Exact developer checks: email DNS, Supabase RLS, cron, JSON, contrast, time zones, npm/PyPI packages
Maintain this server? Claim it
Call this server's tools from your browser. Nothing to install.
Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.
Tool list from our last check. Connect live to refresh it.
Use when you need to check a live Supabase project rather than migration files: returns a read-only SQL query that reads table RLS settings, grants for anon and authenticated, policies, SECURITY DEFINER functions and storage buckets (never row data) and returns one JSON value. Run it with the user's Supabase SQL Editor or a Supabase MCP execute_sql tool, then pass the JSON to deadbolt_check_supabase_access.
This tool takes no arguments.
Pick your client. Values in capitals, like YOUR_TOKEN, are yours to fill in.
Run in a terminal
claude mcp add --transport http dev https://dev.clawhard.com/mcp
Tool list last changed Nov 9, 2026.
Use when you need to check a live Supabase project rather than migration files: returns a read-only SQL query that reads table RLS settings, grants for anon and authenticated, policies, SECURITY DEFINER functions and storage buckets (never row data) and returns one JSON value. Run it with the user's Supabase SQL Editor or a Supabase MCP execute_sql tool, then pass the JSON to deadbolt_check_supabase_access.
No arguments.
{
"type": "object",
"required": [],
"properties": {}
}Use when you write, review or are about to apply Supabase / PostgreSQL migration SQL (CREATE TABLE, RLS, CREATE POLICY, GRANT, views, SECURITY DEFINER functions, storage buckets), or when a user asks whether their Supabase data is exposed, whether RLS is set up right, or why a query returns 42501 permission denied or no rows. Replays the SQL with real Postgres rules and returns, per table, what signed-out (anon) and signed-in (authenticated) users can SELECT/INSERT/UPDATE/DELETE (all rows, own rows, some rows, none, or denied for a missing grant), plus findings with severity and ready-to-run fix SQL: RLS off, policies written but RLS never enabled, using(true) writes, personal columns readable by anyone, views that bypass RLS, SECURITY DEFINER functions anyone can call, user_metadata in policies, public bucket listing, grants missing after the Oct 30 2026 default change. Also accepts the JSON produced by deadbolt_catalog_query for the live database. Deterministic; never connects to any database. Up to 200,000 characters.
| Argument | Type | Description |
|---|---|---|
| sql* | string | Migration SQL (one or many files concatenated, in order), or the single JSON value returned by the catalog query. |
| project_created_before_2026_10_30 | boolean | Only for SQL input. true (default): the project grants new public tables to anon and authenticated automatically (projects created before Oct 30, 2026). false: new tables get no grants unless the SQL grants them (projects created on or after Oct 30, 2026). |
{
"type": "object",
"required": [
"sql"
],
"properties": {
"sql": {
"type": "string",
"maxLength": 200000,
"minLength": 1,
"description": "Migration SQL (one or many files concatenated, in order), or the single JSON value returned by the catalog query."
},
"project_created_before_2026_10_30": {
"type": "boolean",
"description": "Only for SQL input. true (default): the project grants new public tables to anon and authenticated automatically (projects created before Oct 30, 2026). false: new tables get no grants unless the SQL grants them (projects created on or after Oct 30, 2026)."
}
}
}Use when the user asks whether their site (or any public site), or a robots.txt they pasted, blocks ChatGPT, Claude, Google AI, Perplexity or other AI crawlers, whether AI can read or train on their content, or why AI search does not mention their site. Fetches the live robots.txt and reports, for 22 named AI bots in four groups (AI training, AI search, assistants, search engines), which are let in, kept out or partly blocked, plus the site's content-signal preference and fixes. Example: {"url": "example.com"} or {"robots_txt": "User-agent: GPTBot\nDisallow: /"}. Pass robots_txt instead of url to check a draft or pasted file without fetching anything. Read-only.
| Argument | Type | Description |
|---|---|---|
| url | string | Website address or domain, e.g. nytimes.com. Send this or robots_txt. |
| robots_txt | string | robots.txt text to check instead of fetching a site (a draft or a pasted file, up to 512 KB). Empty means no robots.txt. |
{
"type": "object",
"properties": {
"url": {
"type": "string",
"description": "Website address or domain, e.g. nytimes.com. Send this or robots_txt."
},
"robots_txt": {
"type": "string",
"minLength": 0,
"description": "robots.txt text to check instead of fetching a site (a draft or a pasted file, up to 512 KB). Empty means no robots.txt."
}
}
}Use when you are about to read a big JSON response, log or export into context, before loading it: returns a compact outline of the structure (keys, types, array lengths, one example per repeated shape) so you can plan a query without spending tokens on the whole document. Repairs the JSON first if needed. Follow with mend_query_json to pull only the values you need. Up to 100,000 characters.
| Argument | Type | Description |
|---|---|---|
| text* | string | The JSON (or JSON-ish text). |
| max_depth | integer | How many levels to expand. Default 4. |
| max_items | integer | How many array items to show when items differ. Default 6. |
{
"type": "object",
"required": [
"text"
],
"properties": {
"text": {
"type": "string",
"maxLength": 100000,
"minLength": 1,
"description": "The JSON (or JSON-ish text)."
},
"max_depth": {
"type": "integer",
"maximum": 10,
"minimum": 1,
"description": "How many levels to expand. Default 4."
},
"max_items": {
"type": "integer",
"maximum": 20,
"minimum": 1,
"description": "How many array items to show when items differ. Default 6."
}
}
}Use when you need specific fields from a JSON document without reading all of it: $.users[0].name, $.items[*].id, $.a.b[-1], $.list[1:3], $..email (recursive). Returns each match with its exact path, type and value. Repairs the JSON first if needed, so broken input still works. Up to 100,000 characters.
| Argument | Type | Description |
|---|---|---|
| max | integer | Maximum matches to return. Default 50. |
| path* | string | Path such as $.users[*].email, data.items[0], $..id, $.list[-1], $.list[1:3]. |
| text* | string | The JSON (or JSON-ish text). |
{
"type": "object",
"required": [
"text",
"path"
],
"properties": {
"max": {
"type": "integer",
"maximum": 200,
"minimum": 1,
"description": "Maximum matches to return. Default 50."
},
"path": {
"type": "string",
"maxLength": 300,
"minLength": 1,
"description": "Path such as $.users[*].email, data.items[0], $..id, $.list[-1], $.list[1:3]."
},
"text": {
"type": "string",
"maxLength": 100000,
"minLength": 1,
"description": "The JSON (or JSON-ish text)."
}
}
}Use when JSON from an LLM, API, log, config or copy-paste fails to parse (JSON.parse error, "Unexpected token", "Expecting property name"), or the user pastes JSON with trailing commas, single quotes, unquoted keys, comments, Python True/False/None, NaN, missing commas or brackets, a ```json fence, text around it, or output that was cut off. Deterministic repair: returns valid, formatted JSON plus a list of every fix with line and column. Values are never rewritten, so big numbers, number formatting and key order stay exactly as written. If the text is already valid it says so. Up to 100,000 characters.
| Argument | Type | Description |
|---|---|---|
| text* | string | The broken JSON, or any text that contains JSON (a chat reply, a log line, a code block). |
| indent | integer | Spaces per indent level in the output. Default 2. Use 0 for one minified line. |
| sort_keys | boolean | Sort object keys alphabetically. Default false (keep the original order). |
{
"type": "object",
"required": [
"text"
],
"properties": {
"text": {
"type": "string",
"maxLength": 100000,
"minLength": 1,
"description": "The broken JSON, or any text that contains JSON (a chat reply, a log line, a code block)."
},
"indent": {
"type": "integer",
"maximum": 8,
"minimum": 0,
"description": "Spaces per indent level in the output. Default 2. Use 0 for one minified line."
},
"sort_keys": {
"type": "boolean",
"description": "Sort object keys alphabetically. Default false (keep the original order)."
}
}
}Use when you need to convert a specific wall-clock time from one place to others, for any date. It uses the real tz database, so daylight saving is right for that exact date (the US and Europe switch on different weeks), and it warns when the time does not exist (spring forward) or happens twice (fall back). Time accepts "15:00", "3:30pm", "noon", "now" or an ISO local time like 2026-11-05T15:00 (no Z). Date defaults to today in the source zone. Returns {input, utc, source:{...}, converted:[{place, zone, local, time_12h, date, utc_offset, abbreviation, day_note, hours_ahead_of_source}], warning?, summary, open_url}.
| Argument | Type | Description |
|---|---|---|
| to* | array | Destination places, e.g. ["London","Tokyo"]. |
| date | string | Optional date YYYY-MM-DD in the source zone. Default today. |
| from* | string | Source place or zone, e.g. "New York" or "America/New_York". |
| time* | string | Local time in the source place, e.g. "15:00", "3:30pm", "noon", "now", "2026-11-05T15:00". |
{
"type": "object",
"required": [
"time",
"from",
"to"
],
"properties": {
"to": {
"type": "array",
"items": {
"type": "string",
"maxLength": 60,
"minLength": 1
},
"maxItems": 12,
"minItems": 1,
"description": "Destination places, e.g. [\"London\",\"Tokyo\"]."
},
"date": {
"type": "string",
"maxLength": 10,
"description": "Optional date YYYY-MM-DD in the source zone. Default today."
},
"from": {
"type": "string",
"maxLength": 60,
"minLength": 1,
"description": "Source place or zone, e.g. \"New York\" or \"America/New_York\"."
},
"time": {
"type": "string",
"maxLength": 40,
"minLength": 1,
"description": "Local time in the source place, e.g. \"15:00\", \"3:30pm\", \"noon\", \"now\", \"2026-11-05T15:00\"."
}
}
}Use when you need to schedule a call across several places. Scans the day in 15-minute steps and ranks start times so the most people are inside working hours and nobody is at night, using each place's real offset and DST for that date. Returns up to 5 slots with each person's local start and end, and says plainly when no time works for everyone. Defaults: working hours 9 to 17, 60 minutes, date today in the first place.
| Argument | Type | Description |
|---|---|---|
| date | string | Date YYYY-MM-DD, local to the first place. Default today. |
| count | integer | How many slots to return, default 5. |
| places* | array | Where each attendee is, e.g. ["San Francisco","London","Tokyo"]. |
| end_hour | integer | Working day end hour, default 17. |
| start_hour | integer | Working day start hour, default 9. |
| duration_minutes | integer | Meeting length in minutes, multiple of 15. Default 60. |
{
"type": "object",
"required": [
"places"
],
"properties": {
"date": {
"type": "string",
"maxLength": 10,
"description": "Date YYYY-MM-DD, local to the first place. Default today."
},
"count": {
"type": "integer",
"maximum": 8,
"minimum": 1,
"description": "How many slots to return, default 5."
},
"places": {
"type": "array",
"items": {
"type": "string",
"maxLength": 60,
"minLength": 1
},
"maxItems": 8,
"minItems": 2,
"description": "Where each attendee is, e.g. [\"San Francisco\",\"London\",\"Tokyo\"]."
},
"end_hour": {
"type": "integer",
"maximum": 24,
"minimum": 1,
"description": "Working day end hour, default 17."
},
"start_hour": {
"type": "integer",
"maximum": 23,
"minimum": 0,
"description": "Working day start hour, default 9."
},
"duration_minutes": {
"type": "integer",
"maximum": 480,
"minimum": 15,
"description": "Meeting length in minutes, multiple of 15. Default 60."
}
}
}Use when the user asks what time or date it is right now somewhere. Reads the server clock and returns the current time, date, UTC offset, abbreviation and daylight saving status for each place. Places can be cities ("Tokyo"), IANA zones ("Europe/Paris"), abbreviations ("PST") or "UTC+5:30".
| Argument | Type | Description |
|---|---|---|
| places* | array | Cities, IANA zones or abbreviations, e.g. ["London","Asia/Tokyo"]. |
{
"type": "object",
"required": [
"places"
],
"properties": {
"places": {
"type": "array",
"items": {
"type": "string",
"maxLength": 60,
"minLength": 1
},
"maxItems": 12,
"minItems": 1,
"description": "Cities, IANA zones or abbreviations, e.g. [\"London\",\"Asia/Tokyo\"]."
}
}
}Use when you need to answer "what is the UTC offset of X", "does X observe daylight saving" and "when do the clocks change". Returns the current offset and abbreviation, whether the place observes DST, every clock change in the year with exact local before and after times, and the next change. Abbreviations like IST or CST are ambiguous, so the answer says which zone was used.
| Argument | Type | Description |
|---|---|---|
| year | integer | Year to list clock changes for. Default this year. |
| place* | string | City, IANA zone or abbreviation, e.g. "London" or "America/Phoenix". |
{
"type": "object",
"required": [
"place"
],
"properties": {
"year": {
"type": "integer",
"maximum": 2100,
"minimum": 1970,
"description": "Year to list clock changes for. Default this year."
},
"place": {
"type": "string",
"maxLength": 60,
"minLength": 1,
"description": "City, IANA zone or abbreviation, e.g. \"London\" or \"America/Phoenix\"."
}
}
}Use when the user or an agent is about to install or import npm or PyPI packages: before npm install or pip install, when adding lines to package.json or requirements.txt, or when a package name came from an AI answer, a tutorial or memory and may be invented. Looks each name up in the live registry and returns whether it exists, the latest version, whether a pinned version exists, weekly downloads, first and last publish dates, deprecation or yanked status, install-time scripts, whether the name is one or two typed characters from a well-known package, and real similar packages when the name does not exist. Example: {"packages":[{"ecosystem":"npm","name":"@anthropic/mcp-client"},{"ecosystem":"pypi","name":"requests","version":"2.32.3"}]}. Up to 10 packages per call; versions must be exact, not ranges. Not a malware or vulnerability scan: "ok" means it exists and nothing looked wrong.
| Argument | Type | Description |
|---|---|---|
| packages* | array | 1 to 10 packages to look up. |
{
"type": "object",
"required": [
"packages"
],
"properties": {
"packages": {
"type": "array",
"items": {
"type": "object",
"required": [
"ecosystem",
"name"
],
"properties": {
"name": {
"type": "string",
"maxLength": 214,
"minLength": 1,
"description": "The package name only, e.g. left-pad, @types/node or requests. No version, extras (requests[security]), URL or path."
},
"version": {
"type": "string",
"maxLength": 64,
"description": "Optional: one exact version to verify, e.g. 4.17.21 (npm also accepts a dist-tag like latest). Not a range such as ^4.17.0."
},
"ecosystem": {
"enum": [
"npm",
"pypi"
],
"type": "string",
"description": "Which registry: npm (JavaScript, TypeScript, Node) or pypi (Python)."
}
}
},
"maxItems": 10,
"minItems": 1,
"description": "1 to 10 packages to look up."
}
}
}Use when you or the user are about to publish or edit an SPF, DMARC or DKIM TXT record, for example after writing a new SPF record that adds a sending service, or when the user pastes a record and asks "is this right?". Detects the record type. SPF: syntax per RFC 7208, every include and redirect followed live in DNS and counted against the 10-lookup limit, void lookups, loops, the final all; returns a lookup tree. DMARC: RFC 7489 tags and values (p, sp, pct, rua/ruf, adkim/aspf, fo). DKIM: key type and RSA key size read from the key, revoked (empty p=) or truncated keys. Returns valid true/false, errors, warnings and where to publish it. Pass domain so a/mx terms without a value can be resolved.
| Argument | Type | Description |
|---|---|---|
| domain | string | Optional: the domain the record is for, so SPF a and mx terms can be checked. |
| record* | string | The TXT record value, e.g. "v=spf1 include:_spf.google.com ~all" or "v=DMARC1; p=none; rua=mailto:[email protected]". Quoted chunks ("..." "...") are joined. |
{
"type": "object",
"required": [
"record"
],
"properties": {
"domain": {
"type": "string",
"maxLength": 300,
"minLength": 1,
"description": "Optional: the domain the record is for, so SPF a and mx terms can be checked."
},
"record": {
"type": "string",
"maxLength": 4000,
"minLength": 1,
"description": "The TXT record value, e.g. \"v=spf1 include:_spf.google.com ~all\" or \"v=DMARC1; p=none; rua=mailto:[email protected]\". Quoted chunks (\"...\" \"...\") are joined."
}
}
}Use when the user asks why their email goes to spam, whether their domain is set up to send email, or before they launch a newsletter, cold outreach, transactional email or a new sending service, e.g. "why are my emails going to spam?", "is my SPF/DKIM/DMARC right?", "do I meet Gmail and Yahoo's sender requirements?" or "I added SendGrid, did I break SPF?". Reads public DNS (DNS-over-HTTPS) and checks: SPF (exactly one record, every include followed and DNS lookups counted per RFC 7208 against the limit of 10, void lookups, loops, +all/?all, ptr), DMARC (RFC 7489 syntax, policy, pct, alignment, inherited from the parent domain, and whether an external report address authorized it), DKIM (17 common selectors plus any you pass; key type and RSA key size read from the key, revoked or broken keys), and MX (provider, null MX). Returns a grade A-F, a verdict, each check with status pass/warn/fail/info, whether the Gmail, Yahoo and Outlook.com sender rules are met, and copy-ready DNS records to fix problems (e.g. one merged SPF record, a starter DMARC record). DNS cannot list DKIM selectors, so when none of the common selectors is found the result says so and a known selector (the s= value in a DKIM-Signature header) can be passed in. Accepts a domain, an email address or a URL. Results are cached for 5 minutes; pass fresh=true right after the user changes DNS.
| Argument | Type | Description |
|---|---|---|
| fresh | boolean | true to skip the 5-minute cache, e.g. right after a DNS change. |
| domain* | string | The sending domain, e.g. mycompany.com. An email address ([email protected]) or a URL also works. |
| dkim_selectors | array | Extra DKIM selectors to try besides the common ones, e.g. ["mxvault"]. Find it as s= in a DKIM-Signature header or in the provider's setup page. |
Use when the user asks whether a color combination is readable or accessible, passes WCAG AA or AAA, or has enough contrast (text on a background, button, badge, link color), or what a color is in another format. Returns the exact contrast ratio, pass or fail for normal text, large text and UI components at AA and AAA, the APCA lightness contrast and a plain note. Colors can be hex, rgb(), hsl() or CSS names. Example: {"foreground": "#777777", "background": "#ffffff"}. Also returns each color in hex, rgb, hsl and oklch with its nearest CSS name.
| Argument | Type | Description |
|---|---|---|
| background* | string | Background color, e.g. "#ffffff". |
| foreground* | string | Text (or icon) color, e.g. "#767676" or "rgb(20 20 20)" or "tomato". |
{
"type": "object",
"required": [
"foreground",
"background"
],
"properties": {
"background": {
"type": "string",
"maxLength": 80,
"minLength": 1,
"description": "Background color, e.g. \"#ffffff\"."
},
"foreground": {
"type": "string",
"maxLength": 80,
"minLength": 1,
"description": "Text (or icon) color, e.g. \"#767676\" or \"rgb(20 20 20)\" or \"tomato\"."
}
}
}Use when the user has a whole design system, theme or stylesheet and wants every text and background pair checked for accessibility in one go. Takes up to 50 pairs and returns the ratio and AA and AAA results for each, with a count of failures. Example: {"pairs": [{"foreground": "#777", "background": "#fff", "label": "muted text"}, {"foreground": "#fff", "background": "#ff5a1f", "label": "button"}]}.
| Argument | Type | Description |
|---|---|---|
| pairs* | array | Pairs to check. |
{
"type": "object",
"required": [
"pairs"
],
"properties": {
"pairs": {
"type": "array",
"items": {
"type": "object",
"required": [
"foreground",
"background"
],
"properties": {
"label": {
"type": "string",
"maxLength": 60,
"description": "Optional name, like \"muted text on card\"."
},
"background": {
"type": "string",
"maxLength": 80,
"minLength": 1
},
"foreground": {
"type": "string",
"maxLength": 80,
"minLength": 1
}
}
},
"maxItems": 50,
"minItems": 1,
"description": "Pairs to check."
}
}
}Use when a color pair fails contrast and the user wants the smallest change that makes it pass, such as "make this gray text accessible without changing the look". Returns the closest text color on that background that reaches the target (AA, AAA, AA-large or ui), and separately the closest background, keeping the hue. Example: {"foreground": "#777777", "background": "#ffffff", "target": "AA"}. Returns already_passes if nothing needs to change.
| Argument | Type | Description |
|---|---|---|
| target | string | Contrast target. Default AA. |
| background* | string | Current background color. |
| foreground* | string | Current text color. |
{
"type": "object",
"required": [
"foreground",
"background"
],
"properties": {
"target": {
"enum": [
"AA",
"AAA",
"AA-large",
"ui"
],
"type": "string",
"description": "Contrast target. Default AA."
},
"background": {
"type": "string",
"maxLength": 80,
"minLength": 1,
"description": "Current background color."
},
"foreground": {
"type": "string",
"maxLength": 80,
"minLength": 1,
"description": "Current text color."
}
}
}Use when the user asks for a palette, shades, tints, a design-token scale or a Tailwind-style 50 to 950 ramp from a brand color. Returns 11 steps that keep the hue, with the hex, contrast on white and on black, and the best text color for each step. Example: {"color": "#ff5a1f", "name": "brand"}.
| Argument | Type | Description |
|---|---|---|
| name | string | Token name used in the CSS and Tailwind output. Default "brand". |
| color* | string | Base color, e.g. "#ff5a1f". |
{
"type": "object",
"required": [
"color"
],
"properties": {
"name": {
"type": "string",
"maxLength": 24,
"description": "Token name used in the CSS and Tailwind output. Default \"brand\"."
},
"color": {
"type": "string",
"maxLength": 80,
"minLength": 1,
"description": "Base color, e.g. \"#ff5a1f\"."
}
}
}Use when you need a yes/no on whether a cron expression would fire at a specific instant in a timezone — for example before shipping a schedule that crosses a DST transition, or to verify a single expected fire. Example: {"expression":"0 9 * * 1-5","timezone":"America/New_York","at":"2026-11-06T14:00:00Z"}. Returns fires true/false, the local wall time of that instant, and DST notes if the local time is in a gap or fold.
| Argument | Type | Description |
|---|---|---|
| at* | string | ISO datetime to test, e.g. 2026-11-06T14:00:00Z. |
| timezone | string | IANA timezone. Default UTC. |
| expression* | string | Cron expression (5 or 6 fields, or a nickname like @hourly). |
{
"type": "object",
"required": [
"expression",
"at"
],
"properties": {
"at": {
"type": "string",
"maxLength": 40,
"minLength": 1,
"description": "ISO datetime to test, e.g. 2026-11-06T14:00:00Z."
},
"timezone": {
"type": "string",
"maxLength": 80,
"description": "IANA timezone. Default UTC."
},
"expression": {
"type": "string",
"maxLength": 120,
"minLength": 1,
"description": "Cron expression (5 or 6 fields, or a nickname like @hourly)."
}
}
}Use when you or the user just wrote a cron expression (GitHub Actions, Vercel cron, Cloudflare Cron Triggers, systemd, an agent schedule) and need its next fire times. Pass the expression and an IANA timezone (default UTC). Returns the next N runs as local wall times and UTC ISO, a plain-English field breakdown, and DST gap/fold warnings (spring-forward skips, fall-back double fires). Example: {"expression":"0 9 * * 1-5","timezone":"America/New_York","count":5}. Uses the tz database, so DST rules match the region and year. Not for converting a meeting time across cities (use Meridian) or for email DNS (use Stamp).
| Argument | Type | Description |
|---|---|---|
| from | string | Optional ISO datetime to start from (default now), e.g. 2026-03-07T12:00:00Z. |
| count | integer | How many next runs to return (1–20). Default 5. |
| timezone | string | IANA timezone for local wall times, e.g. America/New_York. Default UTC. |
| expression* | string | Cron expression: 5 fields (minute hour day-of-month month day-of-week) or 6 with seconds first. Also accepts @hourly, @daily, @weekly, @monthly, @yearly. |
{
"type": "object",
"required": [
"expression"
],
"properties": {
"from": {
"type": "string",
"maxLength": 40,
"description": "Optional ISO datetime to start from (default now), e.g. 2026-03-07T12:00:00Z."
},
"count": {
"type": "integer",
"maximum": 20,
"minimum": 1,
"description": "How many next runs to return (1–20). Default 5."
},
"timezone": {
"type": "string",
"maxLength": 80,
"description": "IANA timezone for local wall times, e.g. America/New_York. Default UTC."
},
"expression": {
"type": "string",
"maxLength": 120,
"minLength": 1,
"description": "Cron expression: 5 fields (minute hour day-of-month month day-of-week) or 6 with seconds first. Also accepts @hourly, @daily, @weekly, @monthly, @yearly."
}
}
}We read every tool's name, description and inputs the way the model will, looking for instructions hidden from you. A clean result means no warning signs, not a guarantee. Scanned Nov 9, 2026.
What changed in this server's tools since we started watching, newest first. Each change is scanned again.
Use when the user or an agent is about to install or import npm or PyPI packages: before npm install or pip install, when adding lines to package.json or requirements.txt, or when a package name came from an AI answer, a tutorial or memory and may be invented. Looks each name up in the live registry and returns whether it exists, the latest version, whether a pinned version exists, weekly downloads, first and last publish dates, deprecation or yanked status, install-time scripts, whether the name is one or two typed characters from a well-known package, and real similar packages when the name does not exist. Example: {"packages":[{"ecosystem":"npm","name":"@anthropic/mcp-client"},{"ecosystem":"pypi","name":"requests","version":"2.32.3"}]}. Up to 10 packages per call; versions must be exact, not ranges. Not a malware or vulnerability scan: "ok" means it exists and nothing looked wrong.
{
"type": "object",
"required": [
"domain"
],
"properties": {
"fresh": {
"type": "boolean",
"description": "true to skip the 5-minute cache, e.g. right after a DNS change."
},
"domain": {
"type": "string",
"maxLength": 300,
"minLength": 1,
"description": "The sending domain, e.g. mycompany.com. An email address ([email protected]) or a URL also works."
},
"dkim_selectors": {
"type": "array",
"items": {
"type": "string",
"maxLength": 63,
"minLength": 1
},
"maxItems": 5,
"description": "Extra DKIM selectors to try besides the common ones, e.g. [\"mxvault\"]. Find it as s= in a DKIM-Signature header or in the provider's setup page."
}
}
}