# Agent Tools MCP (remote · agent-tools-mcp.yvan11.workers.dev) 32 free MCP tools for data validation, text optimization, and synthetic test data. - Trust score: 72/100 (medium) - Change this week: +4 - Registry status: active - Liveness: live - Owner verified: no - Last scored: 2026-11-05 ## Components - remote · `agent-tools-mcp.yvan11.workers.dev`: 72/100 (this document), [markdown](https://verifymcp.io/servers/why-see-agent-tools-mcp/agent-tools-mcp.md), [page](https://verifymcp.io/servers/why-see-agent-tools-mcp/agent-tools-mcp) ## Channel facts - Endpoint: `https://agent-tools-mcp.yvan11.workers.dev/mcp` - Transports: `streamable-http` - Auth: `none` - Version: `1.1.0` ## Trust breakdown How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog) Scored 2026-11-05. - **Endpoint Security**: 63/100 - The endpoint's TLS certificate is valid, in date, and uses a strong key. - No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one. - HTTPS enforcement could not be verified: the plaintext port answered with HTTP 405, which proves neither a plaintext path nor enforcement. - HSTS check failed: the Strict-Transport-Security header is absent. - DNSSEC check failed: this domain isn't protected by DNSSEC. - **Transport & Reachability**: 100/100 - Verified streamable-http transport via a live MCP handshake. - **Schema Quality & AI Usability**: 82/100 - AI-judged instruction clarity (excellent). - Tool/resource definitions use about 2765 tokens (~86/item across 32 items; 32 tools + 0 resources), lean. - Usage-examples check failed: none of the tools include examples. - **Stability & Change Management**: 38/100 - Stability check failed: schema churn in the 18 days we've observed: 7 tool removals, 0 breaking changes, 0 auth/transport breaks, 7 additions. - **Tool Coverage**: 100/100 - 100% of tools have a non-trivial description (not blank, and not just the tool's name). - 100% of tool parameters carry a description. - **Tool Safety**: 75/100 - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured. - 0 of 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "minify-html" implies "remove" and declares readOnlyHint instead, contradicting what its own name says it does. - An AI judge read all 32 captured unit(s) of tool text and found none that tries to manipulate the model reading it. - **Capabilities**: 100/100 - Implements a current MCP spec version (2026-07-28). ## Install ### How do I install the Agent Tools MCP server? Agent Tools MCP is a hosted endpoint at https://agent-tools-mcp.yvan11.workers.dev/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation. ### Claude ```bash claude mcp add --transport http why-see-agent-tools-mcp 'https://agent-tools-mcp.yvan11.workers.dev/mcp' ``` ### Cursor ```json { "mcpServers": { "why-see-agent-tools-mcp": { "url": "https://agent-tools-mcp.yvan11.workers.dev/mcp" } } } ``` ### VS Code ```json { "servers": { "why-see-agent-tools-mcp": { "type": "http", "url": "https://agent-tools-mcp.yvan11.workers.dev/mcp" } } } ``` ### Codex ```toml [mcp_servers.why-see-agent-tools-mcp] url = "https://agent-tools-mcp.yvan11.workers.dev/mcp" ``` ### opencode ```json { "$schema": "https://opencode.ai/config.json", "mcp": { "why-see-agent-tools-mcp": { "type": "remote", "url": "https://agent-tools-mcp.yvan11.workers.dev/mcp", "enabled": true } } } ``` ### OpenClaw ```bash openclaw mcp add why-see-agent-tools-mcp --url 'https://agent-tools-mcp.yvan11.workers.dev/mcp' --transport streamable-http ``` ### Hermes ```yaml mcp_servers: why-see-agent-tools-mcp: url: "https://agent-tools-mcp.yvan11.workers.dev/mcp" ``` ### Netclaw ```json { "McpServers": { "why-see-agent-tools-mcp": { "Transport": "http", "Url": "https://agent-tools-mcp.yvan11.workers.dev/mcp" } } } ``` ### Vellum ```bash assistant mcp add why-see-agent-tools-mcp -t streamable-http -u 'https://agent-tools-mcp.yvan11.workers.dev/mcp' ``` ### Other ```json { "mcpServers": { "why-see-agent-tools-mcp": { "type": "http", "url": "https://agent-tools-mcp.yvan11.workers.dev/mcp" } } } ``` The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs. ## Changelog Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims. ### 2026-11-05 (score 72, +1) No change was recorded against any check on this day. Stability & Change Management went from 34 to 38. ### 2026-11-03 (score 71, +1) No change was recorded against any check on this day. Stability & Change Management went from 28 to 31. ### 2026-11-01 (score 70, +1) No change was recorded against any check on this day. Stability & Change Management went from 21 to 24. ### 2026-10-30 (score 69, +1) No change was recorded against any check on this day. Stability & Change Management went from 14 to 18. ### 2026-10-27 (score 68, +1) No change was recorded against any check on this day. Stability & Change Management went from 4 to 8. ### 2026-10-25 (score 67, +1) No change was recorded against any check on this day. Stability & Change Management went from 0 to 1. ### 2026-10-20 (score 66, −3) - [security regression] Stability: 0.03 → fail - [security regression] A breaking change shipped without a version bump: still 1.1.0 - [security regression] Tool “is-dataset-minify” was removed - [security regression] Tool “is-google-tag” was removed - [security regression] Tool “is-html-minify” was removed - [security regression] Tool “is-minify-css” was removed - [security regression] Tool “is-minify-js” was removed - [security regression] Tool “is-prompt-minify” was removed - [security regression] Tool “is-strip-ansi” was removed - [security] Tool “is-ip-safe” rewrote its description, which is the text the model reads - [security] Tool “generate-avatar” rewrote its description, which is the text the model reads - [security] Tool “generate-card-number” rewrote its description, which is the text the model reads - [security] Tool “generate-color” rewrote its description, which is the text the model reads - [security] Tool “generate-dataset” rewrote its description, which is the text the model reads - [security] Tool “generate-fake-data” rewrote its description, which is the text the model reads - [security] Tool “generate-hash” rewrote its description, which is the text the model reads - [security] Tool “generate-lorem” rewrote its description, which is the text the model reads - [security] Tool “generate-password” rewrote its description, which is the text the model reads - [security] Tool “generate-phone-number” rewrote its description, which is the text the model reads - [security] Tool “generate-prompt” rewrote its description, which is the text the model reads - [security] Tool “generate-slug” rewrote its description, which is the text the model reads - [security] Tool “generate-ssn” rewrote its description, which is the text the model reads - [security] Tool “generate-token” rewrote its description, which is the text the model reads - [security] Tool “is-card-safe” rewrote its description, which is the text the model reads - [security] Tool “is-email-safe” rewrote its description, which is the text the model reads - [security] Tool “is-iban-safe” rewrote its description, which is the text the model reads - [security] Tool “is-iso-date-safe” rewrote its description, which is the text the model reads - [security] Tool “is-json-safe” rewrote its description, which is the text the model reads - [security] Tool “is-password-safe” rewrote its description, which is the text the model reads - [security] Tool “is-phone-e164” rewrote its description, which is the text the model reads - [security] Tool “is-url-safe” rewrote its description, which is the text the model reads - [security] Tool “is-us-tin-safe” rewrote its description, which is the text the model reads - [security] Tool “is-uuid-safe” rewrote its description, which is the text the model reads - [security] Tool “is-vat-safe” rewrote its description, which is the text the model reads - [functional improvement] Schema quality: 102 → 86 - [functional] Destructive annotations: pass → 0 - [functional] New tool “minify-css” - [functional] New tool “minify-html” - [functional] New tool “minify-js” - [functional] New tool “minify-prompt” - [functional] New tool “optimize-dataset” - [functional] New tool “optimize-google-tag” - [functional] New tool “strip-ansi” - [cosmetic] “generate-phone-number” reworded the description of “city” - [cosmetic] “generate-prompt” reworded the description of “seed” - [cosmetic] “generate-prompt” reworded the description of “template” - [cosmetic] “generate-prompt” reworded the description of “vars” - [cosmetic] Tool “generate-card-number” changed its title: Generate a synthetic card test number → Generate a synthetic payment card fixture - [cosmetic] Tool “is-phone-e164” changed its title: Normalize an international phone number → Validate E.164 phone number syntax ### 2026-10-19 (score 69, +1) - [security] Tool “is-dataset-minify” rewrote its description, which is the text the model reads - [security] Tool “is-google-tag” rewrote its description, which is the text the model reads - [security] Tool “is-html-minify” rewrote its description, which is the text the model reads - [security] Tool “is-minify-css” rewrote its description, which is the text the model reads - [security] Tool “is-minify-js” rewrote its description, which is the text the model reads - [security] Tool “is-prompt-minify” rewrote its description, which is the text the model reads - [security] Tool “is-strip-ansi” rewrote its description, which is the text the model reads - [functional improvement] Stability: unverified → 0.03 ## MCP tools (32) ### `is-card-safe` (~72 tokens) Check card number structure Check payment-card brand, length and Luhn checksum. Use with synthetic card numbers in payment-form tests. Returns {ok, normalized?, brand?, last4?, issues}; not a payment authorization or fraud check. Input parameters: - `number` (string, required): Synthetic payment-card number string to examine; do not provide real card details. ### `is-email-safe` (~63 tokens) Validate email address syntax Check conservative ASCII email address syntax. Use to reject malformed addresses in forms and test fixtures. Returns true or false; does not check mailbox existence or deliverability. Input parameters: - `email` (string, required): Email address string to check, such as founder@example.com; ASCII format only. ### `is-iban-safe` (~77 tokens) Check IBAN syntax and checksum Check IBAN country rules, length and checksum against a bundled registry. Use to screen public or synthetic IBANs in test data. Returns {ok, normalized?, issues}; does not verify account ownership or transferability. Input parameters: - `iban` (string, required): IBAN string, optionally with spaces; do not submit real private bank account details. ### `is-iso-date-safe` (~69 tokens) Validate an ISO calendar date Check Gregorian YYYY-MM-DD calendar dates, including leap days. Use for date-only form fields, not timestamps or timezone offsets. Returns true for a valid date, otherwise false. Input parameters: - `date` (string, required): Candidate date formatted YYYY-MM-DD, such as 2024-02-29. ### `is-ip-safe` (~85 tokens) Validate IPv4 or IPv6 address syntax Check IPv4 or IPv6 literal-address syntax. Use to screen candidate IP strings, not test reachability or geolocation. Returns {ok, version, issues}; version is 4, 6 or null. Input parameters: - `ip` (string, required): IPv4 or IPv6 literal address such as 192.0.2.1 or 2001:db8::1. ### `is-json-safe` (~88 tokens) Parse JSON under safety limits Parse JSON with bounded depth, key counts and input size. Use to screen JSON without execution; use optimize-dataset for JSONL or CSV cleanup. Returns {ok, issues, bytes, depth, keys, value?}; parsed value is included only when valid. Input parameters: - `json` (string, required): JSON document as a string, up to 4096 characters; depth and key counts are limited. ### `is-password-safe` (~70 tokens) Assess password strength heuristically Evaluate password strength using local heuristics. Use only with dummy passwords when testing password policies. Returns {ok, score, entropyBits, length, sets, reasons, suggestions}; no breach-database lookup. Input parameters: - `password` (string, required): Fictitious test password; never supply an actual password or secret. ### `is-phone-e164` (~73 tokens) Validate E.164 phone number syntax Check phone number syntax against E.164 after local normalization. Use to test international number formats, including spaces or 00 prefixes. Returns true or false, not the normalized number; no subscriber or reachability check. Input parameters: - `phone` (string, required): Candidate internationally formatted telephone number, for example +66812345678. ### `is-uuid-safe` (~85 tokens) Validate canonical UUID syntax Check canonical UUID syntax and optional RFC variant/version. Use to validate UUIDs; use generate-token to create them. Returns true or false; does not check uniqueness or resource existence. Input parameters: - `uuid` (string, required): UUID string in canonical hyphenated format. - `version` (integer): Optional UUID version number from 1 to 8; omit to accept any supported version. ### `is-url-safe` (~63 tokens) Validate HTTP or HTTPS URL syntax Check absolute HTTP or HTTPS URL syntax. Use to screen links before display or storage. Returns true or false; does not visit or assess the site's safety. Input parameters: - `url` (string, required): Absolute HTTP(S) URL string; other schemes such as javascript: are not supported. ### `is-us-tin-safe` (~73 tokens) Check US tax ID format Check synthetic US EIN, SSN or ITIN number formats. Use with tax-ID input fixtures, never real personal identifiers. Returns {ok, normalized?, type, issues}; does not verify IRS issuance or identity. Input parameters: - `tin` (string, required): Synthetic US taxpayer identifier string; do not submit actual personal identifiers. ### `is-vat-safe` (~64 tokens) Validate European VAT number format Check country-specific VAT number patterns. Use to screen VAT fixtures before form submission. Returns {ok, country?, normalized?, issues}; no VIES lookup or active-registration check. Input parameters: - `vat` (string, required): Country-prefixed VAT number string such as DE123456789. ### `optimize-dataset` (~95 tokens) Minify small structured datasets Clean and compact JSON, JSONL or CSV rows. Use for small datasets; use is-json-safe to check JSON syntax without changes. Returns text in the selected format; trims strings, deduplicates rows and may drop mostly empty columns. Input parameters: - `format` (string): Parsing format: auto detects, or explicitly select json, jsonl or csv. - `input` (string, required): Source dataset text (maximum 4096 characters). ### `optimize-google-tag` (~83 tokens) Optimize an existing Google tag snippet Rebuild GA4 gtag.js markup from a G- measurement ID. Use on existing GA4 snippets, not GTM containers or consent setup. Returns replacement HTML with async loading and a config call, or original input if no G- ID exists. Review lost settings and consent. Input parameters: - `html` (string, required): Existing HTML snippet containing the Google Analytics tag to optimize. ### `minify-html` (~70 tokens) Minify an HTML fragment Remove comments and compact whitespace in HTML fragments. Use for small, controlled HTML snippets, not full document compilation. Returns an HTML string; preserves pre, textarea, script and style contents. Regression-test rendered output. Input parameters: - `html` (string, required): Original HTML source as text, up to 4096 characters. ### `minify-js` (~63 tokens) Compact JavaScript source Compact small JavaScript snippets. Use for basic source cleanup, not AST-aware production minification. Returns JavaScript text, sometimes unchanged for complex syntax; regression-test its behavior. Input parameters: - `code` (string, required): JavaScript source code string, limited to 4096 characters. ### `minify-css` (~55 tokens) Compact CSS source Reduce whitespace in CSS snippets. Use for basic stylesheet cleanup rather than production minification. Not a full CSS parser; visually test the result. Input parameters: - `code` (string, required): CSS source code string, limited to 4096 characters. ### `minify-prompt` (~64 tokens) Reduce prompt verbosity and whitespace Normalize prompt whitespace and line breaks. Use to compact formatting before calling a model; filler phrases are not removed. Returns trimmed text with normalized spacing; review prompts where whitespace carries meaning. Input parameters: - `text` (string, required): Prompt text to compact, up to 4096 characters. ### `strip-ansi` (~52 tokens) Remove terminal ANSI escape codes Strip terminal ANSI escape codes from text. Use to make colorized logs readable for indexing or display. Returns plain text without interpreting log entries. Input parameters: - `text` (string, required): Terminal output string containing optional ANSI escape sequences. ### `generate-avatar` (~112 tokens) Generate an SVG placeholder avatar Create an SVG placeholder profile icon. Use for synthetic avatars in demos and UI prototypes. Returns SVG markup, not a photorealistic likeness. Input parameters: - `pattern` (string): Avatar layout: initials, blocks, circles or random. - `seed` (string): Optional deterministic seed for repeatable test fixtures; do not use as a secret. - `size` (integer): SVG width and height in pixels, from 32 to 256. - `text` (string): Optional initials or label used to customize the placeholder. ### `generate-card-number` (~84 tokens) Generate a synthetic payment card fixture Generate a synthetic payment-card fixture. Use for payment-form UI tests requiring a Luhn-valid card number. Returns {number, brand, expiry, cvc}; values are synthetic, not issued credentials. Input parameters: - `brand` (string): Synthetic card brand: visa, mastercard, amex or discover. - `seed` (string): Optional deterministic seed for reproducible fake card fixtures. ### `generate-color` (~151 tokens) Generate an illustrative color palette Generate a palette from a base color and harmony scheme. Use for design prototypes; defaults: random base, triadic scheme, five hex colors. Returns {base, scheme, colors, textOnBase}; text color is heuristic, not a WCAG contrast check. Input parameters: - `base` (string): Optional base color such as #3366ff. - `count` (integer): Number of colors, from 1 to 12. - `format` (string): Output color notation: hex, rgb or hsl. - `scheme` (string): Palette harmony algorithm: complementary, triadic, tetradic, analogous, monochrome or random. - `seed` (string): Optional deterministic seed for repeatable palette generation. ### `generate-dataset` (~122 tokens) Generate a small synthetic dataset Generate synthetic rows as JSON, JSONL or CSV. Use for data import/export tests; use generate-fake-data for preset people or company fixtures. Returns at most eight records without accessing a database. Input parameters: - `count` (integer): Number of records to generate, 1–8, default 3. - `format` (string): Output format: json, jsonl or csv. - `schema` (object): Optional map of field names to upstream synthetic field specifications; no real records. - `seed` (string): Optional deterministic seed for reproducible test rows. ### `generate-fake-data` (~92 tokens) Generate fictional people and company records Create fictional users, companies, addresses or rows. Use to seed demos with preset records; use generate-dataset for custom fields. Synthetic values are not verified identities. Input parameters: - `count` (integer): Requested number of synthetic records, up to eight. - `kind` (string, required): Fixture category: user, company, address or rows. - `seed` (string): Optional deterministic seed to reproduce the same fake records. ### `generate-hash` (~88 tokens) Compute a text digest Compute SHA-256 or legacy MD5 text digests. Use for non-secret content fingerprints; generate-token creates new IDs instead. Returns a hex digest; unsuitable for password storage or key derivation. Input parameters: - `algo` (string): Digest algorithm: sha-256 (default) or legacy md5. - `text` (string, required): Public or synthetic text to digest; never send secrets for hashing. ### `generate-lorem` (~87 tokens) Create filler copy for layouts Generate lorem ipsum placeholder copy. Use for mock layouts needing filler words, sentences or paragraphs. Returns synthetic copy, not sourced editorial content. Input parameters: - `count` (integer): Number of units, from 1 to 8; default 3. - `seed` (string): Optional deterministic seed for reproducible placeholder text. - `units` (string): Output unit: words, sentences or paragraphs. ### `generate-password` (~92 tokens) Generate a random test password Generate random or seeded test passwords. Use for demo login fields; use generate-token for identifiers. Seeded values are predictable and visible to MCP clients; not a secure credential vault. Input parameters: - `length` (integer): Desired password length, 8–256 characters. - `seed` (string): Optional deterministic seed for testing only; seeded output is predictable. - `symbols` (boolean): Whether punctuation/symbol characters are included. ### `generate-phone-number` (~134 tokens) Generate fictional US phone fixtures Generate fictional US-format phone numbers. Use for US demo phone fields; when supplied, city selects a local area-code pool and must match state. Returns an array of fictional (AAA) 555-01XX numbers; no subscriber lookup. Input parameters: - `city` (string): Optional city: Los Angeles, San Francisco, New York, Houston or Miami; must match state if given. - `count` (integer): Number of fabricated numbers, up to eight. - `seed` (string): Optional deterministic seed for repeatable test numbers. - `state` (string): Optional US state abbreviation: CA, NY, TX or FL. ### `generate-prompt` (~140 tokens) Fill a prompt template with variables Fill a prompt template with supplied variables. Use {name} placeholders with matching vars.name; missing variables become empty text. Returns a prompt string without invoking a model; code/image modes can add framing. Input parameters: - `seed` (string): Optional deterministic seed for the {{RAND_INT:min,max}} helper, not ordinary placeholders. - `template` (string, required): Template text, e.g. Hello {name}; omitted variables are replaced with empty text. - `type` (string): Prompt template category: text, code or image; default text. - `vars` (object): Object mapping placeholder names to values, e.g. {"name":"Ada"} for {name}. ### `generate-slug` (~74 tokens) Turn a title into a URL slug Convert a title into a Unicode-aware URL slug. Use when forming new path segments from headings. Inspect output before publishing permanent URLs. Input parameters: - `maxLength` (integer): Maximum slug length, 1–160 characters; omit for the upstream default. - `text` (string, required): Source title to normalize, such as Café startups!. ### `generate-ssn` (~128 tokens) Generate fictional US SSN-style identifiers Generate fictional US SSN-style test identifiers. Use for SSN test fields; use generate-fake-data for mixed-record fixtures. Returns a string for count=1, otherwise an array; structural validity does not confirm issuance. Input parameters: - `count` (integer): Number of synthetic SSN-style fixtures, 1–8. - `formatted` (boolean): Whether to add standard dashes to the generated identifier. - `seed` (string): Optional deterministic seed for repeatable fake identifiers. - `valid` (boolean): Whether fixtures should pass the generator's structural validity rules, not actual issuance checks. ### `generate-token` (~97 tokens) Generate random tokens or UUIDs Generate token strings or UUIDs. Use for test identifiers; use generate-password for password fixtures. Seeded output is predictable and unsuitable for authentication credentials. Input parameters: - `length` (integer): Output length parameter, 1–256, where applicable to the selected token type. - `seed` (string): Optional deterministic seed, intended for reproducible test output only. - `type` (string, required): Token format: uuid, hex, base64 or numeric. ## Diagnostics Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/why-see-agent-tools-mcp/agent-tools-mcp#diagnostics ## Score history - 2026-11-05: 72 - 2026-11-04: 71 - 2026-11-03: 71 - 2026-11-02: 70 - 2026-11-01: 70 - 2026-10-31: 69 - 2026-10-30: 69 - 2026-10-29: 68 - 2026-10-28: 68 - 2026-10-27: 68 - 2026-10-26: 67 - 2026-10-25: 67 - 2026-10-24: 66 - 2026-10-23: 66 - 2026-10-22: 66 - 2026-10-21: 66 - 2026-10-20: 66 - 2026-10-19: 69 - 2026-10-18: 68 ## Common questions ### What is the Agent Tools MCP server? Agent Tools MCP is listed in the public MCP registry as io.github.why-see/agent-tools-mcp. 32 free MCP tools for data validation, text optimization, and synthetic test data. This page covers its hosted endpoint (https://agent-tools-mcp.yvan11.workers.dev/mcp). ### Is the Agent Tools MCP server safe to use? Agent Tools MCP scores 72 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm. ### What tools does the Agent Tools MCP server expose? Agent Tools MCP exposes 32 tools: is-card-safe, is-email-safe, is-iban-safe, is-iso-date-safe, is-ip-safe, and 27 more. Their descriptions and schemas cost roughly 2,765 tokens of context every time the server is loaded. ### Does the Agent Tools MCP server require authentication? No. We connected to Agent Tools MCP without credentials and it answered, so anything it exposes is reachable by anyone who knows the address. ### Is the Agent Tools MCP server still maintained? Agent Tools MCP is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced. ## Links - Remote endpoint: https://agent-tools-mcp.yvan11.workers.dev/mcp - Repository: https://github.com/why-see/agent-tools-mcp - Website: https://agent-tools-mcp.yvan11.workers.dev/ - Changelog RSS feed: https://verifymcp.io/servers/why-see-agent-tools-mcp/agent-tools-mcp.xml - Changelog JSON feed: https://verifymcp.io/servers/why-see-agent-tools-mcp/agent-tools-mcp.json - HTML version of this page: https://verifymcp.io/servers/why-see-agent-tools-mcp/agent-tools-mcp