Benchline MCP Server

by fabwaseem Your server? Claim it

not responding

Benchline is listed as active in the registry but did not answer our last check. It exposes 82 tools. Last commit 23 Oct 2026.

Open-source developer, PDF, image, SEO and security tools over a stateless HTTP MCP server. No key.

Uptime history 23 days of history · worst day 0%

23 days agonow

0.0%

Uptime 24h

0 of 91 checks

Tools

read from the server

118 ms

Response time

average over 24h

Stars

last commit 23 Oct 2026

What the code does

We read the source, 1 d ago · tools taken from the live server · rules 995398eba69f

Capabilities

What this server is able to do. For an MCP server this is often the job itself — a terminal server runs commands because that is what it is for. Listed so you know what you are plugging in, not as an accusation.

A line of code looks encrypted src/tools/jwt-decoder/lib/jwt.ts:21

  "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJhZGEiLCJuYW1lIjoiQWRhIExvdmVsYWNlIiwicm9sZSI6Imluc3RydW1lbnQiLCJpc3MiOiJiZW5jaGxpbmUiLCJhdWQiOiJiZW5jaCIsImlhdCI6MTcwMDAwMDAwMCwiZXhwIjoxOTAwMDAwMDAwLCJqdGkiOiJleGFtcGxlIn0.Ups8wj1x8FyQauHBYCamwxB_nw4-RwJsrEny2mbp75Y";

Runs an external command src/tools/base64-codec/lib/codec.ts:103

  const match = /^data:([^,]*),([\s\S]*)$/.exec(input.trim());

Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.

This code can reach further than it looks

We found places where it runs commands, builds paths or queries from values it is given. None of that is a flaw by itself — it becomes one when the code changes, and code changes quietly between releases. We re-read it on every one.

Connect this server

Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 12 min ago.

Claude Code Claude Desktop Codex Cursor VS Code

run in your terminal

claude mcp add benchline --transport http https://benchline.fabwaseem.com/mcp

Settings → Connectors → Add custom connector, then paste this address

https://benchline.fabwaseem.com/mcp

~/.codex/config.toml

[mcp_servers.benchline]
url = "https://benchline.fabwaseem.com/mcp"

.cursor/mcp.json

{
  "mcpServers": {
    "benchline": {
      "url": "https://benchline.fabwaseem.com/mcp"
    }
  }
}

.vscode/mcp.json

{
  "servers": {
    "benchline": {
      "type": "http",
      "url": "https://benchline.fabwaseem.com/mcp"
    }
  }
}

Available tools 82

Read directly from the server with tools/list, grouped by what they act on. If a tool disappears, we record the date.

convert

convert_case

Convert text to camelCase, snake_case, kebab-case, CONSTANT_CASE, and AP or Chicago title case. Returns every style unless one is requested.

convert_color

Convert HEX, RGB, HSL, OKLCH, or CMYK into every format, name the nearest Tailwind token, and report the WCAG 2 contrast ratio against a background.

convert_csv_json

Convert CSV to JSON or JSON to CSV. Supports comma, tab, semicolon, and pipe delimiters, an optional header, type inference, and dotted flattening. Inferred numbers that do not fit in a JavaScript number keep their digits.

convert_curl

Parse a curl command and generate equivalent JavaScript fetch, Python requests, Go, PHP, or Rust code.

convert_currency

Convert money between ISO 4217 currencies using live exchange rates from the Frankfurter API, fetched through the SSRF-safe outbound guard. Supports historical dates.

convert_data_format

Convert between JSON, YAML, TOML, and XML. Auto-detects the source. Numbers that do not fit in a JavaScript number keep their digits. Errors include a line and column. TOML refuses null and a non-table root.

convert_image

Convert an image to JPEG, PNG, WebP, or AVIF. Send base64 or a public URL. Private addresses are refused and the decoded file is capped at 10 MB. Returns the image as base64. HEIC is not decoded here.

convert_json_to_types

Infer types from a JSON document and generate TypeScript interfaces, Zod schemas, Python Pydantic models or dataclasses, and Go structs.

convert_markdown_html

Convert GitHub-flavored Markdown to HTML, or HTML to Markdown. to is html or markdown. sanitize strips scripts from the text output. The conversion does not fetch a URL.

convert_units

Convert length, mass, volume, temperature, area, speed, time, and data size. Decimal bytes (kB, MB) and binary bytes (KiB, MiB) are separate categories.

convert_unix_timestamp

Convert epoch seconds, milliseconds, microseconds, or nanoseconds to ISO-8601 and RFC 2822 in an IANA time zone, or convert a calendar time back to epoch.

generate

generate_fake_data

Generate seeded lorem ipsum, or fake JSON, CSV, or SQL rows from a list of field types.

generate_favicon

Build a favicon pack from an image or up to three letters. The ZIP contains favicon.ico, PNG sizes, a web manifest, an HTML snippet, and a Next.js metadata snippet. Letters are drawn with a built-in bitmap font so the result does not depend on a system font. Send base64 or a public URL. Private addresses are refused and the decoded file is capped at 10 MB.

generate_invoice

Build an invoice or quote PDF from company and client details, line items with quantities and rates, a tax rate, and an optional percent or flat discount. All money is computed in integer cents, so there are no float rounding errors. Returns the PDF as base64 plus the total.

generate_keypair

Generate an RSA, EC, or Ed25519 key pair as PEM and JWK, or convert between PEM and JWK. The private key is returned in the result and is not stored. The page in the browser generates keys locally and does not send them.

generate_llms_txt

Render llms.txt and llms-full.txt from a site name, a summary, and a list of pages. It does not crawl. Grouping follows the page URLs.

generate_meme

Render a classic top/bottom-caption meme as a PNG. Give it an image (base64, data URI, or public URL) or pick a gradient style, and it returns captioned meme artwork.

generate_password

Generate cryptographic passwords or EFF-wordlist passphrases and report the entropy in bits. Randomness comes from the platform CSPRNG.

generate_qr_code

Build a static QR code for text, a URL, Wi-Fi, or a vCard. Returns the payload, an SVG string, and a PNG as base64.

generate_resume

Build a resume PDF from profile, experience, education, and skills. A name plus at least one experience, education, or skills entry is required. Choose the clean, modern, or compact template. Returns the A4 PDF as base64.

generate_totp

Compute RFC 4226/6238 one-time passcodes from a base32 secret. Supports 6/8 digits, SHA1/SHA256/SHA512, and custom periods.

generate_uuid

Generate UUID version 4 or version 7 from cryptographic randomness, up to 10,000 at once, or inspect the version, variant, and v7 timestamp.

build

build_csp

Build a Content-Security-Policy from directives, or lint an existing policy. Returns the header line, a Next.js headers() snippet, and warnings for unsafe sources.

build_json_ld

Build schema.org JSON-LD for one type, plus a script tag and a list of missing fields. Use this when you already know the fields. It does not fetch a page.

build_nextjs_dockerfile

Generate a production Dockerfile, dockerignore, compose file, and next.config snippet for a Next.js app. Defaults match a pnpm standalone image.

build_open_graph

Render one of the Open Graph templates as a PNG and a Next.js opengraph-image.tsx file. Pass a template id from list_og_templates, the fields that template uses, colors, a size, and optional base64 images.

calculate

calculate_cidr

Return the network, broadcast, host range, and host count for an IPv4 or IPv6 CIDR. Optionally test whether an address is inside it, split it, or merge it with other CIDRs.

calculate_emi

Calculate a reducing-balance loan installment and its amortization schedule. Money is rounded half up to cents. An optional extra monthly payment reduces principal.

calculate_percentage

Calculate percent of a value, what percent one number is of another, percent change, the reverse, an increase or decrease, and margin versus markup.

calculate_programmer

Evaluate integer expressions with C-like precedence (hex/octal/binary literals, bitwise ops, shifts) and report base conversions plus signed/unsigned interpretations.

validate

validate_json_schema

Infer a JSON Schema from a sample, or validate JSON against a schema. Returns error paths plus TypeScript and Zod generated from the sample.

validate_sitemap

Validate sitemap XML or a public sitemap URL, including a sitemap index and a sample of HTTP statuses. Or generate a urlset from a list of URLs. Private addresses are refused and responses are size-capped.

validate_websocket_url

Validate and parse a ws:// or wss:// URL into its components, and optionally decode a WebSocket close code.

compress

compress_image

Re-encode an image at a quality from 1 to 100, optionally capping the longest edge. Send base64 or a public URL. Private addresses are refused and the decoded file is capped at 10 MB. Returns the image as base64.

compress_pdf

Recompress embedded images in a PDF. Presets are light, medium, and strong. Send base64 or a public URL. Private addresses are refused. An optional target size tries harder. Returns the PDF and the sizes before and after.

count

count_text

Count words, code points, graphemes, sentences, and paragraphs, and compare the length with SEO and social limits.

count_tokens

Count tokens with the o200k or cl100k encoder and price the count against the published model table. Claude and Gemini rows are estimates, not those vendors' tokenizers.

explain

explain_chmod

Convert an octal or symbolic file mode into octal, symbolic notation, and a chmod command, including setuid, setgid, and the sticky bit.

explain_cron

Turn a cron expression into English, the next UTC run times, and snippets for crontab, GitHub Actions, Vercel, Kubernetes, and node-cron.

format

format_json

Pretty-print or minify JSON. A number that does not fit in a JavaScript number keeps the digits you sent. Returns the formatted text when it is valid, or the line and column of each syntax error.

format_sql

Format SQL for PostgreSQL, MySQL, BigQuery, Snowflake, and other dialects. Choose keyword case and an indent of 2 or 4 spaces.

hash

hash_data

Compute MD5, SHA-1, SHA-256, and SHA-512 for UTF-8 text or base64 bytes. Pass hmacKey for HMAC and expected to see which digest matches.

hash_password

Hash a password with bcrypt or argon2id, or verify a hash. Returns an htpasswd line when a username is set. The password is not stored or logged. The page in the browser never sends the password; this call only hashes the arguments you send.

resize

resize_image

Resize an image by pixels or percent. Fit is contain, cover, or stretch. Send base64 or a public URL. Private addresses are refused and the decoded file is capped at 10 MB. Returns the image as base64.

resize_social_image

Crop and resize an image to an exact social media preset: instagram-post (1080x1080), instagram-portrait (1080x1350), instagram-story (1080x1920), youtube-thumbnail (1280x720), x-post (1200x675), x-header (1500x500), linkedin-post (1200x627), or facebook-post (1200x630). The cover crop keeps the center subject. Send base64 or a public URL. Private addresses are refused and the decoded file is capped at 10 MB. Returns the image as base64 PNG.

aes

aes_crypt

AES-256-GCM encryption with PBKDF2-SHA256 key derivation. Encrypt returns a base64 bundle (salt, IV, ciphertext); decrypt reverses it.

analyze

analyze_har

Parse a HAR (HTTP Archive) capture and summarize it: request counts, status distribution, slowest and largest requests, top hosts, and per-request timings.

background

remove_background

Remove a solid or near-solid background by flood-filling from the border. color is an optional #rrggbb. The portrait model runs in the browser, not in this handler: MODNet is Apache-2.0, RMBG-1.4 is non-commercial, and the ONNX runtime is too large for the serverless function. Send base64 or a public URL. Private addresses are refused and the decoded file is capped at 10 MB. Returns a PNG as base64.

barcode

read_barcode

Read QR codes and barcodes from an image. Send base64 or a public URL. Private addresses are refused and the decoded file is capped at 10 MB. Returns each code's text and format. An image with no code returns an empty list.

base64

base64_codec

Encode UTF-8 text as Base64, or decode Base64 and data URIs. URL-safe output uses - and _ and omits padding. Decode reports the sniffed media type and whether the bytes are UTF-8 text.

crop

crop_image

Crop an image to a pixel box or a 0 to 1 ratio box. circle cuts a round mask. format is png, jpeg, or webp. Send base64 or a public URL. Private addresses are refused and the decoded file is capped at 10 MB. Returns the image as base64.

date

date_difference

Count calendar days, elapsed time, and business days between two dates. Business days skip weekends and any YYYY-MM-DD holidays you list.

decode

decode_jwt

Decode a signed JSON Web Token into its header, payload, and registered claims. Dates are absolute ISO timestamps. The signature is not checked.

diff

diff_text

Compare two texts by line, word, or character, or compare JSON so object key order does not matter. Returns an inline diff, side-by-side rows for line and JSON modes, and a unified patch.

execute

execute_graphql

Send a GraphQL query with optional variables and headers to a public http or https endpoint on port 80 or 443 and return the response data or errors. Local, private, and internal addresses are refused.

exif

read_exif

Read EXIF tags, including GPS, or strip them. action is read or strip. scope is all or gps. gps-only removal keeps the other JPEG tags. Other formats are re-encoded, which drops every tag. Send base64 or a public URL. Private addresses are refused and the decoded file is capped at 10 MB.

extract

extract_pdf_text

Read the selectable text layer of a PDF. Returns per-page text, markdown-style headings, and an o200k token count. Does not OCR scans. Send base64 or a public URL. Private addresses are refused.

fill

fill_pdf_form

Fill an interactive PDF form's text fields, checkboxes, dropdowns, and radios by field name, with an option to flatten the result. Pass inspectOnly to list the fields first.

http

check_http_headers

Fetch a public URL, follow redirects, and grade HSTS, Content-Security-Policy, framing, nosniff, and Referrer-Policy. Private addresses are refused. The body is not stored.

image

read_image_text

Extract text from an image with Tesseract. language defaults to eng. Other codes in the list are fetched when first used. Send base64 or a public URL. Private addresses are refused and the decoded file is capped at 10 MB. Returns the text and a confidence from 0 to 100. An image with no text returns an empty string.

images

images_to_pdf

Turn images, sent as base64 or public URLs in order, into one PDF. JPEG and PNG are embedded directly. Other formats are converted to PNG first. Page size is A4, Letter, or fit. Private addresses are refused. Returns the PDF as base64.

inspect

inspect_meta_tags

Fetch one public HTML page and report title, description, canonical, Open Graph, Twitter, and JSON-LD. Use this to see what a live URL advertises.

jsonpath

query_jsonpath

Evaluate a JSONPath Plus query against a JSON document and return the matches with their paths. A number that does not fit in a JavaScript number is returned as its original digits, with a precision warning.

lookup

lookup_dns

Query A, AAAA, MX, TXT, CNAME, and CAA for a public hostname over DNS-over-HTTPS, and parse SPF and DMARC. Private names are refused. The resolver is Cloudflare or Google.

make

make_collage

Arrange up to 9 photos into a collage layout (duo, trio, focus, quad, six, nine) with a gap and background color, and get back a square PNG.

merge

merge_pdf

Combine PDF files. Each file is base64 or a public URL, and can keep a page range such as 1-3,5. Private addresses are refused. Returns one PDF as base64.

minify

minify_code

Minify source code with Terser (JS), csso (CSS), or a structural HTML pass and report before/after byte counts.

optimize

optimize_svg

Minify an SVG with SVGO. Send markup or a file as base64 or a public URL. Private addresses are refused and the file is capped at 10 MB. The viewBox is kept unless removeViewBox is true. Returns the optimized markup and the byte counts.

organize

organize_pdf

Reorder, rotate, or drop PDF pages. Each entry names a 1-based source page and a rotation of 0, 90, 180, or 270. The same page may be listed twice. Send base64 or a public URL. Private addresses are refused.

page

fetch_page_markdown

Fetch a public HTML page and return the article as Markdown, plus a title, excerpt, and o200k token count. Private and local addresses are refused. The response is capped at 800 KB.

protect

protect_pdf

Protect a PDF with AES-256, or unlock one when the password is known. action is protect or unlock. password is the user password. ownerPassword is optional. permissions cover printing, copying, modifying, annotating, filling forms, accessibility, and assembly. Send base64 or a public URL. Private addresses are refused.

render

render_pdf_pages

Render PDF pages to PNG or JPEG. DPI is 72 to 216. A page range such as 1-3,5 is optional. At most 24 pages and 25 MB of images. Send base64 or a public URL. Private addresses are refused. Returns image base64 and a ZIP when there is more than one page.

robots

check_robots_txt

Fetch a public robots.txt and report whether the wildcard group blocks the site and whether Sitemap lines are absolute. Use this when you have a URL, not a pasted file.

score

score_ai_seo

Fetch a public page plus its robots.txt, sitemap, and llms.txt, then score how ready it is for AI search crawlers. Use this when you have a live URL.

sign

sign_pdf

Stamp a PNG signature image onto one or more PDF pages at given positions (fractions of the page, x and y measured from the top-left, width as a fraction of page width). The signature keeps its aspect ratio. Returns the signed PDF as base64.

split

split_pdf

Extract a page range into one PDF, or split into single pages or chunks of N. Send base64 or a public URL. Private addresses are refused. Returns PDF base64 and a ZIP when there are several files.

ssl

check_ssl

Connect to a public host on port 443 and report certificate expiry, subject alternative names, protocol, and chain. Private addresses are refused. The handshake times out after 8 seconds.

templates

list_og_templates

List Open Graph card templates with ids, names, categories, defaults, color presets, and field schemas.

test

test_regex

Run a JavaScript regular expression against a sample and return every match, capture group, a short explanation, and an optional replacement.

trim

trim_audio

Trim a WAV audio file to a time range with optional fade in and out, returning a 16-bit PCM WAV as base64. Only WAV is accepted; the web UI handles MP3/OGG/M4A.

url

url_codec

Percent-encode or decode text, or parse a URL into its host, path, hash, and query parameters.

zip

zip_files

Create a ZIP archive from files or list and extract the contents of a ZIP archive. Everything is handled in memory; no files are stored.

Endpoints

URL	Transport	State	Latency	Checked
https://benchline.fabwaseem.com/mcp	streamable-http	answering	118 ms	12 min ago

Alternatives to Benchline

same job, measured the same way

Mythos Agent

by mythos-agent

Open-source AI security agent: SAST, DAST, and policy-as-code over MCP.

534 installs/wk local only

Osv MCP

by mrfentmen

MCP server for OSV open source vulnerability data and package security checks.

107 installs/wk local only

Nandi Proxmox MCP

by papischolz

Open-source MCP server for secure Proxmox node, VM, and LXC operations.

127 installs/wk local only

Runtime

by formatho

Self-hosted MCP server: 26 deterministic dev, security, and EVM tools.

26 tools answering

MCP Server for OSCAL

by dfkunstler

AI agent tools for Open Security Controls Assessment Language (OSCAL)

930 installs/wk local only

Sourcery

by abyssbugg

Sourcery security findings: MCP server, CLI, and fix-prompt builder over the Sourcery API.

76 installs/wk local only

MCP Server for OSCAL

by awslabs

AI agent tools for Open Security Controls Assessment Language (OSCAL)

local only

Sourcery

by abyssbugg-labs

Sourcery security findings: MCP server, CLI, and fix-prompt builder over the Sourcery API.

local only

Benchline — questions

Answers built from our own checks of this server.

What can Benchline do?

It exposes 82 tools, read directly from the server on our last check. Among them: aes_crypt, analyze_har, base64_codec, build_csp, build_json_ld, build_nextjs_dockerfile and 76 more. The full list with descriptions is on this page — we take it from the server itself via tools/list, not from a README. How MCP servers expose tools in the first place →

What is Benchline mostly used for?

Its tools cluster around generate, convert and build. That is what this server is built to work with — the grouping comes from the actual tool names, not from a category we assigned.

Is Benchline working right now?

We send a real MCP handshake every 15 minutes. Over the last 24 hours 0 of 91 checks got a reply (0.0%), average response time 118 ms. The bar chart above shows every period we have measured.

The registry lists Benchline as active — why does it not respond?

The official MCP registry stores what the author submitted; it does not verify that the server still runs. We check the endpoint ourselves, and this one does not answer. Catalogues that copy the registry without checking will show it as working.

How do I connect Benchline?

Copy the ready config from this page. We generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each in the form that client actually reads. It is a remote server, so there is nothing to install — the client connects to the address.

Does Benchline need an API key?

No. Benchline completed a full MCP handshake with us as an anonymous client and listed its tools without asking for anything. All 82 of them are readable on this page. This is what we observed, not what the docs claim.

Is Benchline open source?

The code is open source: it is published under the MIT licence, written in TypeScript, 0 stars on GitHub and 1 open issue. The licence covers the code in the repository, not the hosted service at benchline.fabwaseem.com, which runs on its operator's own terms.