mcp-toolbelt

할 수 있는 일

이 서버는 아직 쉬운 말로 된 요약을 쓰지 못했어요. 아래는 레지스트리에서 읽어 온 사실이에요.

• 연결 방식: 클라우드에서 실행
• 전송 방식: Streamable HTTP
• 카테고리: 사이버 보안

설치

쓰고 있는 AI 앱을 고른 다음 설정을 복사하세요.

필요한 것

• 클라우드에서 실행설치할 것 없음. 인터넷으로 연결돼요

어떤 앱을 쓰세요?

https://papacasper.com/mcp

claude mcp add --transport http toolbelt https://papacasper.com/mcp

{
  "mcpServers": {
    "toolbelt": {
      "url": "https://papacasper.com/mcp"
    }
  }
}

{
  "servers": {
    "toolbelt": {
      "type": "http",
      "url": "https://papacasper.com/mcp"
    }
  }
}

https://papacasper.com/mcp

선택한 앱은 이 기기의 쿠키에만 저장돼요. 계정은 필요 없어요.

이 설정은 제작자의 레지스트리 정보로 만들었어요. README와 다르면 README를 따르세요.

할 수 있는 일

도구 이름과 설명은 서버가 2026년 11월 6일에 알려 준 그대로예요. 우리가 아니라 제작자가 쓴 글이고, 일반 텍스트로만 보여 드려요.

• url_to_markdown

  Fetch a URL and return its main text content as clean, readable plain text/markdown-ish output. Strips scripts, styles, and HTML tags.

• security_headers_audit

  Fetch a URL and audit its response headers in one pass: security headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy) with a score, PLUS its CORS policy (the probe sends a foreign Origin header and flags wildcard-origin + credentials c

• redirect_chain_check

  Follow a URL through every HTTP redirect hop and report the full chain, final destination, and issues like redirect loops, too many hops, or HTTPS-to-HTTP downgrades.

• page_performance_check

  Fetch a URL and measure time-to-first-byte, total fetch time, and response size from this server. Flags missing compression, missing Cache-Control, oversized payloads, and slow TTFB. Lightweight raw-timing check — for Google Lighthouse scores, Core Web Vitals, and real-user field

• structured_data_extract

  Fetch a URL and extract structured data deterministically: JSON-LD blocks (each one also VALIDATED — @context/@type presence plus required fields for common schema.org types like Article, Product, Organization, FAQPage), OpenGraph/meta tags, and optional caller-supplied CSS-selec

• tech_stack_fingerprint

  Fetch a URL and fingerprint its likely tech stack from response headers (server, x-powered-by, x-generator) and HTML markers (generator meta tag, framework/CMS-specific script or class patterns). Answers 'what is this site built with?' — for on-page SEO/content signals use seo_au

• seo_audit

  Fetch a URL and run a full on-page SEO audit: title/meta description length, canonical tag, Open Graph + Twitter Card tags, html lang attribute, viewport meta, heading structure, image alt-text coverage, internal/external link counts and generic-anchor-text detection, robots meta

• check_robots_sitemap

  Check a site's robots.txt and sitemap.xml in one call: raw contents (truncated), sitemap presence, an AI-crawler policy analysis (explicit rules for GPTBot, ClaudeBot, CCBot, PerplexityBot, Google-Extended, Bytespider, Amazonbot and other AI crawlers, vs wildcard/default), and ll

• broken_link_check

  Find broken links two ways. Default (crawl mode): crawl a site starting from a URL (same-origin pages only, bounded by maxPages) and check every linked URL for broken status codes, returning each broken link with the page(s) it was found on. Sitemap mode (viaSitemap: true): parse

• ai_readiness_audit

  Score how ready a website is for AI agents and LLM-driven discovery, 0-100 with a letter grade: robots.txt presence, explicit AI-crawler policy (GPTBot, ClaudeBot, CCBot, PerplexityBot, and 8 more), llms.txt presence and structure, structured data (JSON-LD) and Open Graph basics,

• domain_health_check

  Check a domain's registration expiry (via WHOIS) and DNS health: nameservers, A/AAAA, MX, SPF, and DMARC records. Flags common misconfigurations. WHOIS + DNS only — for the WHOIS record alone use whois_lookup; for deliverability detail (DKIM, DNSBL, PTR) use email_deliverability_

• dns_propagation_check

  Query a DNS record for a domain against several major public resolvers (Google, Cloudflare, Quad9, OpenDNS) in parallel and compare the answers. Flags mismatches, which usually mean propagation is still in progress after a DNS change.

• email_deliverability_check

  Deep-dive email deliverability check for a domain: MX records + reverse-DNS (PTR) on each MX host, common DKIM selector probing, SPF lookup-count (RFC 7208 caps at 10), DMARC policy strength, and DNSBL blacklist lookups (Spamhaus Zen, SpamCop, Barracuda) on MX IPs. Note: public-r

• whois_lookup

  Look up a domain's WHOIS registration record: registrar, creation and expiry dates, days remaining, name servers, and domain statuses, direct from the TLD registry. Registration data only — for DNS/mail health as well, use domain_health_check; for a combined report, use domain_re

• domain_availability_check

  Check whether a domain is registered, plus scan common typo-squat variants (adjacent-key substitution, letter omission/doubling, transposition) across popular TLDs (.com, .net, .org, .io, .co, .ai, .app, .dev) for brand-protection or domain-flipping research. WHOIS-based; capped

• subdomain_discovery

  Enumerate a domain's subdomains from public Certificate Transparency logs (crt.sh, with a Cert Spotter fallback): every hostname that has ever appeared on a certificate for the domain. Passive reconnaissance - no packets are sent to the target. Useful for attack-surface reviews,

• ssl_cert_check

  Connect to a host over TLS and report its certificate's expiry date, days remaining, issuer, and subject. Fast facts only — for a full graded TLS assessment (protocols, ciphers, vulnerabilities) use ssl_labs_grade instead.

• check_open_ports

  TCP-connect scan a host for open ports, plus network intel on the host's resolved IPs (ASN, network owner, BGP prefix, country — via Team Cymru). Defaults to a list of ~20 common service ports (SSH, HTTP/S, mail, DBs, etc.) if none are given. For checking your own infrastructure'

• websocket_endpoint_check

  Test a WebSocket endpoint (ws:// or wss://): attempts the handshake, reports success/failure, time-to-open in ms, and close code/reason. Useful for verifying a WebSocket server is reachable and completes its upgrade handshake before you wire real traffic to it.

• domain_report

  Bundle: runs seo_audit, domain_health_check (WHOIS + DNS: nameservers, A/AAAA, MX, SPF, DMARC), and email_deliverability_check (DKIM, SPF lookup-count, DMARC strength, DNSBL) against a domain in one call, one charge. Cheaper than calling the three tools separately. Each sub-check

• safe_browsing_check

  Check a URL against Google Safe Browsing's malware/phishing/unwanted-software/PUA blocklists. Requires GOOGLE_SAFE_BROWSING_API_KEY to be configured server-side (free Google Cloud API key).

• ssl_labs_grade

  Full SSL Labs-style TLS assessment: overall letter grade, protocol support (TLS 1.0-1.3), cipher strength, certificate chain issues, and known vulnerabilities (Heartbleed, POODLE, etc.) for each endpoint. Use this for a deep grade; use ssl_cert_check instead for a fast expiry/iss

• exposed_files_check AI에게 내리는 지시처럼 보여요

  Probe a site for publicly exposed sensitive files attackers scan for: /.env and variants, /.git/config and /.git/HEAD, /.svn/entries, docker-compose files, /.aws/credentials, /.ssh/id_rsa, database dumps (backup.sql, db.sql, dump.sql), backup archives, phpinfo pages, .DS_Store, a

• pagespeed_insights

  Run Google's real PageSpeed Insights (Lighthouse + Chrome UX Report) against a URL: performance score, Core Web Vitals (LCP, CLS, INP/TBT), and real-user field data where available. The authoritative, Google-measured score — for a quick raw TTFB/size timing check from this server

• package_vulnerability_check

  Look up a package (optionally pinned to a version) against OSV.dev's aggregated vulnerability database (GitHub Advisories, PyPA, RustSec, Go vuln DB, etc.) for known CVEs/advisories. Supports npm, PyPI, crates.io, RubyGems, Go, Maven, NuGet, and Packagist ecosystems. Useful befor

• github_repo_health_check

  Check a GitHub repository's health signals: stars, forks, open issues, license, archived/disabled status, and days since last push. Flags likely-abandoned or unlicensed repos. Useful before depending on a repo.

• email_address_validate

  Validate a single email address: RFC syntax check, MX record lookup on the domain, disposable/temporary-email-provider detection, and role-account detection (info@, admin@, etc.). Per-address check — different from email_deliverability_check, which audits a whole domain's sending

• smtp_server_check

  Live-probe a mail server over SMTP: connects to port 25 (or a given port), reads the banner, issues EHLO and lists advertised capabilities (STARTTLS, AUTH mechanisms, SIZE, 8BITMIME, PIPELINING), then upgrades via STARTTLS when offered and reports the TLS protocol and certificate

• mcp_server_probe

  Probe a remote MCP server end-to-end: performs the initialize handshake, captures server info and protocol version, lists its tools, and grades tool-quality the way directories like Glama do — description coverage and depth, input-schema completeness, and naming consistency — wit

기본 점검i

누구나 볼 수 있는 정보를 점검했고, 코드는 읽지 않았어요. 해당하지 않는 항목은 개수에서 뺐어요. · 2026년 11월 7일 점검

• ! 주의

  제작자와 저장소 일치

  레지스트리에 소스 저장소가 없어서, 게시자(papacasper.com)와 코드를 맞춰 볼 수 없어요

• … 아직 점검 안 함

  계속 관리되고 있음

  아직 GitHub에서 이 저장소를 읽어 오지 않았어요

• … 아직 점검 안 함

  라이선스 있음

  아직 GitHub에서 이 저장소를 읽어 오지 않았어요

• ✓ 통과

  엔드포인트 응답

  863ms 만에 응답(HTTP 200)

• – 해당 없음

  OAuth로 로그인

  로그인 필요 없음

• ✕ 실패

  도구 설명에 숨겨진 지시 없음

  도구 설명 1개에 AI에게 지시하는 것처럼 보이는 글이 있어요. 설치하기 전에 아래 내용을 읽어 보세요

사이버 보안 카테고리의 다른 서버와 비교i

• 이 카테고리의 다른 서버 994개 중 0%보다 스타가 많아요
• 이 카테고리의 다른 서버 994개 중 85%보다 최근에 레지스트리에 공개됐어요
• 기본 점검 결과가 이 카테고리의 다른 서버 994개 중 22%와 같거나 더 좋아요

레지스트리에서 이 카테고리의 활성 서버 전체와 비교했어요. 스타는 게시자가 저장소를 소유한 경우에만 세요.

대안

같은 카테고리에서 다른 제작자가 만든 서버예요. 스타 순으로 정렬했어요.

카드 보는 법:★ GitHub 스타i세 기둥: 리뷰 · 점검 · 사용 정도i업데이트 = 최신 버전을 레지스트리에 공개한 날i

제작자의 README

저장소에서 README를 찾지 못했어요