Presend MCP Server

{"destructiveHint":false,"idempotentHint":true,"openWorldHint":false,"readOnlyHint":true,"title":"Base64 encode / decode"}

{"destructiveHint":false,"idempotentHint":true,"openWorldHint":false,"readOnlyHint":true,"title":"Color converter"}

{"destructiveHint":false,"idempotentHint":true,"openWorldHint":false,"readOnlyHint":true,"title":"CSV / JSON converter"}

{"destructiveHint":false,"idempotentHint":true,"openWorldHint":true,"readOnlyHint":true,"title":"CVE lookup"}

{"destructiveHint":false,"idempotentHint":true,"openWorldHint":true,"readOnlyHint":true,"title":"DNS lookup"}

{"destructiveHint":false,"idempotentHint":true,"openWorldHint":false,"readOnlyHint":true,"title":"Disposable email check"}

{"destructiveHint":false,"idempotentHint":true,"openWorldHint":true,"readOnlyHint":true,"title":"Email domain security check"}

{"destructiveHint":false,"idempotentHint":true,"openWorldHint":true,"readOnlyHint":true,"title":"Email address validation"}

{"destructiveHint":false,"idempotentHint":true,"openWorldHint":true,"readOnlyHint":true,"title":"Email verification"}

{"destructiveHint":false,"idempotentHint":true,"openWorldHint":true,"readOnlyHint":true,"title":"Favicon lookup"}

{"destructiveHint":false,"idempotentHint":true,"openWorldHint":false,"readOnlyHint":true,"title":"IBAN validation"}

{"destructiveHint":false,"idempotentHint":true,"openWorldHint":true,"readOnlyHint":true,"title":"IP reputation check"}

{"destructiveHint":false,"idempotentHint":true,"openWorldHint":false,"readOnlyHint":true,"title":"JWT decode"}

{"destructiveHint":false,"idempotentHint":true,"openWorldHint":true,"readOnlyHint":true,"title":"JWT signature verification"}

{"destructiveHint":false,"idempotentHint":true,"openWorldHint":true,"readOnlyHint":true,"title":"Link preview metadata"}

{"destructiveHint":false,"idempotentHint":true,"openWorldHint":true,"readOnlyHint":true,"title":"Package maintainer change check"}

{"destructiveHint":false,"idempotentHint":true,"openWorldHint":false,"readOnlyHint":true,"title":"Password generator"}

{"destructiveHint":false,"idempotentHint":true,"openWorldHint":true,"readOnlyHint":true,"title":"Password breach check"}

{"destructiveHint":false,"idempotentHint":true,"openWorldHint":true,"readOnlyHint":true,"title":"Password strength check"}

{"destructiveHint":false,"idempotentHint":true,"openWorldHint":false,"readOnlyHint":true,"title":"Phone number validation"}

{"destructiveHint":false,"idempotentHint":true,"openWorldHint":true,"readOnlyHint":true,"title":"Redirect trace"}

{"destructiveHint":false,"idempotentHint":true,"openWorldHint":true,"readOnlyHint":true,"title":"Repository health check"}

{"destructiveHint":false,"idempotentHint":true,"openWorldHint":true,"readOnlyHint":true,"title":"Cosmos RPC endpoint check"}

{"destructiveHint":false,"idempotentHint":true,"openWorldHint":true,"readOnlyHint":true,"title":"HTTP security headers check"}

{"destructiveHint":false,"idempotentHint":true,"openWorldHint":true,"readOnlyHint":true,"title":"Website security scan"}

{"destructiveHint":false,"idempotentHint":true,"openWorldHint":true,"readOnlyHint":true,"title":"Subdomain discovery"}

{"destructiveHint":false,"idempotentHint":true,"openWorldHint":true,"readOnlyHint":true,"title":"Package supply-chain check"}

{"destructiveHint":false,"idempotentHint":true,"openWorldHint":false,"readOnlyHint":true,"title":"Text similarity"}

{"destructiveHint":false,"idempotentHint":true,"openWorldHint":false,"readOnlyHint":true,"title":"Timestamp converter"}

{"destructiveHint":false,"idempotentHint":true,"openWorldHint":false,"readOnlyHint":true,"title":"Cosmos transaction decoder"}

{"destructiveHint":false,"idempotentHint":true,"openWorldHint":false,"readOnlyHint":true,"title":"Package typosquat check"}

{"destructiveHint":false,"idempotentHint":true,"openWorldHint":false,"readOnlyHint":true,"title":"URL tracking-parameter cleaner"}

{"destructiveHint":false,"idempotentHint":true,"openWorldHint":true,"readOnlyHint":true,"title":"URL reputation check"}

{"destructiveHint":false,"idempotentHint":true,"openWorldHint":false,"readOnlyHint":true,"title":"User-Agent parser"}

{"destructiveHint":false,"idempotentHint":true,"openWorldHint":false,"readOnlyHint":true,"title":"UUID generator"}

{"destructiveHint":false,"idempotentHint":true,"openWorldHint":true,"readOnlyHint":true,"title":"EU VAT number validation"}

 ⟨15 unchanged words⟩  crates.io, Maven, RubyGems, Packagist and NuGet. For npm and PyPI, a name that does not exist returns found: false and vulnerable: null, never a clean result. Use cve_lookup when you already have a CVE/GHSA  ⟨7 unchanged words⟩ 

{"destructiveHint":false,"idempotentHint":true,"openWorldHint":true,"readOnlyHint":true,"title":"Package vulnerability check"}

{"destructiveHint":false,"idempotentHint":true,"openWorldHint":true,"readOnlyHint":true,"title":"WHOIS lookup"}

Call before installing a package whose name you typed or recalled. Checks whether an npm or PyPI package name  ⟨35 unchanged words⟩  result does not prove a package is safe. It does not check that the package exists: supply_chain_check does.

 ⟨3 unchanged words⟩ :"Password to check against known data-breach corpora. Checked via k-anonymity (onlyOnly a partial5-character SHA-1 hash prefix is sent to HIBP (k-anonymity), --but the full password isitself nevertravels transmitted.in this request's URL; for real passwords, prefer password_check, which takes it in a POST body.","type":"string"}},"required": ⟨3 unchanged words⟩ 

Returns the favicon URL fora website declares: fetches the homepage and takes the first <link rel='icon'> (or 'shortcut icon') href, resolved to an absolute URL, which may be a domain.data: URI when the page inlines its icon (source: declared). If no icon canis declared, or the homepage cannot be verifiedfetched, a defaultreturns guessthe isconventional returnedhttps://<domain>/favicon.ico with source: default and a note, sayingwithout so.checking that it exists. Use it to display a site icon; it does not download or validate the image.

 ⟨20 unchanged words⟩  365 days (the event-stream attack pattern). CI/trusted-publishingnpm andtrusted publishing (verified OIDC identity, not just a bot-like account name), pre-release, transitionsand handovers to a publisher who already maintains another widely used package (100k+ weekly downloads) are reported but not flagged. Does not detect ⟨9 unchanged words⟩ 

{"properties":{"ecosystem":{"description":"Currently only \\\"npm\\\"'npm' is supported.","type":"string"}," ⟨13 unchanged words⟩ 

 ⟨5 unchanged words⟩ , character variety, entropy, common patterns) and, canwith check_breach=true, also checklooks it againstup in Have I Been Pwned breach data via k-anonymity.k-anonymity The(only passworda hash prefix is sent). Use it to evaluate a password someone is choosing; use password_breach when you only need the breach count, and password to generate a new one. The password travels in a POST body, never in a URL.

GitHub repository healthMaintenance signals fromfor thea GitHub APIrepository given as owner/name: stars, forks, open issues, license, archived statusand fork flags, creation date and age, days since last push.push, Inputtopics. Use it to judge whether a dependency looks maintained or abandoned. For an npm or PyPI package whose repository you do not know, supply_chain_check resolves it from registry metadata and includes these signals. GitHub only; missing or private repositories return found: owner/name.false.

Audits a URL'sthe HTTP security headers of one URL (CSP, HSTS, X-Frame-Options, Permissions-Policy, cross-origin policies and others): and returns per-header findings with fix advice, a score and a letter grade. AlsoUse includedit when you need header hardening advice; security_scan runs this audit together with URL reputation and subdomain discovery in security_scan.one call.

EncodeEncodes text to Base64 or decodedecodes a Base64 string back to text (action = encode or decode).

ConvertConverts a color formatsbetween hex, RGB and HSL. Provide exactly one of hex, rgb or hsl.

ConvertConverts betweenCSV text to JSON andor JSON to CSV (GETdirection = csv-to-json or json-to-csv), for data passed inline as text.

DirectLooks CVE/GHSAup vulnerabilitya lookupvulnerability by identifier (CVE, GHSA or other OSV ID) on OSV.dev: summary, CVSS severity, affected packages and versions, references. Use when you already have an ID; use vulnerability_check when you have a package name instead.

Returns DNS recordrecords lookupfor (a domain via Cloudflare DNS-over-HTTPS: A, AAAA, CNAME, MX, TXT, and NS) in one call, or a single record type with 'type'. For registration data use whois_lookup; for SPF/DMARC/DKIM analysis use email_security.

DetectChecks disposableonly whether an email domainsaddress uses a known disposable/temporary email domain. For syntax, MX, disposable and role-account checks in one call, use email_verify.

DomainAudits a domain's email anti-spoofing checksetup: (SPF/DMARC/DKIM)SPF strength, DMARC policy and a best-effort DKIM lookup on common selectors. A missing DKIM match does not prove DKIM is absent. Checks a domain, not a single address.

ValidateLightweight email check: syntax plus confirmation that the domain has an emailMX addressrecord. Does not detect disposable or role addresses; use email_verify for the combined check.

CombinedMost complete email verificationcheck in one call: syntax, MX record, disposable-domain detection and role/generic account detection (e.g. info@, admin@). Prefer it over email_validate and email_disposable unless you need a single signal. Does not probe the mailbox.

Fetch aReturns domain'sthe favicon URL for a domain. If no icon can be verified, a default guess is returned with a note saying so.

ValidateValidates an IBAN (offline: ISO 7064 mod-97 checksum) and country-specific length. Confirms the number is well-formed, not that the account exists.

IPChecks reputationan checkIPv4 or IPv6 address against a curated list of netblocks known spam/hijackerto netblocksbe hijacked or run by spam/cyber-crime operations (IPv4-mapped IPv6 uses the IPv4 list). A narrow list-based signal: a clean result is not a safety guarantee. Includes list date and attribution.

{"properties":{"ip":{"description":"IPv4 or IPv6 address to check (IPv4-mapped IPv6 such as ::ffff:1.2.3.4 is checked against the IPv4 list) against a curated list of known spam/hijackerhijacked or cyber-crime-controlled netblocks.","type":"string"}},"required ⟨3 unchanged words⟩ 

DecodeDecodes a JWTJWT's header and payload WITHOUT verifying its signature, so its claims must not be trusted on this basis alone. To check authenticity, use jwt_verify.

VerifyCryptographically averifies JWT'sa cryptographicJWT signature (HS256/384/512, RS/PS256/384/512, ES256/384/512) and checks exp/nbf claims. Provide a secret for HS*, or a JWK or JWKS URL for RS/PS/ES. Use instead of jwt_decode whenever authenticity matters.

ExtractFetches a web page and extracts its title, description, canonical URL, Open Graph /and Twitter Card metadatatags from(the data behind link previews). To follow a URLURL's redirects hop by hop, use redirect_trace.

Detectnpm only. Flags a suspiciouspreviously npmunseen human publisher taking over a package maintainerafter change180+ days of inactivity, within the last 365 days (the event-stream attack pattern). CI/trusted-publishing and pre-release transitions are reported but not flagged. Does not detect hijacked existing accounts; a heuristic for review, not proof.

GenerateGenerates a securerandom password, with options for length, symbols, uppercase, numbers and excluding ambiguous characters. To evaluate an existing password, use password_check.

CheckChecks ifwhether a password hasappears beenin breachedknown data breaches (Have I Been Pwned) and how many times, using k-anonymity towards HIBP. Breach check only; password_check adds strength scoring and sends the password in a POST body.

CombinedScores passworda password's strength +(length, breachcharacter variety, entropy, common patterns) and can also check it against Have I Been Pwned breach data via k-anonymity. The password is sent in a POST body, never in a URL.

ValidateValidates and formatformats a phone number: validity, country, line type, E.164, international and national formats. Numbers without a leading + require 'country', since the end user's country cannot be inferred over MCP.

 ⟨4 unchanged words⟩ 3166-1 alpha-2 country code (e.g. US, FR), used. toRequired interpretunless athe number starts with no+: leadingover +.MCP the end user's country cannot be inferred.","type":"string"},"number":{ ⟨20 unchanged words⟩ 

FullFollows a URL's full redirect chain trace(up to 15 hops) and returns every hop with its status code, plus whether the chain crossed domains. Use it to see where a short or tracking link really leads; check the final URL with url_reputation.

GitHub repository health signals from the GitHub API: stars, forks, open issues, license, archived status and days since last push. Input: owner/name.

AuditRead-only audit of a public CometBFT (Cosmos SDK) RPC endpoint: (node status, health, peers, unsafe-methodand exposurewhether unsafe admin methods (dial_seeds, dial_peers, unsafe_flush_mempool) are publicly exposed. Never calls an unsafe method; exposure is inferred from the node's route listing.

AuditAudits a URL's HTTP security headers (CSP, HSTS, X-Frame-Options, Permissions-Policy, cross-origin policies and others): per-header findings with advice, a score and a letter grade. Also included in security_scan.

Combined website check in one call: security postureheaders, reportURL reputation and passive subdomain discovery, run in parallel, with an overall score and verdict. Use the individual tools when you need a single signal.

Passive subdomain discovery from Certificate Transparency logs (crt.sh): finds hostnames that appeared in public TLS certificates, not every DNS record. crt.sh is occasionally slow or unavailable.

Combined supply-chainOne-call risk check for a package: combines vulnerability_check (maintainer-changeOSV.dev), +typosquat_check, vulnerabilitymaintainer_change_check +(npm typosquatonly) +and repo-healthrepo_health_check (when the GitHub repo can be resolved) into one overall verdict. Use before adding a dependency; use the individual tools to investigate one signal.

TextNear-duplicate similaritydetection viawith a 64-bit SimHash (over word shingles: send 1 text to get its hash, or 2 texts) to compare them. Detects paraphrased or lightly edited copies; unrelated texts score around 50%, not 0%.

ConvertReturns timestampsthe current time, or converts between a Unix timestamp (seconds) and an ISO date. Provide unix or date, or neither for the current time.

DecodeDecodes a raw signed Cosmos SDK transaction (protobufbase64 TxRaw bytes, as found in a CometBFT block's data.txs) into JSON: messages, fee, gas, signers and signatures. Bank, staking, gov and authz messages are fully decoded; other types are returned as type URL plus raw hex.

PackageChecks whether an npm or PyPI package name is a near-miss of a well-known package (typosquatting), checkwith an edit-distance threshold scaled to name length; names of 3 characters or fewer are not fuzzy-matched. Uses a curated list of popular names, so a clean result does not prove a package is safe.

CleanRemoves a60+ singleknown tracking parameters (utm_*, fbclid, gclid and similar) from a URL and returns the clean URL. Does not follow redirects; for that, use redirect_trace.

CheckChecks a URL against malware/phishingURLhaus (abuse.ch), a public database of known malware distribution URLs. A clean result only means the URL is not listed, not that it is safe.

ParseParses a User-Agent string into browser and version, operating system and version, device type, and whether it looks like a bot.

{"properties":{"ua":{"description":"User-Agent string to parse. IfRequired omitted,over MCP: the request'sserver owncannot User-Agentsee headerthe isend parseduser's instead.own User-Agent.","type":"string"}},"required":["ua"],"type":"object"}

GenerateGenerates UUIDs1 to 100 random UUID v4 values.

ValidateChecks an EU VAT number viain real time against the officialEuropean Commission's VIES service and, when valid, returns the registered company name and address. VIES is occasionally unavailable for some member states.

PackageChecks vulnerabilitya checkpackage (OSV.devoptionally a specific version) against OSV.dev for known vulnerabilities: npm, PyPI, Go, crates.io, Maven, RubyGems, Packagist and NuGet. Use cve_lookup when you already have a CVE/GHSA ID, or supply_chain_check for a combined verdict.

Domain registration lookup (WHOISdata via RDAP (the modern WHOIS): registrar, creation and expiration dates, domain age in days, nameservers. For DNS records, use dns_lookup.