similar in meaning to a given public URL, with highlights. Up to 10 results. Returns { url, results: [{ title, url, publishedDate, score, highlights }] }. Price: 8 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `excludeSourceDomain` (boolean): Leave out pages from the same domain as the URL (default true). - `numResults` (integer): Results to return, 1 to 10. - `url` (string, required): Public http(s) URL. Private, loopback, link-local and metadata addresses, internal hostnames and this service's own hosts are refused. ### `web-scrape` (~138 tokens) Web scrape to Markdown Main content of one public page as Markdown (up to 50,000 characters), with title and status. Returns { url, finalUrl, title, description, statusCode, markdown, characters, truncated }. Price: 7 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `maxChars` (integer): Markdown kept, 1,000 to 50,000 characters. - `url` (string, required): Public http(s) URL. Private, loopback, link-local and metadata addresses, internal hostnames and this service's own hosts are refused. ### `web-map` (~165 tokens) Site map Discovers the URLs of a public site (up to 200), optionally ranked by a search term. Returns { url, count, links }: up to 200 unique public URLs. Price: 6 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `includeSubdomains` (boolean): Also include links on subdomains of the site. - `limit` (integer): Links to return, 1 to 200. - `search` (string): Optional term to rank and filter links by, up to 200 characters. - `url` (string, required): Public http(s) URL. Private, loopback, link-local and metadata addresses, internal hostnames and this service's own hosts are refused. ### `web-extract` (~228 tokens) Structured web extract Scrapes a public page and fills your flat schema (up to 20 typed fields) from it. Values are type-checked. Returns { url, finalUrl, title, data, missing }: one value per field (typed, or null when the page does not say) and the required fields that came back null. Price: 10 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `schema` (object, required): Flat JSON Schema of what to extract: { type: "object", properties: { : { type: string|number|integer|boolean, description?, enum? } }, required? }. 1 to 20 fields; names match ^[A-Za-z_][A-Za-z… - `url` (string, required): Public http(s) URL. Private, loopback, link-local and metadata addresses, internal hostnames and this service's own hosts are refused. ### `enrich-url` (~150 tokens) Enrich URL Profiles one public page: title, summary, organisations and other entities, topics, sentiment and public contact points. Returns { url, finalUrl, title, summary, entities: [{ text, type }], topics, sentiment: { label, score }, contact_points: { emails, phones, pages, social } }. Only role mailboxes (info@, sales@ ...) are returned. Price: 12 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `url` (string, required): Public http(s) URL. Private, loopback, link-local and metadata addresses, internal hostnames and this service's own hosts are refused. ### `enrich-company` (~131 tokens) Enrich company Company profile from public web sources: name, description, industry, recent signals and the sources used. Returns { name, domain, description, industry, signals, sources: [{ url, title }] }: up to 5 signals and 8 sources. Organisations only, never people. Price: 14 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `domain` (string, required): Public domain name, e.g. example.com; IP literals and private suffixes (.local, .internal, .lan, .corp) are refused. ### `entity-extract` (~158 tokens) Entity extraction Named entities of fixed types (person, organization, location, product, event, date, money, law, technology), each found verbatim in your text. Returns { entities: [{ text, type }], counts }: up to 50 entities, each present in the (redacted) text, and a count per type. Price: 10 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `text` (string, required): Text to analyse, 1 to 8,000 characters. Emails, phone numbers, card numbers, SINs and IPv4s are redacted first. - `types` (array): Entity types to return; default all nine. ### `keywords` (~142 tokens) Keywords Key phrases of your text, each found verbatim in it; falls back to a frequency ranking if the model answer is unusable. Returns { keywords, source }: up to `max` phrases and whether they came from the model or the frequency fallback. Price: 10 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `max` (integer): Keywords to return, 1 to 25. - `text` (string, required): Text to analyse, 1 to 8,000 characters. Emails, phone numbers, card numbers, SINs and IPv4s are redacted first. ### `sentiment` (~137 tokens) Sentiment Positive, negative or neutral, with a score from -1 to 1, from a sentiment classifier over up to 8,000 characters. Returns { label, score, positive, negative, chunks }: label is positive, negative or neutral (below 0.6 confidence); score is positive minus negative. Price: 10 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `text` (string, required): Text to analyse, 1 to 8,000 characters. Emails, phone numbers, card numbers, SINs and IPv4s are redacted first. ### `cf-ip-check` (~110 tokens) Cloudflare IP check Says whether an IPv4 or IPv6 address is in Cloudflare's published edge ranges, and which range. Returns { ip, version, cloudflare, range, rangesAsOf }: range is the matching CIDR or null. Price: 1 credit (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `ip` (string, required): IPv4 (dotted quad) or IPv6 address, without a port or zone id. ### `wrangler-lint` (~161 tokens) Wrangler config lint Lints a wrangler.jsonc or wrangler.toml: name, entry point, compatibility date, secrets left in vars, routes. Returns { ok, format, findings[{ severity: error|warning|info, code, path, message }] and counts { error, warning, info } }. Values are never echoed, only paths. Price: 2 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `config` (string, required): The wrangler.jsonc, wrangler.json or wrangler.toml text, up to 60,000 characters. - `format` (string): Config format; auto treats text starting with { as JSONC, otherwise TOML. ### `cron-to-cf` (~143 tokens) Cron to Cloudflare trigger Checks a cron expression against Cloudflare Cron Trigger syntax, explains it, lists the next runs and gives the wrangler snippet. Returns { valid, cron, errors, warnings, explanation, nextRuns (up to 5 ISO times, standard syntax only), snippets { jsonc, toml } }. Price: 1 credit (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `cron` (string, required): Cron expression. Cloudflare uses 5 fields in UTC, weekdays 1 to 7 with 1 = Sunday (or SUN-SAT), and allows L, W and #. ### `mcp-config-validate` (~140 tokens) MCP config validator Validates a Claude Code .mcp.json: transports, commands, URLs, headers and env, and flags literal secrets by path. Returns { ok, servers[{ name, transport }], findings[{ severity: error|warning|info, code, path, message }] and counts { error, warning, info } }. Values are never echoed. Price: 2 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `config` (required): The config as a JSON string (comments and trailing commas allowed) or as an object, up to 60,000 characters. ### `claude-md-lint` (~138 tokens) CLAUDE.md lint Lints a CLAUDE.md: size, structure, @imports, and secrets, passwords or email addresses that should not be there. Returns { ok, stats { characters, lines, approxTokens, headings, imports }, findings[{ severity: error|warning|info, code, path, message }] and counts { error, warning, info } }. Paths are line numbers. Price: 2 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `text` (string, required): The CLAUDE.md text, up to 60,000 characters. ### `hooks-validate` (~132 tokens) Claude Code hooks validator Validates a Claude Code hooks block (or a whole settings.json): events, matchers, hook types, timeouts and risky commands. Returns { ok, events, hookCount, findings[{ severity: error|warning|info, code, path, message }] and counts { error, warning, info } }. Price: 2 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `config` (required): The config as a JSON string (comments and trailing commas allowed) or as an object, up to 60,000 characters. ### `slash-command-scaffold` (~169 tokens) Slash command scaffold Writes a ready-to-save Claude Code slash command file with frontmatter, $ARGUMENTS and a step outline. Returns { path, content, usage }: save content at path (.claude/commands/.md). Price: 1 credit (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `allowedTools` (array): Optional tool rules the command may use, e.g. Read or Bash(git diff:*). - `argumentHint` (string): Optional hint for the arguments, e.g. [file] [focus]. - `description` (string, required): One-line description shown in the / menu. - `name` (string, required): Command name: lowercase letters, digits and -, up to 40 characters. ### `token-count` (~127 tokens) Token count estimate Estimated token counts for cl100k-like, o200k-like, Claude-like and Llama-like tokenizers plus a char/4 baseline. Deterministic estimates, not exact counts. Returns { estimates: { cl100k, o200k, claude, llama, char4 }, chars, bytes, pieces, method, exact: false } Price: 1 credit (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `text` (string, required): Text to count, up to 60,000 characters. ### `chunk-text` (~230 tokens) RAG text chunker Splits text for retrieval by estimated tokens, sentences or markdown headings, with token overlap and stable SHA-256 chunk ids. Returns { chunks: [{ id (sha-256 hex of the chunk text), index, text, tokens, start, end, heading? }], count, mode, size, overlap, family, method } Price: 2 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `family` (string): Tokenizer family used for counts: cl100k, o200k, claude or llama (all estimates). - `mode` (string): Split by estimated tokens, by sentence boundaries, or by markdown heading sections (each chunk carries its heading). - `overlap` (integer): Estimated tokens repeated from the end of one chunk at the start of the next; must be under half of size. - `size` (integer): Target maximum estimated tokens per chunk, 32 to 4000. - `text` (string, required): Text or markdown to chunk, up to 60,000 characters. ### `dataset-validate` (~266 tokens) Fine-tune dataset validator Checks chat (OpenAI-style), messages (Anthropic-style) or Alpaca JSONL: per-line errors, role order, empty turns, duplicates, token estimates and a training-cost estimate from your price. Returns { format, lines, valid, invalid, ok, errors: [{ line, code, message }] (first 100), errorCount, errorsTruncated, duplicates: [{ line, firstLine }], duplicateCount, tokens: { total, mean, max }, costEstimate } Price: 2 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `epochs` (integer): Training epochs for the cost estimate, 1 to 50. - `format` (string): openai (messages with system/user/assistant/tool), anthropic (top-level system + user/assistant messages), alpaca (instruction/input/output), or auto to detect from the first parseable row. - `jsonl` (string, required): JSONL: one JSON object per line, up to 60,000 characters and 5,000 lines. Blank lines are ignored. - `pricePerMillionTokens` (number): Optional: your training price per million tokens, used only for costEstimate (any currency). ### `dataset-convert` (~209 tokens) Fine-tune dataset converter Converts JSONL between OpenAI-style chat, Anthropic-style messages and Alpaca rows. System prompts move between the system message and the top-level field; rows that cannot convert are listed. Returns { from, to, converted, skippedCount, skipped: [{ line, reason }], jsonl } Price: 2 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `from` (string): openai (messages with system/user/assistant/tool), anthropic (top-level system + user/assistant messages), alpaca (instruction/input/output), or auto to detect from the first parseable row. - `jsonl` (string, required): JSONL: one JSON object per line, up to 60,000 characters and 5,000 lines. Blank lines are ignored. - `to` (string, required): Target format: openai, anthropic or alpaca (alpaca takes single user/assistant exchanges only). ### `dataset-split` (~189 tokens) Seeded dataset split Deterministic seeded shuffle and train/val/test split of JSONL rows. The same seed and input always give the same split. Returns { seed, ratios, counts: { train, val, test, skipped }, train, val, test } (each split as JSONL) Price: 1 credit (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `jsonl` (string, required): JSONL: one JSON object per line, up to 60,000 characters and 5,000 lines. Blank lines are ignored. - `seed` (string): Shuffle seed; any string. - `test` (number): Share of rows for test. - `train` (number): Share of rows for train. train + val + test must equal 1. - `val` (number): Share of rows for validation. ### `embed` (~108 tokens) Text embeddings Embeds 1 to 16 short texts with the fixed Workers AI model @cf/baai/bge-base-en-v1.5 (768 dimensions) for search and clustering. Returns { model, dimensions, count, vectors: number[][] } Price: 3 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `inputs` (array, required): 1 to 16 texts, each up to 2000 characters. ### `similarity` (~130 tokens) Semantic similarity ranking Ranks up to 15 candidate texts by cosine similarity to a query, using @cf/baai/bge-base-en-v1.5 embeddings. Returns { model, ranked: [{ index, score }] (highest first), scores: number[] (input order) } Price: 3 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `candidates` (array, required): 1 to 15 candidate texts, each up to 2000 characters. - `query` (string, required): Query text, up to 2000 characters. ### `prompt-lint` (~127 tokens) Prompt safety lint Flags prompt-injection phrasing, chat-template tokens, hidden characters, PII and secrets per line, and lists {{variables}}. Rule-based, no model call; flagged text is never echoed. Returns { ok, findings: [{ kind, severity, line, detail }], counts: { high, medium, low }, variables } Price: 1 credit (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `prompt` (string, required): Prompt or template text to check, up to 60,000 characters. ### `jwt-decode` (~129 tokens) JWT decoder Decodes a JWT header and payload without verifying it, with warnings for alg none, missing or past exp, future nbf/iat and risky header fields. Returns { header, payload, signatureBytes, times: { exp, nbf, iat, expired }, verified: false, warnings, note } Price: 1 credit (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `token` (string, required): Compact JWS (header.payload.signature). It is decoded only; do not send production tokens you cannot rotate. ### `url-parse` (~129 tokens) URL parser Splits a URL into scheme, host, port, path segments, query (repeated keys as arrays) and fragment, with warnings for credentials, plain http and punycode. Passwords are never echoed. Returns { href, protocol, username, hasPassword, hostname, port, pathname, pathSegments, query, hash, origin, isIp, warnings } Price: 1 credit (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `url` (string, required): Absolute URL to parse. It is not fetched. ### `base64` (~172 tokens) Base64 encode and decode Encodes UTF-8 text to standard or url-safe base64, or decodes either form; binary results that are not valid UTF-8 come back as hex. Returns encode: { base64, variant, bytes } · decode: { text | null, hex | null, utf8, bytes } Price: 1 credit (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `data` (string, required): Text to encode, or base64 (standard or url-safe, padding optional) to decode. - `mode` (string, required): encode turns text into base64; decode turns base64 into text (or hex). - `variant` (string): Output alphabet when encoding: standard (+/ and padding) or url (-_ without padding). ### `uuid` (~118 tokens) UUID generator Generates 1 to 100 random v4 or time-ordered v7 UUIDs (RFC 9562) from Web Crypto. Returns { version, uuids: string[] } Price: 1 credit (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `count` (integer): How many UUIDs, 1 to 100. - `version` (integer): 4 for random, 7 for Unix-ms time-ordered (sortable, good for database keys). ### `user-agent-parse` (~114 tokens) User-agent parser Identifies browser, engine, OS, device class and known crawlers, AI bots and HTTP clients from a User-Agent string. Rule-based; user agents can be spoofed. Returns { browser: { name, version }, engine, os: { name, version }, device, isBot, bot } Price: 1 credit (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `userAgent` (string, required): The User-Agent header value. ### `cors-check` (~232 tokens) CORS check Sends a GET with an Origin header (and an OPTIONS preflight for non-simple methods, custom headers or credentials) to a public URL and reports the Access-Control-* headers with an allowed/blocked verdict. Returns { url, finalUrl, origin, status, preflight: { status } | null, headers: { acao, acac, acam, acah, vary }, allowed, issues } Price: 2 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `credentials` (boolean): Whether the call sends cookies or auth (credentials: include). - `method` (string): Method the browser call would use; non-simple methods trigger a preflight. - `origin` (string): Origin the browser would send, e.g. https://app.example.com. - `requestHeaders` (array): Request header names the call would send (triggers a preflight when non-empty). - `url` (string, required): Public http(s) URL. Private, loopback, link-local, metadata and our own hosts are refused. ### `openapi-lint` (~136 tokens) OpenAPI lint Checks an OpenAPI 3.0/3.1 document (as JSON): version, info, paths, responses, unique operationIds, declared path parameters and unresolved local $refs. Returns { valid, version, operations, refs, unresolvedRefs, errors: [{ path, message }], warnings: [{ path, message }] } Price: 2 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `spec` (object, required): The OpenAPI document as a JSON object (convert YAML first). Request bodies are capped at 64 KiB. ### `http-status` (~100 tokens) HTTP status lookup Name, meaning, class, retryability and default cacheability of an HTTP status code, including Cloudflare's 52x codes. Returns { code, name, meaning, class, known, retryable, cacheableByDefault } Price: 1 credit (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `code` (integer, required): Status code, 100 to 599. ### `og-preview` (~136 tokens) Link preview (Open Graph) Fetches a public page (first 512 KB) and returns its link-preview metadata: title, description, image, Open Graph and Twitter tags, canonical URL, icons and missing tags. Returns { url, finalUrl, status, title, description, image, siteName, canonical, icons, lang, og, twitter, missing, truncated } Price: 3 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `url` (string, required): Public http(s) URL. Private, loopback, link-local, metadata and our own hosts are refused. ### `code-review` (~116 tokens) AI code review Reviews a code snippet and returns concrete issues (bugs, security, performance, style) with severity and a fix for each. Returns { language, summary, issues: [{ severity, line, issue, fix }] } Price: 4 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `code` (string, required): Source code to review, up to 6,000 characters. - `language` (string): Language name, or omit to auto-detect. ### `commit-message` (~90 tokens) Commit message writer Turns a unified diff into a Conventional Commits message: type, scope, subject and body. Returns { message, type, scope, subject, body } Price: 2 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `diff` (string, required): Unified diff (git diff output), up to 7,000 characters. ### `regex-from-english` (~129 tokens) Regex from English Writes a JavaScript regex from a plain-English description, compiles it, and tests it against your sample strings. Returns { pattern, flags, literal, explanation, tests: [{ input, expected, got }], passed, total } Price: 3 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `description` (string, required): What the regex should match, in plain English. - `should_match` (array): Strings that must match. - `should_not_match` (array): Strings that must not match. ### `sql-explain` (~93 tokens) SQL explainer Explains a SQL query step by step and flags performance and safety risks, with index suggestions. Returns { summary, steps, risks, index_suggestions } Price: 2 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `sql` (string, required): One SQL statement, up to 5,000 characters. It is not executed. ### `semver` (~105 tokens) Semver resolver Sorts versions by SemVer 2.0 precedence, returns the latest stable and pre-release, and the next major, minor and patch. Returns { sorted, latest_stable, latest, invalid, next: { major, minor, patch, from } } Price: 1 credit (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `versions` (array, required): Version strings, optionally v-prefixed. ### `page-markdown` (~121 tokens) Web page to Markdown Fetches a public page and returns clean, LLM-ready Markdown of the main content, with title, word and link counts. No third-party scraper. Returns { url, title, words, links, truncated, markdown } Price: 3 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `max_chars` (integer): Markdown kept, default 20,000. - `url` (string, required): Public http(s) URL to fetch. Private and internal hosts are refused. ### `json-extract` (~112 tokens) Structured extraction Pulls the fields you name out of free text (emails, invoices, tickets) and returns strict JSON, null when a field is absent. Returns { data: { : value | null }, found, total } Price: 3 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `fields` (array, required): Field names to extract. - `text` (string, required): Source text, up to 6,000 characters. ### `tool-schema` (~132 tokens) Tool schema generator Builds ready-to-paste tool definitions for Anthropic, OpenAI and MCP from a compact parameter spec. Returns { anthropic, openai, mcp } Price: 1 credit (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `description` (string, required): What the tool does. - `name` (string, required): Tool name. - `params` (object): Map of parameter name to "type[:extra][!] description"; types string, number, integer, boolean, object, enum:a,b, array:itemtype; ! marks required. ### `prompt-inject-scan` (~118 tokens) Prompt-injection scanner Scans untrusted text (web pages, emails, tool output) for prompt-injection patterns before it reaches your agent; returns a risk score and the hits. Returns { risk: none|low|medium|high, score, hits: [{ rule, weight, match, index }] } Price: 1 credit (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `text` (string, required): Untrusted text, up to 100,000 characters. ### `seo-audit` (~132 tokens) On-page SEO audit Audits a live page: title and description length, H1s, canonical, robots, lang, viewport, image alts, structured data and links, scored 0-100. Returns { url, status, score, title, description, h1_count, images, images_missing_alt, links, checks: [{ id, pass, weight }] } Price: 3 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `url` (string, required): Public http(s) URL to fetch. Private and internal hosts are refused. ### `contrast-check` (~114 tokens) WCAG contrast checker Computes the WCAG 2.2 contrast ratio of two colours, pass/fail for AA and AAA, and the nearest passing foreground when it fails. Returns { ratio, aa_normal, aa_large, aaa_normal, aaa_large, ui_components, suggested_foreground } Price: 1 credit (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `background` (string, required): Background colour, hex. - `foreground` (string, required): Text colour, hex. ### `robots-check` (~131 tokens) robots.txt checker Reads a site's robots.txt and says whether a crawler may fetch a path, with the matching rule, the major AI crawlers' access and the sitemaps. Returns { robots_url, robots_status, agent, path, allowed, rule, ai_crawlers, sitemaps } Price: 1 credit (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `agent` (string): Crawler user agent, default *. - `url` (string, required): Public http(s) URL to fetch. Private and internal hosts are refused. ### `webhook-verify` (~209 tokens) Webhook signature verifier Verifies Stripe, GitHub, Slack, Shopify or generic HMAC-SHA256 webhook signatures exactly as the provider computes them, with timestamp tolerance. Returns { provider, valid, timestamp?, age_s?, within_tolerance? } Price: 1 credit (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `payload` (string, required): Raw request body exactly as received. - `provider` (string, required): Signature scheme. - `secret` (string, required): Webhook signing secret. Use a test secret; it is not stored. - `signature` (string, required): Signature header value (Stripe-Signature, X-Hub-Signature-256, X-Slack-Signature, X-Shopify-Hmac-Sha256, or hex/base64). - `timestamp` (string): Slack only: X-Slack-Request-Timestamp. - `tolerance_s` (integer): Allowed clock skew for Stripe and Slack, default 300. ### `curl-to-code` (~98 tokens) curl to code Converts a curl command into JavaScript fetch, Python requests, Go net/http or PHP code. Returns { language, request: { url, method, headers, data }, code } Price: 2 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `curl` (string, required): A curl command line. - `language` (string): Target language, default javascript. ### `mock-response` (~112 tokens) Mock API response Generates realistic sample JSON from a JSON Schema or OpenAPI schema object, with field-aware values (emails, UUIDs, dates, URLs). Returns { data } or { data: [...], count } Price: 1 credit (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `count` (integer): Items to generate, default 1. - `schema` (object, required): JSON Schema (or OpenAPI schema object) of one response item. ### `rdap-lookup` (~129 tokens) Domain RDAP lookup Modern WHOIS over RDAP: registrar, creation and expiry dates, days to expiry, status codes, nameservers and DNSSEC. Returns { domain, registrar, created, updated, expires, days_to_expiry, status, nameservers, dnssec } Price: 2 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing. Input parameters: - `domain` (string, required): Public domain name, e.g. example.com; IP literals and private suffixes (.local, .internal, .lan, .corp) are refused. ## Diagnostics Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/group-highlnd-intel-highland-apis/api#diagnostics ## Score history - 2026-11-05: 64 - 2026-11-04: 64 - 2026-11-03: 63 - 2026-11-02: 63 - 2026-11-01: 62 - 2026-10-31: 62 - 2026-10-30: 61 - 2026-10-29: 61 - 2026-10-28: 60 ## Common questions ### What is the Highland Intel APIs MCP server? Highland Intel APIs is an MCP server listed in the public MCP registry as group.highlnd-intel/highland-apis. 70 pay-per-call APIs: DNS, email auth, security headers, web search, scraping, AI. x402 USDC/Base. This page covers its hosted endpoint (https://api.highlnd-intel.group/mcp). ### Is the Highland Intel APIs MCP server safe to use? Highland Intel APIs scores 64 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm. ### What tools does the Highland Intel APIs MCP server expose? Highland Intel APIs exposes 70 tools: dns-lookup, mail-auth, header-audit, https-redirect, security-txt, and 65 more. Their descriptions and schemas cost roughly 9,756 tokens of context every time the server is loaded. ### Does the Highland Intel APIs MCP server require authentication? No. We connected to Highland Intel APIs without credentials and it answered, so anything it exposes is reachable by anyone who knows the address. ### Is the Highland Intel APIs MCP server still maintained? Highland Intel APIs is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced. ### What did VerifyMCP test on the Highland Intel APIs MCP server? VerifyMCP ran 12 checks on Highland Intel APIs, covering TLS certificate, HTTPS, HSTS header, DNSSEC and 8 more. One item could not be completed, a gap on our side rather than a finding about Highland Intel APIs: Authorization. Supply Chain Security and Provenance & Transparency do not apply to a hosted endpoint, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out. ## Links - Remote endpoint: https://api.highlnd-intel.group/mcp - Website: https://api.highlnd-intel.group/ - Changelog RSS feed: https://verifymcp.io/servers/group-highlnd-intel-highland-apis/api.xml - Changelog JSON feed: https://verifymcp.io/servers/group-highlnd-intel-highland-apis/api/changelog.json - Trust report (JSON): https://verifymcp.io/servers/group-highlnd-intel-highland-apis/api.json - HTML version of this page: https://verifymcp.io/servers/group-highlnd-intel-highland-apis/api