io.github.marras0914/agent-toolbelt-mcp
NPM · AGENT-TOOLBELT-MCP
19 focused API tools for AI agents: contract review, prompt optimizer, context packing, and more.
Available components
Last scanned (18 hours ago)
Scores higher than 58% of npm servers
Category AI and Machine Learning
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security81
- No malware found by supply-chain analysis.Pass
- CVE check failed: a known high-severity CVE affects zod 3.25.76, a direct dependency. A fixed version is available. View diagnostics → Fail
- No install/post-install scripts declared.Pass
- 30 of 93 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 76 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability87
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Tool/resource definitions use about 2155 tokens (~102/item across 21 items; 20 tools + 1 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management77
- Stability observed for 23 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage98
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 95% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 20 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 21 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 4 Nov 26 −3
- Stability: pass → 0.77 functional
- 29 Oct 26 +1
- Stability: 0.97 → pass security
- 28 Oct 26 −1
- Stability: pass → 0.97 functional
- 24 Oct 26 −5
- CVE-2023-54404 affects this package: high ▼ security
- Known CVEs: pass → fail ▼ security
- 22 Oct 26 +1
- Stability: 0.97 → pass security
- 21 Oct 26 −1
- Stability: pass → 0.97 functional
- 17 Oct 26 +3
- Stability: 0.80 → pass security
- 16 Oct 26 −3
- Stability: pass → 0.80 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 4 Nov 2026 · Analysed npm/agent-toolbelt-mcp@1.0.1
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Vulnerabilities 1 finding
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-mrhx-c7xc-m3w5 | CVE-2023-54404 | high | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | yes |
Background: What a vulnerability scan can and cannot prove →
Dependencies 93 packages
| Packages resolved | 93 |
|---|---|
| Stale | 30 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
audit_dependencies Dependency Auditor ~91
Audit npm and PyPI packages for known CVEs using the OSV database (GitHub Dependabot's source). Pass packages directly or paste package.json / requirements.txt content.
| Name | Type | Req | Description |
|---|---|---|---|
| includeDevDependencies | boolean | – | – |
| manifest | string | – | Raw package.json or requirements.txt |
| manifestType | string | – | – |
| minSeverity | string | – | – |
| packages | array | – | Packages to audit |
No output schema declared.
No examples provided.
build_cron Cron Expression Builder ~80
Convert natural language schedule descriptions into cron expressions. Examples: 'every weekday at 9am', 'first Monday of each month at noon', 'every 5 minutes'. Returns the expression, human-readable confirmation, and next 5 run times.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | yes | Natural language schedule description |
| timezone | string | – | Timezone for context |
No output schema declared.
No examples provided.
build_regex Regex Builder & Tester ~115
Build and test regular expressions from natural language descriptions. Supports emails, URLs, phones, dates, IPs, colors, UUIDs, and 15+ more patterns. Returns the pattern, code snippets in JS/Python/TS, and optional test results.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | yes | What to match (e.g., 'email addresses', 'hex color codes', 'semantic versions') |
| flags | string | – | Regex flags (default: 'g') |
| testStrings | array | – | Optional strings to test the regex against |
No output schema declared.
No examples provided.
compare_documents Document Comparator ~96
Compare two versions of a document and produce a semantic diff with additions, deletions, and modifications. Works with contracts, READMEs, policies, essays, or any text. Powered by Claude.
| Name | Type | Req | Description |
|---|---|---|---|
| context | string | – | Document type for more relevant analysis |
| mode | string | – | Output format |
| original | string | yes | The original version of the document |
| revised | string | yes | The revised version of the document |
No output schema declared.
No examples provided.
convert_markdown Markdown Converter ~96
Convert HTML to clean Markdown, or Markdown to HTML. Use HTML→Markdown when you've fetched a web page and need readable text for an LLM — strips tags, preserves headings, lists, code blocks, links, and tables. Use Markdown→HTML when rendering content in a web context.
| Name | Type | Req | Description |
|---|---|---|---|
| content | string | yes | The content to convert |
| from | string | yes | Input format |
| to | string | yes | Output format |
No output schema declared.
No examples provided.
count_tokens Token Counter ~107
Count tokens for any text across multiple LLM models and get per-model cost estimates. Use before sending text to an LLM to check context window usage or compare costs across models. Supports GPT-4o, GPT-4, GPT-3.5-turbo, Claude 3.5 Sonnet, Claude 3 Opus, and 10+ more.
| Name | Type | Req | Description |
|---|---|---|---|
| models | array | – | Models to count tokens for |
| text | string | yes | The text to count tokens for |
No output schema declared.
No examples provided.
csv_to_json CSV to JSON ~120
Convert CSV data to typed JSON. Auto-detects delimiters, uses the first row as headers, and casts values to proper types (numbers, booleans, nulls). Use when processing spreadsheet exports or any CSV-formatted data.
| Name | Type | Req | Description |
|---|---|---|---|
| csv | string | yes | The CSV content to convert |
| delimiter | string | – | Column delimiter |
| hasHeader | boolean | – | Whether the first row contains column names |
| limit | number | – | Max rows to return |
| typeCast | boolean | – | Auto-convert values to proper types |
No output schema declared.
No examples provided.
extract_contract_clauses Contract Clause Extractor ~90
Extract key clauses from a contract — parties, payment terms, termination, liability, IP ownership, confidentiality, and more. Optionally flags risky or one-sided clauses with severity ratings. Powered by Claude.
| Name | Type | Req | Description |
|---|---|---|---|
| clauses | array | – | Which clause types to extract |
| contract | string | yes | The contract or legal document text |
| flagRisks | boolean | – | Flag risky or unfavorable clauses |
No output schema declared.
No examples provided.
extract_from_text Text Extractor ~120
Extract structured data from raw text: emails, URLs, phone numbers, dates, currencies, addresses, names, or JSON blocks. Useful for parsing documents, emails, web content, or any unstructured text into clean structured data.
| Name | Type | Req | Description |
|---|---|---|---|
| deduplicate | boolean | – | Remove duplicate results within each type |
| extractors | array | yes | Which types of data to extract. Choose one or more: emails, urls, phone_numbers, dates, currencies, addresses, names, json_blocks |
| text | string | yes | The raw text to extract data from |
No output schema declared.
No examples provided.
extract_meeting_action_items Meeting Action Items ~92
Extract structured action items, decisions, and a summary from meeting notes or transcripts. Identifies task owners, deadlines, and priorities. Powered by Claude.
| Name | Type | Req | Description |
|---|---|---|---|
| format | string | – | 'full' includes summary and decisions; 'action_items_only' returns just the task list |
| notes | string | yes | Meeting notes or transcript |
| participants | array | – | Known participant names to help with owner attribution |
No output schema declared.
No examples provided.
fetch_url_metadata URL Metadata ~94
Fetch a URL and extract its metadata: title, description, Open Graph tags (og:image, og:type), Twitter card tags, favicon, canonical URL, author, and publish date. Use to enrich links with context or understand what a page is about without reading the full content.
| Name | Type | Req | Description |
|---|---|---|---|
| timeout | number | – | Request timeout in milliseconds (default 8000) |
| url | string | yes | The URL to fetch metadata from |
No output schema declared.
No examples provided.
generate_brand_kit Brand Kit Generator ~125
Generate a complete brand kit from a company name, industry, and aesthetic keywords. Returns a color palette with WCAG accessibility scores, curated typography pairings, and design tokens in JSON, CSS, or Tailwind format.
| Name | Type | Req | Description |
|---|---|---|---|
| format | string | – | Output format |
| industry | string | – | Industry (e.g., 'fintech', 'healthcare', 'fashion') |
| name | string | yes | Company or brand name |
| vibe | array | – | Aesthetic keywords: 'modern', 'playful', 'luxurious', 'minimal', 'bold', etc. |
No output schema declared.
No examples provided.
generate_color_palette Color Palette Generator ~154
Generate a color palette from a description, mood, industry, or hex seed color. Accepts moods (calm, energetic, luxurious), industries (fintech, healthcare, fashion), nature themes (sunset, ocean, forest), or a specific hex color. Returns hex/RGB/HSL values, WCAG accessibility scores, and CSS custom properties.
| Name | Type | Req | Description |
|---|---|---|---|
| count | integer | – | Number of colors (2-10) |
| description | string | yes | Description of the desired palette (e.g. 'calm fintech blue', 'sunset', '#3B82F6') |
| format | string | – | Color format in output |
| includeShades | boolean | – | Include light/dark shades for each color |
No output schema declared.
No examples provided.
generate_schema Schema Generator ~134
Generate a JSON Schema, TypeScript interface, or Zod validation schema from a natural language description of a data structure. Examples: 'a user profile with name, email, and signup date', 'a product listing with title, price, and inventory count'.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | yes | Natural language description of the data structure you want a schema for |
| format | string | – | Output format: json_schema (standard JSON Schema), typescript (TS interface), or zod (Zod validation schema) |
| strict | boolean | – | If true, all fields are required. If false, optional fields are marked as optional |
No output schema declared.
No examples provided.
list_tools List Available Tools ~25
List all tools available in the Agent Toolbelt API catalog, including descriptions and pricing.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
mock_api_response API Response Mocker ~110
Generate realistic mock API responses from a JSON Schema. Supports nested objects, arrays, string formats (email, uuid, date-time, url), field-name heuristics, enums, and min/max constraints. Set seed for reproducible output. Returns 1–100 records.
| Name | Type | Req | Description |
|---|---|---|---|
| count | integer | – | Number of mock records to generate (1–100) |
| schema | object | yes | JSON Schema object describing the shape of the mock data |
| seed | integer | – | Optional seed for reproducible output |
No output schema declared.
No examples provided.
normalize_address Address Normalizer ~82
Normalize a US mailing address to USPS standard format. Expands abbreviations (st→ST, ave→AVE), standardizes directionals, converts state names to codes. Returns parsed components and a confidence score (high/medium/low).
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | yes | The US address to normalize |
| includeComponents | boolean | – | Include parsed address components in response |
No output schema declared.
No examples provided.
optimize_prompt Prompt Optimizer ~132
Analyze and improve an LLM prompt. Scores clarity, specificity, structure, and completeness. Returns an optimized rewrite with a summary of what changed and why. Powered by Claude.
| Name | Type | Req | Description |
|---|---|---|---|
| mode | string | – | 'both' returns analysis + improved prompt; 'analyze' scores only; 'improve' rewrites only |
| model | string | – | Target model (e.g. 'gpt-4o', 'claude-3-5-sonnet') |
| prompt | string | yes | The LLM prompt to analyze and/or improve |
| task | string | – | What this prompt is trying to accomplish |
No output schema declared.
No examples provided.
pack_context_window Context Window Packer ~139
Pack content chunks into a token budget for an LLM context window. Selects the best subset of chunks that fits within the token limit using priority, greedy, or balanced strategies. Use when you have more content than fits in the context window.
| Name | Type | Req | Description |
|---|---|---|---|
| chunks | array | yes | Content chunks to pack |
| model | string | – | Target model for tokenization |
| reserveForOutput | integer | – | Tokens to reserve for output |
| separator | string | – | Text between chunks |
| strategy | string | – | Packing strategy |
| systemPrompt | string | – | System prompt to reserve tokens for |
| tokenBudget | integer | yes | Maximum tokens allowed |
No output schema declared.
No examples provided.
strip_image_metadata Image Metadata Stripper ~137
Strip EXIF, GPS, IPTC, XMP, and ICC metadata from an image for privacy. Use before uploading or sharing images to remove sensitive embedded data like GPS coordinates, camera model, timestamps, and editing history. Accepts base64-encoded JPEG, PNG, WebP, or TIFF. Returns cleaned base64 image with a removal report.
| Name | Type | Req | Description |
|---|---|---|---|
| format | string | – | Output format ('preserve' keeps original) |
| image | string | yes | Base64-encoded image (JPEG, PNG, WebP, TIFF). No data URI prefix. |
| quality | integer | – | Quality for lossy formats (1-100) |
No output schema declared.
No examples provided.
How do I install the io.github.marras0914/agent-toolbelt-mcp server?
io.github.marras0914/agent-toolbelt-mcp runs locally as an npm package, launched with npx -y agent-toolbelt-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · agent-toolbelt-mcp
claude mcp add marras0914-agent-toolbelt-mcp -- npx -y agent-toolbelt-mcp
What is the io.github.marras0914/agent-toolbelt-mcp server?
io.github.marras0914/agent-toolbelt-mcp is listed in the public MCP registry as io.github.marras0914/agent-toolbelt-mcp. 19 focused API tools for AI agents: contract review, prompt optimizer, context packing, and more. This page covers its npm package (agent-toolbelt-mcp).
Is the io.github.marras0914/agent-toolbelt-mcp server safe to use?
io.github.marras0914/agent-toolbelt-mcp scores 78 out of 100 on VerifyMCP. We recorded 1 known advisory against it as of 4 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.marras0914/agent-toolbelt-mcp server expose?
io.github.marras0914/agent-toolbelt-mcp exposes 20 tools: generate_schema, extract_from_text, build_cron, build_regex, generate_brand_kit, and 15 more. Their descriptions and schemas cost roughly 2,139 tokens of context every time the server is loaded.
Is the io.github.marras0914/agent-toolbelt-mcp server still maintained?
io.github.marras0914/agent-toolbelt-mcp is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.marras0914/agent-toolbelt-mcp server under?
io.github.marras0914/agent-toolbelt-mcp declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.