# ToolAPI (remote · toolapi.org)

Free public MCP for AI agents — 193 tools, 44 workflows. No API key.

- Trust score: 57/100 (low)
- Change this week: +3
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- remote · `toolapi.org`: 57/100 (this document), [markdown](https://verifymcp.io/servers/org-toolapi-hub/toolapi.md), [page](https://verifymcp.io/servers/org-toolapi-hub/toolapi)
- remote · `toolapi.org`: 18/100, [markdown](https://verifymcp.io/servers/org-toolapi-hub/toolapi-2.md), [page](https://verifymcp.io/servers/org-toolapi-hub/toolapi-2)

## Channel facts

- Endpoint: `https://toolapi.org/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `2.8.2`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Endpoint Security**: 46/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation not fully verified: no authorisation is required to call this server, and 193 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe.
  - HTTPS check failed: the endpoint is reachable over plaintext HTTP.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 82/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 7411 tokens (~36/item across 202 items; 193 tools + 9 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 70/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 10% of tool parameters carry a description.
- **Capabilities**: 20/100
  - Spec-recency check failed: implements MCP spec 2024-11-05; the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add --transport http org-toolapi-hub https://toolapi.org/mcp
```

### Codex

```toml
[mcp_servers.org-toolapi-hub]
url = "https://toolapi.org/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "org-toolapi-hub": {
      "type": "remote",
      "url": "https://toolapi.org/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add org-toolapi-hub --url https://toolapi.org/mcp --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  org-toolapi-hub:
    url: "https://toolapi.org/mcp"
```

### Other

```json
{
  "mcpServers": {
    "org-toolapi-hub": {
      "type": "http",
      "url": "https://toolapi.org/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 57, +1)

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-01 (score 56, +1)

No change was recorded against any check on this day. Stability & Change Management went from 17 to 20. That category is still filling its 30-day observation window: 5 days of observed history at the previous scan, 6 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-31 (score 55, −1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-29 (score 56, +1)

No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-28 (score 55, +1)

No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-27 (score 54, 0)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-26 (score 54)

First indexed and scored.

## MCP tools (193)

### `json_validate` (~25 tokens)

Validate JSON text; return parsed object or error.

Input parameters:

- `text` (string, required)

### `json_format` (~40 tokens)

Pretty-print JSON with indent. When: Pretty-print JSON when the agent needs readable output.

Input parameters:

- `indent` (integer)
- `text` (string, required)

### `json_minify` (~36 tokens)

Minify JSON (remove whitespace). When: Minify JSON for compact payloads or size checks.

Input parameters:

- `text` (string, required)

### `csv_to_json` (~37 tokens)

Convert CSV text to JSON array of row objects. When: Convert CSV rows → JSON array of objects.

Input parameters:

- `text` (string, required)

### `json_to_csv` (~25 tokens)

Convert JSON array of objects to CSV text.

Input parameters:

- `text` (string, required)

### `yaml_validate` (~25 tokens)

Validate YAML text; return parsed object or error.

Input parameters:

- `text` (string, required)

### `yaml_to_json` (~24 tokens)

Parse YAML and return JSON-compatible object.

Input parameters:

- `text` (string, required)

### `json_to_yaml` (~35 tokens)

Convert JSON text to YAML string. When: Convert JSON → YAML for config files agents write.

Input parameters:

- `text` (string, required)

### `xml_validate` (~24 tokens)

Validate XML markup (well-formed check).

Input parameters:

- `text` (string, required)

### `xml_format` (~32 tokens)

Pretty-print XML with indentation. When: Pretty-print XML after the agent edits markup.

Input parameters:

- `text` (string, required)

### `jsonpath_query` (~45 tokens)

Query JSON with JSONPath expression; returns matching values.

Input parameters:

- `path` (string, required): e.g. $.store.book[*].author
- `text` (string, required): JSON text

### `json_merge` (~33 tokens)

Deep-merge two JSON objects (second overlays first).

Input parameters:

- `a` (string, required)
- `b` (string, required)

### `json_flatten` (~42 tokens)

Flatten nested JSON to dot-key map. When: Flatten nested JSON keys before comparing or exporting.

Input parameters:

- `separator` (string)
- `text` (string, required)

### `json_pretty_diff` (~35 tokens)

Unified diff of two JSON documents (pretty-printed).

Input parameters:

- `a` (string, required)
- `b` (string, required)

### `json_sort_keys` (~38 tokens)

Recursively sort JSON object keys. When: Canonicalize JSON key order for stable diffs/hashes.

Input parameters:

- `text` (string, required)

### `json_type_summary` (~29 tokens)

Summarize JSON value types (counts per type in tree).

Input parameters:

- `text` (string, required)

### `json_schema_validate` (~51 tokens)

Validate JSON data against JSON Schema (Draft 7).

Input parameters:

- `data` (string, required): JSON document text
- `max_errors` (integer)
- `schema` (string, required): JSON Schema (Draft 7)

### `toml_validate` (~27 tokens)

Validate TOML text; return parsed object or error.

Input parameters:

- `text` (string, required)

### `toml_to_json` (~26 tokens)

Parse TOML and return JSON-compatible object.

Input parameters:

- `text` (string, required)

### `json_to_toml` (~27 tokens)

Convert JSON object text to TOML string.

Input parameters:

- `text` (string, required)

### `toml_schema_validate` (~59 tokens)

Validate TOML config against JSON Schema (Draft 7) in one step.

Input parameters:

- `max_errors` (integer)
- `schema` (string, required): JSON Schema (Draft 7)
- `toml` (string, required): TOML document text

### `sql_format` (~44 tokens)

Format SQL text (never executed; reindent + keyword case).

Input parameters:

- `keyword_case` (string)
- `reindent` (boolean)
- `text` (string, required)

### `graphql_validate` (~27 tokens)

Validate GraphQL query or schema SDL syntax (parse only).

Input parameters:

- `text` (string, required)

### `openapi_validate` (~29 tokens)

Validate OpenAPI 3.x document (JSON or YAML snippet).

Input parameters:

- `text` (string, required)

### `openapi_diff` (~49 tokens)

Compare two OpenAPI specs and flag breaking vs non-breaking API changes.

Input parameters:

- `new` (string, required): New OpenAPI JSON/YAML
- `old` (string, required): Previous OpenAPI JSON/YAML

### `package_manifest_audit` (~65 tokens)

Audit package.json or pyproject.toml — license, risky scripts, loose ranges; emit semver_checks for batch. Note: best-effort / heuristic — not a full language parser.

Input parameters:

- `kind` (string)
- `text` (string, required): Manifest file contents

### `graphql_schema_diff` (~37 tokens)

Diff two GraphQL schemas for removed types/fields (breaking changes).

Input parameters:

- `new` (string, required)
- `old` (string, required)

### `compose_validate` (~30 tokens)

Validate docker-compose YAML and flag privileged/host-network/secret env issues.

Input parameters:

- `text` (string, required)

### `github_actions_lint` (~37 tokens)

Lint GitHub Actions workflow YAML (triggers, unpinned actions, curl|bash).

Input parameters:

- `text` (string, required)

### `requirements_audit` (~30 tokens)

Audit Python requirements.txt for unpinned/VCS/deprecated packages.

Input parameters:

- `text` (string, required)

### `json_schema_validate_batch` (~44 tokens)

Batch JSON Schema (Draft 7) validation — up to 25 documents (agent favorite).

Input parameters:

- `items` (array, required)
- `max_errors` (integer)

### `json_assert_paths` (~40 tokens)

Assert JSONPath expressions against JSON (exists/equals/type) — agent self-check.

Input parameters:

- `assertions` (array, required)
- `data` (string, required)

### `json_equal` (~33 tokens)

Deep-compare two JSON documents and list differing paths.

Input parameters:

- `a` (string, required)
- `b` (string, required)

### `yaml_schema_validate` (~43 tokens)

Parse YAML then validate against JSON Schema (Draft 7).

Input parameters:

- `max_errors` (integer)
- `schema` (string, required)
- `yaml` (string, required)

### `tsconfig_lint` (~30 tokens)

Lint tsconfig.json structure (compilerOptions, strict hints).

Input parameters:

- `text` (string, required)

### `json_pointer_get` (~58 tokens)

Get value by RFC 6901 JSON Pointer (e.g. /user/id). When: Read one field by RFC 6901 pointer without full walk in the agent.

Input parameters:

- `data` (string, required)
- `pointer` (string)

### `json_patch_apply` (~61 tokens)

Apply RFC 6902 JSON Patch ops (add/remove/replace/test/move/copy). When: Apply RFC 6902 ops (add/remove/replace/test/move/copy).

Input parameters:

- `data` (string, required)
- `patch` (string, required)

### `json_schema_infer` (~40 tokens)

Infer a Draft-7 JSON Schema from a sample JSON document (agent favorite).

Input parameters:

- `data` (string, required)
- `title` (string)

### `jsonl_validate` (~56 tokens)

Validate JSON Lines (NDJSON); optional per-line JSON Schema. When: Validate NDJSON / JSON Lines logs or datasets.

Input parameters:

- `max_lines` (integer)
- `schema` (string)
- `text` (string, required)

### `xml_to_json` (~40 tokens)

Convert XML document to JSON (attributes as @attr). When: Convert XML → JSON for agents that prefer JSON tools.

Input parameters:

- `text` (string, required)

### `json_merge_patch` (~52 tokens)

Apply RFC 7396 JSON Merge Patch (null deletes keys). When: RFC 7396 merge patch — use when patching JSON configs.

Input parameters:

- `patch` (string, required)
- `target` (string, required)

### `csv_validate` (~49 tokens)

Validate CSV structure — consistent column counts / header. When: Check CSV column consistency before import.

Input parameters:

- `delimiter` (string)
- `has_header` (boolean)
- `text` (string, required)

### `ini_parse` (~38 tokens)

Parse INI / simple key=value config into sections. When: Parse INI/section configs into structured maps.

Input parameters:

- `text` (string, required)

### `openapi_operations_list` (~43 tokens)

List OpenAPI path operations (method, path, operationId, tags). When: List OpenAPI operations before validate/diff.

Input parameters:

- `text` (string, required)

### `graphql_operations_list` (~44 tokens)

List GraphQL query/mutation/subscription names and type defs. When: List GraphQL ops/types from a document (best-effort).

Input parameters:

- `text` (string, required)

### `properties_parse` (~37 tokens)

Parse Java .properties key=value file. When: Parse Java .properties key=value configs (best-effort).

Input parameters:

- `text` (string, required)

### `time_now` (~18 tokens)

Current UTC unix timestamp and ISO-8601.

### `time_convert` (~27 tokens)

Convert unix seconds or ISO-8601 to both formats.

Input parameters:

- `value` (string, required)

### `timezone_convert` (~59 tokens)

Convert datetime between IANA timezones (e.g. UTC to Asia/Shanghai).

Input parameters:

- `from_timezone` (string)
- `to_timezone` (string, required): e.g. Asia/Shanghai
- `value` (string, required): Unix seconds or ISO datetime

### `timezone_list` (~17 tokens)

List common IANA timezone names for conversion.

### `datetime_parse` (~29 tokens)

Parse unix timestamp or ISO-8601 into UTC ISO + unix.

Input parameters:

- `value` (string, required)

### `duration_parse` (~58 tokens)

Parse duration (ISO-8601 PnDTnHnMnS or human 1h30m / 90s) to seconds. When: Parse ISO-8601 / human durations to seconds.

Input parameters:

- `value` (string, required)

### `regex_test` (~45 tokens)

Test regex pattern; returns match, groups, span.

Input parameters:

- `flags` (string): i, m, s
- `pattern` (string, required)
- `text` (string, required)

### `regex_replace` (~72 tokens)

Replace regex matches in text (supports backreferences in replacement).

Input parameters:

- `count` (integer): Max replacements when global
- `flags` (string): i, m, s
- `global_replace` (boolean)
- `pattern` (string, required)
- `replacement` (string, required)
- `text` (string, required)

### `text_diff` (~33 tokens)

Unified line diff between two texts (like git diff).

Input parameters:

- `left` (string, required)
- `right` (string, required)

### `text_slugify` (~37 tokens)

URL-safe slug from title or heading. When: Make URL-safe slugs from titles/filenames.

Input parameters:

- `text` (string, required)

### `text_stats` (~28 tokens)

Count chars, words, lines, sentences; estimate reading time.

Input parameters:

- `text` (string, required)

### `text_case_convert` (~42 tokens)

Convert case: lower, upper, title, snake, kebab, camel, pascal.

Input parameters:

- `mode` (string, required)
- `text` (string, required)

### `text_lorem` (~22 tokens)

Generate lorem ipsum placeholder paragraphs.

Input parameters:

- `paragraphs` (integer)

### `color_convert` (~41 tokens)

Convert color between hex, rgb(), and hsl().

Input parameters:

- `color` (string, required): hex, rgb(), or hsl()
- `to_format` (string)

### `unit_convert` (~66 tokens)

Convert units: length, weight, temperature, data, speed, time.

Input parameters:

- `category` (string): optional: length, weight, temperature, data, speed, time
- `from_unit` (string, required)
- `to_unit` (string, required)
- `value` (number, required)

### `unit_list` (~17 tokens)

List supported units per category for unit_convert.

### `markdown_to_html` (~33 tokens)

Convert Markdown text to HTML. When: Render markdown → HTML for previews or emails.

Input parameters:

- `text` (string, required)

### `html_to_markdown` (~35 tokens)

Convert HTML to Markdown text. When: Convert HTML → markdown for docs the agent edits.

Input parameters:

- `html` (string, required)

### `pick_choice` (~38 tokens)

Pick one item from a list (optional seed for reproducibility).

Input parameters:

- `items` (array, required)
- `seed` (integer): Optional RNG seed

### `string_truncate` (~53 tokens)

Truncate text with ellipsis. When: Truncate long strings with ellipsis for UI/logs.

Input parameters:

- `ellipsis` (string)
- `max_length` (integer)
- `text` (string, required)

### `extract_urls` (~24 tokens)

Extract HTTP/HTTPS URLs from arbitrary text.

Input parameters:

- `text` (string, required)

### `extract_emails` (~33 tokens)

Extract email addresses from text. When: Pull email addresses from free text / logs.

Input parameters:

- `text` (string, required)

### `email_validate` (~29 tokens)

Validate email address format. When: Syntax-check a single email address.

Input parameters:

- `email` (string, required)

### `text_wrap` (~40 tokens)

Wrap text to a maximum line width. When: Hard-wrap text to a column width.

Input parameters:

- `text` (string, required)
- `width` (integer)

### `list_unique` (~22 tokens)

Deduplicate list items preserving order.

Input parameters:

- `items` (array, required)

### `template_fill` (~32 tokens)

Fill {{variable}} placeholders in a template string.

Input parameters:

- `template` (string, required)
- `variables` (object, required)

### `unicode_normalize` (~37 tokens)

Unicode normalization (NFC/NFD/NFKC/NFKD).

Input parameters:

- `form` (string)
- `text` (string, required)

### `user_agent_parse` (~30 tokens)

Parse User-Agent string into browser, OS, and device hints.

Input parameters:

- `user_agent` (string, required)

### `secrets_scan` (~49 tokens)

Scan text for hardcoded secrets (API keys, tokens, private keys). Returns redacted findings.

Input parameters:

- `min_entropy` (number): Entropy threshold for heuristic strings
- `text` (string, required)

### `dockerfile_lint` (~36 tokens)

Lint Dockerfile for common security/style issues (root user, curl|sh, secrets).

Input parameters:

- `text` (string, required)

### `env_required_check` (~36 tokens)

Check .env text contains required keys (and non-empty values).

Input parameters:

- `required` (array, required)
- `text` (string, required)

### `path_safety_check` (~37 tokens)

Check filesystem path for traversal / absolute / sensitive system paths.

Input parameters:

- `allow_absolute` (boolean)
- `path` (string, required)

### `spdx_license_check` (~26 tokens)

Validate SPDX license expression against common license IDs.

Input parameters:

- `expression` (string, required)

### `robots_txt_validate` (~25 tokens)

Validate robots.txt syntax and User-agent rules.

Input parameters:

- `text` (string, required)

### `csp_parse` (~28 tokens)

Parse Content-Security-Policy header and flag unsafe directives.

Input parameters:

- `header` (string, required)

### `cors_check` (~42 tokens)

Check CORS Allow-Origin vs credentials for unsafe combinations.

Input parameters:

- `allow_credentials` (boolean)
- `allow_origin` (string, required)
- `origin` (string)

### `markdown_link_extract` (~27 tokens)

Extract markdown/bare links and flag javascript: URLs.

Input parameters:

- `text` (string, required)

### `gitignore_check` (~32 tokens)

Review .gitignore for common missing ignores (.env, node_modules, keys).

Input parameters:

- `text` (string, required)

### `editorconfig_validate` (~25 tokens)

Validate .editorconfig syntax and common keys.

Input parameters:

- `text` (string, required)

### `nginx_config_lint` (~37 tokens)

Lint nginx config snippets (braces, SSLv3, server_tokens, HSTS hints).

Input parameters:

- `text` (string, required)

### `sql_danger_scan` (~47 tokens)

Scan SQL text for dangerous patterns (DROP/TRUNCATE/DELETE without WHERE). Note: best-effort / heuristic — not a full language parser.

Input parameters:

- `text` (string, required)

### `html_security_scan` (~48 tokens)

Scan HTML for XSS-prone patterns (javascript: URLs, inline handlers, eval). Note: best-effort / heuristic — not a full language parser.

Input parameters:

- `text` (string, required)

### `conventional_commit_lint` (~31 tokens)

Lint Conventional Commits message (feat/fix/chore…).

Input parameters:

- `message` (string, required)

### `changelog_parse` (~27 tokens)

Parse Keep-a-Changelog style markdown into version sections.

Input parameters:

- `text` (string, required)

### `todo_comment_extract` (~30 tokens)

Extract TODO/FIXME/HACK/XXX comments with line numbers.

Input parameters:

- `text` (string, required)

### `code_fence_extract` (~28 tokens)

Extract fenced code blocks from markdown (language + code).

Input parameters:

- `text` (string, required)

### `unified_diff_parse` (~28 tokens)

Parse unified diff — files changed, lines added/removed.

Input parameters:

- `text` (string, required)

### `glob_match_batch` (~35 tokens)

Match paths against glob patterns (gitignore-style fnmatch).

Input parameters:

- `paths` (array, required)
- `patterns` (array, required)

### `identifier_validate` (~34 tokens)

Validate identifier for python/javascript/typescript (keywords + syntax).

Input parameters:

- `language` (string)
- `name` (string, required)

### `text_similarity` (~30 tokens)

SequenceMatcher similarity ratio between two texts.

Input parameters:

- `a` (string, required)
- `b` (string, required)

### `import_list_analyze` (~48 tokens)

List imports from python/js source and flag duplicates. Note: best-effort / heuristic — not a full language parser.

Input parameters:

- `language` (string)
- `text` (string, required)

### `frontmatter_parse` (~37 tokens)

Parse YAML frontmatter from markdown (--- ... ---). When: Split YAML frontmatter from markdown body.

Input parameters:

- `text` (string, required)

### `markdown_toc` (~43 tokens)

Build a table of contents from markdown headings. When: Build heading TOC from markdown docs.

Input parameters:

- `max_level` (integer)
- `text` (string, required)

### `gitignore_match` (~50 tokens)

Match paths against .gitignore rules (ignore / negate). When: Test paths against .gitignore rules (best-effort).

Input parameters:

- `gitignore` (string, required)
- `paths` (array, required)

### `shell_escape` (~54 tokens)

Shell-escape a string for posix/powershell/cmd (safe quoting). When: Safely quote strings for posix/powershell/cmd.

Input parameters:

- `shell` (string)
- `text` (string, required)

### `path_normalize` (~48 tokens)

Normalize filesystem path (resolve . and ..) for posix or windows. When: Resolve . and .. in filesystem paths.

Input parameters:

- `path` (string, required)
- `style` (string)

### `env_diff` (~52 tokens)

Diff two .env files — only_in_a / only_in_b / changed values. When: Diff two .env files for missing/changed keys.

Input parameters:

- `a` (string, required)
- `b` (string, required)

### `package_scripts_list` (~58 tokens)

List scripts from package.json or pyproject.toml (poetry/PEP 621). When: List npm/poetry/PEP 621 scripts from manifests.

Input parameters:

- `kind` (string)
- `text` (string, required)

### `line_ending_normalize` (~46 tokens)

Detect and normalize line endings to lf/crlf/cr. When: Detect/normalize CRLF vs LF.

Input parameters:

- `style` (string)
- `text` (string, required)

### `shebang_parse` (~37 tokens)

Parse #! shebang line — interpreter and args. When: Parse #! interpreter lines in scripts.

Input parameters:

- `text` (string, required)

### `trailing_whitespace_scan` (~40 tokens)

Scan text for trailing whitespace and tab characters. Note: best-effort / heuristic — not a full language parser.

Input parameters:

- `text` (string, required)

### `sql_tables_extract` (~47 tokens)

Extract table names from SQL (FROM/JOIN/INTO/UPDATE/TABLE). When: Heuristic extract of SQL table names (best-effort).

Input parameters:

- `text` (string, required)

### `dependency_versions_extract` (~54 tokens)

Extract name@version from requirements/lockfile/go.mod/Cargo snippets. When: Extract name@version from lock/requirements snippets (best-effort).

Input parameters:

- `ecosystem` (string)
- `text` (string, required)

### `color_contrast` (~47 tokens)

WCAG contrast ratio between two hex colors (AA/AAA). When: WCAG contrast ratio for UI color pairs.

Input parameters:

- `bg` (string, required)
- `fg` (string, required)

### `human_bytes` (~60 tokens)

Format bytes to human size, or parse '1.5 GB' to bytes. When: Format or parse human byte sizes (1.5 GB).

Input parameters:

- `precision` (integer)
- `text` (string)
- `value` (number)

### `password_strength` (~35 tokens)

Offline password strength heuristic (length/classes/common). When: Offline password strength heuristic (not a cracker).

Input parameters:

- `password` (string, required)

### `hosts_file_parse` (~43 tokens)

Parse /etc/hosts style file into IP → hostnames entries. When: Parse /etc/hosts style IP→hostname maps.

Input parameters:

- `text` (string, required)

### `hash_md5` (~41 tokens)

MD5 hex digest of UTF-8 text. When: MD5 digest (non-crypto integrity / legacy checksums).

Input parameters:

- `text` (string, required)

### `hash_sha256` (~21 tokens)

SHA256 hex digest.

Input parameters:

- `text` (string, required)

### `hash_sha512` (~21 tokens)

SHA512 hex digest.

Input parameters:

- `text` (string, required)

### `base64_encode` (~24 tokens)

Base64-encode UTF-8.

Input parameters:

- `text` (string, required)

### `base64_decode` (~25 tokens)

Base64-decode to UTF-8.

Input parameters:

- `text` (string, required)

### `base64url_encode` (~32 tokens)

Base64url-encode UTF-8 (no padding, URL-safe).

Input parameters:

- `text` (string, required)

### `base64url_decode` (~27 tokens)

Base64url-decode to UTF-8.

Input parameters:

- `text` (string, required)

### `url_encode` (~21 tokens)

Percent-encode URL component.

Input parameters:

- `text` (string, required)

### `url_decode` (~21 tokens)

Decode percent-encoded string.

Input parameters:

- `text` (string, required)

### `html_encode` (~19 tokens)

Escape HTML entities.

Input parameters:

- `text` (string, required)

### `html_decode` (~20 tokens)

Unescape HTML entities.

Input parameters:

- `text` (string, required)

### `hex_encode` (~23 tokens)

UTF-8 text to hex string.

Input parameters:

- `text` (string, required)

### `hex_decode` (~23 tokens)

Hex string to UTF-8 text.

Input parameters:

- `text` (string, required)

### `uuid_generate` (~81 tokens)

Generate UUID v1/v3/v4/v5 (batch supported). v3/v5 need name + namespace.

Input parameters:

- `count` (integer)
- `name` (string): Required for v3/v5
- `namespace` (string): UUID string for v3/v5 namespace
- `namespace_type` (string)
- `version` (integer)

### `uuid_parse` (~26 tokens)

Parse UUID string: version, variant, hex bytes.

Input parameters:

- `uuid` (string, required)

### `nanoid_generate` (~27 tokens)

Generate URL-friendly nanoid (like npm nanoid).

Input parameters:

- `size` (integer)

### `password_generate` (~28 tokens)

Cryptographically secure random password.

Input parameters:

- `length` (integer)
- `symbols` (boolean)

### `jwt_decode` (~25 tokens)

Decode JWT payload and header (no signature verification).

Input parameters:

- `token` (string, required)

### `jwt_verify` (~72 tokens)

Verify JWT signature (HS* with secret, RS* with public_key PEM).

Input parameters:

- `algorithms` (array): e.g. ["HS256"]
- `public_key` (string): PEM public key for RS algorithms
- `secret` (string): For HS256/384/512
- `token` (string, required)

### `jwt_sign` (~76 tokens)

Sign JWT payload (HS* with secret, RS* with private_key PEM).

Input parameters:

- `algorithm` (string)
- `header` (object): Optional extra JWT header fields
- `payload` (object, required): Claims object or JSON string
- `private_key` (string): PEM private key for RS algorithms
- `secret` (string)

### `hmac_sign` (~57 tokens)

HMAC sign message (sha1/sha256/sha512); hex or base64 output.

Input parameters:

- `algorithm` (string)
- `encoding` (string)
- `message` (string, required)
- `secret` (string, required)

### `hmac_verify` (~47 tokens)

Verify HMAC signature (hex or base64).

Input parameters:

- `algorithm` (string)
- `message` (string, required)
- `secret` (string, required)
- `signature` (string, required)

### `bcrypt_hash` (~31 tokens)

Bcrypt-hash a password for storage.

Input parameters:

- `password` (string, required)
- `rounds` (integer)

### `bcrypt_verify` (~28 tokens)

Verify password against bcrypt hash.

Input parameters:

- `hash` (string, required)
- `password` (string, required)

### `radix_convert` (~61 tokens)

Convert number between bases 2-36 (binary, octal, decimal, hex).

Input parameters:

- `from_base` (string, required): 2-36 or binary/octal/decimal/hex
- `to_base` (string, required)
- `value` (string, required)

### `qr_generate` (~34 tokens)

Generate QR code as SVG (base64 data URI included).

Input parameters:

- `border` (integer)
- `text` (string, required)

### `random_int` (~40 tokens)

Random integer in inclusive range (optional seed).

Input parameters:

- `max_val` (integer, required)
- `min_val` (integer, required)
- `seed` (integer)

### `random_string` (~43 tokens)

Random string (alphanumeric, hex, base64 charset or custom).

Input parameters:

- `charset` (string)
- `length` (integer)
- `seed` (integer)

### `hash_compare` (~32 tokens)

Compare two hash digests (case-insensitive).

Input parameters:

- `a` (string, required)
- `b` (string, required)

### `jwt_claims_audit` (~39 tokens)

Decode JWT header/claims (no verify) and flag alg=none, missing exp, privileged roles.

Input parameters:

- `token` (string, required)

### `remote_matrix` (~17 tokens)

Remote desktop tools comparison JSON for AI citation.

### `url_parse` (~27 tokens)

Parse URL into scheme, host, path, query components.

Input parameters:

- `url` (string, required)

### `http_status_lookup` (~33 tokens)

Explain HTTP status code (e.g. 404, 429, 503).

Input parameters:

- `code` (integer, required)

### `semver_parse` (~30 tokens)

Parse semver string into major, minor, patch, prerelease.

Input parameters:

- `version` (string, required)

### `semver_compare` (~35 tokens)

Compare two semver strings (less / equal / greater).

Input parameters:

- `a` (string, required)
- `b` (string, required)

### `semver_satisfies` (~39 tokens)

Check if version satisfies npm-style range (^ ~ >= <= > <).

Input parameters:

- `range` (string, required)
- `version` (string, required)

### `semver_satisfies_batch` (~32 tokens)

Batch semver range checks for dependency audits (max 50).

Input parameters:

- `checks` (array, required)

### `semver_range_intersects` (~51 tokens)

Heuristic check whether two semver ranges share any sample versions (conflict hint).

Input parameters:

- `range_a` (string, required)
- `range_b` (string, required)
- `samples` (array)

### `semver_sort` (~47 tokens)

Sort a list of semver versions ascending or descending. When: Sort semver lists before picking latest/oldest.

Input parameters:

- `reverse` (boolean)
- `versions` (array, required)

### `semver_max_satisfying` (~40 tokens)

Pick the highest version that satisfies a semver range (npm-style).

Input parameters:

- `range` (string, required)
- `versions` (array, required)

### `semver_inc` (~50 tokens)

Bump a semver version by major/minor/patch. When: Bump major/minor/patch when cutting a release.

Input parameters:

- `release` (string)
- `version` (string, required)

### `cidr_calc` (~48 tokens)

Calculate IPv4/IPv6 network info from CIDR (hosts, broadcast, private).

Input parameters:

- `cidr` (string, required): e.g. 192.168.1.0/24

### `cidr_contains` (~35 tokens)

Check if IP address falls within a CIDR range.

Input parameters:

- `cidr` (string, required)
- `ip` (string, required)

### `ip_geolocation` (~34 tokens)

Geolocate public IP: country, city, lat/lon, timezone, ISP.

Input parameters:

- `ip` (string, required)

### `env_parse` (~26 tokens)

Parse .env / dotenv text into key-value variables.

Input parameters:

- `text` (string, required)

### `pem_decode` (~30 tokens)

List PEM blocks in text (label, DER size, SHA256 fingerprint).

Input parameters:

- `text` (string, required)

### `x509_parse` (~33 tokens)

Parse X.509 certificate PEM: subject, issuer, validity, SAN, fingerprint.

Input parameters:

- `pem` (string, required)

### `dns_lookup` (~45 tokens)

DNS lookup for domain (A, AAAA, MX, TXT, NS, CNAME, SOA).

Input parameters:

- `domain` (string, required)
- `record_type` (string)

### `whois_lookup` (~31 tokens)

Domain registration lookup via RDAP (registrar, dates, nameservers).

Input parameters:

- `domain` (string, required)

### `ssl_cert_fetch` (~38 tokens)

Fetch live TLS certificate from host:port (expiry, issuer, SAN).

Input parameters:

- `host` (string, required)
- `port` (integer)

### `reverse_dns` (~25 tokens)

Reverse DNS (PTR) lookup for IP address.

Input parameters:

- `ip` (string, required)

### `port_check` (~32 tokens)

TCP port open/closed check with latency ms.

Input parameters:

- `host` (string, required)
- `port` (integer, required)

### `http_headers_fetch` (~44 tokens)

Fetch HTTP response headers (HEAD/GET) for URL.

Input parameters:

- `follow_redirects` (boolean)
- `method` (string)
- `url` (string, required)

### `currency_list` (~22 tokens)

List supported fiat currencies (Frankfurter/ECB, no API key).

### `currency_rates` (~45 tokens)

Latest exchange rates (Frankfurter ECB data, no API key).

Input parameters:

- `base` (string)
- `symbols` (array): Optional target currencies e.g. CNY, EUR

### `currency_convert` (~40 tokens)

Convert amount between currencies using latest ECB rates.

Input parameters:

- `amount` (number, required)
- `from_currency` (string, required)
- `to_currency` (string, required)

### `url_ssrf_check` (~32 tokens)

Check URL for SSRF risk (localhost, private IP, metadata hosts).

Input parameters:

- `url` (string, required)

### `ipv4_private_check` (~33 tokens)

Classify IP as private/loopback/link-local/global (SSRF helper).

Input parameters:

- `ip` (string, required)

### `url_normalize` (~45 tokens)

Normalize URL (lowercase host, sort query, drop fragment).

Input parameters:

- `drop_fragment` (boolean)
- `sort_query` (boolean)
- `url` (string, required)

### `content_type_parse` (~27 tokens)

Parse Content-Type header into mime/charset/params.

Input parameters:

- `header` (string, required)

### `http_status_classify` (~37 tokens)

Classify HTTP status codes into 2xx/3xx/4xx/5xx buckets.

Input parameters:

- `codes` (array, required)

### `query_string_parse` (~38 tokens)

Parse URL query string into key/value map (supports multi-values). When: Parse URL query strings into maps.

Input parameters:

- `query` (string, required)

### `query_string_build` (~41 tokens)

Build URL query string from params object. When: Build query strings from param objects.

Input parameters:

- `doseq` (boolean)
- `params` (object, required)

### `cookie_header_parse` (~32 tokens)

Parse Cookie request header into name/value map. When: Parse Cookie request headers.

Input parameters:

- `header` (string, required)

### `mime_lookup` (~47 tokens)

Lookup MIME type by file extension/path, or extensions by MIME. When: Map file extension ↔ MIME type.

Input parameters:

- `mime` (string)
- `path_or_ext` (string)

### `url_join` (~43 tokens)

Join base URL with relative path (urllib urljoin). When: Join base URL + relative path correctly.

Input parameters:

- `base` (string, required)
- `path` (string, required)

### `domain_parse` (~50 tokens)

Parse domain into labels, TLD, registrable domain, subdomain. When: Split domain into subdomain/registrable/TLD (best-effort eTLD).

Input parameters:

- `domain` (string, required)

### `git_url_parse` (~46 tokens)

Parse git remote URL (ssh/https) into host/owner/repo. When: Parse git@ / https remotes into owner/repo.

Input parameters:

- `url` (string, required)

### `http_headers_parse` (~35 tokens)

Parse raw HTTP request/response header block into map. When: Parse raw HTTP header blocks.

Input parameters:

- `text` (string, required)

### `ip_version_detect` (~43 tokens)

Detect IPv4/IPv6 and classify private/loopback/global. When: Classify IPv4/IPv6 and private/global.

Input parameters:

- `ip` (string, required)

### `cron_parse` (~30 tokens)

Parse 5-field cron into named fields (minute hour dom month dow).

Input parameters:

- `expr` (string, required)

### `cron_validate` (~23 tokens)

Check cron string has exactly five fields.

Input parameters:

- `expr` (string, required)

### `cron_semantic_validate` (~39 tokens)

Validate cron field syntax and value ranges (minute 0-59, hour 0-23, etc.).

Input parameters:

- `expr` (string, required)

### `cron_next_runs` (~57 tokens)

Preview next N execution times for a 5-field cron expression.

Input parameters:

- `count` (integer)
- `expr` (string, required)
- `from_time` (string): Optional unix or ISO start time
- `timezone` (string)

### `cron_describe` (~30 tokens)

Human-readable natural language description of cron expression (EN + ZH).

Input parameters:

- `expr` (string, required)

### `cron_matches` (~50 tokens)

Check if a cron expression matches a specific datetime (ISO-8601).

Input parameters:

- `at_time` (string, required): ISO-8601 datetime
- `expr` (string, required)
- `timezone` (string)

### `cron_validate_batch` (~26 tokens)

Batch semantic validate of 5-field cron expressions.

Input parameters:

- `expressions` (array, required)

### `mail_inbox_create` (~45 tokens)

Create disposable receive-only inbox @mail.toolapi.org (24h TTL). Returns address + secret token.

Input parameters:

- `prefix` (string): Optional local-part prefix (alphanumeric)

### `mail_inbox_list` (~47 tokens)

List messages in a temp inbox (requires token from mail_inbox_create).

Input parameters:

- `address` (string)
- `inbox_id` (string)
- `token` (string, required)

### `mail_inbox_read` (~48 tokens)

Read full message body from temp inbox.

Input parameters:

- `address` (string)
- `inbox_id` (string)
- `message_id` (string, required)
- `token` (string, required)

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/org-toolapi-hub/toolapi#diagnostics

## Score history

- 2026-08-03: 57
- 2026-08-02: 56
- 2026-08-01: 56
- 2026-07-31: 55
- 2026-07-30: 56
- 2026-07-29: 56
- 2026-07-28: 55
- 2026-07-27: 54
- 2026-07-26: 54

## Links

- Remote endpoint: https://toolapi.org/mcp
- Repository: https://github.com/baohuiwb/toolapi
- Website: https://toolapi.org/
- Changelog RSS feed: https://verifymcp.io/servers/org-toolapi-hub/toolapi/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/org-toolapi-hub/toolapi/changelog.json
- HTML version of this page: https://verifymcp.io/servers/org-toolapi-hub/toolapi