Stateless, zero-log Streamable HTTP MCP server exposing 42 deterministic tools for AI prompt-injection defense, PII redaction, secret scanning, MCP manifest linting, JSON repair, SSRF firewalling, and EU VAT/IBAN/Peppol validation.
Scored across 42 tools
Most tools have clearly distinct resource domains and action targets, such as receipt issuance, PII redaction, SSRF validation, and EU VAT calculation. A few adjacent security/compliance tools could still be confused, especially email_dns vs email_dns_generator, eu_vat_calculator vs eu_vat_iban vs invoice_validator, and the multiple LLM guardrail tools. Overall boundaries are mostly clear from the descriptions.
All tools follow a consistent tinplate_<snake_case_domain> convention with predictable descriptive names. Although most use noun phrases rather than verb_noun, the convention is applied uniformly across the entire set. There is no mixing of camelCase, vague verbs, or inconsistent prefixes.
The set contains 42 tools, which is very heavy and spans many loosely related domains from AI safety to EU tax compliance. While individual tools are specialized, the surface feels more like a bundled utility catalog than a tightly scoped server. This exceeds the typical 3-15 well-scoped range by a large margin.
The suite covers a broad range of AI safety, security, privacy, and EU compliance operations, including prompt injection, output guardrails, PII, secrets, SSRF, invoices, VAT, sanctions, and identifiers. There are minor gaps such as broader GDPR/data-subject workflows or lifecycle management, but the core stated domains are well represented. Agents can accomplish most foreseeable tasks without dead ends.
Agent Action Receipts API: Issue and verify tamper-evident HMAC-signed receipts for autonomous AI agent actions. (Endpoint: POST /v1/agent-action-receipts/issue)
Inputs: agent_id (required), tool_name (required), secret, action_input.
AI-Generated Code & CI Workflow Sandbox Auditor API: Audit LLM-generated Python, JS/TS, Shell, or GitHub Actions code for sandbox escapes before execution. (Endpoint: POST /v1/agent-code-guard)
Inputs: code (required), language (required), allow_network, allow_filesystem_write.
Agent Shell Command & SQL Query Safety Firewall API: Audit agent shell commands and Text-to-SQL queries for RCE, reverse shells, and destructive SQL. (Endpoint: POST /v1/command-sql-guard)
Inputs: mode (required), input (required), sql_policy.
Stateless Consent & One-Click Unsubscribe Tokens API: Issue and verify stateless HMAC unsubscribe tokens and RFC 8058 List-Unsubscribe headers. (Endpoint: POST /v1/consent-tokens/issue)
Inputs: scope (required), subject (required), secret, ttl_seconds, +1 more.
Synthetic Content Provenance Checker API: Detect C2PA manifests, AI generator EXIF/XMP tags, and stripped metadata in files or headers. (Endpoint: POST /v1/content-provenance)
Inputs: metadata_text (required).
Cron & Schedule Explainer & Validator API: Validate cron expressions, translate to plain English, and compute next N runs with DST. (Endpoint: POST /v1/cron-explainer)
Inputs: timezone (required), expression (required), next_runs, reference_time.
Email DNS Deliverability Auditor API: Audit MX, SPF 10-lookup limits, DMARC, DKIM, BIMI, and MTA-STS with a 0–100 score. (Endpoint: POST /v1/email-dns)
Inputs: domain (required), dkim_selectors (required).
SPF, DKIM & DMARC Record Linter & Generator API: Lint existing SPF/DMARC strings and generate clean, RFC-compliant DNS TXT records. (Endpoint: POST /v1/email-dns-generator)
Inputs: domain (required), providers (required), ip4, spf_mode, +2 more.
European Corporate Tax, LEI, EORI & National ID Validator API: Validate LEI, EORI, SIREN/SIRET, Steuer-ID, Codice Fiscale, NIF/CIF, NIP, BSN, CRN & EIN checksums. (Endpoint: POST /v1/eu-id-validator)
Inputs: type (required), value (required).
EU Cross-Border VAT Rate & Reverse-Charge Calculator API: Determine exact EU VAT rates, B2B reverse charge, EN 16931 tax category codes, and mandatory invoice legal text. (Endpoint: POST /v1/eu-vat-calculator)
Inputs: buyer_country (required), seller_country (required), amount, amount_type, +2 more.
EU VAT & IBAN/BIC Validator API: Validate IBANs, BIC/SWIFT codes, and EU/UK VAT numbers with live EU VIES lookup. (Endpoint: POST /v1/eu-vat-iban/iban)
Inputs: bic (required), iban (required).
Deterministic Hallucination Diff API: Fast first filter to catch unsupported numbers, dates, and names in LLM answers vs RAG sources. (Endpoint: POST /v1/hallucination-diff)
Inputs: answer (required), sources (required).
LLM HTML-to-Markdown Cleaner API: Convert noisy web pages or raw HTML into clean, token-efficient Markdown for RAG. (Endpoint: POST /v1/html-to-markdown)
Inputs: html (required).
Hungarian Business Document & NAV Validator API: Validate Hungarian adószám, cégjegyzékszám, GIRO bank accounts, and NAV invoice rules. (Endpoint: POST /v1/hu-business-validator)
Inputs: adoszam (required), bank_account (required).
ICS / iCalendar Feed Sanitizer & Validator API: Repair broken .ics calendar feeds, normalize Windows timezones to IANA, and parse VEVENTs. (Endpoint: POST /v1/ics-sanitizer)
Inputs: ics (required).
Invoice & EU EN 16931 / Peppol Validator API: Audit extracted invoices for line-item math errors, VAT mismatches, and Peppol compliance. (Endpoint: POST /v1/invoice-validator)
Inputs: invoice (required), check_en16931 (required).
Broken JSON & LLM Output Healer API: Repair malformed or truncated LLM JSON outputs into valid, schema-checked JSON in 1 ms. (Endpoint: POST /v1/json-heal)
Inputs: raw (required).
JWT, JWS & JWK Security Auditor & RFC 8725 Linter API: Audit JWT tokens and JWK sets against RFC 8725 for alg:none, weak secrets, and leaked keys. (Endpoint: POST /v1/jwt-jwk-inspector)
Inputs: token (required).
LLM Chat Messages Policy Proxy & Sanitizer API: Sanitize entire multi-turn LLM messages[] arrays in one call before forwarding to OpenAI, Anthropic, or Gemini. (Endpoint: POST /v1/llm-messages-guard)
Inputs: messages (required), check_prompt_injection (required), redact_pii, sensitivity, +2 more.
LLM Output Safety, Leakage & Format Guardrail API: Scan and sanitize LLM outputs for prompt leakage, Markdown beacons, XSS, and policy violations. (Endpoint: POST /v1/llm-output-guard)
Inputs: output (required), canary_tokens (required), allowed_link_domains.
Text-to-Structured Date, Money & Unit Parser API: Normalize messy EU/US prices, dates, percentages, and measurements into structured JSON. (Endpoint: POST /v1/locale-value-parser)
Inputs: text (required), locale_hint (required).
MCP Server Manifest & Tool Security Linter API: Audit MCP server manifests for hidden tool poisoning, shell risks, and excessive permissions. (Endpoint: POST /v1/mcp-manifest-linter)
Inputs: manifest (required).
Peppol UBL 2.1 / XRechnung E-Invoice Converter & EPC-QR API: Generate EN 16931 / Peppol BIS 3.0 UBL 2.1 XML and SEPA EPC-QR payloads from JSON, or parse UBL XML to JSON. (Endpoint: POST /v1/peppol-ubl-invoice)
Inputs: invoice (required), seller_bic (required), buyer_reference.
PII Redactor API: Mask emails, phones, IBANs, cards, and EU IDs with reversible tokens before LLM calls. (Endpoint: POST /v1/pii-redactor)
Inputs: mode (required), text (required).
Prompt Cache Key & Context Budgeter API: Estimate tokens, optimize message order for prompt caching, and calculate LLM API costs. (Endpoint: POST /v1/prompt-cache-budgeter)
Inputs: model (required), max_context_tokens (required), blocks.
Prompt Injection Detection API: Catch prompt injections, role hijacks, and encoded jailbreaks in user inputs and RAG chunks. (Endpoint: POST /v1/prompt-guard)
Inputs: text (required), context (required), sensitivity.
Markdown & Code Aware Smart RAG Document Chunker API: Split Markdown into token-budgeted RAG chunks with heading breadcrumbs and intact code/tables. (Endpoint: POST /v1/rag-chunker)
Inputs: text (required), max_tokens (required), overlap_tokens, prepend_breadcrumbs.
Regex ReDoS Vulnerability Scanner & Pattern Explainer API: Audit regular expressions for O(2^n) ReDoS backtracking, explain patterns, and test matches. (Endpoint: POST /v1/regex-safety)
Inputs: flags (required), pattern (required), test_strings.
robots.txt & llms.txt AI Crawler Analyzer & Generator API: Audit which AI crawlers your robots.txt allows and generate a valid llms.txt file. (Endpoint: POST /v1/robots-llms-analyzer)
Inputs: robots_txt (required).
Sanctions, Watchlist & Embargo Entity Screener API: Screen beneficiaries, vendors, BICs, and wallets against embargo rules and fuzzy sanctions watchlists. (Endpoint: POST /v1/sanctions-screener)
Inputs: entity_name (required), entity_type (required), identifiers, country_code, +1 more.
OpenAPI & JSON Schema Breaking-Change Diff API: Diff two OpenAPI 3.x or JSON Schemas to catch breaking changes and recommend SemVer bumps. (Endpoint: POST /v1/schema-diff)
Inputs: mode (required), before (required), after.
Log Redact & Secret Scanner API: Detect and mask leaked API keys, JWTs, and private keys in logs, diffs, and prompts. (Endpoint: POST /v1/secret-scanner)
Inputs: text (required), redact (required).
HTTP Security Header Scanner API: Audit CSP, HSTS, and browser security headers with an A+ to F grade and fix snippets. (Endpoint: POST /v1/security-headers)
Inputs: headers (required).
SemVer & Package Manifest / Lockfile Diff Judge API: Diff two package.json files to flag breaking SemVer bumps and risky dependency changes. (Endpoint: POST /v1/semver-lockfile-judge)
Inputs: after (required), before (required).
Signup Fraud & Disposable Email Scorer API: Block disposable emails, alias abuse, and bot signups with a 0–100 fraud risk score. (Endpoint: POST /v1/signup-fraud)
Inputs: email (required).
Agent URL & SSRF Firewall API: Validate URLs and redirect chains against SSRF, private IPs, and cloud metadata targets. (Endpoint: POST /v1/ssrf-firewall)
Inputs: url (required).
Tabular CSV/JSON RAG Sanitizer & Formula-Injection Firewall API: Neutralize CSV formula injection, redact cell-level PII, and convert tables into RAG-ready Markdown & row chunks. (Endpoint: POST /v1/tabular-rag-cleaner)
Inputs: csv (required), delimiter (required), redact_pii, sanitize_formulas, +1 more.
Agent Tool-Call Validator & Repairer API: Validate and auto-repair broken LLM tool-call arguments against your JSON Schema. (Endpoint: POST /v1/tool-call-validator)
Inputs: tools (required), tool_call (required), coerce_types.
User-Agent & AI Bot Parser API: Detect AI training crawlers, RAG bots, headless browsers, and device/OS details from User-Agent. (Endpoint: POST /v1/ua-bot-parser)
Inputs: user_agent (required).
URL Normalizer & Tracking Parameter Stripper API: Canonicalize URLs and strip 120+ ad-tracking and click-ID parameters for clean deduplication. (Endpoint: POST /v1/url-normalizer)
Inputs: url (required).
Webhook Signature Verifier API: Verify Stripe, GitHub, Slack, Shopify, and Svix HMAC webhook signatures and timestamps. (Endpoint: POST /v1/webhook-verify)
Inputs: secret (required), provider (required), headers, raw_body.
Workday & Holiday Calculator API: Calculate business days and SLA deadlines across 30+ countries including HU swap Saturdays. (Endpoint: POST /v1/workday-holiday/between)
Inputs: country (required), start_date (required), end_date.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Add one secure layer between your agents and this server.
