Presend MCP Server

Official40 toolsLive

by presendapp · HTML

Free MCP server of security & dev API tools -- supply-chain, CVE, DNS, WHOIS, OFAC, Cosmos SDK.

Free MCP server providing a set of 32 security and developer API tools. The server description lists capabilities including WHOIS, DNS, CVE checks, and IP reputation, aimed at security-oriented querying through the Model Context Protocol.

🛠️ Key Features

32 security & developer API tools
WHOIS support
DNS support
CVE checks
IP reputation checks

🚀 Use Cases

Perform WHOIS lookups
Query DNS information
Check CVEs for vulnerability information
Assess IP reputation

⚡ Developer Benefits

Centralized access to multiple security-related tools via MCP
Developer API usage for WHOIS, DNS, CVE checks, and IP reputation

⚠️ Limitations

Limited detail available in the provided source material beyond the tool count and listed capabilities (WHOIS, DNS, CVE checks, IP reputation).

Topics

browser-toolsclient-sidecloudflare-pagesfree-apino-signupprivacy-toolscybersecuritydeveloper-toolsdnsmcp-servermodel-context-protocolopenapirest-apisecurity-toolssupply-chain-securitytyposquattingvulnerability-scannerwhoispdf-toolscosmos-sdk

Captured live from the server via tools/list.

address_risk

Screens a crypto address against every OFAC SDN digital currency address list. EVM (0x...) and Bitcoin (bc1..., 1..., 3...) addresses are fully covered (sanctioned true or false, with the matching lists). Addresses of other chains are flagged when listed; Cosmos SDK bech32 addresses return sanctioned: null when not listed, as OFAC publishes none. A sanctions signal only, not a full risk score.

Parameters1

address

string

required

Address to screen: EVM (0x + 40 hex chars) or Bitcoin (bc1..., 1..., 3...), both fully covered. Addresses of other chains are matched against their lists too; bech32 addresses of other chains (e.g. cosmos1...) return sanctioned: null (unchecked, not clean) when not listed.

Raw schema

{
  "type": "object",
  "properties": {
    "address": {
      "type": "string",
      "description": "Address to screen: EVM (0x + 40 hex chars) or Bitcoin (bc1..., 1..., 3...), both fully covered. Addresses of other chains are matched against their lists too; bech32 addresses of other chains (e.g. cosmos1...) return sanctioned: null (unchecked, not clean) when not listed."
    }
  },
  "required": [
    "address"
  ]
}

ai_crawler_check

Fetches a domain's robots.txt and reports which known AI crawlers (GPTBot, ClaudeBot, PerplexityBot, Google-Extended, CCBot and others) are allowed or blocked, including wildcard rules. Reflects robots.txt only, not server-side blocking.

Parameters1

domain

string

required

Domain to check, e.g. example.com. robots.txt is fetched from https://<domain>/robots.txt.

Raw schema

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "description": "Domain to check, e.g. example.com. robots.txt is fetched from https://<domain>/robots.txt."
    }
  },
  "required": [
    "domain"
  ]
}

base64

Encodes text to Base64 or decodes a Base64 string back to text (action = encode or decode).

Parameters2

action	string	required	Either 'encode' or 'decode'.
text	string	required	Text to encode, or Base64 string to decode.

Raw schema

{
  "type": "object",
  "properties": {
    "action": {
      "type": "string",
      "description": "Either 'encode' or 'decode'."
    },
    "text": {
      "type": "string",
      "description": "Text to encode, or Base64 string to decode."
    }
  },
  "required": [
    "action",
    "text"
  ]
}

color

Converts a color between hex, RGB and HSL. Provide exactly one of hex, rgb or hsl.

Parameters3

hex	string	optional	Hex color code, e.g. #ff0000 or ff0000. Provide exactly one of hex, rgb, or hsl.
rgb	string	optional	RGB color, e.g. 255,0,0. Provide exactly one of hex, rgb, or hsl.
hsl	string	optional	HSL color, e.g. 0,100%,50%. Provide exactly one of hex, rgb, or hsl.

Raw schema

{
  "type": "object",
  "properties": {
    "hex": {
      "type": "string",
      "description": "Hex color code, e.g. #ff0000 or ff0000. Provide exactly one of hex, rgb, or hsl."
    },
    "rgb": {
      "type": "string",
      "description": "RGB color, e.g. 255,0,0. Provide exactly one of hex, rgb, or hsl."
    },
    "hsl": {
      "type": "string",
      "description": "HSL color, e.g. 0,100%,50%. Provide exactly one of hex, rgb, or hsl."
    }
  },
  "required": []
}

csv_json

Converts CSV text to JSON or JSON to CSV (direction: csv-to-json or json-to-csv), for data passed inline. CSV must be comma-separated, with a header row and at least one data row; double-quoted fields may contain commas. Semicolon- or tab-separated input is not detected and comes back as a single column. JSON input must be an array of objects: the union of their keys becomes the CSV header and missing values are left empty. Returns result (the converted text), rows and cols. Max 500,000 characters.

Parameters2

direction	string	required	Either 'csv-to-json' or 'json-to-csv'.
data	string	required	The CSV or JSON text to convert, matching the chosen direction.

Raw schema

{
  "type": "object",
  "properties": {
    "direction": {
      "type": "string",
      "description": "Either 'csv-to-json' or 'json-to-csv'."
    },
    "data": {
      "type": "string",
      "description": "The CSV or JSON text to convert, matching the chosen direction."
    }
  },
  "required": [
    "direction",
    "data"
  ]
}

cve_lookup

Looks up a vulnerability by identifier (CVE, GHSA or other OSV ID) on OSV.dev: summary, CVSS severity, affected packages and versions, references. Use when you already have an ID; use vulnerability_check when you have a package name instead.

Parameters1

string

required

CVE, GHSA, or other OSV-native identifier, e.g. CVE-2021-44228.

Raw schema

{
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "description": "CVE, GHSA, or other OSV-native identifier, e.g. CVE-2021-44228."
    }
  },
  "required": [
    "id"
  ]
}

dns_lookup

Returns DNS records for a domain via Cloudflare DNS-over-HTTPS: A, AAAA, CNAME, MX, TXT and NS in one call, or a single record type with 'type'. For registration data use whois_lookup; for SPF/DMARC/DKIM analysis use email_security.

Parameters2

domain	string	required	Domain to look up, e.g. example.com.
type	string	optional	Narrow to a single record type. Omit to get all 6 at once.

Raw schema

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "description": "Domain to look up, e.g. example.com."
    },
    "type": {
      "type": "string",
      "description": "Narrow to a single record type. Omit to get all 6 at once."
    }
  },
  "required": [
    "domain"
  ]
}

email_disposable

Checks only whether an email address uses a known disposable/temporary email domain. For syntax, MX, disposable and role-account checks in one call, use email_verify.

Parameters1

string

required

Email address to check against a list of known disposable/temporary email domains.

Raw schema

{
  "type": "object",
  "properties": {
    "email": {
      "type": "string",
      "description": "Email address to check against a list of known disposable/temporary email domains."
    }
  },
  "required": [
    "email"
  ]
}

email_security

Audits a domain's email anti-spoofing setup: SPF strength, DMARC policy and a best-effort DKIM lookup on common selectors. A missing DKIM match does not prove DKIM is absent. Checks a domain, not a single address.

Parameters1

domain

string

required

Domain to check SPF, DKIM, and DMARC records for, e.g. example.com.

Raw schema

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "description": "Domain to check SPF, DKIM, and DMARC records for, e.g. example.com."
    }
  },
  "required": [
    "domain"
  ]
}

email_validate

Lightweight email check: syntax plus confirmation that the domain has an MX record. Does not detect disposable or role addresses; use email_verify for the combined check.

Parameters1

string

required

Email address to validate for correct syntax and a resolvable domain.

Raw schema

{
  "type": "object",
  "properties": {
    "email": {
      "type": "string",
      "description": "Email address to validate for correct syntax and a resolvable domain."
    }
  },
  "required": [
    "email"
  ]
}

email_verify

Most complete email check in one call: syntax, MX record, disposable-domain detection and role/generic account detection (e.g. info@, admin@). Prefer it over email_validate and email_disposable unless you need a single signal. Does not probe the mailbox.

Parameters1

string

required

Email address to run through combined syntax, disposable-domain, and MX-record checks.

Raw schema

{
  "type": "object",
  "properties": {
    "email": {
      "type": "string",
      "description": "Email address to run through combined syntax, disposable-domain, and MX-record checks."
    }
  },
  "required": [
    "email"
  ]
}

favicon

Returns the favicon URL a website declares: fetches the homepage and takes the first <link rel='icon'> (or 'shortcut icon') href, resolved to an absolute URL, which may be a data: URI when the page inlines its icon (source: declared). If no icon is declared, or the homepage cannot be fetched, returns the conventional https://<domain>/favicon.ico with source: default and a note, without checking that it exists. Use it to display a site icon; it does not download or validate the image.

Parameters1

domain

string

required

Domain to fetch the favicon URL for, e.g. example.com.

Raw schema

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "description": "Domain to fetch the favicon URL for, e.g. example.com."
    }
  },
  "required": [
    "domain"
  ]
}

iban_validate

Validates an IBAN offline: ISO 7064 mod-97 checksum and country-specific length. Confirms the number is well-formed, not that the account exists.

Parameters1

iban

string

required

IBAN to validate. Spaces are ignored.

Raw schema

{
  "type": "object",
  "properties": {
    "iban": {
      "type": "string",
      "description": "IBAN to validate. Spaces are ignored."
    }
  },
  "required": [
    "iban"
  ]
}

ip_reputation

Checks an IPv4 or IPv6 address against a curated list of netblocks known to be hijacked or run by spam/cyber-crime operations (IPv4-mapped IPv6 uses the IPv4 list). A narrow list-based signal: a clean result is not a safety guarantee. Includes list date and attribution.

Parameters1

string

required

IPv4 or IPv6 address to check (IPv4-mapped IPv6 such as ::ffff:1.2.3.4 is checked against the IPv4 list) against a curated list of known hijacked or cyber-crime-controlled netblocks.

Raw schema

{
  "type": "object",
  "properties": {
    "ip": {
      "type": "string",
      "description": "IPv4 or IPv6 address to check (IPv4-mapped IPv6 such as ::ffff:1.2.3.4 is checked against the IPv4 list) against a curated list of known hijacked or cyber-crime-controlled netblocks."
    }
  },
  "required": [
    "ip"
  ]
}

jwt_decode

Decodes a JWT's header and payload WITHOUT verifying its signature, so its claims must not be trusted on this basis alone. To check authenticity, use jwt_verify.

Parameters1

token

string

required

The JWT to decode. Decodes header and payload only -- does not verify the signature (use /jwt-verify for that).

Raw schema

{
  "type": "object",
  "properties": {
    "token": {
      "type": "string",
      "description": "The JWT to decode. Decodes header and payload only -- does not verify the signature (use /jwt-verify for that)."
    }
  },
  "required": [
    "token"
  ]
}

jwt_verify

Cryptographically verifies a JWT signature (HS256/384/512, RS/PS256/384/512, ES256/384/512) and checks exp/nbf claims. Provide a secret for HS*, or a JWK or JWKS URL for RS/PS/ES. Use instead of jwt_decode whenever authenticity matters.

Parameters4

token	string	required	The JWT to verify. Checks the cryptographic signature -- use /jwt-decode if you only need to read the header and payload.
secret	string	optional	Required for HS256/384/512.
jwk	object	optional	Public key in JWK format, for RS/PS/ES algorithms.
jwks_url	string	optional	URL to a JWKS document; the key is matched by the token's "kid" header.

Raw schema

{
  "type": "object",
  "properties": {
    "token": {
      "type": "string",
      "description": "The JWT to verify. Checks the cryptographic signature -- use /jwt-decode if you only need to read the header and payload."
    },
    "secret": {
      "type": "string",
      "description": "Required for HS256/384/512."
    },
    "jwk": {
      "type": "object",
      "description": "Public key in JWK format, for RS/PS/ES algorithms."
    },
    "jwks_url": {
      "type": "string",
      "description": "URL to a JWKS document; the key is matched by the token's \"kid\" header."
    }
  },
  "required": [
    "token"
  ]
}

link_metadata

Fetches a web page and extracts its title, description, canonical URL, Open Graph and Twitter Card tags (the data behind link previews). To follow a URL's redirects hop by hop, use redirect_trace.

Parameters1

url

string

required

URL to extract title, description, and Open Graph / Twitter Card metadata from.

Raw schema

{
  "type": "object",
  "properties": {
    "url": {
      "type": "string",
      "description": "URL to extract title, description, and Open Graph / Twitter Card metadata from."
    }
  },
  "required": [
    "url"
  ]
}

maintainer_change_check

npm only. Flags a previously unseen human publisher taking over a package after 180+ days of inactivity, within the last 365 days (the event-stream attack pattern). npm trusted publishing (verified OIDC identity, not just a bot-like account name), pre-release, and handovers to a publisher who already maintains another widely used package (100k+ weekly downloads) are reported but not flagged. Does not detect hijacked existing accounts; a heuristic for review, not proof.

Parameters2

ecosystem	string	required	Currently only 'npm' is supported.
package	string	required	Package name, e.g. lodash

Raw schema

{
  "type": "object",
  "properties": {
    "ecosystem": {
      "type": "string",
      "description": "Currently only 'npm' is supported."
    },
    "package": {
      "type": "string",
      "description": "Package name, e.g. lodash"
    }
  },
  "required": [
    "ecosystem",
    "package"
  ]
}

password

Generates a random password, with options for length, symbols, uppercase, numbers and excluding ambiguous characters. To evaluate an existing password, use password_check.

Parameters5

length	string	optional	Desired password length. Defaults to a reasonable secure length if omitted.
symbols	string	optional	Whether to include symbol characters. 1 for yes, 0 for no.
uppercase	string	optional	Whether to include uppercase letters. 1 for yes, 0 for no.
numbers	string	optional	Whether to include numeric digits. 1 for yes, 0 for no.
exclude_ambiguous	string	optional	Whether to exclude visually ambiguous characters (e.g. 0/O, 1/l). 1 for yes, 0 for no.

Raw schema

{
  "type": "object",
  "properties": {
    "length": {
      "type": "string",
      "description": "Desired password length. Defaults to a reasonable secure length if omitted."
    },
    "symbols": {
      "type": "string",
      "description": "Whether to include symbol characters. 1 for yes, 0 for no."
    },
    "uppercase": {
      "type": "string",
      "description": "Whether to include uppercase letters. 1 for yes, 0 for no."
    },
    "numbers": {
      "type": "string",
      "description": "Whether to include numeric digits. 1 for yes, 0 for no."
    },
    "exclude_ambiguous": {
      "type": "string",
      "description": "Whether to exclude visually ambiguous characters (e.g. 0/O, 1/l). 1 for yes, 0 for no."
    }
  },
  "required": []
}

password_breach

Checks whether a password appears in known data breaches (Have I Been Pwned) and how many times, using k-anonymity towards HIBP. Breach check only; password_check adds strength scoring and sends the password in a POST body.

Parameters1

password

string

required

Password to check against known data-breach corpora. Only a 5-character SHA-1 hash prefix is sent to HIBP (k-anonymity), but the password itself travels in this request's URL; for real passwords, prefer password_check, which takes it in a POST body.

Raw schema

{
  "type": "object",
  "properties": {
    "password": {
      "type": "string",
      "description": "Password to check against known data-breach corpora. Only a 5-character SHA-1 hash prefix is sent to HIBP (k-anonymity), but the password itself travels in this request's URL; for real passwords, prefer password_check, which takes it in a POST body."
    }
  },
  "required": [
    "password"
  ]
}

password_check

Scores a password's strength (length, character variety, entropy, common patterns) and, with check_breach=true, also looks it up in Have I Been Pwned breach data via k-anonymity (only a hash prefix is sent). Use it to evaluate a password someone is choosing; use password_breach when you only need the breach count, and password to generate a new one. The password travels in a POST body, never in a URL.

Parameters2

password	string	required	Password to evaluate for strength (length, character variety, common patterns).
check_breach	boolean	optional	Whether to also check the password against known data-breach corpora via k-anonymity. true or false.

Raw schema

{
  "type": "object",
  "properties": {
    "password": {
      "type": "string",
      "description": "Password to evaluate for strength (length, character variety, common patterns)."
    },
    "check_breach": {
      "type": "boolean",
      "description": "Whether to also check the password against known data-breach corpora via k-anonymity. true or false."
    }
  },
  "required": [
    "password"
  ]
}

phone_verify

Validates and formats a phone number: validity, country, line type, E.164, international and national formats. Numbers without a leading + require 'country', since the end user's country cannot be inferred over MCP.

Parameters2

number	string	required	Phone number to validate and format, ideally in E.164 format (e.g. +14155552671).
country	string	optional	ISO 3166-1 alpha-2 country code (e.g. US, FR). Required unless the number starts with +: over MCP the end user's country cannot be inferred.

Raw schema

{
  "type": "object",
  "properties": {
    "number": {
      "type": "string",
      "description": "Phone number to validate and format, ideally in E.164 format (e.g. +14155552671)."
    },
    "country": {
      "type": "string",
      "description": "ISO 3166-1 alpha-2 country code (e.g. US, FR). Required unless the number starts with +: over MCP the end user's country cannot be inferred."
    }
  },
  "required": [
    "number"
  ]
}

redirect_trace

Follows a URL's full redirect chain (up to 15 hops) and returns every hop with its status code, plus whether the chain crossed domains. Use it to see where a short or tracking link really leads; check the final URL with url_reputation.

Parameters1

url

string

required

URL to follow the full redirect chain for, hop by hop.

Raw schema

{
  "type": "object",
  "properties": {
    "url": {
      "type": "string",
      "description": "URL to follow the full redirect chain for, hop by hop."
    }
  },
  "required": [
    "url"
  ]
}

repo_health_check

Maintenance signals for a GitHub repository given as owner/name: stars, forks, open issues, license, archived and fork flags, creation date and age, days since last push, topics. Use it to judge whether a dependency looks maintained or abandoned. For an npm or PyPI package whose repository you do not know, supply_chain_check resolves it from registry metadata and includes these signals. GitHub only; missing or private repositories return found: false.

Parameters1

repo

string

required

GitHub repository in owner/name format, e.g. lodash/lodash.

Raw schema

{
  "type": "object",
  "properties": {
    "repo": {
      "type": "string",
      "description": "GitHub repository in owner/name format, e.g. lodash/lodash."
    }
  },
  "required": [
    "repo"
  ]
}

rpc_check

Read-only audit of a public CometBFT (Cosmos SDK) RPC endpoint: node status, health, peers, and whether unsafe admin methods (dial_seeds, dial_peers, unsafe_flush_mempool) are publicly exposed. Never calls an unsafe method; exposure is inferred from the node's route listing.

Parameters1

url

string

required

Base URL of a CometBFT RPC endpoint to audit, e.g. https://rpc.cosmos.network:443.

Raw schema

{
  "type": "object",
  "properties": {
    "url": {
      "type": "string",
      "description": "Base URL of a CometBFT RPC endpoint to audit, e.g. https://rpc.cosmos.network:443."
    }
  },
  "required": [
    "url"
  ]
}

security_headers

Audits the HTTP security headers of one URL (CSP, HSTS, X-Frame-Options, Permissions-Policy, cross-origin policies and others) and returns per-header findings with fix advice, a score and a letter grade. Use it when you need header hardening advice; security_scan runs this audit together with URL reputation and subdomain discovery in one call.

Parameters1

url

string

required

URL to audit HTTP security headers for (CSP, HSTS, X-Frame-Options, etc.).

Raw schema

{
  "type": "object",
  "properties": {
    "url": {
      "type": "string",
      "description": "URL to audit HTTP security headers for (CSP, HSTS, X-Frame-Options, etc.)."
    }
  },
  "required": [
    "url"
  ]
}

security_scan

Combined website check in one call: security headers, URL reputation and passive subdomain discovery, run in parallel, with an overall score and verdict. Use the individual tools when you need a single signal.

Parameters1

url

string

required

URL to run a combined security posture check against (headers, reputation, and related signals).

Raw schema

{
  "type": "object",
  "properties": {
    "url": {
      "type": "string",
      "description": "URL to run a combined security posture check against (headers, reputation, and related signals)."
    }
  },
  "required": [
    "url"
  ]
}

subdomains

Passive subdomain discovery from Certificate Transparency logs (crt.sh): finds hostnames that appeared in public TLS certificates, not every DNS record. crt.sh is occasionally slow or unavailable.

Parameters1

domain

string

required

Domain to passively discover subdomains for via Certificate Transparency logs, e.g. example.com.

Raw schema

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "description": "Domain to passively discover subdomains for via Certificate Transparency logs, e.g. example.com."
    }
  },
  "required": [
    "domain"
  ]
}

supply_chain_check

One-call risk check for a package: combines vulnerability_check (OSV.dev), typosquat_check, maintainer_change_check (npm only) and repo_health_check (when the GitHub repo can be resolved) into one overall verdict. Use before adding a dependency; use the individual tools to investigate one signal.

Parameters2

ecosystem	string	required	Package ecosystem, e.g. npm. maintainer-change-check only runs for npm.
package	string	required	Package name to check.

Raw schema

{
  "type": "object",
  "properties": {
    "ecosystem": {
      "type": "string",
      "description": "Package ecosystem, e.g. npm. maintainer-change-check only runs for npm."
    },
    "package": {
      "type": "string",
      "description": "Package name to check."
    }
  },
  "required": [
    "ecosystem",
    "package"
  ]
}

text_similarity

Near-duplicate detection with a 64-bit SimHash over word shingles: send 1 text to get its hash, or 2 texts to compare them. Detects paraphrased or lightly edited copies; unrelated texts score around 50%, not 0%.

Parameters1

texts

array

required

1 text (hash only) or 2 texts (compare). Max 200,000 characters each.

Raw schema

{
  "type": "object",
  "properties": {
    "texts": {
      "type": "array",
      "description": "1 text (hash only) or 2 texts (compare). Max 200,000 characters each."
    }
  },
  "required": [
    "texts"
  ]
}

timestamp

Returns the current time, or converts between a Unix timestamp (seconds) and an ISO date. Provide unix or date, or neither for the current time.

Parameters2

unix	string	optional	Unix timestamp (seconds since epoch) to convert to a human-readable date. Provide either unix or date, not both.
date	string	optional	Date/time string to convert to a Unix timestamp. Provide either unix or date, not both.

Raw schema

{
  "type": "object",
  "properties": {
    "unix": {
      "type": "string",
      "description": "Unix timestamp (seconds since epoch) to convert to a human-readable date. Provide either unix or date, not both."
    },
    "date": {
      "type": "string",
      "description": "Date/time string to convert to a Unix timestamp. Provide either unix or date, not both."
    }
  },
  "required": []
}

tx_decode

Decodes a raw signed Cosmos SDK transaction (base64 TxRaw bytes, as found in a CometBFT block's data.txs) into JSON: messages, fee, gas, signers and signatures. Bank, staking, gov and authz messages are fully decoded; other types are returned as type URL plus raw hex.

Parameters1

string

required

Base64-encoded Cosmos SDK TxRaw protobuf bytes, as returned by a chain's CometBFT RPC /block or /tx_search endpoints.

Raw schema

{
  "type": "object",
  "properties": {
    "tx": {
      "type": "string",
      "description": "Base64-encoded Cosmos SDK TxRaw protobuf bytes, as returned by a chain's CometBFT RPC /block or /tx_search endpoints."
    }
  },
  "required": [
    "tx"
  ]
}

typosquat_check

Checks whether an npm or PyPI package name is a near-miss of a well-known package (typosquatting), with an edit-distance threshold scaled to name length; names of 3 characters or fewer are not fuzzy-matched. Uses a curated list of popular names, so a clean result does not prove a package is safe.

Parameters2

ecosystem	string	required	Package ecosystem, e.g. npm or PyPI.
package	string	required	Package name to check for likely typosquatting of a well-known package in the given ecosystem.

Raw schema

{
  "type": "object",
  "properties": {
    "ecosystem": {
      "type": "string",
      "description": "Package ecosystem, e.g. npm or PyPI."
    },
    "package": {
      "type": "string",
      "description": "Package name to check for likely typosquatting of a well-known package in the given ecosystem."
    }
  },
  "required": [
    "ecosystem",
    "package"
  ]
}

url_clean

Removes 60+ known tracking parameters (utm_*, fbclid, gclid and similar) from a URL and returns the clean URL. Does not follow redirects; for that, use redirect_trace.

Parameters1

url

string

required

URL to strip tracking parameters from (utm_*, fbclid, gclid, and similar).

Raw schema

{
  "type": "object",
  "properties": {
    "url": {
      "type": "string",
      "description": "URL to strip tracking parameters from (utm_*, fbclid, gclid, and similar)."
    }
  },
  "required": [
    "url"
  ]
}

url_reputation

Checks a URL against URLhaus (abuse.ch), a public database of known malware distribution URLs. A clean result only means the URL is not listed, not that it is safe.

Parameters1

url

string

required

URL to check against known phishing/malware URL databases.

Raw schema

{
  "type": "object",
  "properties": {
    "url": {
      "type": "string",
      "description": "URL to check against known phishing/malware URL databases."
    }
  },
  "required": [
    "url"
  ]
}

user_agent

Parses a User-Agent string into browser and version, operating system and version, device type, and whether it looks like a bot.

Parameters1

string

required

User-Agent string to parse. Required over MCP: the server cannot see the end user's own User-Agent.

Raw schema

{
  "type": "object",
  "properties": {
    "ua": {
      "type": "string",
      "description": "User-Agent string to parse. Required over MCP: the server cannot see the end user's own User-Agent."
    }
  },
  "required": [
    "ua"
  ]
}

uuid

Generates 1 to 100 random UUID v4 values.

Parameters1

count

string

optional

Number of UUIDs (v4) to generate. Defaults to 1 if omitted.

Raw schema

{
  "type": "object",
  "properties": {
    "count": {
      "type": "string",
      "description": "Number of UUIDs (v4) to generate. Defaults to 1 if omitted."
    }
  },
  "required": []
}

vat_validate

Checks an EU VAT number in real time against the European Commission's VIES service and, when valid, returns the registered company name and address. VIES is occasionally unavailable for some member states.

Parameters2

country	string	optional	2-letter EU country code (EL for Greece, XI for Northern Ireland). Optional if vat includes the prefix.
vat	string	required	VAT number, with or without the country prefix.

Raw schema

{
  "type": "object",
  "properties": {
    "country": {
      "type": "string",
      "description": "2-letter EU country code (EL for Greece, XI for Northern Ireland). Optional if vat includes the prefix."
    },
    "vat": {
      "type": "string",
      "description": "VAT number, with or without the country prefix."
    }
  },
  "required": [
    "vat"
  ]
}

vulnerability_check

Checks a package (optionally a specific version) against OSV.dev for known vulnerabilities: npm, PyPI, Go, crates.io, Maven, RubyGems, Packagist and NuGet. Use cve_lookup when you already have a CVE/GHSA ID, or supply_chain_check for a combined verdict.

Parameters3

ecosystem	string	required	Package ecosystem, e.g. npm, PyPI, Go, crates.io, Maven, RubyGems, Packagist, or NuGet.
package	string	required	Package name to check against OSV.dev for known CVEs.
version	string	optional	Omit to check all versions of the package.

Raw schema

{
  "type": "object",
  "properties": {
    "ecosystem": {
      "type": "string",
      "description": "Package ecosystem, e.g. npm, PyPI, Go, crates.io, Maven, RubyGems, Packagist, or NuGet."
    },
    "package": {
      "type": "string",
      "description": "Package name to check against OSV.dev for known CVEs."
    },
    "version": {
      "type": "string",
      "description": "Omit to check all versions of the package."
    }
  },
  "required": [
    "ecosystem",
    "package"
  ]
}

whois_lookup

Domain registration data via RDAP (the modern WHOIS): registrar, creation and expiration dates, domain age in days, nameservers. For DNS records, use dns_lookup.

Parameters1

domain

string

required

Domain to look up registration details for via RDAP, e.g. example.com.

Raw schema

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "description": "Domain to look up registration details for via RDAP, e.g. example.com."
    }
  },
  "required": [
    "domain"
  ]
}

README.md8 KBView on GitHub

Presend — Free Privacy Tools, a Security API, and an MCP Server for AI Agents

Presend is three things: 48 free browser-based file tools (nothing ever uploaded), a free 48-endpoint security/utility API (no signup, no key), and an MCP server exposing 41 of those endpoints to AI agents.

Open Presend · API docs · OpenAPI spec · MCP server

Why Presend?

Unlike most online tools, Presend processes files entirely locally in your browser -- your files never leave your device. And unlike most free API directories, the API layer has no signup wall or aggressive rate limits gating basic use.

100% Private (browser tools) -- Web Crypto API, Canvas API, FileReader -- all client-side
Real supply-chain security (API) -- maintainer-change-check flags a package recently taken over by a previously unseen publisher after a long dormancy (the event-stream pattern; it does not detect hijacked existing accounts)
Instant -- Cloudflare CDN, loads in under 1 second globally
PWA -- Install on mobile/desktop, works offline
Free Forever -- No freemium, no watermarks, no limits

API & MCP Server

REST API -- 40 free endpoints: security & verification (WHOIS/DNS, package vulnerability & typosquat checks, malware scanning, JWT decode/verify, GitHub repo health, maintainer-change detection), file & image processing, and everyday utilities. Full OpenAPI 3.0 spec.
MCP server -- 33 tools over Streamable HTTP, no signup, no key. Verified working with LangChain, CrewAI, LlamaIndex, OpenAI's Agents SDK, and Google's ADK.
npm client -- npm install presend-api, zero-dependency, wraps 42 methods.
GitHub Action -- drop-in dependency security scanning (npm + PyPI) for any CI pipeline.
Code examples -- working Python for LangChain, CrewAI, LlamaIndex, OpenAI Agents SDK, Google ADK, and plain REST.
MCP config guides -- copy-paste setup for Claude Desktop, Claude Code, Cursor, and Windsurf, no code required.
Browser extension -- "Presend — Clean Photos", strips EXIF/GPS on right-click.

Python: Cloudflare rejects the default urllib User-Agent (Python-urllib/3.x) with 403 error code: 1010. Set an explicit one, e.g. urllib.request.Request(url, headers={"User-Agent": "my-app/1.0"}). requests, curl and Node are not affected.

Browser Tools (48 total, 22 shown below)

Tool	What it does	Link
EXIF Remover	Strip GPS, camera model, timestamps from photos	Open
PDF Metadata Remover	Remove author, software, dates from PDFs	Open
Image Compressor	Shrink JPG/PNG/WebP with quality preview	Open
PDF Compress	Reduce PDF file size without quality loss	Open
PDF Merger	Combine multiple PDFs into one document	Open
Image Resizer	Resize to exact dimensions (Instagram, LinkedIn, Twitter)	Open
HEIC to JPG Converter	Convert iPhone photos to universal JPG	Open
Video Metadata Remover	Strip GPS and device data from MP4/MOV	Open
Office Metadata Remover	Clean Word, Excel, PowerPoint hidden data	Open
File Hash Checker	Verify SHA-256, SHA-1, SHA-512 checksums	Open
Password Generator	Create cryptographically secure passwords	Open
Password Strength	Analyze password entropy and crack time	Open
QR Code Generator	Generate QR codes for URLs, WiFi, text	Open
URL Cleaner	Remove tracking parameters (UTM, fbclid, gclid)	Open
Email List Cleaner	Deduplicate, validate, clean email lists	Open
JSON to CSV Converter	Convert between JSON and CSV instantly	Open
Image to Base64	Encode images for embedding in HTML/CSS	Open
Text Diff	Compare two texts side by side	Open
Text Formatter	Bold, italic, stylized text for social media	Open
Thread Splitter	Split long text into Twitter/X threads	Open
Word Counter	Count words, characters, reading time	Open
Color Contrast	Check WCAG accessibility contrast ratios	Open

SEO and Performance

Presend is built for search engines and AI assistants:

Schema.org: HowTo, FAQPage, SoftwareApplication, BreadcrumbList, Organization on every page
Dynamic Sitemap: 842 URLs auto-updated (40 tools + blog/guide pages, across 8 languages)
Dynamic OG Images: API generates social preview images per tool
Core Web Vitals: Preconnect, DNS-prefetch, CSS preload, zero render-blocking JS
PWA: Service worker + manifest for offline use and installability
Privacy-First Analytics: Cloudflare Web Analytics (no cookies, no IP tracking)

Embed on Your Site

Add a Presend tool to your website or link back to us:

See all embed options

Tech Stack

Frontend: Vanilla HTML5, CSS3, ES6 (zero build step)
Hosting: Cloudflare Pages (200+ edge locations)
APIs: Cloudflare Workers (share links, analytics, sitemap, OG images)
Storage: Cloudflare KV (share links, 30-day TTL)
PWA: Service Worker + Web App Manifest

License

MIT — free to use, modify, and embed.

Open Presend

Install

Tools (40)

address_riskai_crawler_checkbase64colorcsv_jsoncve_lookupdns_lookupemail_disposable

Remote endpoint

Streamable HTTP

Hosted server - connect over the network, no local install.

url

https://presend.pages.dev/mcp

Add to VS Code Add to Cursor

claude_desktop_config.json

json

{
  "mcpServers": {
    "presend-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://presend.pages.dev/mcp"
      ]
    }
  }
}

Desktop config is stdio-only; this bridges via mcp-remote. Native remote: Settings > Connectors.

🛠️ Key Features

🚀 Use Cases

⚡ Developer Benefits

⚠️ Limitations

Topics

address_risk

ai_crawler_check

base64

color

csv_json

cve_lookup

dns_lookup

email_disposable

email_security

email_validate

email_verify

favicon

iban_validate

ip_reputation

jwt_decode

jwt_verify

link_metadata

maintainer_change_check

password

password_breach

password_check

phone_verify

redirect_trace

repo_health_check

rpc_check

security_headers

security_scan

subdomains

supply_chain_check

text_similarity

timestamp

tx_decode

typosquat_check

url_clean

url_reputation

user_agent

uuid

vat_validate

vulnerability_check

whois_lookup

Presend — Free Privacy Tools, a Security API, and an MCP Server for AI Agents

Why Presend?

API & MCP Server

Browser Tools (48 total, 22 shown below)

SEO and Performance

Embed on Your Site

Tech Stack

License

Install

Remote endpoint

Related servers