MCP server

mcp-toolbelt

com.papacasper/mcp-toolbelt

Checked 26 Oct 2026, 08:29 UTC · Connected to it and listed its tools

29 pay-per-call DNS, SEO, SSL, security, WHOIS, mail, and AI tools for AI agents. x402, no API key.

At a glance

Type

MCP server

Publisher

papacasper.com (verified by the MCP Registry)

Status

Working at last check

Tools

29

Token cost

About 5,149 tokens per request

Sets up in

Claude Code, Claude Desktop, Codex, Gemini CLI, Cursor, VS Code, Antigravity, ChatGPT, OpenAI API, Grok

Last checked

26 Oct 2026, 08:29 UTC

Connect it to your agent

Add to CursorAdd to VS CodeVS Code Insiders

Opens the app, which shows the server and asks you to confirm. For other apps, copy the setup below.

Claude Code

claude mcp add --transport http mcp-toolbelt https://papacasper.com/mcp

Claude Desktop

Settings → Connectors → Add custom connector, and paste the URL.

Codex (config.toml)

[mcp_servers.mcp-toolbelt]
url = "https://papacasper.com/mcp"

Gemini CLI

{"mcpServers":{"mcp-toolbelt":{"httpUrl":"https://papacasper.com/mcp"}}}

Cursor

{"mcpServers":{"mcp-toolbelt":{"url":"https://papacasper.com/mcp"}}}

VS Code

{"servers":{"mcp-toolbelt":{"type":"http","url":"https://papacasper.com/mcp"}}}

Antigravity

agy mcp add mcp-toolbelt https://papacasper.com/mcp

ChatGPT

Settings → Apps & Connectors → Advanced settings: turn on Developer mode, then Create a connector and paste the URL. Which plans can do this varies.

OpenAI API (Responses tools)

{"type":"mcp","server_label":"mcp-toolbelt","server_url":"https://papacasper.com/mcp","require_approval":"always"}

Grok (xAI API tools)

{"type":"mcp","server_label":"mcp-toolbelt","server_url":"https://papacasper.com/mcp"}

Tools

• ai_readiness_audit ~220 tokens
  Score how ready a website is for AI agents and LLM-driven discovery, 0-100 with a letter grade: robots.txt presence, explicit AI-crawler policy (GPTBot, ClaudeBot, CCBot, PerplexityBot, and 8 more), llms.txt presence and structure, structured data (JSON-LD) and Open Graph basics, agent/payment disco
• broken_link_check ~338 tokens
  Find broken links two ways. Default (crawl mode): crawl a site starting from a URL (same-origin pages only, bounded by maxPages) and check every linked URL for broken status codes, returning each broken link with the page(s) it was found on. Sitemap mode (viaSitemap: true): parse the site's sitemap.
• check_open_ports ~189 tokens
  TCP-connect scan a host for open ports, plus network intel on the host's resolved IPs (ASN, network owner, BGP prefix, country — via Team Cymru). Defaults to a list of ~20 common service ports (SSH, HTTP/S, mail, DBs, etc.) if none are given. For checking your own infrastructure's exposure — capped
• check_robots_sitemap ~168 tokens
  Check a site's robots.txt and sitemap.xml in one call: raw contents (truncated), sitemap presence, an AI-crawler policy analysis (explicit rules for GPTBot, ClaudeBot, CCBot, PerplexityBot, Google-Extended, Bytespider, Amazonbot and other AI crawlers, vs wildcard/default), and llms.txt presence. For
• dns_propagation_check ~154 tokens
  Query a DNS record for a domain against several major public resolvers (Google, Cloudflare, Quad9, OpenDNS) in parallel and compare the answers. Flags mismatches, which usually mean propagation is still in progress after a DNS change.
• domain_availability_check ~178 tokens
  Check whether a domain is registered, plus scan common typo-squat variants (adjacent-key substitution, letter omission/doubling, transposition) across popular TLDs (.com, .net, .org, .io, .co, .ai, .app, .dev) for brand-protection or domain-flipping research. WHOIS-based; capped at 40 variants check
• domain_health_check ~160 tokens
  Check a domain's registration expiry (via WHOIS) and DNS health: nameservers, A/AAAA, MX, SPF, and DMARC records. Flags common misconfigurations. WHOIS + DNS only — for the WHOIS record alone use whois_lookup; for deliverability detail (DKIM, DNSBL, PTR) use email_deliverability_check; for all of it
• domain_report ~161 tokens
  Bundle: runs seo_audit, domain_health_check (WHOIS + DNS: nameservers, A/AAAA, MX, SPF, DMARC), and email_deliverability_check (DKIM, SPF lookup-count, DMARC strength, DNSBL) against a domain in one call, one charge. Cheaper than calling the three tools separately. Each sub-check reports independent
• email_address_validate ~145 tokens
  Validate a single email address: RFC syntax check, MX record lookup on the domain, disposable/temporary-email-provider detection, and role-account detection (info@, admin@, etc.). Per-address check — different from email_deliverability_check, which audits a whole domain's sending reputation (SPF/DKI
• email_deliverability_check ~197 tokens
  Deep-dive email deliverability check for a domain: MX records + reverse-DNS (PTR) on each MX host, common DKIM selector probing, SPF lookup-count (RFC 7208 caps at 10), DMARC policy strength, and DNSBL blacklist lookups (Spamhaus Zen, SpamCop, Barracuda) on MX IPs. Note: public-resolver DNSBL querie
• exposed_files_check ~210 tokens
  Probe a site for publicly exposed sensitive files attackers scan for: /.env and variants, /.git/config and /.git/HEAD, /.svn/entries, docker-compose files, /.aws/credentials, /.ssh/id_rsa, database dumps (backup.sql, db.sql, dump.sql), backup archives, phpinfo pages, .DS_Store, and similar. Reports
• github_repo_health_check ~134 tokens
  Check a GitHub repository's health signals: stars, forks, open issues, license, archived/disabled status, and days since last push. Flags likely-abandoned or unlicensed repos. Useful before depending on a repo.
• mcp_server_probe ~178 tokens
  Probe a remote MCP server end-to-end: performs the initialize handshake, captures server info and protocol version, lists its tools, and grades tool-quality the way directories like Glama do — description coverage and depth, input-schema completeness, and naming consistency — with a 0-100 score, let
• package_vulnerability_check ~212 tokens
  Look up a package (optionally pinned to a version) against OSV.dev's aggregated vulnerability database (GitHub Advisories, PyPA, RustSec, Go vuln DB, etc.) for known CVEs/advisories. Supports npm, PyPI, crates.io, RubyGems, Go, Maven, NuGet, and Packagist ecosystems. Useful before adding a dependenc
• page_performance_check ~141 tokens
  Fetch a URL and measure time-to-first-byte, total fetch time, and response size from this server. Flags missing compression, missing Cache-Control, oversized payloads, and slow TTFB. Lightweight raw-timing check — for Google Lighthouse scores, Core Web Vitals, and real-user field data use pagespeed_
• pagespeed_insights ~199 tokens
  Run Google's real PageSpeed Insights (Lighthouse + Chrome UX Report) against a URL: performance score, Core Web Vitals (LCP, CLS, INP/TBT), and real-user field data where available. The authoritative, Google-measured score — for a quick raw TTFB/size timing check from this server use page_performanc
• redirect_chain_check ~100 tokens
  Follow a URL through every HTTP redirect hop and report the full chain, final destination, and issues like redirect loops, too many hops, or HTTPS-to-HTTP downgrades.
• safe_browsing_check ~103 tokens
  Check a URL against Google Safe Browsing's malware/phishing/unwanted-software/PUA blocklists. Requires GOOGLE_SAFE_BROWSING_API_KEY to be configured server-side (free Google Cloud API key).
• security_headers_audit ~176 tokens
  Fetch a URL and audit its response headers in one pass: security headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy) with a score, PLUS its CORS policy (the probe sends a foreign Origin header and flags wildcard-origin + credentials combinations and arbi
• seo_audit ~211 tokens
  Fetch a URL and run a full on-page SEO audit: title/meta description length, canonical tag, Open Graph + Twitter Card tags, html lang attribute, viewport meta, heading structure, image alt-text coverage, internal/external link counts and generic-anchor-text detection, robots meta (noindex/nofollow),
• smtp_server_check ~227 tokens
  Live-probe a mail server over SMTP: connects to port 25 (or a given port), reads the banner, issues EHLO and lists advertised capabilities (STARTTLS, AUTH mechanisms, SIZE, 8BITMIME, PIPELINING), then upgrades via STARTTLS when offered and reports the TLS protocol and certificate (issuer, expiry). T
• ssl_cert_check ~148 tokens
  Connect to a host over TLS and report its certificate's expiry date, days remaining, issuer, and subject. Fast facts only — for a full graded TLS assessment (protocols, ciphers, vulnerabilities) use ssl_labs_grade instead.
• ssl_labs_grade ~170 tokens
  Full SSL Labs-style TLS assessment: overall letter grade, protocol support (TLS 1.0-1.3), cipher strength, certificate chain issues, and known vulnerabilities (Heartbleed, POODLE, etc.) for each endpoint. Use this for a deep grade; use ssl_cert_check instead for a fast expiry/issuer check. Slower (c
• structured_data_extract ~338 tokens
  Fetch a URL and extract structured data deterministically: JSON-LD blocks (each one also VALIDATED — @context/@type presence plus required fields for common schema.org types like Article, Product, Organization, FAQPage), OpenGraph/meta tags, and optional caller-supplied CSS-selector fields (e.g. { p
• subdomain_discovery ~162 tokens
  Enumerate a domain's subdomains from public Certificate Transparency logs (crt.sh, with a Cert Spotter fallback): every hostname that has ever appeared on a certificate for the domain. Passive reconnaissance - no packets are sent to the target. Useful for attack-surface reviews, migration inventorie
• tech_stack_fingerprint ~166 tokens
  Fetch a URL and fingerprint its likely tech stack from response headers (server, x-powered-by, x-generator) and HTML markers (generator meta tag, framework/CMS-specific script or class patterns). Answers 'what is this site built with?' — for on-page SEO/content signals use seo_audit, for raw structu
• url_to_markdown ~86 tokens
  Fetch a URL and return its main text content as clean, readable plain text/markdown-ish output. Strips scripts, styles, and HTML tags.
• websocket_endpoint_check ~136 tokens
  Test a WebSocket endpoint (ws:// or wss://): attempts the handshake, reports success/failure, time-to-open in ms, and close code/reason. Useful for verifying a WebSocket server is reachable and completes its upgrade handshake before you wire real traffic to it.
• whois_lookup ~142 tokens
  Look up a domain's WHOIS registration record: registrar, creation and expiry dates, days remaining, name servers, and domain statuses, direct from the TLD registry. Registration data only — for DNS/mail health as well, use domain_health_check; for a combined report, use domain_report.

Browse

• GitHub tools
• OpenAPI tools
• Web scraping
• SEO
• Website monitoring
• Domains and DNS

Related MCP servers

• ScrapeMole Domains
  Pay-per-call x402 DNS, WHOIS/RDAP, availability, email security, SSL check, CT subdomains.
• Email DNS Preflight x402
  Paid email, DNS, mail-security and RDAP intelligence for agents over x402.
• DC5 WHOIS
  WHOIS, RDAP, DNS, IP / ASN / CIDR and Web3 name (ENS, Unstoppable, Handshake) lookups. No API key.
• SiteCheck Web Intel
  129 pay-per-call agent tools: security, threat intelligence, web search and SEO data tools. x402
• x402 Toolbox
  62 pay-per-call web, DNS, EVM and data tools. x402 USDC on Base, $0.003-$0.02 per call, no signup.
• ipv4.fr Network Tools
  DNS, WHOIS, SSL, IP geolocation, email validation, DNSBL blacklist, HTTP headers, subnet calc.
• Fetcher
  The web capability layer for AI agents: render, extract, DNS, SSL, WHOIS & more via x402.
• SiteCheck
  225 pay-per-call agent tools: Polymarket, chain reads, DeFi, web, SEC, KYB, geo, dev, AI. x402

Badge for your README

[![AptLynx](https://aptlynx.net/badge/com.papacasper/mcp-toolbelt.svg)](https://aptlynx.net/servers/com.papacasper/mcp-toolbelt)

Listing text is written by the maker; AptLynx lists tools and does not vouch for them. Find another tool · Browse by topic · For agents