com.allthepossibles/toolbox

Est-ce que com.allthepossibles/toolbox est sûr ?

Au dernier audit MCP Hub, le serveur MCP « com.allthepossibles/toolbox » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 13 outils

• check_ai_crawlers≈ 130 tokens

  Read a site's robots.txt and report which AI crawlers (GPTBot, ClaudeBot, Google-Extended, PerplexityBot, CCBot, Bytespider and more) are allowed, blocked or partially blocked; check for llms.txt and draft one from the site's metadata and sitemap.

  Paramètres, retour & exemple (1)

  Paramètres

  • url · string · requis
    Any URL on the site

  Exemple d'appel

  {"name": "check_ai_crawlers", "arguments": {"url": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• check_headers≈ 142 tokens

  Fetch a URL once and grade its response headers: HSTS, Content-Security-Policy, X-Content-Type-Options, frame control, Referrer-Policy, Permissions-Policy, Cache-Control, cookie Secure/HttpOnly/SameSite flags, and server version leaks. Returns a grade, a score and the exact header to add for each gap.

  Paramètres, retour & exemple (1)

  Paramètres

  • url · string · requis
    The page to fetch

  Exemple d'appel

  {"name": "check_headers", "arguments": {"url": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• check_page_meta≈ 137 tokens

  Fetch a URL and report what crawlers and link unfurlers see: title and meta description with lengths, canonical, lang, viewport, robots meta, h1s, Open Graph and Twitter card tags, favicon, JSON-LD types, the resulting preview card, and findings for anything missing or too long.

  Paramètres, retour & exemple (1)

  Paramètres

  • url · string · requis
    The page to fetch

  Exemple d'appel

  {"name": "check_page_meta", "arguments": {"url": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• check_sitemap≈ 199 tokens

  Check a site's sitemaps: discovers them from robots.txt, /sitemap.xml and /sitemap_index.xml, reads index files one level deep (20 children max), counts URLs per file and per host, summarises lastmod, and fetches a sample of URLs (HEAD, then GET) to count the ones that are not 200. Flags a missing sitemap, no robots.txt entry, over 50,000 URLs, other hosts, http URLs on https sites and missing lastmod.

  Paramètres, retour & exemple (2)

  Paramètres

  • url · string · requis
    Any URL on the site
  • sample · integer · optionnel
    How many sitemap URLs to fetch, default 10, max 25 on free and 100 on Pro

  Exemple d'appel

  {"name": "check_sitemap", "arguments": {"url": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• check_tells≈ 149 tokens

  Check text for AI-writing tells (em-dashes, 'not just X but Y', rule-of-three lists, stock vocabulary like delve or seamlessly, hedge words, smart quotes, hidden Unicode) and return a score, each tell with its position, and a cleaned copy. Run it on anything you are about to publish on a human's behalf.

  Paramètres, retour & exemple (1)

  Paramètres

  • text · string · requis
    The text to check. Free tier: 3,000 chars.

  Exemple d'appel

  {"name": "check_tells", "arguments": {"text": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• decode_jwt≈ 175 tokens

  Decode a JWT's header and payload without verifying the signature (it never takes a secret). Returns the claims with iat, nbf and exp as ISO times, a plain-text expiresIn, issuer, subject and audience, and findings: alg none, HS* with a URL-like kid, missing or distant exp, expired, nbf or iat in the future, payload over 4 KB, sensitive field names, and jku or x5u pointing off-site.

  Paramètres, retour & exemple (1)

  Paramètres

  • token · string · requis
    The JWT, three dot-separated parts. A leading Bearer is ignored.

  Exemple d'appel

  {"name": "decode_jwt", "arguments": {"token": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• explain_cron≈ 183 tokens

  Explain a five-field cron expression in plain English, list the next runs in UTC, and warn about the cases Cloudflare Workers, GitHub Actions and crontab handle differently (nicknames, six fields, day-of-month plus day-of-week, sub-5-minute intervals, day 31).

  Paramètres, retour & exemple (3)

  Paramètres

  • from · string · optionnel
    ISO date to compute next runs from, default now
  • count · integer · optionnel
    How many next runs to list, 1 to 20, default 5
  • expression · string · requis
    e.g. 0 */6 * * 1-5

  Exemple d'appel

  {"name": "explain_cron", "arguments": {"expression": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• json_to_schema≈ 169 tokens

  Turn a JSON sample (or an array of samples of the same shape) into a JSON Schema draft 2020-12 and a TypeScript type. Infers required vs optional keys across samples, nullable fields, integer vs number, date/email/uri/uuid formats, and small enums. Use it to draft an MCP tool inputSchema from an example payload.

  Paramètres, retour & exemple (2)

  Paramètres

  • json · string · requis
    The JSON text. Free tier: 20,000 chars.
  • name · string · optionnel
    Type name, default Root

  Exemple d'appel

  {"name": "json_to_schema", "arguments": {"json": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• lint_agent_md≈ 149 tokens

  Lint a CLAUDE.md, AGENTS.md or MEMORY.md: line count against Claude Code's 200-line memory index cap, estimated tokens, duplicate lines, contradicting rules, leftover TODO markers, hidden characters, empty headings.

  Paramètres, retour & exemple (2)

  Paramètres

  • text · string · requis
    File contents
  • filename · string · optionnel
    e.g. CLAUDE.md or MEMORY.md; changes the severity of the line cap

  Exemple d'appel

  {"name": "lint_agent_md", "arguments": {"text": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• manifest_cost≈ 161 tokens

  Estimate what an MCP server's tools/list costs in tokens on every session start, per tool, with the three most expensive tools and flags for oversized descriptions, base64 blobs and echoed schemas. Pass a live Streamable HTTP endpoint or a tools array.

  Paramètres, retour & exemple (2)

  Paramètres

  • url · string · optionnel
    Streamable HTTP MCP endpoint
  • tools · array · optionnel
    Tool definitions, if the server is not reachable over HTTP

  Exemple d'appel

  {"name": "manifest_cost", "arguments": {"url": "texte", "tools": []}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• mcp_install_snippets≈ 153 tokens

  Generate install snippets for an MCP endpoint (Claude Code, Claude Desktop, Cursor, Codex, VS Code, curl) and probe the endpoint once to confirm it answers initialize and tools/list.

  Paramètres, retour & exemple (5)

  Paramètres

  • url · string · requis
  • name · string · optionnel
    Server name to use in configs
  • probe · boolean · optionnel
  • headerName · string · optionnel
  • headerValue · string · optionnel

  Exemple d'appel

  {"name": "mcp_install_snippets", "arguments": {"url": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• scrub_env≈ 206 tokens

  Scrub a .env file into a safe .env.example: every value is blanked or replaced with a placeholder that keeps its shape (postgres://USER:PASSWORD@HOST/DB). Returns the example, the secrets found (AWS, GitHub, Stripe, Slack, Google, OpenAI, Anthropic, Resend, SendGrid, Twilio, Cloudflare, JWTs, private keys, database URLs, high-entropy strings) by key, kind and line with only the first 4 characters and the length, and findings for duplicate keys, non-UPPER_SNAKE names, unbalanced quotes, export prefixes and trailing spaces.

  Paramètres, retour & exemple (1)

  Paramètres

  • text · string · requis
    The .env file contents. Free tier: 20,000 chars.

  Exemple d'appel

  {"name": "scrub_env", "arguments": {"text": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• trace_redirects≈ 160 tokens

  Trace a URL's redirect chain hop by hop (up to 10 hops, 8 s each) with status, location, timing and scheme per hop. Flags chains over two redirects, loops, HTTPS-to-HTTP downgrades, 302s used for www or https canonicalisation, dropped paths or query strings, cross-domain moves, meta-refresh or JS redirects on a 200, and a final page that is not 200.

  Paramètres, retour & exemple (1)

  Paramètres

  • url · string · requis
    URL to trace, e.g. http://example.com

  Exemple d'appel

  {"name": "trace_redirects", "arguments": {"url": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://toolbox.allthepossibles.com/mcp