passiv-mcp
# passiv-mcp
MCP server that gives AI agents free web tools — zero auth, zero dependencies.
Four tools, backed by the free APIs at [mahope.tools](https://mahope.tools):
| Tool | What it does |
|------|--------------|
| `html_to_markdown` | Convert HTML to clean Markdown or plain text (max 50 KB/call) |
| `compliance_scan` | 9-point EU compliance scan: privacy policy, terms, cookie consent, imprint, accessibility statement, DPA, security headers, meta tags, hreflang |
| `profile_page` | Page profile: meta/OG tags, JSON-LD, heading structure, alt-text coverage, security headers, score + grade |
| `check_security_headers` | CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy |
Listed in the official [MCP Registry](https://registry.modelcontextprotocol.io) as `io.github.mahope/passiv-mcp`.
Works with any MCP client: Claude Desktop, Claude Code, Cursor, Windsurf, and others.
## Install
No dependencies. Node.js 18+ required.
### Run with npx (no install needed)
```bash
npx @mahope/passiv-mcp
```
### Claude Desktop
Add to `claude_desktop_config.json`:
```json
{
"mcpServers": {
"passiv": {
"command": "npx",
"args": ["@mahope/passiv-mcp"]
}
}
}
```
### Claude Code
```bash
claude mcp add passiv -- npx @mahope/passiv-mcp
```
## Example prompts
Once connected, try:
- "Convert this HTML snippet to Markdown: <h1>…</h1>…"
- "Scan example.com for GDPR compliance basics"
- "Check the security headers on my site"
- "Profile this page and tell me what meta tags are missing"
## Privacy
URLs sent to a tool are fetched server-side by the mahope.tools scan proxy and not stored.
HTML sent to `html_to_markdown` is converted and discarded immediately.
## Related
- [Clean Copy](https://github.com/mahope/clean-copy) — browser extension, same Markdown engine
- [clean-copy-cli](https://github.com/mahope/clean-copy-cli) — CLI version
- [compliance-site-check](https://github.com/mahope/compliance-site-check) — GitHub Action with the compliance engine
## Releasing
`npm run release -- patch` (or `minor`/`major`) bumps the version, commits and pushes the tag.
CI publishes to npm and creates the GitHub release.
## License
MIT
## Author
Built by Mads Holst Jensen — developer and technical partner for small businesses, Odense, Denmark. https://mahoje.dk
TDQS
Scored across 4 tools
The four tools have distinct primary purposes: security headers, HTML conversion, compliance scanning, and page profiling. However, there is some overlap: both compliance_scan and profile_page include security headers in their checks, and check_security_headers is a standalone tool for the same. This minor redundancy could cause confusion about which tool to use for security header information.
All tool names follow a consistent verb_noun or noun_noun pattern (check_security_headers, html_to_markdown, compliance_scan, profile_page). They are clear, descriptive, and use snake_case uniformly with no mixing of conventions.
Four tools is a reasonable number for a focused web analysis and conversion server. It covers distinct functionalities without bloat. Slightly on the lower side but adequate for the apparent scope.
The server covers several web page analysis and conversion tasks, but notable gaps exist: no tool for analyzing performance metrics, broken links, or SEO beyond compliance and profiling. More importantly, check_security_headers is subsumed by compliance_scan and profile_page, suggesting incomplete decomposition or redundant surface. However, for the listed core functionalities, the surface is complete.