# Apixies Developer API Suite (npm · @apixies/mcp-server)

50 developer utility APIs as tools: SSL, DNS, WHOIS, email checks, HTML to PDF, sitemaps and more.

- Trust score: 71/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-09-25

## Components

- npm · `@apixies/mcp-server`: 71/100 (this document), [markdown](https://verifymcp.io/servers/io-apixies-mcp-server/apixies-mcp-server.md), [page](https://verifymcp.io/servers/io-apixies-mcp-server/apixies-mcp-server)

## Channel facts

- Registry: `npm`
- Package: `@apixies/mcp-server`
- Version: `1.4.2`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-09-25.

- **Supply Chain Security**: 98/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - 31 of 96 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 6 days ago).
  - Security-disclosure policy not yet verified: we couldn't inspect the source repository.
- **Schema Quality & AI Usability**: 83/100
  - AI-judged instruction clarity (excellent).
  - Tool/resource definitions use about 4020 tokens (~80/item across 50 items; 50 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 50 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 50 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### How do I install the Apixies Developer API Suite MCP server?

Apixies Developer API Suite runs locally as an npm package, launched with npx -y @apixies/mcp-server. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add io-apixies-mcp-server -- npx -y @apixies/mcp-server
```

### Cursor

```json
{
  "mcpServers": {
    "io-apixies-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@apixies/mcp-server"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "io-apixies-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@apixies/mcp-server"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add io-apixies-mcp-server -- npx -y @apixies/mcp-server
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "io-apixies-mcp-server": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@apixies/mcp-server"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add io-apixies-mcp-server --command npx --arg -y --arg @apixies/mcp-server
```

### Hermes

```yaml
mcp_servers:
  io-apixies-mcp-server:
    command: "npx"
    args: ["-y", "@apixies/mcp-server"]
```

### Netclaw

```json
{
  "McpServers": {
    "io-apixies-mcp-server": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "@apixies/mcp-server"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add io-apixies-mcp-server -t stdio -c npx -a -y @apixies/mcp-server
```

### Other

```json
{
  "mcpServers": {
    "io-apixies-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@apixies/mcp-server"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-09-25 (score 71, 0)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-09-23 (score 71, 0)

- [functional regression] Security disclosure: unverified → fail

### 2026-09-22 (score 71, 0)

- [functional regression] Security disclosure: fail → unverified

### 2026-09-20 (score 71, +15)

- [security improvement] Malware scan: unverified → pass

### 2026-09-19 (score 56)

First indexed and scored.

## MCP tools (50)

### `check_ssl` (~70 tokens)

Check the SSL/TLS certificate of a domain. Returns issuer, validity dates, expiry countdown, protocol version, cipher suite, and certificate chain details.

Input parameters:

- `domain` (string, required): Domain name to check (e.g., "stripe.com")
- `port` (number): Port number (default: 443)

### `check_headers` (~59 tokens)

Check security headers for a URL. Returns present and missing headers (HSTS, CSP, X-Frame-Options, etc.) with a security grade.

Input parameters:

- `url` (string, required): Full URL to check (e.g., "https://github.com")

### `inspect_email` (~52 tokens)

Inspect an email address. Checks format validity, MX records, domain resolution, disposable domain detection, and role-based address detection.

Input parameters:

- `email` (string, required): Email address to inspect (e.g., "hello@example.com")

### `parse_user_agent` (~49 tokens)

Parse a User-Agent string. Detects browser name and version, operating system, device type, and whether it's a bot or crawler.

Input parameters:

- `user_agent` (string, required): User-Agent string to parse

### `geolocate_ip` (~60 tokens)

Get geolocation data for an IP address. Returns country, city, region, coordinates, timezone, ISP, and organization.

Input parameters:

- `ip` (string, required): IPv4 or IPv6 address (e.g., "8.8.8.8")

### `dns_lookup` (~107 tokens)

Query DNS records for a domain. Returns A, AAAA, MX, TXT, CNAME, NS, SOA, SRV, CAA, PTR records. Optionally filter by record type.

Input parameters:

- `domain` (string, required): Domain name to query (e.g., "github.com")
- `type` (string): Record type filter: A, AAAA, MX, TXT, CNAME, NS, SOA, SRV, CAA, PTR. Omit for all.

### `dns_propagation` (~115 tokens)

Check whether a DNS change has propagated: asks Google, Cloudflare, Quad9, OpenDNS and AdGuard the same question at once and reports which resolvers agree, with TTLs. Different answers can also mean load balancing, not only an unfinished change.

Input parameters:

- `domain` (string, required): Domain name to check (e.g., "github.com")
- `resolvers` (array): Resolvers to ask, at least two. Omit for all five.
- `type` (string): Record type (default: A)

### `trace_redirects` (~53 tokens)

Follow a URL's redirect chain. Shows every hop with HTTP status code, final destination URL, and total number of redirects.

Input parameters:

- `url` (string, required): URL to trace (e.g., "http://github.com")

### `extract_meta_tags` (~56 tokens)

Extract meta tags from a URL. Returns OpenGraph tags, Twitter Card tags, standard meta tags, title, and description.

Input parameters:

- `url` (string, required): URL to extract meta tags from (e.g., "https://stripe.com")

### `check_link` (~50 tokens)

Check if a URL is reachable. Returns HTTP status code, response time, content type, and SSL status.

Input parameters:

- `url` (string, required): URL to check (e.g., "https://docs.github.com")

### `parse_robots_txt` (~57 tokens)

Fetch and parse a domain's robots.txt file. Returns user-agent rules, allowed/disallowed paths, crawl delays, and sitemap URLs.

Input parameters:

- `domain` (string, required): Domain name (e.g., "github.com"). Without https://

### `fetch_favicon` (~49 tokens)

Find favicon URLs for a website. Returns all discovered icons with their URLs, types, and sizes.

Input parameters:

- `domain` (string, required): Domain name (e.g., "stripe.com"). Without https://

### `validate_url` (~54 tokens)

Validate a URL's format and reachability. Checks syntax, whether it resolves, SSL status, response code, and response time.

Input parameters:

- `url` (string, required): URL to validate (e.g., "https://cloudflare.com")

### `validate_email_auth` (~62 tokens)

Validate email authentication records (SPF, DKIM, DMARC) for a domain. Checks if each record exists, is valid, and returns the raw records.

Input parameters:

- `domain` (string, required): Domain name (e.g., "google.com"). Without https://

### `check_performance` (~58 tokens)

Measure website performance. Returns DNS lookup time, TCP connect time, SSL handshake time, TTFB, content download time, and total load time.

Input parameters:

- `url` (string, required): URL to analyze (e.g., "https://stripe.com")

### `whois_lookup` (~55 tokens)

Look up WHOIS registration data for a domain. Returns registrar, creation date, expiration date, name servers, and contact info.

Input parameters:

- `domain` (string, required): Domain name (e.g., "github.com"). Without https://

### `decode_jwt` (~58 tokens)

Decode a JWT token without verification. Returns the header, payload with all claims, signature, and expiry information.

Input parameters:

- `token` (string, required): JWT token string (e.g., "eyJhbGciOiJIUzI1NiIs...")

### `analyze_text` (~47 tokens)

Analyze text content. Returns word count, character count, sentence count, paragraph count, reading time, speaking time, and top word frequency.

Input parameters:

- `text` (string, required): Text content to analyze

### `my_ip` (~37 tokens)

Get the public IP address of the MCP server. Returns the IP, version (IPv4/IPv6), and whether it's a private address.

### `html_to_pdf` (~48 tokens)

Convert HTML content to a PDF document. Send HTML markup and receive a PDF. Useful for generating invoices, reports, and documents.

Input parameters:

- `html` (string, required): HTML content to convert to PDF

### `markdown_to_html` (~75 tokens)

Convert Markdown text to HTML. Supports GFM (GitHub Flavored Markdown) including tables, code blocks, and task lists.

Input parameters:

- `allow_html` (boolean): Keep raw HTML from the input (default: false, HTML is escaped). Unsafe link schemes are always dropped.
- `markdown` (string, required): Markdown text to convert

### `format_json` (~103 tokens)

Format, validate, and analyze JSON. Returns formatted output, minified version, and stats (key count, depth, size, type counts).

Input parameters:

- `indent` (number): Indent spaces (default: 2, range: 0-8)
- `input` (string, required): JSON string to format
- `minify` (boolean): Return minified JSON (default: false)
- `sort_keys` (boolean): Sort object keys alphabetically (default: false)

### `json_to_csv` (~76 tokens)

Convert a JSON array of objects to CSV format. Handles nested objects and custom delimiters.

Input parameters:

- `data` (string, required): JSON array of objects (e.g., '[{"name": "Alice", "age": 30}]')
- `delimiter` (string): CSV delimiter: "," (default), ";", "\t", or "|"

### `base64_encode_decode` (~55 tokens)

Encode or decode a Base64 string. Supports standard and URL-safe Base64.

Input parameters:

- `action` (string, required): "encode" or "decode"
- `input` (string, required): Text to encode or Base64 string to decode

### `format_phone` (~93 tokens)

Parse and format a phone number into E.164, national, and international formats. Validates the number and identifies the country.

Input parameters:

- `country_code` (string): ISO 3166-1 alpha-2 country code (e.g., "US", "GB", "DE"). Default: "US"
- `phone` (string, required): Phone number (e.g., "+1 (212) 555-1234")

### `validate_json_schema` (~59 tokens)

Validate JSON data against a JSON Schema definition (Draft-07+). Returns whether the data is valid and detailed error messages if not.

Input parameters:

- `data` (string, required): JSON data to validate
- `schema` (string, required): JSON Schema to validate against

### `convert_color` (~96 tokens)

Convert a color between HEX, RGB, and HSL formats. Input any format and get all three representations back.

Input parameters:

- `color` (string, required): Color value in HEX (#FF5733), RGB (rgb(255,87,51)), or HSL (hsl(11,100%,60%))
- `format` (string): Preferred output format: "hex", "rgb", or "hsl". Returns all formats regardless.

### `convert_timestamp` (~100 tokens)

Convert between Unix timestamps and human-readable dates. Returns ISO 8601, RFC 2822, human-readable, and Unix formats with timezone support.

Input parameters:

- `timestamp` (string, required): Unix timestamp (e.g., "1700000000") or date string (e.g., "2023-11-14")
- `timezone` (string): IANA timezone (e.g., "America/New_York", "Europe/London"). Default: "UTC"

### `encode_decode_url` (~59 tokens)

URL-encode or decode a string. RFC 3986 compliant encoding for URLs and query strings.

Input parameters:

- `action` (string, required): "encode" or "decode"
- `input` (string, required): Text to encode or URL-encoded string to decode

### `generate_hash` (~89 tokens)

Generate a cryptographic hash of the input text. Supports MD5, SHA-1, SHA-256, SHA-384, SHA-512, CRC32, and Whirlpool.

Input parameters:

- `algorithm` (string): Hash algorithm: md5, sha1, sha256, sha384, sha512, crc32, whirlpool (default: sha256)
- `input` (string, required): Text to hash

### `generate_qr` (~149 tokens)

Generate a QR code image from text or a URL. Returns SVG with customizable size, colors, and margin.

Input parameters:

- `bg` (string): Background color as hex (default: "#ffffff")
- `color` (string): Foreground color as hex (default: "#1a1a2e")
- `format` (string): Output format: "svg" (the only format)
- `margin` (number): Margin/quiet zone size (default: 1, range: 0-10)
- `size` (number): Size in pixels (default: 200, range: 50-1000)
- `text` (string, required): Text or URL to encode in the QR code

### `generate_uuid` (~86 tokens)

Generate UUID identifiers. Supports v4 (random) and v7 (time-sorted). Bulk generation up to 50 at once.

Input parameters:

- `count` (number): Number of UUIDs to generate (default: 1, max: 50)
- `version` (string): UUID version: "v4" (random, default) or "v7" (time-sorted)

### `generate_password` (~158 tokens)

Generate cryptographically secure random passwords. Configurable length, character sets, and exclusions.

Input parameters:

- `count` (number): Number of passwords to generate (default: 1, max: 20)
- `exclude` (string): Characters to exclude (e.g., "0O1lI" for ambiguous characters)
- `length` (number): Password length (default: 16, range: 8-128)
- `lowercase` (boolean): Include lowercase letters a-z (default: true)
- `numbers` (boolean): Include numbers 0-9 (default: true)
- `symbols` (boolean): Include symbols !@#$... (default: true)
- `uppercase` (boolean): Include uppercase letters A-Z (default: true)

### `generate_lorem` (~78 tokens)

Generate Lorem Ipsum placeholder text. Choose between words, sentences, or paragraphs with a configurable count.

Input parameters:

- `count` (number): Number of units to generate (default: 3, max: 100)
- `type` (string): Output type: "words", "sentences", or "paragraphs" (default: "paragraphs")

### `take_screenshot` (~175 tokens)

Capture a screenshot of any webpage as PNG or JPEG. Configurable viewport size, full-page mode, and image quality.

Input parameters:

- `format` (string): Image format: "png" (default) or "jpeg"
- `full_page` (boolean): Capture the entire scrollable page (default: false)
- `height` (number): Viewport height in pixels (default: 800, range: 200-2160). Ignored if full_page is true.
- `quality` (number): JPEG quality (default: 80, range: 1-100). Only applies to JPEG format.
- `url` (string, required): URL to screenshot (e.g., "https://github.com")
- `width` (number): Viewport width in pixels (default: 1280, range: 320-3840)

### `parse_cron` (~120 tokens)

Parse a cron expression into a human-readable description and calculate next run times. Supports standard 5-field cron and special strings like @daily, @hourly.

Input parameters:

- `expression` (string, required): Cron expression (e.g., "*/5 * * * *", "0 9 * * MON-FRI")
- `num_next` (number): Number of next run times to return (default: 5, max: 20)
- `timezone` (string): Timezone for calculations (default: UTC, e.g., "Europe/Zurich")

### `csv_to_json` (~83 tokens)

Convert CSV data to a JSON array of objects. Supports custom delimiters, header detection, and quoted fields.

Input parameters:

- `csv` (string, required): CSV content as a string
- `delimiter` (string): Column delimiter: comma, semicolon, tab, or pipe (default: comma)
- `has_headers` (boolean): First row contains column headers (default: true)

### `html_to_markdown` (~94 tokens)

Convert HTML content to clean Markdown. Supports GitHub Flavored Markdown with tables and strikethrough. Useful for scraping web content for LLM processing.

Input parameters:

- `gfm` (boolean): Use GitHub Flavored Markdown (default: true)
- `html` (string, required): HTML content to convert
- `strip_tags` (string): Comma-separated tags to strip (e.g., "script,style,nav")

### `http_status_lookup` (~64 tokens)

Look up an HTTP status code. Returns the name, description, common causes, how to fix, and RFC reference. Covers all standard codes plus Cloudflare codes.

Input parameters:

- `code` (number, required): HTTP status code (e.g., 404, 429, 502)

### `yaml_to_json` (~55 tokens)

Convert YAML content to JSON. Supports multi-document YAML, anchors, aliases, and Kubernetes config files.

Input parameters:

- `pretty` (boolean): Pretty-print JSON output (default: true)
- `yaml` (string, required): YAML content to convert

### `xml_to_json` (~89 tokens)

Convert XML content to a JSON object. Handles attributes, namespaces, CDATA sections, and nested elements. Useful for parsing RSS feeds, SOAP responses, and legacy XML data.

Input parameters:

- `preserve_attributes` (boolean): Include XML attributes prefixed with @ (default: true)
- `pretty` (boolean): Pretty-print JSON output (default: true)
- `xml` (string, required): XML content to convert

### `json_to_xml` (~96 tokens)

Convert a JSON object to well-formed XML. Supports custom root element, attribute conversion, and XML declaration toggle.

Input parameters:

- `json` (string, required): JSON content to convert (must be an object)
- `pretty` (boolean): Pretty-print XML output (default: true)
- `root_element` (string): Root element name (default: "root")
- `xml_declaration` (boolean): Include XML declaration header (default: true)

### `test_regex` (~134 tokens)

Test a regular expression pattern against text. Returns all matches, captured groups, named groups, and match positions. Useful for validating patterns before deploying them.

Input parameters:

- `flags` (string): Regex flags: i (case-insensitive), m (multiline), s (dotall), u (unicode)
- `global` (boolean): Find all matches, not just the first (default: true)
- `pattern` (string, required): Regex pattern without delimiters (e.g., "^[a-z]+$", "(\w+)@(\w+)\.(\w+)")
- `text` (string, required): Text to test the pattern against

### `json_diff` (~82 tokens)

Compare two JSON objects and return a structured diff. Shows additions, deletions, and changes with JSONPath locations. Useful for comparing API responses, config files, or database records.

Input parameters:

- `ignore_order` (boolean): Ignore array element ordering (default: false)
- `modified` (string, required): Modified JSON (after)
- `original` (string, required): Original JSON (before)

### `markdown_to_pdf` (~115 tokens)

Convert Markdown content to a downloadable PDF document. Supports GFM tables, code blocks, and custom page sizes. Returns a URL to the generated PDF.

Input parameters:

- `margin` (string): Page margin (default: "20mm")
- `markdown` (string, required): Markdown content to convert
- `orientation` (string): Orientation: portrait, landscape (default: portrait)
- `page_size` (string): Page size: A4, Letter, Legal (default: A4)
- `title` (string): Document title for PDF metadata

### `json_to_yaml` (~94 tokens)

Convert a JSON object to YAML format. Useful for generating Kubernetes configs, Docker Compose files, and CI/CD pipeline definitions from JSON data.

Input parameters:

- `indent` (number): Indentation spaces: 2, 4, or 8 (default: 2)
- `inline_level` (number): Depth for inline notation (default: 10, higher = more expanded)
- `json` (string, required): JSON content to convert

### `check_cors` (~92 tokens)

Check if a URL has CORS headers configured. Sends a preflight OPTIONS request and reports allowed origins, methods, headers, and security issues. Useful for debugging frontend API integration problems.

Input parameters:

- `origin` (string): Origin to send in preflight request (default: "https://example.com")
- `url` (string, required): URL to check for CORS headers (e.g., "https://api.github.com")

### `parse_sitemap` (~113 tokens)

Fetch and parse a sitemap.xml file. Returns all URLs with lastmod, changefreq, and priority metadata. Can follow sitemap index files. Useful for SEO audits and content discovery.

Input parameters:

- `follow_index` (boolean): Follow and parse child sitemaps in a sitemap index (default: false)
- `limit` (number): Max URLs to return (default: 100, max: 1000)
- `url` (string, required): URL of the sitemap (e.g., "https://example.com/sitemap.xml")

### `validate_structured_data` (~69 tokens)

Fetch a web page and extract all structured data (JSON-LD, Microdata, RDFa). Validates against common Schema.org types and reports missing properties. Useful for SEO audits.

Input parameters:

- `url` (string, required): URL of the page to check (e.g., "https://example.com")

### `check_mixed_content` (~73 tokens)

Scan an HTTPS page for mixed content (HTTP resources on HTTPS pages). Finds insecure images, scripts, stylesheets, and iframes that cause browser warnings. Reports severity (active vs passive) and line numbers.

Input parameters:

- `url` (string, required): HTTPS URL to scan (e.g., "https://example.com")

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/io-apixies-mcp-server/apixies-mcp-server#diagnostics

## Score history

- 2026-09-25: 71
- 2026-09-24: 71
- 2026-09-23: 71
- 2026-09-22: 71
- 2026-09-21: 71
- 2026-09-20: 71
- 2026-09-19: 56

## Common questions

### What is the Apixies Developer API Suite MCP server?

Apixies Developer API Suite is an MCP server listed in the public MCP registry as io.apixies/mcp-server. 50 developer utility APIs as tools: SSL, DNS, WHOIS, email checks, HTML to PDF, sitemaps and more. This page covers its npm package (@apixies/mcp-server).

### Is the Apixies Developer API Suite MCP server safe to use?

Apixies Developer API Suite scores 71 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 25 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Apixies Developer API Suite MCP server expose?

Apixies Developer API Suite exposes 50 tools: check_ssl, check_headers, inspect_email, parse_user_agent, geolocate_ip, and 45 more. Their descriptions and schemas cost roughly 4,020 tokens of context every time the server is loaded.

### Is the Apixies Developer API Suite MCP server still maintained?

Apixies Developer API Suite is still listed as active in the MCP registry. We last reached this channel on 25 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the Apixies Developer API Suite MCP server under?

Apixies Developer API Suite declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- npm package: https://www.npmjs.com/package/@apixies/mcp-server
- Socket report: https://socket.dev/npm/package/@apixies/mcp-server
- Repository: https://github.com/bicibg/apixies-mcp-server
- Website: https://apixies.io/
- Changelog RSS feed: https://verifymcp.io/servers/io-apixies-mcp-server/apixies-mcp-server.xml
- Changelog JSON feed: https://verifymcp.io/servers/io-apixies-mcp-server/apixies-mcp-server.json
- HTML version of this page: https://verifymcp.io/servers/io-apixies-mcp-server/apixies-mcp-server