<div align="center">

# WebToolsHub

### AI-native web tools that run inside your AI

Twelve free, open-source tools for domains and websites. Every tool runs in your
browser, ships with a command line, and plugs into **Claude, ChatGPT, Gemini and
Kimi** through **one MCP connector** and a **REST API**. Connect once, then just
ask your AI.

Built by [Konko Maji](https://www.linkedin.com/in/konkomaji/) · MIT licensed

`Works with:` Claude · ChatGPT / OpenAI · Gemini · Kimi · Cursor · Windsurf · any MCP client

**Live:** https://webtoolshub-blond.vercel.app/ · **Source:** https://github.com/konkomaji/webtoolshub

</div>

---

## The idea: tools that run on your AI

Most web tools are a website and nothing more. WebToolsHub also speaks the
**Model Context Protocol (MCP)** and ships a **REST API**, so your AI assistant
can run every tool for you. It is one connector: set it up once and your AI gets
all twelve tools, no per-tool wiring.

- **One MCP connector** (`mcp_server.py` locally, or the hosted `/api/mcp`) exposes all 13 tool functions.
- **REST API** for anything that speaks HTTP. Four core tools have direct paths; the rest run through a single `/api/tool?name=...` dispatcher. OpenAPI schema in `openapi.yaml`.
- **CLI** with one subcommand per tool.

```bash
# try the local MCP server by hand
printf '%s\n' \
'{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{}}}' \
'{"jsonrpc":"2.0","id":2,"method":"tools/list"}' \
| python mcp_server.py
```

Full setup for every platform: **[CONNECTORS.md](CONNECTORS.md)** and the on-site
[Connect to AI guide](connect/).

---

## The twelve tools

| Tool | Page | What it does |
|------|------|--------------|
| **Domain Name Checker** | `/domain-name-checker/` | Availability across all common TLDs at once, or in bulk. Priority on .com and .in. |
| **WHOIS Lookup** | `/whois-lookup/` | Full RDAP record: registrar, dates, status, nameservers, DNSSEC, contacts. |
| **DNS Checker** | `/dns-checker/` | A, AAAA, CNAME, MX, NS, TXT, SOA, CAA records over DNS-over-HTTPS, with TTLs. |
| **SSL Checker** | `/ssl-checker/` | TLS certificate: issuer, expiry, days left, SAN, TLS version, validity. |
| **Email Auth Checker** | `/email-checker/` | SPF, DMARC, DKIM and MX analysis with a spoofing-protection grade. |
| **Who Is Hosting** | `/who-is-hosting/` | Hosting IP, provider, ASN, country and reverse DNS (DNS + RDAP for IPs). |
| **DNS Propagation** | `/dns-propagation/` | One record across Google, Cloudflare, AdGuard and Quad9, with a consistency flag. |
| **Subdomain Finder** | `/subdomain-finder/` | Subdomains from public Certificate Transparency logs. Passive, no scanning. |
| **Security Headers** | `/security-headers/` | Grades HSTS, CSP, X-Frame-Options and more, with specific fixes. |
| **Redirect Checker** | `/redirect-checker/` | Traces the full HTTP redirect chain hop by hop to the final URL. |
| **Domain Expiry Monitor** | `/domain-expiry-monitor/` | Bulk domain expiry, sorted by urgency. Built for AI renewal alerts. |
| **Homograph Checker** | `/homograph-checker/` | Punycode convert and lookalike / homograph detection (phishing defense). |

Each tool lives in its own folder so it gets an indexable, keyword-targeted URL.
This is the pattern every future tool follows.

### Planned: India-native tools

A set of India-first utilities, most of them pure-logic or one public API, and
rarely available as AI-connected tools anywhere. They will ship as the same
one-connector MCP tools.

| Planned tool | What it does |
|--------------|--------------|
| **GSTIN Validator** | Validate a GST number: checksum, state code and the embedded PAN. |
| **IFSC Lookup** | Bank and branch details from an IFSC code. |
| **PIN Code Lookup** | Area, district and state from an Indian PIN code. |
| **PAN Validator** | Validate PAN format and structure (no data lookup, privacy-safe). |
| **Vehicle RTO Lookup** | State and RTO office from a vehicle registration prefix. |

Want one sooner, or another India tool? Open an issue or email below.

---

## MCP tools (the universal connector)

All served by the same `mcp_server.py` / `/api/mcp` endpoint. Connect once, get all of them.

| MCP tool | Arguments | Returns |
|----------|-----------|---------|
| `check_domain` | name, tlds? | Availability per TLD |
| `check_domains_bulk` | names, tlds? | Availability per name and TLD |
| `whois_lookup` | domain, include_raw? | Full WHOIS/RDAP record |
| `dns_lookup` | domain, types? | DNS records by type |
| `ssl_check` | host, port? | SSL/TLS certificate details |
| `email_auth` | domain, dkim_selector? | SPF/DMARC/DKIM/MX + grade |
| `who_hosts` | domain | Hosting IP, ASN, org, reverse DNS |
| `dns_propagation` | domain, type? | Record across multiple resolvers |
| `find_subdomains` | domain | Subdomains from CT logs |
| `security_headers` | target | HTTP security-header grade |
| `trace_redirects` | target | Full redirect chain |
| `portfolio_expiry` | domains[] | Bulk expiry, sorted by urgency |
| `idn_homograph` | domain | Punycode + homograph detection |

Example asks once connected: *"Is mycoolsite free on .com and .in?"*, *"Who hosts
github.com and when does its domain expire?"*, *"What are the MX records for
example.com and is its SPF set up?"*, *"Is the SSL cert on example.com expiring
soon?"*, *"Does xn--pypal-4ve.com look like a real brand?"*

---

## Security and reliability

Every tool takes an untrusted domain or host and then makes an outbound request
on the server, which is a classic SSRF surface. All outbound access funnels
through one hardened helper, `netutil.py`:

- **Input validation** - domains and hosts are normalized (IDNA/punycode, length, label and TLD rules) before anything touches the network.
- **SSRF protection** - a target is refused if it resolves to any private, loopback, link-local, reserved or multicast address. This blocks `127.0.0.1`, `10.0.0.0/8`, `169.254.169.254` (cloud metadata) and similar. It connects to the exact validated IP to close the DNS-rebinding TOCTOU gap.
- **Safe redirects** - no downgrade to http, no redirect to an internal host.
- **Response caps and retries** - responses are size-capped; transient 429/5xx/timeout are retried with backoff.
- **No crashes, no leaks** - every tool returns a clean JSON error instead of raising; the API layer never leaks a stack trace.

---

## Command line

One CLI, one subcommand per tool.

```bash
# domains and records
python cli.py domain mycoolsite --tlds com,in,io,ai
python cli.py domain --file names.txt --tlds com,in --available --csv > free.csv
python cli.py whois github.com --json
python cli.py dns github.com --types a,mx,txt
python cli.py ssl github.com

# the extended tools
python cli.py email github.com --selector google
python cli.py iphost github.com
python cli.py propagation github.com --type A
python cli.py subdomains github.com
python cli.py headers github.com
python cli.py redirects http://github.com
python cli.py portfolio google.com github.com   # or --file domains.txt
python cli.py idn xn--pypal-4ve.com
```

Add `--json` to any command for the full structured record. Exit codes are
meaningful (e.g. `domain` returns 0 when a name is available, `ssl` when the cert
is valid), so commands script cleanly.

---

## REST API

```
GET /api/check?name=mycoolsite&tlds=com,in        # availability
GET /api/whois?domain=github.com                  # WHOIS (add &raw=1 for raw text)
GET /api/dns?domain=github.com&types=a,mx,txt     # DNS records
GET /api/tls?host=github.com                      # SSL/TLS certificate

# the extended tools share one dispatcher:
GET /api/tool?name=email_auth&domain=github.com&selector=google
GET /api/tool?name=who_hosts&domain=github.com
GET /api/tool?name=dns_propagation&domain=github.com&type=A
GET /api/tool?name=find_subdomains&domain=github.com
GET /api/tool?name=security_headers&target=https://github.com
GET /api/tool?name=trace_redirects&target=http://github.com
GET /api/tool?name=portfolio_expiry&domains=a.com,b.com
GET /api/tool?name=idn_homograph&domain=xn--pypal-4ve.com
```

Run it with `python server.py` (serves the site and all APIs), or deploy it. Full
schema in `openapi.yaml`. One dispatcher keeps the whole suite under the Vercel
serverless function limit.

---

## Run locally

```bash
python server.py
# hub:   http://localhost:8000/
# tools: http://localhost:8000/domain-name-checker/  (and every other tool folder)
```

Browser-only tools (domain, DNS, propagation, homograph) also work fully
client-side on a static host. The rest (WHOIS raw, SSL, hosting, headers,
redirects, subdomains, expiry) use the Python backend, so run `server.py` or
deploy to Vercel for the full set.

---

## Deploy everything on one URL (Vercel, recommended)

GitHub Pages is static and cannot run the API or MCP endpoint. **Vercel** runs the
Python as-is, so one deploy hosts the website, the REST API, and the MCP connector
on a single domain.

1. Push this repo to GitHub.
2. Import it at **vercel.com/new** (no settings needed, `vercel.json` is included).
3. You get:
   - Website + all tool pages
   - REST API: `/api/check`, `/api/whois`, `/api/dns`, `/api/tls`, `/api/tool`
   - MCP connector (all tools): `/api/mcp`

The project uses six serverless functions (`check`, `whois`, `dns`, `tls`, `tool`,
`mcp`) to stay within the free-tier limit. Core module names are deliberately kept
distinct from the function file names to avoid Python import clashes on the
serverless runtime.

---

## Project structure

```
webtoolshub/
  index.html                 hub homepage (lists all tools)
  <tool>/index.html          one folder per tool (12 tools)
  connect/index.html         Connect-to-AI guide
  netutil.py                 shared validation + SSRF-safe networking
  checker.py                 domain availability (RDAP + DNS)
  whoisrec.py                WHOIS/RDAP record
  dnslookup.py               DNS records (DNS-over-HTTPS)
  sslcheck.py                SSL/TLS certificate (port 443)
  emailauth.py               SPF / DMARC / DKIM / MX
  iphost.py                  hosting / IP / ASN / reverse DNS
  propagation.py             multi-resolver DNS propagation
  subdomains.py              subdomains via Certificate Transparency
  headers.py                 HTTP security headers
  redirects.py               redirect chain tracer
  portfolio.py               bulk domain expiry monitor
  idncheck.py                punycode + homograph detection
  tooldispatch.py            shared dispatcher for the extended tools
  cli.py                     one CLI for every tool
  server.py                  local dev server (pages + all APIs)
  mcp_server.py              one MCP server (stdio) exposing all tools
  mcp_http.py                remote MCP server (HTTP)
  api/                       Vercel functions: check, whois, dns, tls, tool, mcp
  vercel.json  requirements.txt
  openapi.yaml               REST schema (GPT Actions / Gemini)
  robots.txt  sitemap.xml  llms.txt   (SEO / AEO / GEO)
  CONNECTORS.md  README.md  CONTRIBUTING.md  LICENSE
```

---

## SEO, AEO and GEO

- Per-tool folders with keyword-targeted titles, descriptions and H1s.
- Structured data on every page: `WebSite`, `ItemList`, `WebApplication`, `BreadcrumbList`, `HowTo`, `FAQPage`.
- Open Graph and Twitter cards with a share image.
- `robots.txt` (allows AI crawlers), `sitemap.xml`, and `llms.txt` positioning the site as AI-native web tools.
- Visible FAQ and how-to content on every tool for answer engines.

---

## Requirements

Python 3.8 or newer. No packages to install. No build step. Standard library only.

## Fork and self-host

WebToolsHub is fully open source. Fork it, run `python server.py`, or deploy your
own copy to Vercel. If you host under a different URL, replace `konkomaji` and the
`webtoolshub-blond.vercel.app` base URLs across `index.html`, the tool folders,
`connect/index.html`, `robots.txt`, `sitemap.xml`, `llms.txt` and `openapi.yaml`.

## Contact

- Feature requests, bug reports and feedback: **work.konkomaji@gmail.com**
- Author: [Konko Maji on LinkedIn](https://www.linkedin.com/in/konkomaji/)

Trademarks (Claude, ChatGPT, OpenAI, Gemini, Kimi, Cursor) belong to their
respective owners and are shown only to indicate compatibility.

## License

MIT. Free to use, change and share. See [LICENSE](LICENSE).
Built by [Konko Maji](https://www.linkedin.com/in/konkomaji/).