Toolbox

Connect Remote server

claude mcp add --transport http toolbox https://toolbox.allthepossibles.com/mcp --header "Authorization: Bearer <YOUR_API_KEY>"

{
  "mcpServers": {
    "toolbox": {
      "url": "https://toolbox.allthepossibles.com/mcp",
      "headers": {
        "Authorization": "Bearer <YOUR_API_KEY>"
      }
    }
  }
}

{
  "servers": {
    "toolbox": {
      "type": "http",
      "url": "https://toolbox.allthepossibles.com/mcp",
      "headers": {
        "Authorization": "Bearer <YOUR_API_KEY>"
      }
    }
  }
}

Settings > Connectors > Add custom connector
URL: https://toolbox.allthepossibles.com/mcp

Replace the values in angle brackets with your own. Keys stay on your machine; we never see them.

Tools 14 found in our last check

• check_tells

  Check text for AI-writing tells (em-dashes, 'not just X but Y', rule-of-three lists, stock vocabulary like delve or seamlessly, hedge words, smart quotes, hidden Unicode) and return a score, each tell with its position, and a cleaned copy. Run it on anything you are about to pub…

• manifest_cost

  Estimate what an MCP server's tools/list costs in tokens on every session start, per tool, with the three most expensive tools and flags for oversized descriptions, base64 blobs and echoed schemas. Pass a live Streamable HTTP endpoint or a tools array.

• lint_agent_md

  Lint a CLAUDE.md, AGENTS.md or MEMORY.md: line count against Claude Code's 200-line memory index cap, estimated tokens, duplicate lines, contradicting rules, leftover TODO markers, hidden characters, empty headings.

• mcp_install_snippets

  Generate install snippets for an MCP endpoint (Claude Code, Claude Desktop, Cursor, Codex, VS Code, curl) and probe the endpoint once to confirm it answers initialize and tools/list.

• check_ai_crawlers

  Read a site's robots.txt and report which AI crawlers (GPTBot, ClaudeBot, Google-Extended, PerplexityBot, CCBot, Bytespider and more) are allowed, blocked or partially blocked; check for llms.txt and draft one from the site's metadata and sitemap.

• check_headers

  Fetch a URL once and grade its response headers: HSTS, Content-Security-Policy, X-Content-Type-Options, frame control, Referrer-Policy, Permissions-Policy, Cache-Control, cookie Secure/HttpOnly/SameSite flags, and server version leaks. Returns a grade, a score and the exact head…

• check_page_meta

  Fetch a URL and report what crawlers and link unfurlers see: title and meta description with lengths, canonical, lang, viewport, robots meta, h1s, Open Graph and Twitter card tags, favicon, JSON-LD types, the resulting preview card, and findings for anything missing or too long.

• json_to_schema

  Turn a JSON sample (or an array of samples of the same shape) into a JSON Schema draft 2020-12 and a TypeScript type. Infers required vs optional keys across samples, nullable fields, integer vs number, date/email/uri/uuid formats, and small enums. Use it to draft an MCP tool in…

• explain_cron

  Explain a five-field cron expression in plain English, list the next runs in UTC, and warn about the cases Cloudflare Workers, GitHub Actions and crontab handle differently (nicknames, six fields, day-of-month plus day-of-week, sub-5-minute intervals, day 31).

• scrub_env

  Scrub a .env file into a safe .env.example: every value is blanked or replaced with a placeholder that keeps its shape (postgres://USER:PASSWORD@HOST/DB). Returns the example, the secrets found (AWS, GitHub, Stripe, Slack, Google, OpenAI, Anthropic, Resend, SendGrid, Twilio, Clo…

• trace_redirects

  Trace a URL's redirect chain hop by hop (up to 10 hops, 8 s each) with status, location, timing and scheme per hop. Flags chains over two redirects, loops, HTTPS-to-HTTP downgrades, 302s used for www or https canonicalisation, dropped paths or query strings, cross-domain moves,…

• check_sitemap

  Check a site's sitemaps: discovers them from robots.txt, /sitemap.xml and /sitemap_index.xml, reads index files one level deep (20 children max), counts URLs per file and per host, summarizes lastmod, and fetches a sample of URLs (HEAD, then GET) to count the ones that are not 2…

• decode_jwt

  Decode a JWT's header and payload without verifying the signature (it never takes a secret). Returns the claims with iat, nbf and exp as ISO times, a plain-text expiresIn, issuer, subject and audience, and findings: alg none, HS* with a URL-like kid, missing or distant exp, expi…

• lint_mcp_tools

  Lint the tools an MCP server lists, from the model's side of the wire: names that break Claude's ^[a-zA-Z0-9_-]{1,64}$ rule, duplicate names, missing or near-identical descriptions, instruction-like text in a description, arguments with no description, required arguments missing…

Headers

Details

More developer tools servers See all

• AGILEX Docs

  Official AGILEX robotics product docs: manuals, CAN protocol, firmware, FAQ. Read-only.

• Echoo public catalog

  Read-only Echoo product facts, pricing, documentation and published writing skills.

• 99tests

  Order human-run real-device app tests from your coding agent; verified bugs return as fix prompts.

• LimitReceipts by aiw3b

  Find the AI coding/app-builder plan that fits your usage: limits, prices and plan-fit picks.

• Candor UI docs

  Candor UI docs and component suggestions. Read-only, no key, never serves paid source.

• MoneyTools Tools

  Call for a cheap read-only utility: 100+ tools; free daily tier; not charged on failure