ToolAPI

Parse Cookie request header into name/value map. When: Parse Cookie request headers.

Check CORS Allow-Origin vs credentials for unsafe combinations.

Human-readable natural language description of cron expression (EN + ZH).

Check if a cron expression matches a specific datetime (ISO-8601).

Preview next N execution times for a 5-field cron expression.

Parse 5-field cron into named fields (minute hour dom month dow).

Validate cron field syntax and value ranges (minute 0-59, hour 0-23, etc.).

Check cron string has exactly five fields.

Batch semantic validate of 5-field cron expressions.

Parse Content-Security-Policy header and flag unsafe directives.

Convert CSV text to JSON array of row objects. When: Convert CSV rows → JSON array of objects.

Validate CSV structure — consistent column counts / header. When: Check CSV column consistency before import.

Convert amount between currencies using latest ECB rates.

List supported fiat currencies (Frankfurter/ECB, no API key).

Latest exchange rates (Frankfurter ECB data, no API key).

Parse unix timestamp or ISO-8601 into UTC ISO + unix.

Extract name@version from requirements/lockfile/go.mod/Cargo snippets. When: Extract name@version from lock/requirements snippets (best-effort).

DNS lookup for domain (A, AAAA, MX, TXT, NS, CNAME, SOA).

Lint Dockerfile for common security/style issues (root user, curl|sh, secrets).

Parse domain into labels, TLD, registrable domain, subdomain. When: Split domain into subdomain/registrable/TLD (best-effort eTLD).

Parse duration (ISO-8601 PnDTnHnMnS or human 1h30m / 90s) to seconds. When: Parse ISO-8601 / human durations to seconds.

Validate .editorconfig syntax and common keys.

Validate email address format. When: Syntax-check a single email address.

Diff two .env files — only_in_a / only_in_b / changed values. When: Diff two .env files for missing/changed keys.

Parse .env / dotenv text into key-value variables.

Check .env text contains required keys (and non-empty values).

Extract email addresses from text. When: Pull email addresses from free text / logs.

Extract HTTP/HTTPS URLs from arbitrary text.

Parse YAML frontmatter from markdown (--- ... ---). When: Split YAML frontmatter from markdown body.

Parse git remote URL (ssh/https) into host/owner/repo. When: Parse git@ / https remotes into owner/repo.

Lint GitHub Actions workflow YAML (triggers, unpinned actions, curl|bash).

Review .gitignore for common missing ignores (.env, node_modules, keys).

Match paths against .gitignore rules (ignore / negate). When: Test paths against .gitignore rules (best-effort).

Match paths against glob patterns (gitignore-style fnmatch).

List GraphQL query/mutation/subscription names and type defs. When: List GraphQL ops/types from a document (best-effort).

Diff two GraphQL schemas for removed types/fields (breaking changes).

Validate GraphQL query or schema SDL syntax (parse only).

Compare two hash digests (case-insensitive).

MD5 hex digest of UTF-8 text. When: MD5 digest (non-crypto integrity / legacy checksums).

SHA256 hex digest.

SHA512 hex digest.

Hex string to UTF-8 text.

UTF-8 text to hex string.

HMAC sign message (sha1/sha256/sha512); hex or base64 output.

Verify HMAC signature (hex or base64).

Parse /etc/hosts style file into IP → hostnames entries. When: Parse /etc/hosts style IP→hostname maps.

Unescape HTML entities.

Escape HTML entities.

Scan HTML for XSS-prone patterns (javascript: URLs, inline handlers, eval). Note: best-effort / heuristic — not a full language parser.

Convert HTML to Markdown text. When: Convert HTML → markdown for docs the agent edits.

Fetch HTTP response headers (HEAD/GET) for URL.

Parse raw HTTP request/response header block into map. When: Parse raw HTTP header blocks.

Classify HTTP status codes into 2xx/3xx/4xx/5xx buckets.

Explain HTTP status code (e.g. 404, 429, 503).

Format bytes to human size, or parse '1.5 GB' to bytes. When: Format or parse human byte sizes (1.5 GB).

Validate identifier for python/javascript/typescript (keywords + syntax).

List imports from python/js source and flag duplicates. Note: best-effort / heuristic — not a full language parser.

Parse INI / simple key=value config into sections. When: Parse INI/section configs into structured maps.

Geolocate public IP: country, city, lat/lon, timezone, ISP.

Detect IPv4/IPv6 and classify private/loopback/global. When: Classify IPv4/IPv6 and private/global.

Classify IP as private/loopback/link-local/global (SSRF helper).

Assert JSONPath expressions against JSON (exists/equals/type) — agent self-check.

Deep-compare two JSON documents and list differing paths.

Flatten nested JSON to dot-key map. When: Flatten nested JSON keys before comparing or exporting.

Pretty-print JSON with indent. When: Pretty-print JSON when the agent needs readable output.

Deep-merge two JSON objects (second overlays first).

Apply RFC 7396 JSON Merge Patch (null deletes keys). When: RFC 7396 merge patch — use when patching JSON configs.

Minify JSON (remove whitespace). When: Minify JSON for compact payloads or size checks.

Apply RFC 6902 JSON Patch ops (add/remove/replace/test/move/copy). When: Apply RFC 6902 ops (add/remove/replace/test/move/copy).

Get value by RFC 6901 JSON Pointer (e.g. /user/id). When: Read one field by RFC 6901 pointer without full walk in the agent.

Unified diff of two JSON documents (pretty-printed).

Infer a Draft-7 JSON Schema from a sample JSON document (agent favorite).

Validate JSON data against JSON Schema (Draft 7).

Batch JSON Schema (Draft 7) validation — up to 25 documents (agent favorite).

Recursively sort JSON object keys. When: Canonicalize JSON key order for stable diffs/hashes.

Convert JSON array of objects to CSV text.

Convert JSON object text to TOML string.

Convert JSON text to YAML string. When: Convert JSON → YAML for config files agents write.

Summarize JSON value types (counts per type in tree).

Validate JSON text; return parsed object or error.

Validate JSON Lines (NDJSON); optional per-line JSON Schema. When: Validate NDJSON / JSON Lines logs or datasets.

Query JSON with JSONPath expression; returns matching values.

Decode JWT header/claims (no verify) and flag alg=none, missing exp, privileged roles.

Decode JWT payload and header (no signature verification).

Sign JWT payload (HS* with secret, RS* with private_key PEM).

Verify JWT signature (HS* with secret, RS* with public_key PEM).

Detect and normalize line endings to lf/crlf/cr. When: Detect/normalize CRLF vs LF.

Deduplicate list items preserving order.

Create disposable receive-only inbox @mail.toolapi.org (24h TTL). Returns address + secret token.

List messages in a temp inbox (requires token from mail_inbox_create).

Read full message body from temp inbox.

Extract markdown/bare links and flag javascript: URLs.

Convert Markdown text to HTML. When: Render markdown → HTML for previews or emails.

Build a table of contents from markdown headings. When: Build heading TOC from markdown docs.

Lookup MIME type by file extension/path, or extensions by MIME. When: Map file extension ↔ MIME type.

Generate URL-friendly nanoid (like npm nanoid).

Lint nginx config snippets (braces, SSLv3, server_tokens, HSTS hints).

Compare two OpenAPI specs and flag breaking vs non-breaking API changes.

List OpenAPI path operations (method, path, operationId, tags). When: List OpenAPI operations before validate/diff.

Validate OpenAPI 3.x document (JSON or YAML snippet).

Audit package.json or pyproject.toml — license, risky scripts, loose ranges; emit semver_checks for batch. Note: best-effort / heuristic — not a full language parser.

List scripts from package.json or pyproject.toml (poetry/PEP 621). When: List npm/poetry/PEP 621 scripts from manifests.

Cryptographically secure random password.

Offline password strength heuristic (length/classes/common). When: Offline password strength heuristic (not a cracker).

Normalize filesystem path (resolve . and ..) for posix or windows. When: Resolve . and .. in filesystem paths.

Check filesystem path for traversal / absolute / sensitive system paths.

List PEM blocks in text (label, DER size, SHA256 fingerprint).

Pick one item from a list (optional seed for reproducibility).

TCP port open/closed check with latency ms.

Parse Java .properties key=value file. When: Parse Java .properties key=value configs (best-effort).

Generate QR code as SVG (base64 data URI included).

Build URL query string from params object. When: Build query strings from param objects.

Parse URL query string into key/value map (supports multi-values). When: Parse URL query strings into maps.

Convert number between bases 2-36 (binary, octal, decimal, hex).

Random integer in inclusive range (optional seed).

Random string (alphanumeric, hex, base64 charset or custom).

Replace regex matches in text (supports backreferences in replacement).

Test regex pattern; returns match, groups, span.

Remote desktop tools comparison JSON for AI citation.

Audit Python requirements.txt for unpinned/VCS/deprecated packages.

Reverse DNS (PTR) lookup for IP address.

Validate robots.txt syntax and User-agent rules.

Scan text for hardcoded secrets (API keys, tokens, private keys). Returns redacted findings.

Compare two semver strings (less / equal / greater).

Bump a semver version by major/minor/patch. When: Bump major/minor/patch when cutting a release.

Pick the highest version that satisfies a semver range (npm-style).

Parse semver string into major, minor, patch, prerelease.

Heuristic check whether two semver ranges share any sample versions (conflict hint).

Check if version satisfies npm-style range (^ ~ >= <= > <).

Batch semver range checks for dependency audits (max 50).

Sort a list of semver versions ascending or descending. When: Sort semver lists before picking latest/oldest.

Parse #! shebang line — interpreter and args. When: Parse #! interpreter lines in scripts.

Shell-escape a string for posix/powershell/cmd (safe quoting). When: Safely quote strings for posix/powershell/cmd.

Validate SPDX license expression against common license IDs.

Scan SQL text for dangerous patterns (DROP/TRUNCATE/DELETE without WHERE). Note: best-effort / heuristic — not a full language parser.

Format SQL text (never executed; reindent + keyword case).

Extract table names from SQL (FROM/JOIN/INTO/UPDATE/TABLE). When: Heuristic extract of SQL table names (best-effort).

Fetch live TLS certificate from host:port (expiry, issuer, SAN).

Truncate text with ellipsis. When: Truncate long strings with ellipsis for UI/logs.

Fill {{variable}} placeholders in a template string.

Convert case: lower, upper, title, snake, kebab, camel, pascal.

Unified line diff between two texts (like git diff).

Generate lorem ipsum placeholder paragraphs.

SequenceMatcher similarity ratio between two texts.

URL-safe slug from title or heading. When: Make URL-safe slugs from titles/filenames.

Count chars, words, lines, sentences; estimate reading time.

Wrap text to a maximum line width. When: Hard-wrap text to a column width.

Convert unix seconds or ISO-8601 to both formats.

Current UTC unix timestamp and ISO-8601.

Convert datetime between IANA timezones (e.g. UTC to Asia/Shanghai).

List common IANA timezone names for conversion.

Extract TODO/FIXME/HACK/XXX comments with line numbers.

Validate TOML config against JSON Schema (Draft 7) in one step.

Parse TOML and return JSON-compatible object.

Validate TOML text; return parsed object or error.

Scan text for trailing whitespace and tab characters. Note: best-effort / heuristic — not a full language parser.

Lint tsconfig.json structure (compilerOptions, strict hints).

Unicode normalization (NFC/NFD/NFKC/NFKD).

Parse unified diff — files changed, lines added/removed.

Convert units: length, weight, temperature, data, speed, time.

List supported units per category for unit_convert.

Decode percent-encoded string.

Percent-encode URL component.

Join base URL with relative path (urllib urljoin). When: Join base URL + relative path correctly.

Normalize URL (lowercase host, sort query, drop fragment).

Parse URL into scheme, host, path, query components.

Check URL for SSRF risk (localhost, private IP, metadata hosts).

Parse User-Agent string into browser, OS, and device hints.

Generate UUID v1/v3/v4/v5 (batch supported). v3/v5 need name + namespace.

Parse UUID string: version, variant, hex bytes.

Domain registration lookup via RDAP (registrar, dates, nameservers).

Parse X.509 certificate PEM: subject, issuer, validity, SAN, fingerprint.

Pretty-print XML with indentation. When: Pretty-print XML after the agent edits markup.

Convert XML document to JSON (attributes as @attr). When: Convert XML → JSON for agents that prefer JSON tools.

Validate XML markup (well-formed check).

Parse YAML then validate against JSON Schema (Draft 7).

Parse YAML and return JSON-compatible object.

Validate YAML text; return parsed object or error.