mcp-toolbelt

What you can do with it

We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.

• Connection: Runs in the cloud
• Transport: Streamable HTTP
• Category: Cybersecurity

Install

Pick the AI app you use, then copy the settings.

You need

• Runs in the cloudNothing to install; it connects over the internet

Which app do you use?

https://papacasper.com/mcp

claude mcp add --transport http toolbelt https://papacasper.com/mcp

{
  "mcpServers": {
    "toolbelt": {
      "url": "https://papacasper.com/mcp"
    }
  }
}

{
  "servers": {
    "toolbelt": {
      "type": "http",
      "url": "https://papacasper.com/mcp"
    }
  }
}

https://papacasper.com/mcp

Your choice stays on this device in a cookie; no account needed.

These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.

What it can do

Tool names and descriptions exactly as the server reported them on Nov 6, 2026. The maker wrote them, not us; we show them as plain text.

• url_to_markdown

  Fetch a URL and return its main text content as clean, readable plain text/markdown-ish output. Strips scripts, styles, and HTML tags.

• security_headers_audit

  Fetch a URL and audit its response headers in one pass: security headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy) with a score, PLUS its CORS policy (the probe sends a foreign Origin header and flags wildcard-origin + credentials c

• redirect_chain_check

  Follow a URL through every HTTP redirect hop and report the full chain, final destination, and issues like redirect loops, too many hops, or HTTPS-to-HTTP downgrades.

• page_performance_check

  Fetch a URL and measure time-to-first-byte, total fetch time, and response size from this server. Flags missing compression, missing Cache-Control, oversized payloads, and slow TTFB. Lightweight raw-timing check — for Google Lighthouse scores, Core Web Vitals, and real-user field

• structured_data_extract

  Fetch a URL and extract structured data deterministically: JSON-LD blocks (each one also VALIDATED — @context/@type presence plus required fields for common schema.org types like Article, Product, Organization, FAQPage), OpenGraph/meta tags, and optional caller-supplied CSS-selec

• tech_stack_fingerprint

  Fetch a URL and fingerprint its likely tech stack from response headers (server, x-powered-by, x-generator) and HTML markers (generator meta tag, framework/CMS-specific script or class patterns). Answers 'what is this site built with?' — for on-page SEO/content signals use seo_au

• seo_audit

  Fetch a URL and run a full on-page SEO audit: title/meta description length, canonical tag, Open Graph + Twitter Card tags, html lang attribute, viewport meta, heading structure, image alt-text coverage, internal/external link counts and generic-anchor-text detection, robots meta

• check_robots_sitemap

  Check a site's robots.txt and sitemap.xml in one call: raw contents (truncated), sitemap presence, an AI-crawler policy analysis (explicit rules for GPTBot, ClaudeBot, CCBot, PerplexityBot, Google-Extended, Bytespider, Amazonbot and other AI crawlers, vs wildcard/default), and ll

• broken_link_check

  Find broken links two ways. Default (crawl mode): crawl a site starting from a URL (same-origin pages only, bounded by maxPages) and check every linked URL for broken status codes, returning each broken link with the page(s) it was found on. Sitemap mode (viaSitemap: true): parse

• ai_readiness_audit

  Score how ready a website is for AI agents and LLM-driven discovery, 0-100 with a letter grade: robots.txt presence, explicit AI-crawler policy (GPTBot, ClaudeBot, CCBot, PerplexityBot, and 8 more), llms.txt presence and structure, structured data (JSON-LD) and Open Graph basics,

• domain_health_check

  Check a domain's registration expiry (via WHOIS) and DNS health: nameservers, A/AAAA, MX, SPF, and DMARC records. Flags common misconfigurations. WHOIS + DNS only — for the WHOIS record alone use whois_lookup; for deliverability detail (DKIM, DNSBL, PTR) use email_deliverability_

• dns_propagation_check

  Query a DNS record for a domain against several major public resolvers (Google, Cloudflare, Quad9, OpenDNS) in parallel and compare the answers. Flags mismatches, which usually mean propagation is still in progress after a DNS change.

• email_deliverability_check

  Deep-dive email deliverability check for a domain: MX records + reverse-DNS (PTR) on each MX host, common DKIM selector probing, SPF lookup-count (RFC 7208 caps at 10), DMARC policy strength, and DNSBL blacklist lookups (Spamhaus Zen, SpamCop, Barracuda) on MX IPs. Note: public-r

• whois_lookup

  Look up a domain's WHOIS registration record: registrar, creation and expiry dates, days remaining, name servers, and domain statuses, direct from the TLD registry. Registration data only — for DNS/mail health as well, use domain_health_check; for a combined report, use domain_re

• domain_availability_check

  Check whether a domain is registered, plus scan common typo-squat variants (adjacent-key substitution, letter omission/doubling, transposition) across popular TLDs (.com, .net, .org, .io, .co, .ai, .app, .dev) for brand-protection or domain-flipping research. WHOIS-based; capped

• subdomain_discovery

  Enumerate a domain's subdomains from public Certificate Transparency logs (crt.sh, with a Cert Spotter fallback): every hostname that has ever appeared on a certificate for the domain. Passive reconnaissance - no packets are sent to the target. Useful for attack-surface reviews,

• ssl_cert_check

  Connect to a host over TLS and report its certificate's expiry date, days remaining, issuer, and subject. Fast facts only — for a full graded TLS assessment (protocols, ciphers, vulnerabilities) use ssl_labs_grade instead.

• check_open_ports

  TCP-connect scan a host for open ports, plus network intel on the host's resolved IPs (ASN, network owner, BGP prefix, country — via Team Cymru). Defaults to a list of ~20 common service ports (SSH, HTTP/S, mail, DBs, etc.) if none are given. For checking your own infrastructure'

• websocket_endpoint_check

  Test a WebSocket endpoint (ws:// or wss://): attempts the handshake, reports success/failure, time-to-open in ms, and close code/reason. Useful for verifying a WebSocket server is reachable and completes its upgrade handshake before you wire real traffic to it.

• domain_report

  Bundle: runs seo_audit, domain_health_check (WHOIS + DNS: nameservers, A/AAAA, MX, SPF, DMARC), and email_deliverability_check (DKIM, SPF lookup-count, DMARC strength, DNSBL) against a domain in one call, one charge. Cheaper than calling the three tools separately. Each sub-check

• safe_browsing_check

  Check a URL against Google Safe Browsing's malware/phishing/unwanted-software/PUA blocklists. Requires GOOGLE_SAFE_BROWSING_API_KEY to be configured server-side (free Google Cloud API key).

• ssl_labs_grade

  Full SSL Labs-style TLS assessment: overall letter grade, protocol support (TLS 1.0-1.3), cipher strength, certificate chain issues, and known vulnerabilities (Heartbleed, POODLE, etc.) for each endpoint. Use this for a deep grade; use ssl_cert_check instead for a fast expiry/iss

• exposed_files_check Looks like an instruction to the AI

  Probe a site for publicly exposed sensitive files attackers scan for: /.env and variants, /.git/config and /.git/HEAD, /.svn/entries, docker-compose files, /.aws/credentials, /.ssh/id_rsa, database dumps (backup.sql, db.sql, dump.sql), backup archives, phpinfo pages, .DS_Store, a

• pagespeed_insights

  Run Google's real PageSpeed Insights (Lighthouse + Chrome UX Report) against a URL: performance score, Core Web Vitals (LCP, CLS, INP/TBT), and real-user field data where available. The authoritative, Google-measured score — for a quick raw TTFB/size timing check from this server

• package_vulnerability_check

  Look up a package (optionally pinned to a version) against OSV.dev's aggregated vulnerability database (GitHub Advisories, PyPA, RustSec, Go vuln DB, etc.) for known CVEs/advisories. Supports npm, PyPI, crates.io, RubyGems, Go, Maven, NuGet, and Packagist ecosystems. Useful befor

• github_repo_health_check

  Check a GitHub repository's health signals: stars, forks, open issues, license, archived/disabled status, and days since last push. Flags likely-abandoned or unlicensed repos. Useful before depending on a repo.

• email_address_validate

  Validate a single email address: RFC syntax check, MX record lookup on the domain, disposable/temporary-email-provider detection, and role-account detection (info@, admin@, etc.). Per-address check — different from email_deliverability_check, which audits a whole domain's sending

• smtp_server_check

  Live-probe a mail server over SMTP: connects to port 25 (or a given port), reads the banner, issues EHLO and lists advertised capabilities (STARTTLS, AUTH mechanisms, SIZE, 8BITMIME, PIPELINING), then upgrades via STARTTLS when offered and reports the TLS protocol and certificate

• mcp_server_probe

  Probe a remote MCP server end-to-end: performs the initialize handshake, captures server info and protocol version, lists its tools, and grades tool-quality the way directories like Glama do — description coverage and depth, input-schema completeness, and naming consistency — wit

Basic checksi

We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 8, 2026

• ! Caution

  Maker matches the repo

  The registry lists no source repo, so we cannot match the publisher (papacasper.com) to the code

• … Not checked yet

  Still maintained

  We have not read this repo from GitHub yet

• … Not checked yet

  Has a licence

  We have not read this repo from GitHub yet

• ✓ Pass

  Endpoint responds

  Responded in 863 ms (HTTP 200)

• – Not applicable

  Sign-in with OAuth

  No sign-in needed

• ✕ Fail

  No hidden instructions in tool descriptions

  1 tool descriptions contain text that looks like instructions to the AI. Read them below before installing

Compared with others in Cybersecurityi

• More stars than 0% of the other 1002 servers in this category
• Published to the registry more recently than 84% of the other 1002 servers in this category
• Basic checks equal to or better than 18% of the other 1002 servers in this category

Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.

Alternatives

Servers in the same category from other makers, sorted by stars.

Reading a card:↓ Downloads per weeki★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi

README from the maker

No README found in the repo