MCP server

Presend MCP Server

io.github.presendapp/presend-mcp

Checked 26 Oct 2026, 08:29 UTC · Connected to it and listed its tools

Before an AI agent installs an npm/PyPI package: typosquat, vulnerability and existence checks.

Source

At a glance

Type

MCP server

Publisher

Not verified

Status

Working at last check

Tools

40

Token cost

About 6,714 tokens per request

Sets up in

Claude Code, Claude Desktop, Codex, Gemini CLI, Cursor, VS Code, Antigravity, ChatGPT, OpenAI API, Grok

Last checked

26 Oct 2026, 08:29 UTC

Connect it to your agent

Add to CursorAdd to VS CodeVS Code Insiders

Opens the app, which shows the server and asks you to confirm. For other apps, copy the setup below.

Claude Code

claude mcp add --transport http presend-mcp https://presend.pages.dev/mcp

Claude Desktop

Settings → Connectors → Add custom connector, and paste the URL.

Codex (config.toml)

[mcp_servers.presend-mcp]
url = "https://presend.pages.dev/mcp"

Gemini CLI

{"mcpServers":{"presend-mcp":{"httpUrl":"https://presend.pages.dev/mcp"}}}

Cursor

{"mcpServers":{"presend-mcp":{"url":"https://presend.pages.dev/mcp"}}}

VS Code

{"servers":{"presend-mcp":{"type":"http","url":"https://presend.pages.dev/mcp"}}}

Antigravity

agy mcp add presend-mcp https://presend.pages.dev/mcp

ChatGPT

Settings → Apps & Connectors → Advanced settings: turn on Developer mode, then Create a connector and paste the URL. Which plans can do this varies.

OpenAI API (Responses tools)

{"type":"mcp","server_label":"presend-mcp","server_url":"https://presend.pages.dev/mcp","require_approval":"always"}

Grok (xAI API tools)

{"type":"mcp","server_label":"presend-mcp","server_url":"https://presend.pages.dev/mcp"}

Tools

• address_risk ~236 tokens
  Screens a crypto address against every OFAC SDN digital currency address list. EVM (0x...) and Bitcoin (bc1..., 1..., 3...) addresses are fully covered (sanctioned true or false, with the matching lists). Addresses of other chains are flagged when listed; Cosmos SDK bech32 addresses return sanctione
• ai_crawler_check ~139 tokens
  Fetches a domain's robots.txt and reports which known AI crawlers (GPTBot, ClaudeBot, PerplexityBot, Google-Extended, CCBot and others) are allowed or blocked, including wildcard rules. Reflects robots.txt only, not server-side blocking.
• base64 ~103 tokens
  Encodes text to Base64 or decodes a Base64 string back to text (action = encode or decode).
• color ~147 tokens
  Converts a color between hex, RGB and HSL. Provide exactly one of hex, rgb or hsl.
• csv_json ~232 tokens
  Converts CSV text to JSON or JSON to CSV (direction: csv-to-json or json-to-csv), for data passed inline. CSV must be comma-separated, with a header row and at least one data row; double-quoted fields may contain commas. Semicolon- or tab-separated input is not detected and comes back as a single co
• cve_lookup ~128 tokens
  Looks up a vulnerability by identifier (CVE, GHSA or other OSV ID) on OSV.dev: summary, CVSS severity, affected packages and versions, references. Use when you already have an ID; use vulnerability_check when you have a package name instead.
• dns_lookup ~149 tokens
  Returns DNS records for a domain via Cloudflare DNS-over-HTTPS: A, AAAA, CNAME, MX, TXT and NS in one call, or a single record type with 'type'. For registration data use whois_lookup; for SPF/DMARC/DKIM analysis use email_security.
• email_disposable ~116 tokens
  Checks only whether an email address uses a known disposable/temporary email domain. For syntax, MX, disposable and role-account checks in one call, use email_verify.
• email_security ~125 tokens
  Audits a domain's email anti-spoofing setup: SPF strength, DMARC policy and a best-effort DKIM lookup on common selectors. A missing DKIM match does not prove DKIM is absent. Checks a domain, not a single address.
• email_validate ~113 tokens
  Lightweight email check: syntax plus confirmation that the domain has an MX record. Does not detect disposable or role addresses; use email_verify for the combined check.
• email_verify ~177 tokens
  Most complete email check in one call: syntax, MX record, disposable-domain detection and role/generic account detection (e.g. info@, admin@). Prefer it over email_validate and email_disposable unless you need a single signal. Does not probe the mailbox. valid is null (not false) when the MX lookup
• favicon ~198 tokens
  Returns the favicon URL a website declares: fetches the homepage and takes the first <link rel='icon'> (or 'shortcut icon') href, resolved to an absolute URL, which may be a data: URI when the page inlines its icon (source: declared). If no icon is declared, or the homepage cannot be fetched, return
• iban_validate ~96 tokens
  Validates an IBAN offline: ISO 7064 mod-97 checksum and country-specific length. Confirms the number is well-formed, not that the account exists.
• ip_reputation ~172 tokens
  Checks an IPv4 or IPv6 address against a curated list of netblocks known to be hijacked or run by spam/cyber-crime operations (IPv4-mapped IPv6 uses the IPv4 list). A narrow list-based signal: a clean result is not a safety guarantee. Includes list date and attribution.
• jwt_decode ~121 tokens
  Decodes a JWT's header and payload WITHOUT verifying its signature, so its claims must not be trusted on this basis alone. To check authenticity, use jwt_verify.
• jwt_verify ~226 tokens
  Cryptographically verifies a JWT signature (HS256/384/512, RS/PS256/384/512, ES256/384/512) and checks exp/nbf claims. Provide a secret for HS*, or a JWK or JWKS URL for RS/PS/ES. Use instead of jwt_decode whenever authenticity matters.
• link_metadata ~159 tokens
  Fetches a web page and extracts its title, description, canonical URL, Open Graph and Twitter Card tags and favicon (the data behind link previews). Follows redirects and returns final_url; favicon_source says whether the icon is declared by the page or only the /favicon.ico guess. To see each redir
• password ~240 tokens
  Generates a random password, with options for length, symbols, uppercase, numbers and excluding ambiguous characters. To evaluate an existing password, use password_check.
• password_breach ~181 tokens
  Checks whether a password appears in known data breaches (Have I Been Pwned) and how many times, using k-anonymity towards HIBP. Breach check only; password_check adds strength scoring and sends the password in a POST body.
• password_check ~259 tokens
  Scores a password's strength (length, character variety, entropy as an upper bound, repeated patterns; passphrases are estimated per word) and, with check_breach=true, also looks it up in Have I Been Pwned breach data via k-anonymity (only a hash prefix is sent); a password found in breaches is alwa
• phone_verify ~182 tokens
  Validates and formats a phone number: validity, country, line type, E.164, international and national formats. Numbers without a leading + require 'country', since the end user's country cannot be inferred over MCP.
• redirect_trace ~126 tokens
  Follows a URL's full redirect chain (up to 15 hops) and returns every hop with its status code, plus whether the chain crossed domains. Use it to see where a short or tracking link really leads; check the final URL with url_reputation.
• rpc_check ~144 tokens
  Read-only audit of a public CometBFT (Cosmos SDK) RPC endpoint: node status, health, peers, and whether unsafe admin methods (dial_seeds, dial_peers, unsafe_flush_mempool) are publicly exposed. Never calls an unsafe method; exposure is inferred from the node's route listing.
• security_headers ~164 tokens
  Audits the HTTP security headers of one URL (CSP, HSTS, X-Frame-Options, Permissions-Policy, cross-origin policies and others) and returns per-header findings with fix advice, a score and a letter grade. Use it when you need header hardening advice; security_scan runs this audit together with URL re
• security_scan ~130 tokens
  Combined website check in one call: security headers, URL reputation and passive subdomain discovery, run in parallel, with an overall score and verdict. Use the individual tools when you need a single signal.
• subdomains ~127 tokens
  Passive subdomain discovery from Certificate Transparency logs (crt.sh): finds hostnames that appeared in public TLS certificates, not every DNS record. crt.sh is occasionally slow or unavailable.
• text_similarity ~124 tokens
  Near-duplicate detection with a 64-bit SimHash over word shingles: send 1 text to get its hash, or 2 texts to compare them. Detects paraphrased or lightly edited copies; unrelated texts score around 50%, not 0%.
• timestamp ~151 tokens
  Returns the current time, or converts between a Unix timestamp (seconds) and an ISO date. Provide unix or date, or neither for the current time.
• tx_decode ~151 tokens
  Decodes a raw signed Cosmos SDK transaction (base64 TxRaw bytes, as found in a CometBFT block's data.txs) into JSON: messages, fee, gas, signers and signatures. Bank, staking, gov and authz messages are fully decoded; other types are returned as type URL plus raw hex.
• url_clean ~111 tokens
  Removes 60+ known tracking parameters (utm_*, fbclid, gclid and similar) from a URL and returns the clean URL. Does not follow redirects; for that, use redirect_trace.
• url_reputation ~107 tokens
  Checks a URL against URLhaus (abuse.ch), a public database of known malware distribution URLs. A clean result only means the URL is not listed, not that it is safe.
• user_agent ~106 tokens
  Parses a User-Agent string into browser and version, operating system and version, device type, and whether it looks like a bot.
• uuid ~68 tokens
  Generates 1 to 100 random UUID v4 values.
• vat_validate ~157 tokens
  Checks an EU VAT number in real time against the European Commission's VIES service and, when valid, returns the registered company name and address. VIES is occasionally unavailable for some member states.
• vulnerability_check ~232 tokens
  Checks a package (optionally a specific version) against OSV.dev for known vulnerabilities: npm, PyPI, Go, crates.io, Maven, RubyGems, Packagist and NuGet. For npm and PyPI, a name that does not exist returns found: false and vulnerable: null, never a clean result. Use cve_lookup when you already ha
• whois_lookup ~110 tokens
  Domain registration data via RDAP (the modern WHOIS): registrar, creation and expiration dates, domain age in days, nameservers. For DNS records, use dns_lookup.

Browse

• GitHub tools
• Cloudflare tools
• Web scraping
• Domains and DNS
• Spreadsheets
• Email

Related MCP servers

• Presend dependency checks
  Check an npm/PyPI package before an AI agent installs it: 5 focused supply-chain tools.
• Stormap
  Brainstorm scored idea maps, check npm/PyPI packages and vendors, find the right paid API.
• FabTally Guard
  Verify before you act: deps-check, x402-preflight, json-repair & url-read for agents.
• Tonbot Tolca
  Verify a company before paying it: OFAC sanctions, UK/Canada registries, contractor licences (x402)
• Databutler
  Verified facts for AI agents: rates, exams, recalls, holidays, and what changed since your cutoff.
• FHI MCP Server Security Audit
  Free payment guide and Base-USDC x402 MCP security, package, domain, and SEC tools.
• Crypto, web, finance and app data tools
  179 tools: crypto, EVM, SEC, FDA, NHTSA VIN, NWS weather, Eurostat, FRED, cloud & LLM prices, DNS.
• Krabbot Devtools
  AI-agent-run devtools: package install risk, stack EOL/CVE checks, scored OSS bounties.

Badge for your README

[![AptLynx](https://aptlynx.net/badge/io.github.presendapp/presend-mcp.svg)](https://aptlynx.net/servers/io.github.presendapp/presend-mcp)

Listing text is written by the maker; AptLynx lists tools and does not vouch for them. Find another tool · Browse by topic · For agents