# io.github.XogZ3/botoi-mcp (remote · api.botoi.com)

49 developer tools via MCP: DNS, WHOIS, IP lookup, JWT, hashing, QR, and more.

- Trust score: 69/100 (medium)
- Change this week: +3
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- remote · `api.botoi.com`: 69/100 (this document), [markdown](https://verifymcp.io/servers/xogz3-botoi-mcp/api.md), [page](https://verifymcp.io/servers/xogz3-botoi-mcp/api)

## Channel facts

- Endpoint: `https://api.botoi.com/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `1.0.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Endpoint Security**: 57/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation not fully verified: no authorisation is required to call this server, and 49 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe.
  - HTTPS is enforced; there's no plaintext access path.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 84/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 2772 tokens (~55/item across 50 items; 49 tools + 1 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add --transport http xogz3-botoi-mcp https://api.botoi.com/mcp
```

### Codex

```toml
[mcp_servers.xogz3-botoi-mcp]
url = "https://api.botoi.com/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "xogz3-botoi-mcp": {
      "type": "remote",
      "url": "https://api.botoi.com/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add xogz3-botoi-mcp --url https://api.botoi.com/mcp --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  xogz3-botoi-mcp:
    url: "https://api.botoi.com/mcp"
```

### Other

```json
{
  "mcpServers": {
    "xogz3-botoi-mcp": {
      "type": "http",
      "url": "https://api.botoi.com/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 69, +1)

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-01 (score 68, +1)

No change was recorded against any check on this day. Stability & Change Management went from 17 to 20. That category is still filling its 30-day observation window: 5 days of observed history at the previous scan, 6 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-31 (score 67, −1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 68, +1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-28 (score 67, +1)

No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-27 (score 66, +1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-26 (score 65)

First indexed and scored.

## MCP tools (49)

### `lookup_ip` (~66 tokens)

IP Lookup

Look up geolocation, ISP, and network details for an IP address. Use when you need to determine the physical location, internet provider, or AS number for a given IP.

Input parameters:

- `ip` (string): IP address to look up. If omitted, the caller's IP is used.

### `lookup_dns` (~65 tokens)

DNS Lookup

Query DNS records (A, AAAA, MX, TXT, CNAME, NS) for a domain. Use when you need to check DNS configuration or troubleshoot domain resolution.

Input parameters:

- `domain` (string, required): Domain name to look up
- `type` (string): DNS record type

### `lookup_whois` (~46 tokens)

WHOIS Lookup

Get WHOIS registration data for a domain. Use when you need to find domain ownership, registrar, or expiration date.

Input parameters:

- `domain` (string, required): Domain name to look up

### `lookup_ssl` (~38 tokens)

SSL Check

Check SSL certificate details and expiry for a domain. Use when verifying HTTPS configuration or checking certificate validity.

Input parameters:

- `domain` (string, required): Domain to check

### `lookup_email` (~48 tokens)

Email Validate

Validate an email address (syntax, MX record, disposable check). Use when you need to verify if an email address is real and deliverable.

Input parameters:

- `email` (string, required): Email address to validate

### `lookup_headers` (~29 tokens)

HTTP Headers

Fetch HTTP response headers for a URL. Use when inspecting server configuration, security headers, or caching policies.

### `lookup_url_metadata` (~48 tokens)

URL Metadata

Extract title, description, OG tags, and favicon from a URL. Use when you need to preview or summarize a webpage.

Input parameters:

- `url` (string, required): URL to fetch and extract metadata from

### `lookup_domain_availability` (~59 tokens)

Domain Availability

Check if a domain name is available for registration. Use when brainstorming project names or validating domain ideas. Returns availability status and WHOIS data if registered.

Input parameters:

- `domain` (string, required): The domain name to check (e.g. "example.com")

### `lookup_tech_detect` (~54 tokens)

Tech Detect

Detect technologies used by a website (frameworks, CMS, analytics). Use when analyzing a competitor's tech stack.

Input parameters:

- `url` (string, required): The full URL to analyze (must start with http:// or https://)

### `lookup_vpn_detect` (~57 tokens)

VPN Detect

Check if an IP address is a VPN, proxy, or Tor exit node. Use when assessing connection trustworthiness or flagging suspicious traffic. Returns detection type and provider details.

Input parameters:

- `ip` (string, required): IPv4 address to check

### `lookup_phone` (~54 tokens)

Phone Lookup

Parse and validate a phone number, returning country, carrier, line type, and E.164 format. Use when normalizing user-submitted phone numbers or verifying contact data.

Input parameters:

- `phone` (string, required): Phone number to validate

### `lookup_company` (~50 tokens)

Company Lookup

Look up company information by domain name. Returns name, industry, employee count, location, and social profiles. Use when enriching leads or researching organizations.

Input parameters:

- `domain` (string, required): Company domain to look up

### `text_base64_encode` (~68 tokens)

Base64 Encode

Encode a UTF-8 string to Base64. Use for embedding data in URLs or APIs that require Base64.

Input parameters:

- `text` (string, required): The string to encode
- `urlSafe` (boolean): Use URL-safe alphabet (- instead of +, _ instead of /, no padding)

### `text_base64_decode` (~72 tokens)

Base64 Decode

Decode a Base64 string back to UTF-8 text. Use when extracting data from Base64-encoded API responses, tokens, or email headers. Returns the original plaintext string.

Input parameters:

- `encoded` (string, required): The Base64 string to decode
- `urlSafe` (boolean): Input uses URL-safe alphabet

### `text_json_format` (~62 tokens)

JSON Format

Format and pretty-print a JSON string with configurable indentation. Use when making minified or compact JSON readable for debugging or documentation.

Input parameters:

- `indent` (number): Number of spaces for indentation (0-8)
- `json` (string, required): Raw JSON string to format

### `text_json_validate` (~32 tokens)

JSON Validate

Validate whether a string is valid JSON and report parsing errors.

Input parameters:

- `json` (string, required): JSON string to validate

### `text_markdown_to_html` (~79 tokens)

Markdown to HTML

Convert Markdown text to HTML. Use when rendering Markdown content for web display or email templates. Returns sanitized HTML.

Input parameters:

- `gfm` (boolean): Enable GitHub Flavored Markdown
- `markdown` (string, required): Markdown source text
- `sanitize` (boolean): Strip script tags, event handlers, iframes, objects, and embeds

### `text_html_to_markdown` (~46 tokens)

HTML to Markdown

Convert HTML to clean Markdown. Use when extracting readable content from web pages or migrating HTML docs to Markdown format.

Input parameters:

- `html` (string, required): HTML string to convert to Markdown

### `text_csv_to_json` (~73 tokens)

CSV to JSON

Parse CSV text into a JSON array of objects. Use when converting spreadsheet or tabular data into structured JSON for processing or storage.

Input parameters:

- `csv` (string, required): CSV data as a string
- `delimiter` (string): Column delimiter character
- `has_header` (boolean): Whether the first row contains column headers

### `text_yaml_to_json` (~48 tokens)

YAML to JSON

Convert YAML configuration or data to JSON. Use when parsing YAML config files for programmatic access or API consumption. Returns a JSON object.

Input parameters:

- `yaml` (string, required): YAML string to convert

### `text_json_to_yaml` (~52 tokens)

JSON to YAML

Convert JSON data to YAML format. Use when generating human-readable config files from JSON data structures.

Input parameters:

- `data` (object, required): JSON object to convert
- `indent` (number): Number of spaces for indentation

### `text_xml_to_json` (~48 tokens)

XML to JSON

Convert XML documents to JSON. Use when parsing XML API responses, feeds, or config files into a structured JSON format for easier processing.

Input parameters:

- `xml` (string, required): XML string to convert

### `dev_hash` (~62 tokens)

Hash Text

Generate a hash (MD5, SHA-1, SHA-256, SHA-512) of input text. Use for checksums, data integrity, or fingerprinting.

Input parameters:

- `algorithm` (string, required): Hash algorithm
- `text` (string, required): Text to hash

### `dev_uuid` (~40 tokens)

UUID Generate

Generate one or more UUIDs (v4 or v7). Use when you need unique identifiers for database records, request tracing, or idempotency keys.

### `dev_jwt_sign` (~62 tokens)

JWT Sign

Create and sign a JWT with a given payload and secret.

Input parameters:

- `expires_in` (number): Token expiration time in seconds
- `payload` (object, required): JSON payload to encode in the token
- `secret` (string, required): HMAC secret key for signing

### `dev_jwt_verify` (~33 tokens)

JWT Verify

Verify and decode a JWT. Use when debugging authentication tokens.

Input parameters:

- `token` (string, required): JWT token to decode

### `dev_cron_describe` (~32 tokens)

Cron Describe

Convert a cron expression to a human-readable description.

Input parameters:

- `expression` (string, required): Five-field cron expression

### `dev_password_generate` (~113 tokens)

Password Generate

Generate a random password with configurable length and complexity.

Input parameters:

- `count` (number): Number of passwords to generate (1-50)
- `excludeAmbiguous` (boolean): Exclude ambiguous characters (0, O, I, l, 1, |)
- `length` (number): Password length (4-256)
- `lowercase` (boolean): Include lowercase letters
- `numbers` (boolean): Include digits
- `symbols` (boolean): Include special characters
- `uppercase` (boolean): Include uppercase letters

### `dev_url_encode` (~64 tokens)

URL Encode

URL-encode a string by escaping special characters. Use when building query parameters, form data, or safe URLs that contain reserved characters.

Input parameters:

- `component` (boolean): Use encodeURIComponent (true) or encodeURI (false)
- `text` (string, required): String to encode

### `dev_url_decode` (~68 tokens)

URL Decode

URL-decode a percent-encoded string back to readable text. Use when parsing query parameters, redirect URIs, or encoded form values.

Input parameters:

- `component` (boolean): Use decodeURIComponent (true) or decodeURI (false)
- `text` (string, required): URL-encoded string to decode

### `dev_regex_test` (~61 tokens)

Regex Test

Test a regex pattern against a string and return matches.

Input parameters:

- `flags` (string): Regex flags (e.g. "gi")
- `pattern` (string, required): Regular expression pattern (without delimiters)
- `testString` (string, required): String to test against

### `dev_diff` (~57 tokens)

Text Diff

Compute a unified diff between two text strings. Use when comparing file versions, config changes, or code revisions. Returns added, removed, and unchanged lines.

Input parameters:

- `modified` (string, required): Modified text
- `original` (string, required): Original text

### `dev_semver_parse` (~51 tokens)

Semver Parse

Parse and validate a semver string into major, minor, patch, pre-release, and build components. Use when checking version compatibility or sorting releases.

Input parameters:

- `version` (string, required): Version string to validate

### `dev_timestamp_convert` (~91 tokens)

Timestamp Convert

Convert between Unix timestamps and ISO 8601 dates. Use when normalizing date formats across APIs, logs, or databases. Returns both Unix and ISO representations.

Input parameters:

- `from` (string): Source format hint (unix, unix_ms, iso)
- `timestamp` (string, required): Timestamp to convert (Unix seconds, Unix ms, or ISO 8601 string)
- `to` (string): Target format hint

### `security_encrypt` (~46 tokens)

Encrypt Text

Encrypt text using AES-256-GCM with a passphrase.

Input parameters:

- `password` (string, required): Encryption password (used to derive the key)
- `plaintext` (string, required): Text to encrypt

### `security_decrypt` (~48 tokens)

Decrypt Text

Decrypt AES-256-GCM encrypted text with a passphrase.

Input parameters:

- `ciphertext` (string, required): Base64-encoded ciphertext to decrypt
- `password` (string, required): Password used during encryption

### `security_totp_generate` (~61 tokens)

TOTP Generate

Generate a TOTP secret and provisioning URI for 2FA setup.

Input parameters:

- `digits` (number): Number of digits in the code
- `period` (number): Time step in seconds
- `secret` (string, required): Base32-encoded shared secret

### `security_validate_credit_card` (~35 tokens)

Validate Credit Card

Validate a credit card number (Luhn check, network detection).

Input parameters:

- `number` (string, required): Credit card number to validate

### `security_pii_detect` (~39 tokens)

PII Detect

Detect personally identifiable information (emails, phones, SSNs) in text.

Input parameters:

- `text` (string, required): The text to scan for PII

### `transform_minify_js` (~48 tokens)

Minify JS

Minify JavaScript code by removing whitespace, comments, and shortening variable names. Use when optimizing bundle size for production deployment.

Input parameters:

- `code` (string, required): JavaScript code to minify

### `transform_minify_css` (~47 tokens)

Minify CSS

Minify CSS stylesheets by removing whitespace, comments, and redundant rules. Use when reducing stylesheet size for faster page loads.

Input parameters:

- `code` (string, required): CSS code to minify

### `transform_sql_format` (~65 tokens)

SQL Format

Format and beautify SQL queries with proper indentation and keyword casing. Use when cleaning up inline SQL for code reviews, documentation, or debugging.

Input parameters:

- `indent` (number): Number of spaces for indentation (default: 2)
- `sql` (string, required): SQL query to format

### `transform_code_format` (~78 tokens)

Code Format

Format source code with language-aware indentation and style rules. Supports JS, TS, Python, Go, Rust, and more. Use when standardizing code style or preparing snippets for documentation.

Input parameters:

- `code` (string, required): Source code to format
- `language` (string, required): Programming language (javascript, json, html, css, sql, xml)

### `transform_json_to_typescript` (~76 tokens)

JSON to TypeScript

Generate TypeScript interfaces from a JSON sample. Use when building type-safe API clients or converting API responses into TypeScript types.

Input parameters:

- `json` (object, required): Any valid JSON value to convert (object, array, string, number, etc.)
- `name` (string): Name for the generated interface (default: "Root")

### `lookup_address_validate` (~60 tokens)

Address Validate

Validate a freeform address and return structured components (street, city, state, postal code, country), GPS coordinates, and confidence score. Use when you need to verify or parse an address.

Input parameters:

- `address` (string, required): Freeform address to validate

### `lookup_breach_check` (~49 tokens)

Breach Check

Check if a password has appeared in known data breaches using k-Anonymity. Returns breach count. Use when you need to verify password safety.

Input parameters:

- `password` (string, required): Password to check

### `lookup_ssl_cert_expiry` (~53 tokens)

SSL Certificate Expiry

Check SSL certificate expiry for a domain. Returns issuer, valid dates, days remaining, and expired/expiring-soon flags. Use when monitoring certificate health.

Input parameters:

- `domain` (string, required): Domain to check

### `lookup_dns_monitor` (~57 tokens)

DNS Monitor

Check DNS records for a domain and compare against the previous snapshot. Detects record changes over time. Use when monitoring DNS configuration.

Input parameters:

- `domain` (string, required): Domain to monitor
- `types` (array): DNS record types to check

### `lookup_accessibility` (~58 tokens)

Accessibility Check

Run 10 basic accessibility checks on a webpage URL. Returns a score, issues list, and summary. Use when you need a quick accessibility audit.

Input parameters:

- `url` (string, required): URL to check (must start with http:// or https://)

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/xogz3-botoi-mcp/api#diagnostics

## Score history

- 2026-08-03: 69
- 2026-08-02: 68
- 2026-08-01: 68
- 2026-07-31: 67
- 2026-07-30: 68
- 2026-07-29: 67
- 2026-07-28: 67
- 2026-07-27: 66
- 2026-07-26: 65

## Links

- Remote endpoint: https://api.botoi.com/mcp
- Repository: https://github.com/XogZ3/botoi
- Changelog RSS feed: https://verifymcp.io/servers/xogz3-botoi-mcp/api/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/xogz3-botoi-mcp/api/changelog.json
- HTML version of this page: https://verifymcp.io/servers/xogz3-botoi-mcp/api