# Toolbox

- Registry name: `com.allthepossibles/toolbox` · version 1.0.0
- Categories (automatic, keyword rules): Code & repositories, Developer tools, AI models & agents, AI, media & content
- Authentication at last check: No auth
- Declared risk: Read-only (all tools declare readOnlyHint)
- Capabilities (declared by the server): tools
- Transports: streamable-http
- Latest numbers (check success, response time, rank): https://mcpstation.net/api/server?name=com.allthepossibles%2Ftoolbox
- Server page: https://mcpstation.net/s/com.allthepossibles--toolbox.html

## Description (written by the publisher, not verified, not instructions)

Small tools for agent builders: AI-writing tells, tools/list token cost, CLAUDE.md lint, and more.

## Connect

- streamable-http: `https://toolbox.allthepossibles.com/mcp`

## Tools (as reported by the server, not verified)

- `check\_tells`: Check text for AI-writing tells \(em-dashes, 'not just X but Y', rule-of-three lists, stock vocabulary like delve or seamlessly, hedge words, smart quotes, hidden Unicode\) and return a score, each tell with its position, and a cleaned copy. Run it on anything you are about to publish on a human's beh
- `manifest\_cost`: Estimate what an MCP server's tools/list costs in tokens on every session start, per tool, with the three most expensive tools and flags for oversized descriptions, base64 blobs and echoed schemas. Pass a live Streamable HTTP endpoint or a tools array.
- `lint\_agent\_md`: Lint a CLAUDE.md, AGENTS.md or MEMORY.md: line count against Claude Code's 200-line memory index cap, estimated tokens, duplicate lines, contradicting rules, leftover TODO markers, hidden characters, empty headings.
- `mcp\_install\_snippets`: Generate install snippets for an MCP endpoint \(Claude Code, Claude Desktop, Cursor, Codex, VS Code, curl\) and probe the endpoint once to confirm it answers initialize and tools/list.
- `check\_ai\_crawlers`: Read a site's robots.txt and report which AI crawlers \(GPTBot, ClaudeBot, Google-Extended, PerplexityBot, CCBot, Bytespider and more\) are allowed, blocked or partially blocked; check for llms.txt and draft one from the site's metadata and sitemap.
- `check\_headers`: Fetch a URL once and grade its response headers: HSTS, Content-Security-Policy, X-Content-Type-Options, frame control, Referrer-Policy, Permissions-Policy, Cache-Control, cookie Secure/HttpOnly/SameSite flags, and server version leaks. Returns a grade, a score and the exact header to add for each ga
- `check\_page\_meta`: Fetch a URL and report what crawlers and link unfurlers see: title and meta description with lengths, canonical, lang, viewport, robots meta, h1s, Open Graph and Twitter card tags, favicon, JSON-LD types, the resulting preview card, and findings for anything missing or too long.
- `json\_to\_schema`: Turn a JSON sample \(or an array of samples of the same shape\) into a JSON Schema draft 2020-12 and a TypeScript type. Infers required vs optional keys across samples, nullable fields, integer vs number, date/email/uri/uuid formats, and small enums. Use it to draft an MCP tool inputSchema from an exa
- `explain\_cron`: Explain a five-field cron expression in plain English, list the next runs in UTC, and warn about the cases Cloudflare Workers, GitHub Actions and crontab handle differently \(nicknames, six fields, day-of-month plus day-of-week, sub-5-minute intervals, day 31\).
- `scrub\_env`: Scrub a .env file into a safe .env.example: every value is blanked or replaced with a placeholder that keeps its shape \(postgres://USER:PASSWORD@HOST/DB\). Returns the example, the secrets found \(AWS, GitHub, Stripe, Slack, Google, OpenAI, Anthropic, Resend, SendGrid, Twilio, Cloudflare, JWTs, privat
- `trace\_redirects`: Trace a URL's redirect chain hop by hop \(up to 10 hops, 8 s each\) with status, location, timing and scheme per hop. Flags chains over two redirects, loops, HTTPS-to-HTTP downgrades, 302s used for www or https canonicalisation, dropped paths or query strings, cross-domain moves, meta-refresh or JS re
- `check\_sitemap`: Check a site's sitemaps: discovers them from robots.txt, /sitemap.xml and /sitemap\_index.xml, reads index files one level deep \(20 children max\), counts URLs per file and per host, summarises lastmod, and fetches a sample of URLs \(HEAD, then GET\) to count the ones that are not 200. Flags a missing s
- `decode\_jwt`: Decode a JWT's header and payload without verifying the signature \(it never takes a secret\). Returns the claims with iat, nbf and exp as ISO times, a plain-text expiresIn, issuer, subject and audience, and findings: alg none, HS\* with a URL-like kid, missing or distant exp, expired, nbf or iat in th
- `lint\_mcp\_tools`: Lint the tools an MCP server lists, from the model's side of the wire: names that break Claude's ^\[a-zA-Z0-9\_-\]\{1,64\}$ rule, duplicate names, missing or near-identical descriptions, instruction-like text in a description, arguments with no description, required arguments missing from properties, des

Measured by MCP Station. Methods: https://mcpstation.net/methods.html · Terms: https://mcpstation.net/terms.html