mcp-toolbelt MCP Server

by papacasper Your server? Claim it

answering

mcp-toolbelt is answering right now. Last checked 10 min ago. It exposes 29 tools.

29 pay-per-call DNS, SEO, SSL, security, and dev tools for AI agents. x402, no API key.

Uptime history 49 days of history · worst day 0%

49 days agonow

100.0%

Uptime 24h

91 of 91 checks

Tools

read from the server

438 ms

Response time

average over 24h

open, no key

Access

streamable-http

Nothing serious here today

Today is the operative word: we check mcp-toolbelt every 15 minutes and re-read its code on every release. Watch it and you find out the day that stops being true.

Connect this server

Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 10 min ago.

Claude Code Claude Desktop Codex Cursor VS Code

run in your terminal

claude mcp add mcp-toolbelt --transport http https://papacasper.com/mcp

~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "mcp-toolbelt": {
      "url": "https://papacasper.com/mcp"
    }
  }
}

~/.codex/config.toml

[mcp_servers.mcp-toolbelt]
url = "https://papacasper.com/mcp"

.cursor/mcp.json

{
  "mcpServers": {
    "mcp-toolbelt": {
      "url": "https://papacasper.com/mcp"
    }
  }
}

.vscode/mcp.json

{
  "mcpServers": {
    "mcp-toolbelt": {
      "url": "https://papacasper.com/mcp"
    }
  }
}

Available tools 29

Read directly from the server with tools/list, grouped by what they act on. If a tool disappears, we record the date.

domain

domain_availability_check

Check whether a domain is registered, plus scan common typo-squat variants (adjacent-key substitution, letter omission/doubling, transposition) across popular TLDs (.com, .net, .org, .io, .co, .ai, .app, .dev) for brand-protection or domain-flipping research. WHOIS-based; capped at 40 variants checked per call for latency.

domain_health_check

Check a domain's registration expiry (via WHOIS) and DNS health: nameservers, A/AAAA, MX, SPF, and DMARC records. Flags common misconfigurations.

domain_report

Bundle: runs seo_audit, domain_health_check (WHOIS + DNS: nameservers, A/AAAA, MX, SPF, DMARC), and email_deliverability_check (DKIM, SPF lookup-count, DMARC strength, DNSBL) against a domain in one call, one charge. Cheaper than calling the three tools separately. Each sub-check reports independently, so a failure in one doesn't void the others.

email_address_validate

Validate a single email address: RFC syntax check, MX record lookup on the domain, disposable/temporary-email-provider detection, and role-account detection (info@, admin@, etc.). Per-address check — different from email_deliverability_check, which audits a whole domain's sending reputation (SPF/DKIM/DMARC/PTR/DNSBL).

email_deliverability_check

Deep-dive email deliverability check for a domain: MX records + reverse-DNS (PTR) on each MX host, common DKIM selector probing, SPF lookup-count (RFC 7208 caps at 10), DMARC policy strength, and DNSBL blacklist lookups (Spamhaus Zen, SpamCop, Barracuda) on MX IPs. Note: public-resolver DNSBL queries are frequently rate-limited or blocked by Spamhaus, so a `listed: null` result means "unknown", not "clean" — treat null results as inconclusive, not as a clean bill of health.

ssl

ssl_cert_check

Connect to a host over TLS and report its certificate's expiry date, days remaining, issuer, and subject.

ssl_labs_grade

Full SSL Labs-style TLS assessment: overall letter grade, protocol support (TLS 1.0-1.3), cipher strength, certificate chain issues, and known vulnerabilities (Heartbleed, POODLE, etc.) for each endpoint. Slower than ssl_cert_check (can take up to ~90s on a cold cache; SSL Labs caches results for 24h server-side).

broken

broken_link_check

Crawl a site starting from a URL (same-origin pages only, bounded by maxPages) and check every linked URL for broken status codes. Returns broken links with the page(s) they were found on. Note: some external sites (e.g. social platforms) block automated HEAD/GET requests and may show up as false positives.

cors

cors_policy_check

Send a probe request with a foreign Origin header to a URL and report its CORS response headers. Flags wildcard-origin + credentials combinations and arbitrary-origin reflection, both common CORS misconfigurations.

crawler

ai_crawler_policy_check

Check a site's robots.txt for explicit directives targeting known AI crawlers (GPTBot, ClaudeBot, CCBot, PerplexityBot, Google-Extended, Bytespider, Amazonbot, and others used for LLM training or AI search/answer products), and check for an llms.txt file. Useful for publishers deciding whether their content policy toward AI crawlers matches their intent, or for auditing a competitor's stance.

dns

dns_propagation_check

Query a DNS record for a domain against several major public resolvers (Google, Cloudflare, Quad9, OpenDNS) in parallel and compare the answers. Flags mismatches, which usually mean propagation is still in progress after a DNS change.

favicon

favicon_manifest_check

Check a site for favicon, apple-touch-icon, web app manifest, and theme-color presence — a quick completeness check for browser/OS chrome and PWA metadata.

geolocation

ip_geolocation_asn_lookup

Resolve a hostname to its IPv4 addresses and look up each one's ASN, network prefix, country code, and network owner via Team Cymru's DNS-based WHOIS service (no API key). Country-level only — not city/street geolocation.

github

github_repo_health_check

Check a GitHub repository's health signals: stars, forks, open issues, license, archived/disabled status, and days since last push. Flags likely-abandoned or unlicensed repos. Useful before depending on a repo.

json

json_ld_schema_validator

Fetch a URL, extract every JSON-LD (<script type="application/ld+json">) block, and validate basic structure — @context/@type presence plus required fields for common schema.org types (Article, Product, Organization, WebSite, LocalBusiness, BreadcrumbList, FAQPage). Reports per-block errors rather than failing the whole call on one bad block.

open

check_open_ports

TCP-connect scan a host for open ports. Defaults to a list of ~20 common service ports (SSH, HTTP/S, mail, DBs, etc.) if none are given. For checking your own infrastructure's exposure — capped at 100 ports per call.

package

package_vulnerability_check

Look up a package (optionally pinned to a version) against OSV.dev's aggregated vulnerability database (GitHub Advisories, PyPA, RustSec, Go vuln DB, etc.) for known CVEs/advisories. Supports npm, PyPI, crates.io, RubyGems, Go, Maven, NuGet, and Packagist ecosystems. Useful before adding a dependency.

page

page_performance_check

Fetch a URL and measure time-to-first-byte, total fetch time, and response size. Flags missing compression, missing Cache-Control, oversized payloads, and slow TTFB.

pagespeed

pagespeed_insights

Run Google's real PageSpeed Insights (Lighthouse + Chrome UX Report) against a URL: performance score, Core Web Vitals (LCP, CLS, INP/TBT), and real-user field data where available. Authoritative version of a local timing check — hits Google's own infrastructure. Works without an API key at low volume; set GOOGLE_PAGESPEED_API_KEY server-side for higher throughput.

redirect

redirect_chain_check

Follow a URL through every HTTP redirect hop and report the full chain, final destination, and issues like redirect loops, too many hops, or HTTPS-to-HTTP downgrades.

robots

check_robots_sitemap

Check whether a site has a valid robots.txt and sitemap.xml, and return their raw contents (truncated).

safe

safe_browsing_check

Check a URL against Google Safe Browsing's malware/phishing/unwanted-software/PUA blocklists. Requires GOOGLE_SAFE_BROWSING_API_KEY to be configured server-side (free Google Cloud API key).

security

security_headers_audit

Fetch a URL and audit its response for security-relevant HTTP headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy). Flags missing/misconfigured headers with a score.

seo

seo_audit

Fetch a URL and run an SEO audit: title/meta description length, canonical tag, Open Graph + Twitter Card tags, html lang attribute, viewport meta, heading structure, image alt-text coverage, internal/external link counts and generic-anchor-text detection, robots meta (noindex/nofollow), structured data (JSON-LD) presence, and robots.txt/sitemap.xml presence.

sitemap

sitemap_url_validator

Parse a site's sitemap.xml (following one level of sitemap-index nesting) and check the HTTP status of every listed URL. Concurrency-limited, capped at 200 URLs checked per call. Reports broken/redirecting URLs found in the sitemap.

structured

structured_data_extract

Fetch a URL and extract structured data deterministically: JSON-LD blocks, OpenGraph/meta tags, and optional caller-supplied CSS-selector fields (e.g. { price: '.product-price', title: 'h1' }). No LLM involved — pure HTML parsing via CSS selectors, so results are exact matches only, not summarized or inferred.

tech

tech_stack_fingerprint

Fetch a URL and fingerprint its likely tech stack from response headers (server, x-powered-by, x-generator) and HTML markers (generator meta tag, framework/CMS-specific script or class patterns). Best-effort — not exhaustive, no additional paths are probed.

url

url_to_markdown

Fetch a URL and return its main text content as clean, readable plain text/markdown-ish output. Strips scripts, styles, and HTML tags.

websocket

websocket_endpoint_check

Test a WebSocket endpoint (ws:// or wss://): attempts the handshake, reports success/failure, time-to-open in ms, and close code/reason. Useful for verifying a WebSocket server is reachable and completes its upgrade handshake before you wire real traffic to it.

Endpoints

URL	Transport	State	Latency	Checked
https://papacasper.com/mcp	streamable-http	answering	489 ms	10 min ago

Alternatives to mcp-toolbelt

same job, measured the same way

Agent Toolkit

by white-hat-lab

Pay-per-call developer utilities and npm supply-chain security tools for coding agents, over x402.

45 installs/wk local only

Defenter Proxy

by defenter-ai

Real-time semantic security for AI coding agents and MCP tools

122 installs/wk local only

Vaultguard MCP

by kota1026

VaultGuard MCP Server - Yearn V3 / DeFi vault security and analysis tools for AI coding agents....

23 installs/wk local only

Shadowgate MCP

by josephibra

Security firewall for AI agents — scans MCP calls for injection, secrets, and risks.

answering

Security Intel MCP

by datakoot

CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.

5 tools answering

Agents

by obsmetrics-paygent

Pay-per-call safety guards for AI agents: injection, tool-call, signing, secret, x402-trust.

7 tools answering

Signal Oracle

by neruoticfarrow

Pay-per-call change-intelligence feeds for AI agents over x402 (deps, security, regs, tariffs)

7 tools answering

GoldBean MCP Server

by goldbean-api

49 pay-per-use APIs for AI agents via x402. AI, crypto, DeFi, blockchain, weather, search, security.

61 installs/wk local only

mcp-toolbelt — questions

Answers built from our own checks of this server.

What can mcp-toolbelt do?

It exposes 29 tools, read directly from the server on our last check. Among them: ai_crawler_policy_check, broken_link_check, check_open_ports, check_robots_sitemap, cors_policy_check, dns_propagation_check and 23 more. The full list with descriptions is on this page — we take it from the server itself via tools/list, not from a README. How MCP servers expose tools in the first place →

What is mcp-toolbelt mostly used for?

Its tools cluster around domain, ssl and email. That is what this server is built to work with — the grouping comes from the actual tool names, not from a category we assigned.

Is mcp-toolbelt working right now?

We send a real MCP handshake every 15 minutes. Over the last 24 hours 91 of 91 checks got a reply (100.0%), average response time 438 ms. The bar chart above shows every period we have measured.

How do I connect mcp-toolbelt?

Copy the ready config from this page — we generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each with the file path that client actually reads. It is a remote server, so there is nothing to install — the client connects to the address.

Does mcp-toolbelt need an API key?

No. mcp-toolbelt completed a full MCP handshake with us as an anonymous client and listed its tools without asking for anything. All 29 of them are readable on this page. This is what we observed, not what the docs claim.

How fast is mcp-toolbelt?

It answers our handshake in 438 ms on average, which is faster than 36% of all working MCP servers we measure. The comparison comes from our own checks across the whole registry, every 15 minutes.