Toolbox

Install

Works with Claude Code, VS Code, Cursor, Windsurf. Read the repository before you give any tool access to your data.

npx agentmarket install connector/allthepossibles-com-toolbox

About

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list and install config. Checked Oct 25, 2026.

Tools

14 read · 0 write · 0 deleteRead-only

Secrets

None asked for

Install scripts

Nothing to install (hosted)

Runs as

Hosted (remote endpoint)

Tools (14)

As the server listed them on Oct 25, 2026. Descriptions are the server’s own words; hidden characters are shown as [U+…].

• check_ai_crawlersread-only

  Read a site's robots.txt and report which AI crawlers (GPTBot, ClaudeBot, Google-Extended, PerplexityBot, CCBot, Bytespider and more) are allowed, blocked or partially blocked; check for llms.txt and draft one from the site's metadata and sitemap.

• check_headersread-only

  Fetch a URL once and grade its response headers: HSTS, Content-Security-Policy, X-Content-Type-Options, frame control, Referrer-Policy, Permissions-Policy, Cache-Control, cookie Secure/HttpOnly/SameSite flags, and server version leaks. Returns a grade, a score and the exact header to add for each gap.

• check_page_metaread-only

  Fetch a URL and report what crawlers and link unfurlers see: title and meta description with lengths, canonical, lang, viewport, robots meta, h1s, Open Graph and Twitter card tags, favicon, JSON-LD types, the resulting preview card, and findings for anything missing or too long.

• check_sitemapread-only

  Check a site's sitemaps: discovers them from robots.txt, /sitemap.xml and /sitemap_index.xml, reads index files one level deep (20 children max), counts URLs per file and per host, summarises lastmod, and fetches a sample of URLs (HEAD, then GET) to count the ones that are not 200. Flags a missing sitemap, no robots.txt entry, over 50,000 URLs, other hosts, http URLs on https sites and missing lastmod.

• check_tellsread-only

  Check text for AI-writing tells (em-dashes, 'not just X but Y', rule-of-three lists, stock vocabulary like delve or seamlessly, hedge words, smart quotes, hidden Unicode) and return a score, each tell with its position, and a cleaned copy. Run it on anything you are about to publish on a human's behalf.

• decode_jwtread-only

  Decode a JWT's header and payload without verifying the signature (it never takes a secret). Returns the claims with iat, nbf and exp as ISO times, a plain-text expiresIn, issuer, subject and audience, and findings: alg none, HS* with a URL-like kid, missing or distant exp, expired, nbf or iat in the future, payload over 4 KB, sensitive field names, and jku or x5u pointing off-site.

• explain_cronread-only

  Explain a five-field cron expression in plain English, list the next runs in UTC, and warn about the cases Cloudflare Workers, GitHub Actions and crontab handle differently (nicknames, six fields, day-of-month plus day-of-week, sub-5-minute intervals, day 31).

• json_to_schemaread-only

  Turn a JSON sample (or an array of samples of the same shape) into a JSON Schema draft 2020-12 and a TypeScript type. Infers required vs optional keys across samples, nullable fields, integer vs number, date/email/uri/uuid formats, and small enums. Use it to draft an MCP tool inputSchema from an example payload.

• lint_agent_mdread-only

  Lint a CLAUDE.md, AGENTS.md or MEMORY.md: line count against Claude Code's 200-line memory index cap, estimated tokens, duplicate lines, contradicting rules, leftover TODO markers, hidden characters, empty headings.

• lint_mcp_toolsread-only

  Lint the tools an MCP server lists, from the model's side of the wire: names that break Claude's ^[a-zA-Z0-9_-]{1,64}$ rule, duplicate names, missing or near-identical descriptions, instruction-like text in a description, arguments with no description, required arguments missing from properties, destructive-sounding tools with no destructiveHint, and unbounded free-text arguments on them. Pass a live Streamable HTTP endpoint or a tools array.

• manifest_costread-only

  Estimate what an MCP server's tools/list costs in tokens on every session start, per tool, with the three most expensive tools and flags for oversized descriptions, base64 blobs and echoed schemas. Pass a live Streamable HTTP endpoint or a tools array.

• mcp_install_snippetsread-only

  Generate install snippets for an MCP endpoint (Claude Code, Claude Desktop, Cursor, Codex, VS Code, curl) and probe the endpoint once to confirm it answers initialize and tools/list.

• scrub_envread-only

  Scrub a .env file into a safe .env.example: every value is blanked or replaced with a placeholder that keeps its shape (postgres://USER:PASSWORD@HOST/DB). Returns the example, the secrets found (AWS, GitHub, Stripe, Slack, Google, OpenAI, Anthropic, Resend, SendGrid, Twilio, Cloudflare, JWTs, private keys, database URLs, high-entropy strings) by key, kind and line with only the first 4 characters and the length, and findings for duplicate keys, non-UPPER_SNAKE names, unbalanced quotes, export prefixes and trailing spaces.

• trace_redirectsread-only

  Trace a URL's redirect chain hop by hop (up to 10 hops, 8 s each) with status, location, timing and scheme per hop. Flags chains over two redirects, loops, HTTPS-to-HTTP downgrades, 302s used for www or https canonicalisation, dropped paths or query strings, cross-domain moves, meta-refresh or JS redirects on a 200, and a final page that is not 200.

Signals

Last release

Oct 19, 2026 (9 days ago)

Details

Registry name

com.allthepossibles/toolbox

Version

1.0.0

Auth

Auth not stated

License

License unknown

Website

toolbox.allthepossibles.com

First seen

Oct 24, 2026

Last checked

Oct 25, 2026

Source

Official MCP Registry