OnlineCyberTools MCP (280+ filterable tools)

security_htaccess_generator

Read-onlyIdempotent

Generate Apache .htaccess file text for security, redirects, caching, compression, and access control using structured options. No file writing; returns the text for copying.

Instructions

Apache .htaccess Generator. Build the text of an Apache 2.4+ .htaccess file from structured options, then return it as a string for you to copy or save - it does NOT deploy, write, or touch any file on any server. Assembles named directive groups on demand: force HTTPS (mod_rewrite), www/non-www canonicalisation, mod_alias path redirects (301/302/303/307/308), custom mod_rewrite rules, IP allow/deny access control (Order/Deny/Allow, IPv4+CIDR / IPv6), custom ErrorDocument pages, GZIP (mod_deflate) and Brotli (mod_brotli) compression, mod_expires + mod_headers browser-cache lifetimes, directory-listing toggle, Referer hotlink protection, and free-form appended rules. Use security_csp_generator for Content-Security-Policy headers, security_robots_txt_generator for robots.txt, or linux_web_server_config_generator for full Apache/Nginx/Caddy vhost configs. Set operation to "presets" to list ready-made configurations instead of generating. Runs locally via a sandboxed compiled module: read-only, non-destructive, c

Input Schema

TableJSON Schema

Name	Required	Description	Default
`operation`	Yes	"generate" builds .htaccess text from the options below; "presets" ignores all options and returns the curated preset list.	generate
`forceHttps`	No	Emit a mod_rewrite block that 301-redirects every HTTP request to HTTPS.
`wwwMode`	No	Canonical host: force the www subdomain, force the bare apex, or emit no host-canonicalisation rule.	leave-alone
`redirects`	No	mod_alias path-prefix redirects. Empty from/to, self-redirects, and homepage catches raise warnings.
`rewrites`	No	Custom mod_rewrite rules. Pattern is regex-compiled for a warning check (Apache uses PCRE).
`denyIps`	No	IPv4/IPv6 addresses or CIDR ranges to block (Deny from). Invalid entries still emit but raise a warning.
`allowIps`	No	IPv4/IPv6 addresses or CIDR ranges to allow; when set alone, everyone else is denied.
`errorPages`	No	Map of HTTP status code (400-599, as string key) to ErrorDocument path, e.g. 404 to /404.html.
`gzip`	No	Emit a mod_deflate GZIP AddOutputFilterByType block for text/JS/CSS/JSON.
`brotli`	No	Emit a mod_brotli compression block (typically 15-25% smaller than gzip).
`cacheHeaders`	No	mod_expires + mod_headers cache lifetimes. Omit or use 0 to skip a tier.
`directoryListing`	No	Autoindex: disabled emits Options -Indexes, enabled emits Options +Indexes, leave-alone emits nothing.	leave-alone
`hotlinkProtection`	No	Referer-based image hotlink protection via mod_rewrite.
`customRules`	No	Free-form Apache directives appended verbatim at the end of the file.

Output Schema

TableJSON Schema

Name	Required	Description
`success`	No	Whether the request succeeded.
`operation`	No	The operation performed (generate or presets).
`result`	No	For operation=generate: the generated file and metadata. For operation=presets: a presets array.

Schema Changelog

Changes observed during successful MCP inspections.

Changed21 schema fields changedv0.5.1Jun 3, 2026

addedInput schema / additionalProperties
```
Added value: +false
```

addedInput schema / properties / allowIps

Added value: +{
+  "description": "IPv4/IPv6 addresses or CIDR ranges to allow; when set alone, everyone else is denied.",
+  "items": {
+    "type": "string"
+  },
+  "type": "array"
+}

addedInput schema / properties / brotli

Added value: +{
+  "default": false,
+  "description": "Emit a mod_brotli compression block (typically 15-25% smaller than gzip).",
+  "type": "boolean"
+}

addedInput schema / properties / cacheHeaders

Added value: +{
+  "additionalProperties": false,
+  "description": "mod_expires + mod_headers cache lifetimes. Omit or use 0 to skip a tier.",
+  "properties": {
+    "htmlMinutes": {
+      "description": "Cache lifetime in minutes for text/html. Over 10080 (1 week) warns.",
+      "minimum": 1,
+      "type": "integer"
+    },
+    "staticDays": {
+      "description": "Cache lifetime in days for static assets (images/CSS/JS/fonts). Over 365 warns.",
+      "minimum": 1,
+      "type": "integer"
+    }
+  },
+  "type": "object"
+}

addedInput schema / properties / customRules

Added value: +{
+  "description": "Free-form Apache directives appended verbatim at the end of the file.",
+  "type": "string"
+}

addedInput schema / properties / denyIps

Added value: +{
+  "description": "IPv4/IPv6 addresses or CIDR ranges to block (Deny from). Invalid entries still emit but raise a warning.",
+  "items": {
+    "type": "string"
+  },
+  "type": "array"
+}

addedInput schema / properties / directoryListing

Added value: +{
+  "default": "leave-alone",
+  "description": "Autoindex: disabled emits Options -Indexes, enabled emits Options +Indexes, leave-alone emits nothing.",
+  "enum": [
+    "enabled",
+    "disabled",
+    "leave-alone"
+  ],
+  "type": "string"
+}

addedInput schema / properties / errorPages

Added value: +{
+  "additionalProperties": {
+    "type": "string"
+  },
+  "description": "Map of HTTP status code (400-599, as string key) to ErrorDocument path, e.g. 404 to /404.html.",
+  "type": "object"
+}

addedInput schema / properties / forceHttps / default
```
Added value: +false
```

addedInput schema / properties / forceHttps / description

Added value: +"Emit a mod_rewrite block that 301-redirects every HTTP request to HTTPS."

addedInput schema / properties / gzip / default
```
Added value: +false
```

addedInput schema / properties / gzip / description

Added value: +"Emit a mod_deflate GZIP AddOutputFilterByType block for text/JS/CSS/JSON."

addedInput schema / properties / hotlinkProtection

Added value: +{
+  "additionalProperties": false,
+  "description": "Referer-based image hotlink protection via mod_rewrite.",
+  "properties": {
+    "allowedDomains": {
+      "description": "Domains whose Referer is permitted; empty list warns (would block all cross-origin images).",
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "enabled": {
+      "default": false,
+      "description": "Turn on hotlink protection.",
+      "type": "boolean"
+    },
+    "replacement": {
+      "description": "Optional replacement image URL for blocked requests; blank returns 403 (Forbidden).",
+      "type": "string"
+    }
+  },
+  "required": [
+    "enabled"
+  ],
+  "type": "object"
+}

addedInput schema / properties / operation

Added value: +{
+  "default": "generate",
+  "description": "\"generate\" builds .htaccess text from the options below; \"presets\" ignores all options and returns the curated preset list.",
+  "enum": [
+    "generate",
+    "presets"
+  ],
+  "type": "string"
+}

addedInput schema / properties / redirects

Added value: +{
+  "description": "mod_alias path-prefix redirects. Empty from/to, self-redirects, and homepage catches raise warnings.",
+  "items": {
+    "additionalProperties": false,
+    "properties": {
+      "from": {
+        "description": "Source path prefix, e.g. /old.",
+        "type": "string"
+      },
+      "to": {
+        "description": "Destination URL or path, e.g. /new.",
+        "type": "string"
+      },
+      "type": {
+        "default": "301",
+        "description": "HTTP redirect status code; unknown values fall back to 301 with a warning.",
+        "enum": [
+          "301",
+          "302",
+          "303",
+          "307",
+          "308"
+        ],
+        "type": "string"
+      }
+    },
+    "required": [
+      "from",
+      "to"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}

addedInput schema / properties / rewrites

Added value: +{
+  "description": "Custom mod_rewrite rules. Pattern is regex-compiled for a warning check (Apache uses PCRE).",
+  "items": {
+    "additionalProperties": false,
+    "properties": {
+      "flags": {
+        "description": "PCRE flags without brackets, e.g. R=301 and L.",
+        "items": {
+          "type": "string"
+        },
+        "type": "array"
+      },
+      "pattern": {
+        "description": "RewriteRule match pattern, e.g. ^old/(.*)$.",
+        "type": "string"
+      },
+      "target": {
+        "description": "RewriteRule substitution target, e.g. /new/$1.",
+        "type": "string"
+      }
+    },
+    "required": [
+      "pattern",
+      "target"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}

addedInput schema / properties / wwwMode / default
```
Added value: +"leave-alone"
```

addedInput schema / properties / wwwMode / description

Added value: +"Canonical host: force the www subdomain, force the bare apex, or emit no host-canonicalisation rule."

addedInput schema / properties / wwwMode / enum

Added value: +[
+  "force-www",
+  "force-non-www",
+  "leave-alone"
+]

changedInput schema / required

Previous value: -[
-  "forceHttps",
-  "wwwMode",
-  "gzip"
-]New value: +[
+  "operation"
+]

changedOutput schema / (root)

Previous value: -nullNew value: +{
+  "properties": {
+    "operation": {
+      "description": "The operation performed (generate or presets).",
+      "type": "string"
+    },
+    "result": {
+      "description": "For operation=generate: the generated file and metadata. For operation=presets: a presets array.",
+      "properties": {
+        "htaccess": {
+          "description": "The complete assembled .htaccess file text (generate only).",
+          "type": "string"
+        },
+        "presets": {
+          "description": "Curated presets (presets only).",
+          "items": {
+            "properties": {
+              "description": {
+                "description": "What the preset configures.",
+                "type": "string"
+              },
+              "id": {
+                "description": "Preset id, e.g. wordpress-security.",
+                "type": "string"
+              },
+              "input": {
+                "description": "The generator input object the preset applies.",
+                "type": "object"
+              },
+              "name": {
+                "description": "Human-readable preset name.",
+                "type": "string"
+              }
+            },
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "sections": {
+          "description": "Per-feature breakdown of the emitted blocks (generate only).",
+          "items": {
+            "properties": {
+              "content": {
+                "description": "The raw directive text for that section.",
+                "type": "string"
+              },
+              "description": {
+                "description": "What the section does.",
+                "type": "string"
+              },
+              "name": {
+                "description": "Section id, e.g. force-https, gzip.",
+                "type": "string"
+              }
+            },
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "warnings": {
+          "description": "Human-readable validation/safety warnings (invalid IPs, risky redirects, aggressive cache, etc.).",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        }
+      },
+      "type": "object"
+    },
+    "success": {
+      "description": "Whether the request succeeded.",
+      "type": "boolean"
+    }
+  },
+  "type": "object"
+}

First observedv0.1.0May 31, 2026

TDQS

A4.9/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate read-only, non-destructive, idempotent. The description reinforces that it does not touch any server files and runs locally in a sandbox. No contradictions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single paragraph that front-loads the core purpose and lists features comprehensively. While slightly dense, it is still relatively concise and well-structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (14 params, nested objects, output schema), the description covers purpose, behavior, parameter details, warnings, and alternatives. It is complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Despite 100% schema coverage, the description adds valuable context beyond schema, such as warnings for self-redirects, explanations of wwwMode values, and compression size comparisons.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool generates Apache .htaccess text from structured options and returns it as a string, emphasizing it does not deploy or write files. It lists many features and distinguishes from sibling tools like security_csp_generator.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly tells when to use this tool versus alternatives (e.g., 'Use security_csp_generator for Content-Security-Policy headers'). Also explains the 'presets' operation for listing ready-made configurations.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server