Runs the text through a language model tuned for editing. Returns the
corrected text and an itemised list of changes with explanations.
Supports multiple style modes for different audiences and registers.

Free tier: up to 500 characters. Pro tier: up to 10,000 characters.

Args:
    text: Text to check and rewrite.
    style: Rewrite target style — one of:
        'concise' (default): Remove filler words, tighten sentences.
        'formal': Business or academic register.
        'friendly': Warm, conversational tone.
        'UK-en': British English spelling and idioms.
        'US-en': American English spelling and idioms.

Returns:
    corrected: Rewritten text applying all suggested changes.
    edits: List of individual changes, each with:
        original: The original phrase.
        replacement: The corrected phrase.
        explanation: Why this change was made.
    chars_in: Character count of the input.
    chars_out: Character count of the corrected output.

Uses the k-anonymity method: only the first 5 characters of the SHA-1 hash
of the password are ever sent over the network. The API returns a list of
matching hash suffixes which are compared locally — the full password and
hash are never transmitted. Data sourced from HaveIBeenPwned and similar
breach databases.

Use this to validate new passwords at registration or to prompt users
to change a compromised credential. Safe to call with real passwords due
to the k-anonymity design.

Args:
    password: The password string to check. Transmitted as a partial hash
              (first 5 chars of SHA-1 only) — never the plaintext password.

Returns:
    breached (bool): True if the password appears in breach databases.
    count: Number of times this password has been seen in breaches.
           A count > 0 means the password should not be used.
           A count of 0 means it has not been seen (not a guarantee of safety).

Parses and decodes the header and payload sections of a JWT for inspection.
Useful for debugging authentication issues, inspecting claim values, or
checking expiry. Does NOT verify the signature — do not use this to make
security decisions about whether a token should be trusted.

Args:
    token: JWT string (three base64url-encoded sections separated by dots).
           Both compact and bearer format ('Bearer eyJ...') are accepted.

Returns:
    header: Decoded JWT header (alg, typ, kid).
    payload: Decoded JWT payload (all claims as-is).
    is_expired (bool): True if the 'exp' claim is in the past.
    expires_at: Expiry datetime string if 'exp' claim present (may be null).
    issued_at: Issue datetime string if 'iat' claim present (may be null).
    subject: The 'sub' claim if present (typically a user ID).
    issuer: The 'iss' claim if present.

Queries authoritative DNS servers for the specified record types and
returns all matching records with TTL values. Useful for diagnosing
email deliverability (MX records), verifying domain ownership (TXT),
tracing CDN configuration (CNAME), and checking propagation status.

Args:
    domain: Domain name to look up (e.g. 'example.com', 'mail.example.com').
    record_types: Comma-separated record types to query. Supported:
        A (IPv4 addresses), AAAA (IPv6), MX (mail servers),
        TXT (verification, SPF, DKIM), NS (nameservers),
        CNAME (aliases), SOA (zone authority). Default: 'A'.
        Example: 'A,MX,TXT' to check all email-related records at once.

Returns:
    records: List of DNS records, each with type, value, and ttl.
    query_time_ms: How long the DNS resolution took.

Computes the hash server-side and returns hex-encoded digest. Useful for
verifying data integrity, creating content fingerprints, or generating
deterministic identifiers. All algorithms produce consistent, reproducible
output for the same input.

Args:
    data: String to hash. Encoded as UTF-8 before hashing.
    algorithm: Hash algorithm to use — one of:
        'sha256' (default): 256-bit SHA-2, widely used standard.
        'sha512': 512-bit SHA-2, stronger but longer output.
        'sha1': 160-bit SHA-1, legacy (not collision-resistant).
        'md5': 128-bit MD5, legacy (not collision-resistant).
        'sha3_256': 256-bit SHA-3 (Keccak), different from SHA-2.
        'blake2b': BLAKE2b, fast and cryptographically strong.

Returns:
    algorithm: The algorithm used.
    hex: Hex-encoded hash digest.
    length: Length of the hex string in characters.

Creates a QR code encoding any text or URL. Supports PNG (raster) and
SVG (vector, scales to any size). Custom foreground and background colours
allow brand-matched QR codes. Error correction level is M (~15% recovery).

Args:
    url: Content to encode — can be any URL, plain text, Wi-Fi credentials
         (WIFI:T:WPA;S:ssid;P:password;;), vCard, or other QR payload.
    size: Output image size in pixels (default 256, range 64–2048).
          Ignored for SVG format which is inherently resolution-independent.
    format: Output format — 'png' (default) or 'svg'.
    fg: Foreground (module) colour as hex (default '#000000').
    bg: Background colour as hex (default '#ffffff').
        Use '#00000000' for transparent background (PNG only).

Returns:
    Base64-encoded image string (PNG bytes or SVG text, base64-encoded).

Produces standards-compliant UUIDs suitable for use as database primary
keys, idempotency tokens, session identifiers, or correlation IDs.

Args:
    version: UUID version to generate:
        1: Time-based UUID (includes MAC address and timestamp).
           Ordered by creation time, useful for time-sortable IDs.
        4 (default): Random UUID (122 bits of entropy).
           Most widely used; suitable for general-purpose IDs.
        7: Unix-time-based UUID (RFC 9562). Monotonically increasing,
           better database index locality than v4, newer standard.

Returns:
    uuid: The generated UUID string (standard hyphenated format).
    version: UUID version that was generated.
    format: Always 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx'.

Renders the HTML in a headless Chromium browser and exports to PDF.
Supports full CSS (including Flexbox, Grid, custom fonts via Google Fonts),
inline SVG, and print-media-query styles. Page size defaults to A4.

Use for generating invoices, reports, certificates, or any document that
needs to be rendered exactly as it appears in a browser.

Args:
    html: Complete HTML document to convert. Should include a full
          <html><head>...</head><body>...</body></html> structure.
          For best results include a <style> block or link to a CDN CSS.
          Use @media print CSS rules to control page breaks.

Returns:
    Base64-encoded PDF bytes. Decode with base64.b64decode() to get the
    raw PDF binary, which can be written to a file or returned to a user.

Returns geolocation data (country, city, coordinates, timezone, ISP) plus
threat intelligence signals: whether the IP is a known VPN exit node, Tor
relay, or datacenter/hosting provider. Includes a composite threat score.

Use for fraud detection, access control, personalising content by region,
or investigating suspicious traffic in server logs.

Args:
    ip: IPv4 or IPv6 address to look up (e.g. '8.8.8.8', '2001:4860:4860::8888').

Returns:
    ip: The queried IP.
    country, country_code: Full country name and ISO-3166 code.
    region, city: Geographic subdivision and city name.
    latitude, longitude: Approximate coordinates (city-level precision).
    timezone: IANA timezone (e.g. 'America/New_York').
    isp: Internet Service Provider name.
    is_vpn (bool): Known VPN exit node.
    is_tor (bool): Tor exit relay.
    is_datacenter (bool): Hosted in a cloud/datacenter AS.
    threat_score: 0.0–1.0 composite risk score.

Accepts standard 5-field cron syntax (minute hour day month weekday) and
the extended 6-field format (with seconds prefix). Returns the next several
scheduled times and a plain-English description of the schedule. Useful for
validating cron jobs, explaining schedules to non-technical stakeholders, or
debugging scheduler configuration.

Args:
    expression: Cron expression to parse. Supports:
        5-field: '0 9 * * 1' (every Monday at 09:00)
        6-field: '0 0 9 * * 1' (with leading seconds field)
        Special strings: '@daily', '@weekly', '@monthly', '@hourly'
        Ranges: '0 9-17 * * 1-5' (hourly 9am-5pm on weekdays)
        Step values: '*/15 * * * *' (every 15 minutes)

Returns:
    description: Plain-English schedule description.
    next_runs: List of the next 5 scheduled UTC datetime strings.
    fields: Parsed cron fields with each component's meaning.
    timezone: Assumes UTC unless a POSIX TZ string is prepended.

Fetches the page and parses all social-sharing metadata. Returns the full
set of og:*, twitter:*, and standard HTML meta tags in a structured format.
Use for link preview generation, SEO auditing, or validating that social
sharing thumbnails and descriptions are correctly set.

Args:
    url: Full URL of the page to parse (must include https://).

Returns:
    title: Page title (og:title or <title>).
    description: Meta description or og:description.
    image: Primary social sharing image URL (og:image).
    site_name: og:site_name if set.
    type: og:type (e.g. 'article', 'website').
    open_graph: Full dict of all og:* key-value pairs.
    twitter: Full dict of all twitter:* key-value pairs.
    favicon: URL of the site favicon.
    lang: Page language code (e.g. 'en', 'fr').
    author: Author meta tag if present.
    published_at: article:published_time if present.
    keywords: Meta keywords if present.

Uses Mozilla's Readability algorithm (the same engine as Firefox Reader Mode)
to strip navigation, ads, and boilerplate and return only the article content.
Ideal for summarising articles, building reading lists, or feeding clean text
into further AI processing without HTML noise.

Args:
    url: Full URL of the article or page to extract (must include https://).

Returns:
    title: Article or page title.
    byline: Author name(s) if detected.
    content: Plain text of the main article body.
    word_count: Number of words in the extracted content.
    published_at: Publication date if found in page metadata (may be null).
    excerpt: Short description/lead paragraph if available.

Detects and replaces PII entities using NER and pattern matching.
Covers email addresses, phone numbers, full names, physical addresses,
credit card numbers, national ID numbers (UK NI, US SSN), dates of birth,
and IP addresses. Replacements use labelled placeholders so the structure
of the text is preserved for downstream processing.

Use before logging user input, storing support tickets, or sharing data
with third parties.

Args:
    text: Text containing PII to redact. Handles mixed content including
          structured data embedded in natural language.

Returns:
    redacted: Text with PII replaced by [REDACTED_TYPE] placeholders.
    entities: List of detected entities, each with:
        type: Entity type (EMAIL, PHONE, NAME, ADDRESS, CREDIT_CARD, etc.).
        original: The original value that was redacted.
        start, end: Character positions in the original text.
    entity_count: Total number of PII entities found and redacted.

Renders the page in a headless Chromium browser with JavaScript execution,
waits for network idle (all resources loaded), then captures the viewport
or full page. Useful for visual regression checks, archiving page state,
generating previews, or letting an AI model analyse page layout.

Args:
    url: Full URL of the page to capture (must include https://).
    width: Viewport width in pixels (default 1280, range 320–3840).
    height: Viewport height in pixels (default 800, range 200–2160).
    full_page: If True, capture the full scrollable page height rather
               than just the visible viewport. May be slow for long pages.

Returns:
    png_b64: Base64-encoded PNG image data.
    w: Actual image width in pixels.
    h: Actual image height in pixels.
    bytes: File size of the PNG in bytes.
    ms: Time taken to render and capture in milliseconds.

Uses a fine-tuned language model to classify the overall sentiment and
return a continuous compound score. Handles negation, sarcasm signals,
and mixed-sentiment text. Works well on reviews, social posts, support
tickets, survey responses, and news excerpts.

Args:
    text: Text to analyse. Optimal range: 10–2000 characters.
          For longer documents, pass key paragraphs separately.

Returns:
    label: Overall sentiment — 'positive', 'negative', or 'neutral'.
    compound: Score from -1.0 (most negative) to +1.0 (most positive).
    confidence: Model confidence in the classification, 0.0–1.0.
    positive: Proportion of positive signal in the text.
    negative: Proportion of negative signal in the text.
    neutral: Proportion of neutral signal in the text.

Connects to the host on port 443 and retrieves the full certificate chain.
Returns validity status, expiry countdown (critical for alerting), issuer
details, Subject Alternative Names (SANs), and cipher suite information.

Use to monitor certificate expiry, verify correct certificate installation,
check SANs cover all required subdomains, or audit cipher strength.

Args:
    host: Hostname to check (e.g. 'example.com', 'api.example.com').
          Do not include https:// or path components.

Returns:
    valid (bool): Whether the certificate is currently valid and trusted.
    subject: Common name on the certificate.
    issuer: Certificate Authority that issued it.
    issued_at: Certificate issuance date.
    expires_at: Certificate expiry date.
    days_remaining: Days until expiry (negative = already expired).
    sans: List of Subject Alternative Names (all covered hostnames).
    chain_length: Number of certificates in the chain.

Uses extractive and abstractive summarisation to distil the most important
information from the input. Suitable for news articles, reports, research
papers, meeting transcripts, and support tickets.

Args:
    text: Text to summarise. Works best with 200+ words of input.
          Handles articles, reports, and multi-paragraph passages.
    max_sentences: Target number of sentences in the output summary
                   (default 3, range 1–10). The model may produce fewer
                   if the source is already concise.

Returns:
    summary: The generated summary text.
    sentences: Number of sentences in the summary.
    compression_ratio: Input length divided by summary length.
    key_points: Bullet-point list of the main points (may be null
                for very short inputs).

Analyses HTTP headers, HTML meta tags, JavaScript fingerprints, and
resource paths to identify the CMS, frontend framework, CDN, analytics
platform, e-commerce engine, and other technologies in use.

Useful for competitive research, sales prospecting, migration planning,
or understanding what stack a client is running before proposing solutions.

Args:
    url: Full URL of the site to analyse (must include https://).
        The homepage is usually sufficient; the scan does not crawl.

Returns:
    technologies: List of detected technologies, each with:
        name: Technology name (e.g. 'WordPress', 'Cloudflare', 'React').
        category: Category (CMS, CDN, Analytics, Framework, etc.).
        confidence: Detection confidence 0.0–1.0.
        version: Version string if detectable (may be null).

Supports 100+ languages. Auto-detection identifies the source language
if not specified. Preserves paragraph structure and handles common
HTML entities. Suitable for document translation, multilingual content
generation, and supporting international users.

Args:
    text: Text to translate. May include multiple paragraphs.
    target: Target language as a BCP-47 code (e.g. 'fr', 'de', 'es',
            'zh', 'ja', 'ar', 'pt', 'ru', 'ko', 'hi').
    source: Source language code, or 'auto' to detect automatically
            (default: 'auto').

Returns:
    translated: The translated text.
    source_language: Detected or specified source language code.
    target_language: Target language code.
    confidence: Source language detection confidence (0.0–1.0).

Performs multi-layer validation: RFC-5322 syntax check, MX record lookup
to confirm the domain accepts mail, disposable/temporary domain detection
(against 50,000+ known throwaway providers), and role-address detection
(e.g. admin@, noreply@).

Use this before sending email campaigns, checking signups, or cleaning a
mailing list to reduce bounce rates and spam complaints.

Args:
    email: The email address to validate (e.g. 'user@example.com').

Returns:
    valid (bool): True if the address appears deliverable.
    reason: Human-readable explanation of the result.
    mx_found (bool): Whether the domain has working mail servers.
    is_disposable (bool): True if a known throwaway email provider.
    is_role_address (bool): True if a shared/role address (admin@, info@).

Validates the IBAN checksum algorithm and structure for 80+ participating
countries. Returns decoded bank and account information derived from the
IBAN format (note: does not confirm the account is live or funded).

Args:
    iban: IBAN string to validate. Spaces are allowed and ignored
          (e.g. 'GB29 NWBK 6016 1331 9268 19' or 'GB29NWBK60161331926819').

Returns:
    valid (bool): True if the IBAN passes checksum and format validation.
    iban: Normalised IBAN with no spaces.
    country_code: ISO country code.
    check_digits: The two check digits (positions 3-4).
    bban: Basic Bank Account Number (country-specific format).
    bank_code: Bank identifier extracted from the BBAN (where applicable).
    account_number: Account number portion of the BBAN.

Queries the EU VIES (VAT Information Exchange System) database in real-time
to confirm the VAT number is currently registered and active. Returns the
registered company name and address. Essential for B2B invoice validation,
zero-rating intra-EU supplies, and customer due diligence.

Note: VIES can return 'SERVICE_UNAVAILABLE' during planned maintenance
(typically weekends). The response includes a 'source' field indicating
whether data came from live VIES or a cached fallback.

Args:
    vat_number: VAT number including the two-letter country prefix
                (e.g. 'GB123456789', 'DE123456789', 'FR12345678901').
                Spaces and dashes in the number are ignored.

Returns:
    valid (bool): True if the VAT number is active in VIES.
    country_code: ISO country code of the VAT registration.
    vat_number: Normalised VAT number without country prefix.
    company_name: Registered business name (may be '---' if VIES withholds).
    address: Registered business address (may be '---' if VIES withholds).
    request_date: Date of the VIES query (ISO 8601).

Returns publicly available registration details from WHOIS databases.
Useful for domain due diligence, checking expiry before purchasing,
identifying registrar, or investigating domain ownership.

Note: Many registrars apply GDPR redaction to registrant contact details.
Technical data (nameservers, dates, registrar) is always available.

Args:
    domain: Domain to look up (e.g. 'example.com'). Supports most TLDs.

Returns:
    registrar: Registrar name and IANA ID.
    registered_at: Domain creation date (ISO 8601).
    expires_at: Expiry date — domain may be purchased after this.
    updated_at: Last modification date.
    nameservers: List of authoritative nameservers.
    status: EPP status codes (e.g. clientTransferProhibited).
    registrant: Registrant contact (may be redacted under GDPR).