Skip to main content
Glama
Sign In

Tinplate Edge AI Safety, Security & EU Compliance

by dev.tinplate
OverviewDiscussionsAdmin

Server Details

Zero-log MCP server with 42 tools for AI guardrails, secret scanning, MCP linting & EU compliance.

If you are the author of this connector, you can claim ownership by verifying the domain or GitHub account it belongs to. Claimed connector authors can inspect health checks, view analytics, and manage their listing.
Status
Healthy
Uptime
100.0% over the last 24 hours
Last Tested
Transport
Streamable HTTP · MCP 2025-03-26
URL
ChatGPT
–
Claude
–

TDQS

B3.2/5.0

Scored across 42 tools

Disambiguation4/5

Most tools target clearly distinct checks or resources, but several clusters overlap in purpose, especially email_dns vs email_dns_generator, eu_vat_calculator vs eu_vat_iban vs invoice_validator, and prompt_guard vs llm_messages_guard vs llm_output_guard. The descriptions usually resolve the boundary, but an agent could misselect without reading them carefully.

Naming Consistency4/5

All names consistently use snake_case with the tinplate_ prefix, so the style is predictable. However, suffixes mix nouns and action-like terms (guard, validator, scanner, verifier, parser, diff) and do not follow a strict verb_noun pattern.

Tool Count2/5

42 tools is far beyond a typical well-scoped MCP surface and is likely overwhelming for an agent to navigate reliably. The suite covers many micro-APIs that would be better split into focused servers, even though most individual tools are purposeful.

Completeness3/5

The surface covers a broad range of AI safety, security, DNS, and EU compliance checks, but it remains a collection of stateless validators rather than a complete lifecycle. Notable gaps include policy/finding management, GDPR/AI Act workflow operations, and access-control or incident-response functions.

Available Tools

42 tools
tinplate_agent_action_receiptsB
Read-onlyIdempotent
Inspect

Agent Action Receipts API: Issue and verify tamper-evident HMAC-signed receipts for autonomous AI agent actions. (Endpoint: POST /v1/agent-action-receipts/issue)

Inputs: agent_id (required), tool_name (required), secret, action_input.

tinplate_agent_code_guardB
Read-onlyIdempotent
Inspect

AI-Generated Code & CI Workflow Sandbox Auditor API: Audit LLM-generated Python, JS/TS, Shell, or GitHub Actions code for sandbox escapes before execution. (Endpoint: POST /v1/agent-code-guard)

Inputs: code (required), language (required), allow_network, allow_filesystem_write.

tinplate_command_sql_guardB
Read-onlyIdempotent
Inspect

Agent Shell Command & SQL Query Safety Firewall API: Audit agent shell commands and Text-to-SQL queries for RCE, reverse shells, and destructive SQL. (Endpoint: POST /v1/command-sql-guard)

Inputs: mode (required), input (required), sql_policy.

tinplate_consent_tokensB
Read-onlyIdempotent
Inspect

Stateless Consent & One-Click Unsubscribe Tokens API: Issue and verify stateless HMAC unsubscribe tokens and RFC 8058 List-Unsubscribe headers. (Endpoint: POST /v1/consent-tokens/issue)

Inputs: scope (required), subject (required), secret, ttl_seconds, +1 more.

tinplate_content_provenanceB
Read-onlyIdempotent
Inspect

Synthetic Content Provenance Checker API: Detect C2PA manifests, AI generator EXIF/XMP tags, and stripped metadata in files or headers. (Endpoint: POST /v1/content-provenance)

Inputs: metadata_text (required).

tinplate_cron_explainerA
Read-onlyIdempotent
Inspect

Cron & Schedule Explainer & Validator API: Validate cron expressions, translate to plain English, and compute next N runs with DST. (Endpoint: POST /v1/cron-explainer)

Inputs: timezone (required), expression (required), next_runs, reference_time.

tinplate_email_dnsB
Read-onlyIdempotent
Inspect

Email DNS Deliverability Auditor API: Audit MX, SPF 10-lookup limits, DMARC, DKIM, BIMI, and MTA-STS with a 0–100 score. (Endpoint: POST /v1/email-dns)

Inputs: domain (required), dkim_selectors (required).

tinplate_email_dns_generatorB
Read-onlyIdempotent
Inspect

SPF, DKIM & DMARC Record Linter & Generator API: Lint existing SPF/DMARC strings and generate clean, RFC-compliant DNS TXT records. (Endpoint: POST /v1/email-dns-generator)

Inputs: domain (required), providers (required), ip4, spf_mode, +2 more.

tinplate_eu_id_validatorA
Read-onlyIdempotent
Inspect

European Corporate Tax, LEI, EORI & National ID Validator API: Validate LEI, EORI, SIREN/SIRET, Steuer-ID, Codice Fiscale, NIF/CIF, NIP, BSN, CRN & EIN checksums. (Endpoint: POST /v1/eu-id-validator)

Inputs: type (required), value (required).

tinplate_eu_vat_calculatorB
Read-onlyIdempotent
Inspect

EU Cross-Border VAT Rate & Reverse-Charge Calculator API: Determine exact EU VAT rates, B2B reverse charge, EN 16931 tax category codes, and mandatory invoice legal text. (Endpoint: POST /v1/eu-vat-calculator)

Inputs: buyer_country (required), seller_country (required), amount, amount_type, +2 more.

tinplate_eu_vat_ibanC
Read-onlyIdempotent
Inspect

EU VAT & IBAN/BIC Validator API: Validate IBANs, BIC/SWIFT codes, and EU/UK VAT numbers with live EU VIES lookup. (Endpoint: POST /v1/eu-vat-iban/iban)

Inputs: bic (required), iban (required).

tinplate_hallucination_diffB
Read-onlyIdempotent
Inspect

Deterministic Hallucination Diff API: Fast first filter to catch unsupported numbers, dates, and names in LLM answers vs RAG sources. (Endpoint: POST /v1/hallucination-diff)

Inputs: answer (required), sources (required).

tinplate_html_to_markdownA
Read-onlyIdempotent
Inspect

LLM HTML-to-Markdown Cleaner API: Convert noisy web pages or raw HTML into clean, token-efficient Markdown for RAG. (Endpoint: POST /v1/html-to-markdown)

Inputs: html (required).

tinplate_hu_business_validatorB
Read-onlyIdempotent
Inspect

Hungarian Business Document & NAV Validator API: Validate Hungarian adószám, cégjegyzékszám, GIRO bank accounts, and NAV invoice rules. (Endpoint: POST /v1/hu-business-validator)

Inputs: adoszam (required), bank_account (required).

tinplate_ics_sanitizerB
Read-onlyIdempotent
Inspect

ICS / iCalendar Feed Sanitizer & Validator API: Repair broken .ics calendar feeds, normalize Windows timezones to IANA, and parse VEVENTs. (Endpoint: POST /v1/ics-sanitizer)

Inputs: ics (required).

tinplate_invoice_validatorB
Read-onlyIdempotent
Inspect

Invoice & EU EN 16931 / Peppol Validator API: Audit extracted invoices for line-item math errors, VAT mismatches, and Peppol compliance. (Endpoint: POST /v1/invoice-validator)

Inputs: invoice (required), check_en16931 (required).

tinplate_json_healB
Read-onlyIdempotent
Inspect

Broken JSON & LLM Output Healer API: Repair malformed or truncated LLM JSON outputs into valid, schema-checked JSON in 1 ms. (Endpoint: POST /v1/json-heal)

Inputs: raw (required).

tinplate_jwt_jwk_inspectorB
Read-onlyIdempotent
Inspect

JWT, JWS & JWK Security Auditor & RFC 8725 Linter API: Audit JWT tokens and JWK sets against RFC 8725 for alg:none, weak secrets, and leaked keys. (Endpoint: POST /v1/jwt-jwk-inspector)

Inputs: token (required).

tinplate_llm_messages_guardB
Read-onlyIdempotent
Inspect

LLM Chat Messages Policy Proxy & Sanitizer API: Sanitize entire multi-turn LLM messages[] arrays in one call before forwarding to OpenAI, Anthropic, or Gemini. (Endpoint: POST /v1/llm-messages-guard)

Inputs: messages (required), check_prompt_injection (required), redact_pii, sensitivity, +2 more.

tinplate_llm_output_guardB
Read-onlyIdempotent
Inspect

LLM Output Safety, Leakage & Format Guardrail API: Scan and sanitize LLM outputs for prompt leakage, Markdown beacons, XSS, and policy violations. (Endpoint: POST /v1/llm-output-guard)

Inputs: output (required), canary_tokens (required), allowed_link_domains.

tinplate_locale_value_parserB
Read-onlyIdempotent
Inspect

Text-to-Structured Date, Money & Unit Parser API: Normalize messy EU/US prices, dates, percentages, and measurements into structured JSON. (Endpoint: POST /v1/locale-value-parser)

Inputs: text (required), locale_hint (required).

tinplate_mcp_manifest_linterA
Read-onlyIdempotent
Inspect

MCP Server Manifest & Tool Security Linter API: Audit MCP server manifests for hidden tool poisoning, shell risks, and excessive permissions. (Endpoint: POST /v1/mcp-manifest-linter)

Inputs: manifest (required).

tinplate_peppol_ubl_invoiceA
Read-onlyIdempotent
Inspect

Peppol UBL 2.1 / XRechnung E-Invoice Converter & EPC-QR API: Generate EN 16931 / Peppol BIS 3.0 UBL 2.1 XML and SEPA EPC-QR payloads from JSON, or parse UBL XML to JSON. (Endpoint: POST /v1/peppol-ubl-invoice)

Inputs: invoice (required), seller_bic (required), buyer_reference.

tinplate_pii_redactorB
Read-onlyIdempotent
Inspect

PII Redactor API: Mask emails, phones, IBANs, cards, and EU IDs with reversible tokens before LLM calls. (Endpoint: POST /v1/pii-redactor)

Inputs: mode (required), text (required).

tinplate_prompt_cache_budgeterB
Read-onlyIdempotent
Inspect

Prompt Cache Key & Context Budgeter API: Estimate tokens, optimize message order for prompt caching, and calculate LLM API costs. (Endpoint: POST /v1/prompt-cache-budgeter)

Inputs: model (required), max_context_tokens (required), blocks.

tinplate_prompt_guardB
Read-onlyIdempotent
Inspect

Prompt Injection Detection API: Catch prompt injections, role hijacks, and encoded jailbreaks in user inputs and RAG chunks. (Endpoint: POST /v1/prompt-guard)

Inputs: text (required), context (required), sensitivity.

tinplate_rag_chunkerB
Read-onlyIdempotent
Inspect

Markdown & Code Aware Smart RAG Document Chunker API: Split Markdown into token-budgeted RAG chunks with heading breadcrumbs and intact code/tables. (Endpoint: POST /v1/rag-chunker)

Inputs: text (required), max_tokens (required), overlap_tokens, prepend_breadcrumbs.

tinplate_regex_safetyB
Read-onlyIdempotent
Inspect

Regex ReDoS Vulnerability Scanner & Pattern Explainer API: Audit regular expressions for O(2^n) ReDoS backtracking, explain patterns, and test matches. (Endpoint: POST /v1/regex-safety)

Inputs: flags (required), pattern (required), test_strings.

tinplate_robots_llms_analyzerB
Read-onlyIdempotent
Inspect

robots.txt & llms.txt AI Crawler Analyzer & Generator API: Audit which AI crawlers your robots.txt allows and generate a valid llms.txt file. (Endpoint: POST /v1/robots-llms-analyzer)

Inputs: robots_txt (required).

tinplate_sanctions_screenerA
Read-onlyIdempotent
Inspect

Sanctions, Watchlist & Embargo Entity Screener API: Screen beneficiaries, vendors, BICs, and wallets against embargo rules and fuzzy sanctions watchlists. (Endpoint: POST /v1/sanctions-screener)

Inputs: entity_name (required), entity_type (required), identifiers, country_code, +1 more.

tinplate_schema_diffA
Read-onlyIdempotent
Inspect

OpenAPI & JSON Schema Breaking-Change Diff API: Diff two OpenAPI 3.x or JSON Schemas to catch breaking changes and recommend SemVer bumps. (Endpoint: POST /v1/schema-diff)

Inputs: mode (required), before (required), after.

tinplate_secret_scannerB
Read-onlyIdempotent
Inspect

Log Redact & Secret Scanner API: Detect and mask leaked API keys, JWTs, and private keys in logs, diffs, and prompts. (Endpoint: POST /v1/secret-scanner)

Inputs: text (required), redact (required).

tinplate_security_headersB
Read-onlyIdempotent
Inspect

HTTP Security Header Scanner API: Audit CSP, HSTS, and browser security headers with an A+ to F grade and fix snippets. (Endpoint: POST /v1/security-headers)

Inputs: headers (required).

tinplate_semver_lockfile_judgeB
Read-onlyIdempotent
Inspect

SemVer & Package Manifest / Lockfile Diff Judge API: Diff two package.json files to flag breaking SemVer bumps and risky dependency changes. (Endpoint: POST /v1/semver-lockfile-judge)

Inputs: after (required), before (required).

tinplate_signup_fraudB
Read-onlyIdempotent
Inspect

Signup Fraud & Disposable Email Scorer API: Block disposable emails, alias abuse, and bot signups with a 0–100 fraud risk score. (Endpoint: POST /v1/signup-fraud)

Inputs: email (required).

tinplate_ssrf_firewallA
Read-onlyIdempotent
Inspect

Agent URL & SSRF Firewall API: Validate URLs and redirect chains against SSRF, private IPs, and cloud metadata targets. (Endpoint: POST /v1/ssrf-firewall)

Inputs: url (required).

tinplate_tabular_rag_cleanerA
Read-onlyIdempotent
Inspect

Tabular CSV/JSON RAG Sanitizer & Formula-Injection Firewall API: Neutralize CSV formula injection, redact cell-level PII, and convert tables into RAG-ready Markdown & row chunks. (Endpoint: POST /v1/tabular-rag-cleaner)

Inputs: csv (required), delimiter (required), redact_pii, sanitize_formulas, +1 more.

tinplate_tool_call_validatorB
Read-onlyIdempotent
Inspect

Agent Tool-Call Validator & Repairer API: Validate and auto-repair broken LLM tool-call arguments against your JSON Schema. (Endpoint: POST /v1/tool-call-validator)

Inputs: tools (required), tool_call (required), coerce_types.

tinplate_ua_bot_parserA
Read-onlyIdempotent
Inspect

User-Agent & AI Bot Parser API: Detect AI training crawlers, RAG bots, headless browsers, and device/OS details from User-Agent. (Endpoint: POST /v1/ua-bot-parser)

Inputs: user_agent (required).

tinplate_url_normalizerA
Read-onlyIdempotent
Inspect

URL Normalizer & Tracking Parameter Stripper API: Canonicalize URLs and strip 120+ ad-tracking and click-ID parameters for clean deduplication. (Endpoint: POST /v1/url-normalizer)

Inputs: url (required).

tinplate_webhook_verifyB
Read-onlyIdempotent
Inspect

Webhook Signature Verifier API: Verify Stripe, GitHub, Slack, Shopify, and Svix HMAC webhook signatures and timestamps. (Endpoint: POST /v1/webhook-verify)

Inputs: secret (required), provider (required), headers, raw_body.

tinplate_workday_holidayB
Read-onlyIdempotent
Inspect

Workday & Holiday Calculator API: Calculate business days and SLA deadlines across 30+ countries including HU swap Saturdays. (Endpoint: POST /v1/workday-holiday/between)

Inputs: country (required), start_date (required), end_date.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

    Related MCP Connectors

    Related MCP Servers

    • MCP Shield

      rob925
      A
      license
      C
      quality
      D
      maintenance
      Security scanner and MCP server that catches dangerous patterns in MCP servers and AI agent projects, such as leaked secrets, shell execution, and prompt-injection text. Runs as both a CLI and MCP server with CI-friendly severity gates.
      2
      1
      MIT

    • sigma-gate

      spektre-labs
      A
      license
      A
      quality
      D
      maintenance
      A deterministic MCP server that guards AI/agent output by detecting secrets, injection, and PII in ~85µs with zero dependencies. Gives a clear ship/block verdict and runs locally or hosted.
      2
      Apache 2.0
    Try in Browser
    One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

    Glama MCP Gateway

    Add one secure layer between your agents and this server.

    Resources