mcp-toolbelt MCP Server

by papacasper Your server? Claim it

answering

mcp-toolbelt is answering right now. Last checked 10 min ago. It exposes 29 tools.

29 DNS, SEO, SSL, security, WHOIS & mail tools for AI agents. Pay per call (x402) or card API key.

Uptime history 91 days of history · worst day 0%

91 days agonow

100.0%

Uptime 24h

91 of 91 checks

Tools

read from the server

569 ms

Response time

average over 24h

open, no key

Access

streamable-http

What changed 26

Every tool that appeared, vanished or quietly changed what it asks for. Recorded since 21 October 2026. No other catalogue keeps this.

31 Oct a tool changed version

21 Oct 12 tool descriptions were rewritten broken_link_check, check_open_ports, check_robots_sitemap and 9 more

21 Oct 6 tools appeared ai_readiness_audit, exposed_files_check, mcp_server_probe and 3 more

21 Oct 6 tools disappeared ai_crawler_policy_check, cors_policy_check, favicon_manifest_check and 3 more

21 Oct a tool changed the parameters it asks for broken_link_check

mcp-toolbelt missed one check this week

Everything else answered, so this is steady rather than shaky. We check every 15 minutes, which is how a one-off gets told apart from the start of a pattern, and how you hear about the next one within the hour instead of from your users.

Connect this server

Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 10 min ago.

Claude Code Claude Desktop Codex Cursor VS Code

run in your terminal

claude mcp add mcp-toolbelt --transport http https://papacasper.com/mcp

Settings → Connectors → Add custom connector, then paste this address

https://papacasper.com/mcp

~/.codex/config.toml

[mcp_servers.mcp-toolbelt]
url = "https://papacasper.com/mcp"

.cursor/mcp.json

{
  "mcpServers": {
    "mcp-toolbelt": {
      "url": "https://papacasper.com/mcp"
    }
  }
}

.vscode/mcp.json

{
  "servers": {
    "mcp-toolbelt": {
      "type": "http",
      "url": "https://papacasper.com/mcp"
    }
  }
}

Available tools 29

Read directly from the server with tools/list, grouped by what they act on. If a tool disappears, we record the date.

domain

domain_availability_check

Check whether a domain is registered, plus scan common typo-squat variants (adjacent-key substitution, letter omission/doubling, transposition) across popular TLDs (.com, .net, .org, .io, .co, .ai, .app, .dev) for brand-protection or domain-flipping research. WHOIS-based; capped at 40 variants checked per call for latency.

domain_health_check

Check a domain's registration expiry (via WHOIS) and DNS health: nameservers, A/AAAA, MX, SPF, and DMARC records. Flags common misconfigurations. WHOIS + DNS only — for the WHOIS record alone use whois_lookup; for deliverability detail (DKIM, DNSBL, PTR) use email_deliverability_check; for all of it plus SEO in one report use domain_report.

domain_report

Bundle: runs seo_audit, domain_health_check (WHOIS + DNS: nameservers, A/AAAA, MX, SPF, DMARC), and email_deliverability_check (DKIM, SPF lookup-count, DMARC strength, DNSBL) against a domain in one call, one charge. Cheaper than calling the three tools separately. Each sub-check reports independently, so a failure in one doesn't void the others.

email_address_validate

Validate a single email address: RFC syntax check, MX record lookup on the domain, disposable/temporary-email-provider detection, and role-account detection (info@, admin@, etc.). Per-address check — different from email_deliverability_check, which audits a whole domain's sending reputation (SPF/DKIM/DMARC/PTR/DNSBL).

email_deliverability_check

Deep-dive email deliverability check for a domain: MX records + reverse-DNS (PTR) on each MX host, common DKIM selector probing, SPF lookup-count (RFC 7208 caps at 10), DMARC policy strength, and DNSBL blacklist lookups (Spamhaus Zen, SpamCop, Barracuda) on MX IPs. Note: public-resolver DNSBL queries are frequently rate-limited or blocked by Spamhaus, so a `listed: null` result means "unknown", not "clean" — treat null results as inconclusive, not as a clean bill of health.

ssl

ssl_cert_check

Connect to a host over TLS and report its certificate's expiry date, days remaining, issuer, and subject. Fast facts only — for a full graded TLS assessment (protocols, ciphers, vulnerabilities) use ssl_labs_grade instead.

ssl_labs_grade

Full SSL Labs-style TLS assessment: overall letter grade, protocol support (TLS 1.0-1.3), cipher strength, certificate chain issues, and known vulnerabilities (Heartbleed, POODLE, etc.) for each endpoint. Use this for a deep grade; use ssl_cert_check instead for a fast expiry/issuer check. Slower (can take up to ~90s on a cold cache; SSL Labs caches results for 24h server-side).

broken

broken_link_check

Find broken links two ways. Default (crawl mode): crawl a site starting from a URL (same-origin pages only, bounded by maxPages) and check every linked URL for broken status codes, returning each broken link with the page(s) it was found on. Sitemap mode (viaSitemap: true): parse the site's sitemap.xml (following one level of sitemap-index nesting) and check the status of every URL listed in it instead. Note: some external sites (e.g. social platforms) block automated HEAD/GET requests and may show up as false positives.

dns

dns_propagation_check

Query a DNS record for a domain against several major public resolvers (Google, Cloudflare, Quad9, OpenDNS) in parallel and compare the answers. Flags mismatches, which usually mean propagation is still in progress after a DNS change.

exposed

exposed_files_check

Probe a site for publicly exposed sensitive files attackers scan for: /.env and variants, /.git/config and /.git/HEAD, /.svn/entries, docker-compose files, /.aws/credentials, /.ssh/id_rsa, database dumps (backup.sql, db.sql, dump.sql), backup archives, phpinfo pages, .DS_Store, and similar. Reports ONLY reachability metadata (path, status, content type, size) — file contents are never returned or stored. A random-nonexistent-path baseline filters out SPA/catch-all false positives. For auditing your own sites' exposure.

github

github_repo_health_check

Check a GitHub repository's health signals: stars, forks, open issues, license, archived/disabled status, and days since last push. Flags likely-abandoned or unlicensed repos. Useful before depending on a repo.

mcp

mcp_server_probe

Probe a remote MCP server end-to-end: performs the initialize handshake, captures server info and protocol version, lists its tools, and grades tool-quality the way directories like Glama do — description coverage and depth, input-schema completeness, and naming consistency — with a 0-100 score, letter grade, and per-tool detail. Use it to vet an MCP server before connecting an agent (or paying per call) to it.

open

check_open_ports

TCP-connect scan a host for open ports, plus network intel on the host's resolved IPs (ASN, network owner, BGP prefix, country — via Team Cymru). Defaults to a list of ~20 common service ports (SSH, HTTP/S, mail, DBs, etc.) if none are given. For checking your own infrastructure's exposure — capped at 100 ports per call.

package

package_vulnerability_check

Look up a package (optionally pinned to a version) against OSV.dev's aggregated vulnerability database (GitHub Advisories, PyPA, RustSec, Go vuln DB, etc.) for known CVEs/advisories. Supports npm, PyPI, crates.io, RubyGems, Go, Maven, NuGet, and Packagist ecosystems. Useful before adding a dependency.

page

page_performance_check

Fetch a URL and measure time-to-first-byte, total fetch time, and response size from this server. Flags missing compression, missing Cache-Control, oversized payloads, and slow TTFB. Lightweight raw-timing check — for Google Lighthouse scores, Core Web Vitals, and real-user field data use pagespeed_insights instead.

pagespeed

pagespeed_insights

Run Google's real PageSpeed Insights (Lighthouse + Chrome UX Report) against a URL: performance score, Core Web Vitals (LCP, CLS, INP/TBT), and real-user field data where available. The authoritative, Google-measured score — for a quick raw TTFB/size timing check from this server use page_performance_check instead. Works without an API key at low volume; set GOOGLE_PAGESPEED_API_KEY server-side for higher throughput.

readiness

ai_readiness_audit

Score how ready a website is for AI agents and LLM-driven discovery, 0-100 with a letter grade: robots.txt presence, explicit AI-crawler policy (GPTBot, ClaudeBot, CCBot, PerplexityBot, and 8 more), llms.txt presence and structure, structured data (JSON-LD) and Open Graph basics, agent/payment discovery files (/.well-known/x402, /openapi.json), sitemap presence, and title/meta basics. The bundle to run before/after making a site agent-friendly — for raw robots/sitemap contents only, use check_robots_sitemap; for classic search SEO only, use seo_audit.

redirect

redirect_chain_check

Follow a URL through every HTTP redirect hop and report the full chain, final destination, and issues like redirect loops, too many hops, or HTTPS-to-HTTP downgrades.

robots

check_robots_sitemap

Check a site's robots.txt and sitemap.xml in one call: raw contents (truncated), sitemap presence, an AI-crawler policy analysis (explicit rules for GPTBot, ClaudeBot, CCBot, PerplexityBot, Google-Extended, Bytespider, Amazonbot and other AI crawlers, vs wildcard/default), and llms.txt presence. For a scored, whole-site AI-readiness report use ai_readiness_audit instead.

safe

safe_browsing_check

Check a URL against Google Safe Browsing's malware/phishing/unwanted-software/PUA blocklists. Requires GOOGLE_SAFE_BROWSING_API_KEY to be configured server-side (free Google Cloud API key).

security

security_headers_audit

Fetch a URL and audit its response headers in one pass: security headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy) with a score, PLUS its CORS policy (the probe sends a foreign Origin header and flags wildcard-origin + credentials combinations and arbitrary-origin reflection). Header-level checks on a single response — for server/TLS-level checks use ssl_cert_check or ssl_labs_grade instead.

seo

seo_audit

Fetch a URL and run a full on-page SEO audit: title/meta description length, canonical tag, Open Graph + Twitter Card tags, html lang attribute, viewport meta, heading structure, image alt-text coverage, internal/external link counts and generic-anchor-text detection, robots meta (noindex/nofollow), structured data (JSON-LD) presence, robots.txt/sitemap.xml presence, and site chrome (favicon, apple-touch-icon, web app manifest, theme-color). Whole-page audit — for raw extracted data only use structured_data_extract, for the platform/framework use tech_stack_fingerprint.

smtp

smtp_server_check

Live-probe a mail server over SMTP: connects to port 25 (or a given port), reads the banner, issues EHLO and lists advertised capabilities (STARTTLS, AUTH mechanisms, SIZE, 8BITMIME, PIPELINING), then upgrades via STARTTLS when offered and reports the TLS protocol and certificate (issuer, expiry). The server-side complement to email_deliverability_check (which reads DNS records only and never connects). No mail is sent and no relay attempt is made.

structured

structured_data_extract

Fetch a URL and extract structured data deterministically: JSON-LD blocks (each one also VALIDATED — @context/@type presence plus required fields for common schema.org types like Article, Product, Organization, FAQPage), OpenGraph/meta tags, and optional caller-supplied CSS-selector fields (e.g. { price: '.product-price', title: 'h1' }). No LLM involved — pure HTML parsing via CSS selectors, so results are exact matches only, not summarized or inferred. For a whole-page SEO audit (headings, links, images, meta lengths) use seo_audit instead.

subdomain

subdomain_discovery

Enumerate a domain's subdomains from public Certificate Transparency logs (crt.sh, with a Cert Spotter fallback): every hostname that has ever appeared on a certificate for the domain. Passive reconnaissance - no packets are sent to the target. Useful for attack-surface reviews, migration inventories, and finding forgotten test/staging hosts.

tech

tech_stack_fingerprint

Fetch a URL and fingerprint its likely tech stack from response headers (server, x-powered-by, x-generator) and HTML markers (generator meta tag, framework/CMS-specific script or class patterns). Answers 'what is this site built with?' — for on-page SEO/content signals use seo_audit, for raw structured data use structured_data_extract. Best-effort — not exhaustive, no additional paths are probed.

url

url_to_markdown

Fetch a URL and return its main text content as clean, readable plain text/markdown-ish output. Strips scripts, styles, and HTML tags.

websocket

websocket_endpoint_check

Test a WebSocket endpoint (ws:// or wss://): attempts the handshake, reports success/failure, time-to-open in ms, and close code/reason. Useful for verifying a WebSocket server is reachable and completes its upgrade handshake before you wire real traffic to it.

whois

whois_lookup

Look up a domain's WHOIS registration record: registrar, creation and expiry dates, days remaining, name servers, and domain statuses, direct from the TLD registry. Registration data only — for DNS/mail health as well, use domain_health_check; for a combined report, use domain_report.

Tools removed

Tools this server used to expose. Anything built against them stopped working on the day they went.

ai_crawler_policy_check

removed 21 Oct 2026

cors_policy_check

removed 21 Oct 2026

favicon_manifest_check

removed 21 Oct 2026

ip_geolocation_asn_lookup

removed 21 Oct 2026

json_ld_schema_validator

removed 21 Oct 2026

sitemap_url_validator

removed 21 Oct 2026

Endpoints

URL	Transport	State	Latency	Checked
https://papacasper.com/mcp	streamable-http	answering	561 ms	10 min ago

Alternatives to mcp-toolbelt

same job, measured the same way

Netintel MCP

by kjgueye

MCP server for NetIntel — DNS, SSL, WHOIS, email security, OSINT via x402 micropayments

277 installs/wk local only

Alphapipeline

by parkyucheol-del

Pay-per-call x402 API for AI trading agents: pre-trade security checks, Polymarket & HIP-4 odds.

30 tools answering

Agent Toolkit

by white-hat-lab

Pay-per-call developer utilities and npm supply-chain security tools for coding agents, over x402.

81 installs/wk local only

Apimesh

by mbeato

74 paid web-analysis APIs (SEO, security, TLS, DNS, email) as MCP tools. USDC via x402.

67 installs/wk local only

Lilambd Data for Agents

by veniwol-li-lambd

21 world data tools: airports, units, markets, security, travel meds, pet entry. x402 per call.

52 tools answering

ScrapeMole Domains

by pages-scrapemole

Pay-per-call x402 DNS, WHOIS/RDAP, availability, email security, SSL check, CT subdomains.

6 tools answering

SiteCheck Web Intel

by bck-stack

129 pay-per-call agent tools: security, threat intelligence, web search and SEO data tools. x402

129 tools answering

Toolcall

by toolcall

30 pay-per-call APIs for AI agents: compliance, trade, safety, web, data. USDC on Base via x402.

20 tools answering

mcp-toolbelt — questions

Answers built from our own checks of this server.

What can mcp-toolbelt do?

It exposes 29 tools, read directly from the server on our last check. Among them: ai_readiness_audit, broken_link_check, check_open_ports, check_robots_sitemap, dns_propagation_check, domain_availability_check and 23 more. The full list with descriptions is on this page — we take it from the server itself via tools/list, not from a README. How MCP servers expose tools in the first place →

What is mcp-toolbelt mostly used for?

Its tools cluster around domain, email and ssl. That is what this server is built to work with — the grouping comes from the actual tool names, not from a category we assigned.

Is mcp-toolbelt working right now?

We send a real MCP handshake every 15 minutes. Over the last 24 hours 91 of 91 checks got a reply (100.0%), average response time 569 ms. The bar chart above shows every period we have measured.

Did mcp-toolbelt ever remove tools?

Yes. ai_crawler_policy_check, cors_policy_check, favicon_manifest_check, ip_geolocation_asn_lookup and 2 more are no longer exposed — we recorded the date each one disappeared. A tool vanishing usually means a breaking change for anything that depended on it.

How do I connect mcp-toolbelt?

Copy the ready config from this page. We generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each in the form that client actually reads. It is a remote server, so there is nothing to install — the client connects to the address.

Does mcp-toolbelt need an API key?

No. mcp-toolbelt completed a full MCP handshake with us as an anonymous client and listed its tools without asking for anything. All 29 of them are readable on this page. This is what we observed, not what the docs claim.

How fast is mcp-toolbelt?

It answers our handshake in 569 ms on average, which is faster than 19% of all working MCP servers we measure. That is on the slow side — worth knowing if the tool sits inside an interactive loop. The comparison comes from our own checks across the whole registry, every 15 minutes.