Clawhard Studio

com.clawhard/studioVersion 1.17.0

Token counts, contrast, time zones, cron, JSON repair, DMARC, packages, Unicode, links, quotes

Status

Responds167 msNov 14, 2026, 13:51 UTCAnswered our handshake without sign-in.

Registry data may be out of date

We could not refresh it, so this page shows the last copy.

Last checked: Nov 14, 2026, 13:51 UTC
Latency: 167 ms
Remotes responding: 1 of 1
Sign-in: No sign-in
Hosting: Hosted outside the EU (detected)
Registry data as of: Nov 14, 2026, 21:12 UTC

Data from the official MCP Registry, checked by run.zero. How we check

Connect

Streamable HTTP

https://mcp.clawhard.com/mcpResponds167 msNov 14, 2026, 13:51 UTC

No sign-in

Claude Code

claude mcp add --transport http studio https://mcp.clawhard.com/mcp

Claude Desktop and claude.ai

1
2
3

Settings > Connectors > Add custom connector
Name: studio
Remote MCP server URL: https://mcp.clawhard.com/mcp

Cursor

{
  "mcpServers": {
    "studio": {
      "url": "https://mcp.clawhard.com/mcp"
    }
  }
}

VS Code

code --add-mcp '{"name":"studio","type":"http","url":"https://mcp.clawhard.com/mcp"}'

Built your own server? run.zero hosts MCP servers on European infrastructure.

Host your own MCP server on run.zero

Tools

31 tools

Tools of Clawhard Studio
	Description		Read-only	Idempotent	Open world
`border_check_cors`Use when the user hits a CORS error ("blocked by CORS policy", "No 'Access-Control-Allow-Origin' header", "preflight", "Failed to fetch" from a frontend) or is about to call a public API from browser code (React, Next.js, Vue, a browser extension page) and asks whether it will work (signals: "CORS", "works in Postman but not in the browser", "preflight 401/404", "Access-Control-Allow-Headers", "withCredentials", "credentials include"). Sends the browser's own preflight (OPTIONS with Origin, Access-Control-Request-Method and -Headers) to the live API and, for GET and HEAD, the request itself with the Origin header, then applies the Fetch standard CORS rules as Chrome implements them. Returns verdict (allowed, blocked, preflight_passed, incomplete, same_origin, unreachable), the exact Chrome console error, which step fails (preflight or response) and why, whether a preflight is needed and why, the CORS headers the server sent, warnings (missing Vary: Origin, a server that echoes any origin with credentials, unreadable response headers, Authorization covered only by *), the exact response headers that fix it, and curl commands to reproduce. Example: {"url":"https://api.example.com/v1/items","origin":"http://localhost:3000","method":"POST","headers":["Content-Type: application/json","Authorization"],"credentials":true}. Limits: public http/https APIs on ports 80 and 443 only (localhost, private and staging servers go through border_check_cors_headers with pasted curl output); never sends POST, PUT, PATCH or DELETE (those get the preflight checked only) and never sends header values for Authorization or keys; a server can answer differently to a real browser session.	Use when the user hits a CORS error ("blocked by CORS policy", "No 'Access-Control-Allow-Origin' header", "preflight", "Failed to fetch" from a frontend) or is about to call a public API from browser code (React, Next.js, Vue, a browser extension page) and asks whether it will work (signals: "CORS", "works in Postman but not in the browser", "preflight 401/404", "Access-Control-Allow-Headers", "withCredentials", "credentials include"). Sends the browser's own preflight (OPTIONS with Origin, Access-Control-Request-Method and -Headers) to the live API and, for GET and HEAD, the request itself with the Origin header, then applies the Fetch standard CORS rules as Chrome implements them. Returns verdict (allowed, blocked, preflight_passed, incomplete, same_origin, unreachable), the exact Chrome console error, which step fails (preflight or response) and why, whether a preflight is needed and why, the CORS headers the server sent, warnings (missing Vary: Origin, a server that echoes any origin with credentials, unreadable response headers, Authorization covered only by *), the exact response headers that fix it, and curl commands to reproduce. Example: {"url":"https://api.example.com/v1/items","origin":"http://localhost:3000","method":"POST","headers":["Content-Type: application/json","Authorization"],"credentials":true}. Limits: public http/https APIs on ports 80 and 443 only (localhost, private and staging servers go through border_check_cors_headers with pasted curl output); never sends POST, PUT, PATCH or DELETE (those get the preflight checked only) and never sends header values for Authorization or keys; a server can answer differently to a real browser session.	No	Yes	Yes	Yes
`border_check_cors_headers`Use when a CORS problem involves a server Border cannot reach (localhost, a dev or staging server, a private network, a custom port) or a POST, PUT, PATCH or DELETE whose real response needs checking, and the raw response headers are available from curl -i or the browser DevTools Network tab (signals: "here is the OPTIONS response", "my local API returns these headers", "CORS works on localhost but not in production", "preflight response is"). Parses the pasted OPTIONS response and/or the actual response (status line plus headers; curl -i, curl -v, curl -iL with redirects, and DevTools copies are all read) and applies the Fetch standard CORS rules as Chrome implements them, for the given page origin, method, request headers and credentials mode. Returns the same result as border_check_cors: verdict, the exact Chrome console error, the failing step and reason, warnings, the response headers that fix it, and the curl commands to capture any missing response. Nothing is fetched. Example: {"url":"http://localhost:8000/api/login","origin":"http://localhost:5173","method":"POST","headers":["Content-Type: application/json"],"credentials":true,"preflight_response":"HTTP/1.1 200 OK\nAccess-Control-Allow-Origin: *\nAccess-Control-Allow-Headers: content-type"}. Limits: the verdict is only as complete as the pasted headers; a preflighted request needs both pastes for a full answer.	Use when a CORS problem involves a server Border cannot reach (localhost, a dev or staging server, a private network, a custom port) or a POST, PUT, PATCH or DELETE whose real response needs checking, and the raw response headers are available from curl -i or the browser DevTools Network tab (signals: "here is the OPTIONS response", "my local API returns these headers", "CORS works on localhost but not in production", "preflight response is"). Parses the pasted OPTIONS response and/or the actual response (status line plus headers; curl -i, curl -v, curl -iL with redirects, and DevTools copies are all read) and applies the Fetch standard CORS rules as Chrome implements them, for the given page origin, method, request headers and credentials mode. Returns the same result as border_check_cors: verdict, the exact Chrome console error, the failing step and reason, warnings, the response headers that fix it, and the curl commands to capture any missing response. Nothing is fetched. Example: {"url":"http://localhost:8000/api/login","origin":"http://localhost:5173","method":"POST","headers":["Content-Type: application/json"],"credentials":true,"preflight_response":"HTTP/1.1 200 OK\nAccess-Control-Allow-Origin: *\nAccess-Control-Allow-Headers: content-type"}. Limits: the verdict is only as complete as the pasted headers; a preflighted request needs both pastes for a full answer.	No	Yes	Yes	No
`deadbolt_catalog_query`Use when you need to check a live Supabase project rather than migration files: returns a read-only SQL query that reads table RLS settings, grants for anon and authenticated, policies, SECURITY DEFINER functions and storage buckets (never row data) and returns one JSON value. Run it with the user's Supabase SQL Editor or a Supabase MCP execute_sql tool, then pass the JSON to deadbolt_check_supabase_access.	Use when you need to check a live Supabase project rather than migration files: returns a read-only SQL query that reads table RLS settings, grants for anon and authenticated, policies, SECURITY DEFINER functions and storage buckets (never row data) and returns one JSON value. Run it with the user's Supabase SQL Editor or a Supabase MCP execute_sql tool, then pass the JSON to deadbolt_check_supabase_access.	No	Yes	Yes	No
`deadbolt_check_supabase_access`Use when you write, review or are about to apply Supabase / PostgreSQL migration SQL (CREATE TABLE, RLS, CREATE POLICY, GRANT, views, SECURITY DEFINER functions, storage buckets), or when a user asks whether their Supabase data is exposed, whether RLS is set up right, or why a query returns 42501 permission denied or no rows. Replays the SQL with real Postgres rules and returns, per table, what signed-out (anon) and signed-in (authenticated) users can SELECT/INSERT/UPDATE/DELETE (all rows, own rows, some rows, none, or denied for a missing grant), plus findings with severity and ready-to-run fix SQL: RLS off, policies written but RLS never enabled, using(true) writes, personal columns readable by anyone, views that bypass RLS, SECURITY DEFINER functions anyone can call, user_metadata in policies, public bucket listing, grants missing after the Oct 30 2026 default change. Also accepts the JSON produced by deadbolt_catalog_query for the live database. Deterministic; never connects to any database. Up to 200,000 characters.	Use when you write, review or are about to apply Supabase / PostgreSQL migration SQL (CREATE TABLE, RLS, CREATE POLICY, GRANT, views, SECURITY DEFINER functions, storage buckets), or when a user asks whether their Supabase data is exposed, whether RLS is set up right, or why a query returns 42501 permission denied or no rows. Replays the SQL with real Postgres rules and returns, per table, what signed-out (anon) and signed-in (authenticated) users can SELECT/INSERT/UPDATE/DELETE (all rows, own rows, some rows, none, or denied for a missing grant), plus findings with severity and ready-to-run fix SQL: RLS off, policies written but RLS never enabled, using(true) writes, personal columns readable by anyone, views that bypass RLS, SECURITY DEFINER functions anyone can call, user_metadata in policies, public bucket listing, grants missing after the Oct 30 2026 default change. Also accepts the JSON produced by deadbolt_catalog_query for the live database. Deterministic; never connects to any database. Up to 200,000 characters.	No	Yes	Yes	No
`doorman_check_ai_bot_access`Use when the user asks whether their site (or any public site), or a robots.txt they pasted, blocks ChatGPT, Claude, Google AI, Perplexity or other AI crawlers, whether AI can read or train on their content, or why AI search does not mention their site. Fetches the live robots.txt and reports, for 22 named AI bots in four groups (AI training, AI search, assistants, search engines), which are let in, kept out or partly blocked, plus the site's content-signal preference and fixes. Example: {"url": "example.com"} or {"robots_txt": "User-agent: GPTBot\nDisallow: /"}. Pass robots_txt instead of url to check a draft or pasted file without fetching anything. Read-only.	Use when the user asks whether their site (or any public site), or a robots.txt they pasted, blocks ChatGPT, Claude, Google AI, Perplexity or other AI crawlers, whether AI can read or train on their content, or why AI search does not mention their site. Fetches the live robots.txt and reports, for 22 named AI bots in four groups (AI training, AI search, assistants, search engines), which are let in, kept out or partly blocked, plus the site's content-signal preference and fixes. Example: {"url": "example.com"} or {"robots_txt": "User-agent: GPTBot\nDisallow: /"}. Pass robots_txt instead of url to check a draft or pasted file without fetching anything. Read-only.	No	Yes	Yes	Yes
`halves_create_group_link`Use when the user wants a shared place for a group (trip, flat, event) to keep adding expenses and see who owes whom, not just a one-time calculation. Creates a group and returns a link anyone can open without signing up to add and edit expenses. Anyone with the link can edit it, so share it only with the group. Each call creates a new saved group; halves_settle_up gives a one-off answer without saving anything. Example: {"name": "Lisbon trip", "currency": "EUR", "people": ["Ana", "Ben", "Cy"]}.	Use when the user wants a shared place for a group (trip, flat, event) to keep adding expenses and see who owes whom, not just a one-time calculation. Creates a group and returns a link anyone can open without signing up to add and edit expenses. Anyone with the link can edit it, so share it only with the group. Each call creates a new saved group; halves_settle_up gives a one-off answer without saving anything. Example: {"name": "Lisbon trip", "currency": "EUR", "people": ["Ana", "Ben", "Cy"]}.	No	No	No	Yes
`halves_settle_up`Use when the user shares a trip, dinner, household or group expense list and asks who owes whom, how to split costs, or how to settle up. Returns each person's paid, share and net balance, and the smallest set of payments that squares everyone up. Handles equal splits, splits among a subset, exact amounts and payments already made, with correct rounding. Nothing is saved. Example: {"people": ["Ana", "Ben", "Cy"], "expenses": [{"what": "Dinner", "amount": 90, "paid_by": "Ana"}, {"what": "Taxi", "amount": 24, "paid_by": "Ben", "split_between": ["Ben", "Cy"]}]}. Amounts are exact to the cent.	Use when the user shares a trip, dinner, household or group expense list and asks who owes whom, how to split costs, or how to settle up. Returns each person's paid, share and net balance, and the smallest set of payments that squares everyone up. Handles equal splits, splits among a subset, exact amounts and payments already made, with correct rounding. Nothing is saved. Example: {"people": ["Ana", "Ben", "Cy"], "expenses": [{"what": "Dinner", "amount": 90, "paid_by": "Ana"}, {"what": "Taxi", "amount": 24, "paid_by": "Ben", "split_between": ["Ben", "Cy"]}]}. Amounts are exact to the cent.	No	Yes	Yes	No
`mend_outline_json`Use when you are about to read a big JSON response, log or export into context, before loading it: returns a compact outline of the structure (keys, types, array lengths, one example per repeated shape) so you can plan a query without spending tokens on the whole document. Repairs the JSON first if needed. Follow with mend_query_json to pull only the values you need. Up to 100,000 characters.	Use when you are about to read a big JSON response, log or export into context, before loading it: returns a compact outline of the structure (keys, types, array lengths, one example per repeated shape) so you can plan a query without spending tokens on the whole document. Repairs the JSON first if needed. Follow with mend_query_json to pull only the values you need. Up to 100,000 characters.	No	Yes	Yes	No
`mend_query_json`Use when you need specific fields from a JSON document without reading all of it: $.users[0].name, $.items[*].id, $.a.b[-1], $.list[1:3], $..email (recursive). Returns each match with its exact path, type and value. Repairs the JSON first if needed, so broken input still works. Up to 100,000 characters.	Use when you need specific fields from a JSON document without reading all of it: $.users[0].name, $.items[*].id, $.a.b[-1], $.list[1:3], $..email (recursive). Returns each match with its exact path, type and value. Repairs the JSON first if needed, so broken input still works. Up to 100,000 characters.	No	Yes	Yes	No
`mend_repair_json`Use when JSON from an LLM, API, log, config or copy-paste fails to parse (JSON.parse error, "Unexpected token", "Expecting property name"), or the user pastes JSON with trailing commas, single quotes, unquoted keys, comments, Python True/False/None, NaN, missing commas or brackets, a ```json fence, text around it, or output that was cut off. Deterministic repair: returns valid, formatted JSON plus a list of every fix with line and column. Values are never rewritten, so big numbers, number formatting and key order stay exactly as written. If the text is already valid it says so. Up to 100,000 characters.	Use when JSON from an LLM, API, log, config or copy-paste fails to parse (JSON.parse error, "Unexpected token", "Expecting property name"), or the user pastes JSON with trailing commas, single quotes, unquoted keys, comments, Python True/False/None, NaN, missing commas or brackets, a ```json fence, text around it, or output that was cut off. Deterministic repair: returns valid, formatted JSON plus a list of every fix with line and column. Values are never rewritten, so big numbers, number formatting and key order stay exactly as written. If the text is already valid it says so. Up to 100,000 characters.	No	Yes	Yes	No
`meridian_convert_time`Use when you need to convert a specific wall-clock time from one place to others, for any date. It uses the real tz database, so daylight saving is right for that exact date (the US and Europe switch on different weeks), and it warns when the time does not exist (spring forward) or happens twice (fall back). Time accepts "15:00", "3:30pm", "noon", "now" or an ISO local time like 2026-11-05T15:00 (no Z). Date defaults to today in the source zone. Returns {input, utc, source:{...}, converted:[{place, zone, local, time_12h, date, utc_offset, abbreviation, day_note, hours_ahead_of_source}], warning?, summary, open_url}.	Use when you need to convert a specific wall-clock time from one place to others, for any date. It uses the real tz database, so daylight saving is right for that exact date (the US and Europe switch on different weeks), and it warns when the time does not exist (spring forward) or happens twice (fall back). Time accepts "15:00", "3:30pm", "noon", "now" or an ISO local time like 2026-11-05T15:00 (no Z). Date defaults to today in the source zone. Returns {input, utc, source:{...}, converted:[{place, zone, local, time_12h, date, utc_offset, abbreviation, day_note, hours_ahead_of_source}], warning?, summary, open_url}.	No	Yes	Yes	No
`meridian_meeting_slots`Use when you need to schedule a call across several places. Scans the day in 15-minute steps and ranks start times so the most people are inside working hours and nobody is at night, using each place's real offset and DST for that date. Returns up to 5 slots with each person's local start and end, and says plainly when no time works for everyone. Defaults: working hours 9 to 17, 60 minutes, date today in the first place.	Use when you need to schedule a call across several places. Scans the day in 15-minute steps and ranks start times so the most people are inside working hours and nobody is at night, using each place's real offset and DST for that date. Returns up to 5 slots with each person's local start and end, and says plainly when no time works for everyone. Defaults: working hours 9 to 17, 60 minutes, date today in the first place.	No	Yes	Yes	No
`meridian_now`Use when the user asks what time or date it is right now somewhere. Reads the server clock and returns the current time, date, UTC offset, abbreviation and daylight saving status for each place. Places can be cities ("Tokyo"), IANA zones ("Europe/Paris"), abbreviations ("PST") or "UTC+5:30".	Use when the user asks what time or date it is right now somewhere. Reads the server clock and returns the current time, date, UTC offset, abbreviation and daylight saving status for each place. Places can be cities ("Tokyo"), IANA zones ("Europe/Paris"), abbreviations ("PST") or "UTC+5:30".	No	Yes	Yes	No
`meridian_zone_info`Use when you need to answer "what is the UTC offset of X", "does X observe daylight saving" and "when do the clocks change". Returns the current offset and abbreviation, whether the place observes DST, every clock change in the year with exact local before and after times, and the next change. Abbreviations like IST or CST are ambiguous, so the answer says which zone was used.	Use when you need to answer "what is the UTC offset of X", "does X observe daylight saving" and "when do the clocks change". Returns the current offset and abbreviation, whether the place observes DST, every clock change in the year with exact local before and after times, and the next change. Abbreviations like IST or CST are ambiguous, so the answer says which zone was used.	No	Yes	Yes	No
`notary_check_packages`Use when the user or an agent is about to install or import npm or PyPI packages: before npm install or pip install, when adding lines to package.json or requirements.txt, or when a package name came from an AI answer, a tutorial or memory and may be invented. Looks each name up in the live registry and returns whether it exists, the latest version, whether a pinned version exists, weekly downloads, first and last publish dates, deprecation or yanked status, install-time scripts, whether the name is one or two typed characters from a well-known package, and real similar packages when the name does not exist. Example: {"packages":[{"ecosystem":"npm","name":"@anthropic/mcp-client"},{"ecosystem":"pypi","name":"requests","version":"2.32.3"}]}. Up to 10 packages per call; versions must be exact, not ranges. Not a malware or vulnerability scan: "ok" means it exists and nothing looked wrong.	Use when the user or an agent is about to install or import npm or PyPI packages: before npm install or pip install, when adding lines to package.json or requirements.txt, or when a package name came from an AI answer, a tutorial or memory and may be invented. Looks each name up in the live registry and returns whether it exists, the latest version, whether a pinned version exists, weekly downloads, first and last publish dates, deprecation or yanked status, install-time scripts, whether the name is one or two typed characters from a well-known package, and real similar packages when the name does not exist. Example: {"packages":[{"ecosystem":"npm","name":"@anthropic/mcp-client"},{"ecosystem":"pypi","name":"requests","version":"2.32.3"}]}. Up to 10 packages per call; versions must be exact, not ranges. Not a malware or vulnerability scan: "ok" means it exists and nothing looked wrong.	No	Yes	Yes	Yes
`postcard_check_link_preview`Use when the user asks how a link will look when shared, why a shared link shows no image or the wrong title, or wants a page checked before a launch post (signals: "link preview", "og:image not showing", "Twitter card", "X card", "social card", "share image", "unfurl", "Open Graph", "LinkedIn preview is blank", "after deploying the landing page"). Fetches the public page the way a link crawler does (following redirects, no JavaScript), reads the og: and twitter: tags with X's documented fallbacks (twitter:* then og:*, last twitter:card wins), downloads the og:image and twitter:image and reads their real pixel size, format and file size from the bytes, and checks robots.txt for Twitterbot and facebookexternalhit on the page and the image. Returns the card X, Facebook, LinkedIn and chat apps will build, every problem with severity and fix (relative or http image URL, image that is really an HTML page, SVG or AVIF, below X's 300x157 / Facebook's 200x200 / LinkedIn's 1200x627, over 5 MB, 2:1 crop of a square logo, tags added by JavaScript, tags past Facebook's first 1 MB, title over X's 70 characters, missing twitter:card, robots.txt blocks), and a paste-ready <meta> block. Rules come from the platforms' docs, with the check date. Example: {"url":"https://example.com/launch"}. Limits: public http/https pages on ports 80 and 443 (localhost and unpublished pages go through postcard_check_preview_tags); platforms cache cards (X for about 7 days), so a fixed page can still show the old card until rescraped; sites that serve different HTML to real crawlers by User-Agent can differ.	Use when the user asks how a link will look when shared, why a shared link shows no image or the wrong title, or wants a page checked before a launch post (signals: "link preview", "og:image not showing", "Twitter card", "X card", "social card", "share image", "unfurl", "Open Graph", "LinkedIn preview is blank", "after deploying the landing page"). Fetches the public page the way a link crawler does (following redirects, no JavaScript), reads the og: and twitter: tags with X's documented fallbacks (twitter:* then og:*, last twitter:card wins), downloads the og:image and twitter:image and reads their real pixel size, format and file size from the bytes, and checks robots.txt for Twitterbot and facebookexternalhit on the page and the image. Returns the card X, Facebook, LinkedIn and chat apps will build, every problem with severity and fix (relative or http image URL, image that is really an HTML page, SVG or AVIF, below X's 300x157 / Facebook's 200x200 / LinkedIn's 1200x627, over 5 MB, 2:1 crop of a square logo, tags added by JavaScript, tags past Facebook's first 1 MB, title over X's 70 characters, missing twitter:card, robots.txt blocks), and a paste-ready <meta> block. Rules come from the platforms' docs, with the check date. Example: {"url":"https://example.com/launch"}. Limits: public http/https pages on ports 80 and 443 (localhost and unpublished pages go through postcard_check_preview_tags); platforms cache cards (X for about 7 days), so a fixed page can still show the old card until rescraped; sites that serve different HTML to real crawlers by User-Agent can differ.	No	Yes	Yes	Yes
`postcard_check_preview_tags`Use when the share-card tags need checking in HTML that is not public yet: a page being built, a localhost or staging page, a template, or a <head> block the user pasted (signals: "check my meta tags", "are these og tags right", "before I deploy", "Next.js metadata", "index.html head"). Reads the og: and twitter: tags in the pasted HTML with X's documented fallbacks and returns the same result as postcard_check_link_preview: the card each platform will build, problems with fixes (missing og:image or twitter:card, relative image path, title over X's 70 characters, duplicates, name= instead of property=, tags in <body>, a JavaScript app shell with no tags) and a paste-ready <meta> block. The page is not fetched; with fetch_image true, a public absolute image URL is downloaded to read its real size, format and bytes. Example: {"html":"<head><meta property=\"og:title\" content=\"Launch\"><meta property=\"og:image\" content=\"/og.png\"></head>","url":"https://example.com/launch"}. Limits: robots.txt and redirects of the page are not checked (no fetch); without url, relative image paths cannot be resolved.	Use when the share-card tags need checking in HTML that is not public yet: a page being built, a localhost or staging page, a template, or a <head> block the user pasted (signals: "check my meta tags", "are these og tags right", "before I deploy", "Next.js metadata", "index.html head"). Reads the og: and twitter: tags in the pasted HTML with X's documented fallbacks and returns the same result as postcard_check_link_preview: the card each platform will build, problems with fixes (missing og:image or twitter:card, relative image path, title over X's 70 characters, duplicates, name= instead of property=, tags in <body>, a JavaScript app shell with no tags) and a paste-ready <meta> block. The page is not fetched; with fetch_image true, a public absolute image URL is downloaded to read its real size, format and bytes. Example: {"html":"<head><meta property=\"og:title\" content=\"Launch\"><meta property=\"og:image\" content=\"/og.png\"></head>","url":"https://example.com/launch"}. Limits: robots.txt and redirects of the page are not checked (no fetch); without url, relative image paths cannot be resolved.	No	Yes	Yes	Yes
`runsheet_create_schedule`Use when the user wants a shareable run-of-show or day-of schedule for a wedding, conference, shoot or other event that guests or crew can open on their phone and that updates live when edited. Creates the page and returns a view link to share with everyone and a private edit link to keep. Start from a template (wedding, conf, shoot, blank) or pass your own items. Example: {"name": "Maya and Sam wedding", "date": "2026-09-12", "timezone": "America/New_York", "template": "wedding"} or {"name": "Offsite", "items": [{"time": "09:00", "title": "Welcome", "duration_minutes": 30}]}. Each call creates a new saved page.	Use when the user wants a shareable run-of-show or day-of schedule for a wedding, conference, shoot or other event that guests or crew can open on their phone and that updates live when edited. Creates the page and returns a view link to share with everyone and a private edit link to keep. Start from a template (wedding, conf, shoot, blank) or pass your own items. Example: {"name": "Maya and Sam wedding", "date": "2026-09-12", "timezone": "America/New_York", "template": "wedding"} or {"name": "Offsite", "items": [{"time": "09:00", "title": "Welcome", "duration_minutes": 30}]}. Each call creates a new saved page.	No	No	No	Yes
`spill_scan_secrets`Use when the user asks whether some text contains secrets, or before you paste, commit, share, log or send code, a .env file, a diff, config, logs, a stack trace or a prompt that might contain credentials, for example "did I leak a key in this?", "is this safe to post?" or "redact the secrets in this log". Detects 48 services by exact key format (OpenAI, Anthropic, Gemini/Google, Groq, xAI, OpenRouter, Stripe, Supabase, AWS, GitHub, GitLab, npm, PyPI, Slack, Discord, Twilio, SendGrid, Resend, Shopify, Cloudflare and more) plus PEM private keys, database URLs with passwords, JWTs, Authorization headers and high-entropy values in variables named like secret, token, api_key or password. It verifies what it can deterministically: GitHub token CRC32 checksums, JWT and Supabase key role and expiry (service_role vs anon), documented example keys and placeholders, and NEXT_PUBLIC_/VITE_/EXPO_PUBLIC_ variables that ship to every browser. Returns findings with severity (critical, high, medium, public, info), line and column, a masked preview (never the full secret), why it matters, the fix and the provider's revoke URL, plus a redacted copy with labels like [STRIPE_SECRET_KEY_1]. Text is processed in memory to answer and is not stored. Limits: format-based, so a random secret with a neutral name can be missed; it never tests keys against providers; up to 200,000 characters. The same scanner also runs entirely in the browser at https://spill.clawhard.com.	Use when the user asks whether some text contains secrets, or before you paste, commit, share, log or send code, a .env file, a diff, config, logs, a stack trace or a prompt that might contain credentials, for example "did I leak a key in this?", "is this safe to post?" or "redact the secrets in this log". Detects 48 services by exact key format (OpenAI, Anthropic, Gemini/Google, Groq, xAI, OpenRouter, Stripe, Supabase, AWS, GitHub, GitLab, npm, PyPI, Slack, Discord, Twilio, SendGrid, Resend, Shopify, Cloudflare and more) plus PEM private keys, database URLs with passwords, JWTs, Authorization headers and high-entropy values in variables named like secret, token, api_key or password. It verifies what it can deterministically: GitHub token CRC32 checksums, JWT and Supabase key role and expiry (service_role vs anon), documented example keys and placeholders, and NEXT_PUBLIC_/VITE_/EXPO_PUBLIC_ variables that ship to every browser. Returns findings with severity (critical, high, medium, public, info), line and column, a masked preview (never the full secret), why it matters, the fix and the provider's revoke URL, plus a redacted copy with labels like [STRIPE_SECRET_KEY_1]. Text is processed in memory to answer and is not stored. Limits: format-based, so a random secret with a neutral name can be missed; it never tests keys against providers; up to 200,000 characters. The same scanner also runs entirely in the browser at https://spill.clawhard.com.	No	Yes	Yes	No
`stamp_check_dns_record`Use when you or the user are about to publish or edit an SPF, DMARC or DKIM TXT record, for example after writing a new SPF record that adds a sending service, or when the user pastes a record and asks "is this right?". Detects the record type. SPF: syntax per RFC 7208, every include and redirect followed live in DNS and counted against the 10-lookup limit, void lookups, loops, the final all; returns a lookup tree. DMARC: RFC 7489 tags and values (p, sp, pct, rua/ruf, adkim/aspf, fo). DKIM: key type and RSA key size read from the key, revoked (empty p=) or truncated keys. Returns valid true/false, errors, warnings and where to publish it. Pass domain so a/mx terms without a value can be resolved.	Use when you or the user are about to publish or edit an SPF, DMARC or DKIM TXT record, for example after writing a new SPF record that adds a sending service, or when the user pastes a record and asks "is this right?". Detects the record type. SPF: syntax per RFC 7208, every include and redirect followed live in DNS and counted against the 10-lookup limit, void lookups, loops, the final all; returns a lookup tree. DMARC: RFC 7489 tags and values (p, sp, pct, rua/ruf, adkim/aspf, fo). DKIM: key type and RSA key size read from the key, revoked (empty p=) or truncated keys. Returns valid true/false, errors, warnings and where to publish it. Pass domain so a/mx terms without a value can be resolved.	No	Yes	Yes	Yes
`stamp_check_email_domain`Use when the user asks why their email goes to spam, whether their domain is set up to send email, or before they launch a newsletter, cold outreach, transactional email or a new sending service, e.g. "why are my emails going to spam?", "is my SPF/DKIM/DMARC right?", "do I meet Gmail and Yahoo's sender requirements?" or "I added SendGrid, did I break SPF?". Reads public DNS (DNS-over-HTTPS) and checks: SPF (exactly one record, every include followed and DNS lookups counted per RFC 7208 against the limit of 10, void lookups, loops, +all/?all, ptr), DMARC (RFC 7489 syntax, policy, pct, alignment, inherited from the parent domain, and whether an external report address authorized it), DKIM (17 common selectors plus any you pass; key type and RSA key size read from the key, revoked or broken keys), and MX (provider, null MX). Returns a grade A-F, a verdict, each check with status pass/warn/fail/info, whether the Gmail, Yahoo and Outlook.com sender rules are met, and copy-ready DNS records to fix problems (e.g. one merged SPF record, a starter DMARC record). DNS cannot list DKIM selectors, so when none of the common selectors is found the result says so and a known selector (the s= value in a DKIM-Signature header) can be passed in. Accepts a domain, an email address or a URL. Results are cached for 5 minutes; pass fresh=true right after the user changes DNS.	Use when the user asks why their email goes to spam, whether their domain is set up to send email, or before they launch a newsletter, cold outreach, transactional email or a new sending service, e.g. "why are my emails going to spam?", "is my SPF/DKIM/DMARC right?", "do I meet Gmail and Yahoo's sender requirements?" or "I added SendGrid, did I break SPF?". Reads public DNS (DNS-over-HTTPS) and checks: SPF (exactly one record, every include followed and DNS lookups counted per RFC 7208 against the limit of 10, void lookups, loops, +all/?all, ptr), DMARC (RFC 7489 syntax, policy, pct, alignment, inherited from the parent domain, and whether an external report address authorized it), DKIM (17 common selectors plus any you pass; key type and RSA key size read from the key, revoked or broken keys), and MX (provider, null MX). Returns a grade A-F, a verdict, each check with status pass/warn/fail/info, whether the Gmail, Yahoo and Outlook.com sender rules are met, and copy-ready DNS records to fix problems (e.g. one merged SPF record, a starter DMARC record). DNS cannot list DKIM selectors, so when none of the common selectors is found the result says so and a known selector (the s= value in a DKIM-Signature header) can be passed in. Accepts a domain, an email address or a URL. Results are cached for 5 minutes; pass fresh=true right after the user changes DNS.	No	Yes	Yes	Yes
`swatch_check_contrast`Use when the user asks whether a color combination is readable or accessible, passes WCAG AA or AAA, or has enough contrast (text on a background, button, badge, link color), or what a color is in another format. Returns the exact contrast ratio, pass or fail for normal text, large text and UI components at AA and AAA, the APCA lightness contrast and a plain note. Colors can be hex, rgb(), hsl() or CSS names. Example: {"foreground": "#777777", "background": "#ffffff"}. Also returns each color in hex, rgb, hsl and oklch with its nearest CSS name.	Use when the user asks whether a color combination is readable or accessible, passes WCAG AA or AAA, or has enough contrast (text on a background, button, badge, link color), or what a color is in another format. Returns the exact contrast ratio, pass or fail for normal text, large text and UI components at AA and AAA, the APCA lightness contrast and a plain note. Colors can be hex, rgb(), hsl() or CSS names. Example: {"foreground": "#777777", "background": "#ffffff"}. Also returns each color in hex, rgb, hsl and oklch with its nearest CSS name.	No	Yes	Yes	No
`swatch_check_pairs`Use when the user has a whole design system, theme or stylesheet and wants every text and background pair checked for accessibility in one go. Takes up to 50 pairs and returns the ratio and AA and AAA results for each, with a count of failures. Example: {"pairs": [{"foreground": "#777", "background": "#fff", "label": "muted text"}, {"foreground": "#fff", "background": "#ff5a1f", "label": "button"}]}.	Use when the user has a whole design system, theme or stylesheet and wants every text and background pair checked for accessibility in one go. Takes up to 50 pairs and returns the ratio and AA and AAA results for each, with a count of failures. Example: {"pairs": [{"foreground": "#777", "background": "#fff", "label": "muted text"}, {"foreground": "#fff", "background": "#ff5a1f", "label": "button"}]}.	No	Yes	Yes	No
`swatch_fix_contrast`Use when a color pair fails contrast and the user wants the smallest change that makes it pass, such as "make this gray text accessible without changing the look". Returns the closest text color on that background that reaches the target (AA, AAA, AA-large or ui), and separately the closest background, keeping the hue. Example: {"foreground": "#777777", "background": "#ffffff", "target": "AA"}. Returns already_passes if nothing needs to change.	Use when a color pair fails contrast and the user wants the smallest change that makes it pass, such as "make this gray text accessible without changing the look". Returns the closest text color on that background that reaches the target (AA, AAA, AA-large or ui), and separately the closest background, keeping the hue. Example: {"foreground": "#777777", "background": "#ffffff", "target": "AA"}. Returns already_passes if nothing needs to change.	No	Yes	Yes	No
`swatch_make_scale`Use when the user asks for a palette, shades, tints, a design-token scale or a Tailwind-style 50 to 950 ramp from a brand color. Returns 11 steps that keep the hue, with the hex, contrast on white and on black, and the best text color for each step. Example: {"color": "#ff5a1f", "name": "brand"}.	Use when the user asks for a palette, shades, tints, a design-token scale or a Tailwind-style 50 to 950 ramp from a brand color. Returns 11 steps that keep the hue, with the hex, contrast on white and on black, and the best text color for each step. Example: {"color": "#ff5a1f", "name": "brand"}.	No	Yes	Yes	No
`tick_matches`Use when you need a yes/no on whether a cron expression would fire at a specific instant in a timezone — for example before shipping a schedule that crosses a DST transition, or to verify a single expected fire. Example: {"expression":"0 9 * * 1-5","timezone":"America/New_York","at":"2026-11-06T14:00:00Z"}. Returns fires true/false, the local wall time of that instant, and DST notes if the local time is in a gap or fold.	Use when you need a yes/no on whether a cron expression would fire at a specific instant in a timezone — for example before shipping a schedule that crosses a DST transition, or to verify a single expected fire. Example: {"expression":"0 9 * * 1-5","timezone":"America/New_York","at":"2026-11-06T14:00:00Z"}. Returns fires true/false, the local wall time of that instant, and DST notes if the local time is in a gap or fold.	No	Yes	Yes	No
`tick_next_runs`Use when you or the user just wrote a cron expression (GitHub Actions, Vercel cron, Cloudflare Cron Triggers, systemd, an agent schedule) and need its next fire times. Pass the expression and an IANA timezone (default UTC). Returns the next N runs as local wall times and UTC ISO, a plain-English field breakdown, and DST gap/fold warnings (spring-forward skips, fall-back double fires). Example: {"expression":"0 9 * * 1-5","timezone":"America/New_York","count":5}. Uses the tz database, so DST rules match the region and year. Not for converting a meeting time across cities (use Meridian) or for email DNS (use Stamp).	Use when you or the user just wrote a cron expression (GitHub Actions, Vercel cron, Cloudflare Cron Triggers, systemd, an agent schedule) and need its next fire times. Pass the expression and an IANA timezone (default UTC). Returns the next N runs as local wall times and UTC ISO, a plain-English field breakdown, and DST gap/fold warnings (spring-forward skips, fall-back double fires). Example: {"expression":"0 9 * * 1-5","timezone":"America/New_York","count":5}. Uses the tz database, so DST rules match the region and year. Not for converting a meeting time across cities (use Meridian) or for email DNS (use Stamp).	No	Yes	Yes	No
`tokendiet_count_tokens`Use when the user asks how many tokens a text, prompt, log, document or code paste is, whether it fits a context window (128K, 200K, 1M), or how big something is before they send it to an AI. Returns the exact o200k token count (GPT-4o family and later; Claude and Gemini usually within about 15%), plus words, characters and how much of each window it uses. Counts are exact for that tokenizer. Example: {"text": "<the text to measure>"}. Not for shortening text.	Use when the user asks how many tokens a text, prompt, log, document or code paste is, whether it fits a context window (128K, 200K, 1M), or how big something is before they send it to an AI. Returns the exact o200k token count (GPT-4o family and later; Claude and Gemini usually within about 15%), plus words, characters and how much of each window it uses. Counts are exact for that tokenizer. Example: {"text": "<the text to measure>"}. Not for shortening text.	No	Yes	Yes	No
`vouch_check_links`Use when the user asks whether links work, or before links, sources or doc URLs go into an answer, README, report, email or code comment (signals: "are these links dead", "check the links in this README", "does this URL exist", "404", "broken link", "where does this redirect", "is this docs page still there"). Fetches each URL live (GET, redirects followed hop by hop) and returns per link a status: ok, redirected (link the final_url), soft_404 (answers 200 but the title says not found, or a deep link lands on the front page), anchor_missing (the #section id is not on the page), broken (404, 410 or other 4xx), server_error (5xx), blocked (401, 403, 429 or a bot challenge: not proof the page is missing), unreachable (DNS, connection or timeout) or invalid. Each result has http_status, every hop, final_url, page title and canonical; for broken pages it lists the closest real pages from the site's own sitemap (suggestions, the top one re-checked). Give urls (up to 15) or text (Markdown, HTML or plain text; its http and https links are extracted, first 15 checked). Example: {"urls":["https://docs.stripe.com/api/charge","https://developer.mozilla.org/en-US/docs/Web/HTML/Element/a#attributes"]}. Limits: a page can work in a browser and still be blocked here; pages built by JavaScript may hide anchors; one call makes at most 45 requests.	Use when the user asks whether links work, or before links, sources or doc URLs go into an answer, README, report, email or code comment (signals: "are these links dead", "check the links in this README", "does this URL exist", "404", "broken link", "where does this redirect", "is this docs page still there"). Fetches each URL live (GET, redirects followed hop by hop) and returns per link a status: ok, redirected (link the final_url), soft_404 (answers 200 but the title says not found, or a deep link lands on the front page), anchor_missing (the #section id is not on the page), broken (404, 410 or other 4xx), server_error (5xx), blocked (401, 403, 429 or a bot challenge: not proof the page is missing), unreachable (DNS, connection or timeout) or invalid. Each result has http_status, every hop, final_url, page title and canonical; for broken pages it lists the closest real pages from the site's own sitemap (suggestions, the top one re-checked). Give urls (up to 15) or text (Markdown, HTML or plain text; its http and https links are extracted, first 15 checked). Example: {"urls":["https://docs.stripe.com/api/charge","https://developer.mozilla.org/en-US/docs/Web/HTML/Element/a#attributes"]}. Limits: a page can work in a browser and still be blocked here; pages built by JavaScript may hide anchors; one call makes at most 45 requests.	No	Yes	Yes	Yes
`vouch_check_quote`Use when a quote, a statistic or a claim is attributed to a web page and the user asks whether the source says it, or before a citation goes into an answer, report, article or essay (signals: "does this article actually say", "verify this quote", "is this citation real", "check the source", "did they really write that", "fact-check this quote against the link"). Fetches the page once, extracts its visible text and returns per quote a verdict: exact (word for word), normalized (same words in order; only punctuation, capitals, spacing or curly quotes differ), close (similarity 0.85 or more, wording differs), partial (0.5 to 0.85) or not_found, with the matching passage, surrounding context, the words that differ and numbers_differ when a number changed (for example 1914 in the quote, 1912 on the page). Quotes with "..." are checked part by part. Example: {"url":"https://en.wikipedia.org/wiki/Alan_Turing","quotes":["widely regarded as the father of theoretical computer science"]}. Limits: a match shows the words are on the page, not that the claim is true; pages built by JavaScript may have little text in their HTML; PDFs and paywalled or bot-blocked pages cannot be read; up to 10 quotes of 1000 characters, at least 3 words each.	Use when a quote, a statistic or a claim is attributed to a web page and the user asks whether the source says it, or before a citation goes into an answer, report, article or essay (signals: "does this article actually say", "verify this quote", "is this citation real", "check the source", "did they really write that", "fact-check this quote against the link"). Fetches the page once, extracts its visible text and returns per quote a verdict: exact (word for word), normalized (same words in order; only punctuation, capitals, spacing or curly quotes differ), close (similarity 0.85 or more, wording differs), partial (0.5 to 0.85) or not_found, with the matching passage, surrounding context, the words that differ and numbers_differ when a number changed (for example 1914 in the quote, 1912 on the page). Quotes with "..." are checked part by part. Example: {"url":"https://en.wikipedia.org/wiki/Alan_Turing","quotes":["widely regarded as the father of theoretical computer science"]}. Limits: a match shows the words are on the page, not that the claim is true; pages built by JavaScript may have little text in their HTML; PDFs and paywalled or bot-blocked pages cannot be read; up to 10 quotes of 1000 characters, at least 3 words each.	No	Yes	Yes	Yes
`xray_scan_text`Use when the user asks whether text, a prompt, a SKILL.md, AGENTS.md, CLAUDE.md, .cursorrules, README, MCP tool description, PR diff, email or web page hides anything, or before an agent follows, installs or merges instructions that came from someone else (signals: "hidden characters", "invisible unicode", "ASCII smuggling", "prompt injection in this file", "Trojan Source", "why does this string not match", "is this domain spelled with a Cyrillic letter"). Inspects every code point and returns a verdict (clean, suspicious, dangerous) with each finding's line, column, code points and Unicode names: Unicode tag characters (decoded back to the hidden ASCII message), variation-selector payloads (decoded bytes), bidirectional overrides and isolates, long zero-width runs, zero-width and other invisible characters, ANSI terminal escapes, control characters, words that mix Latin with Cyrillic or Greek look-alikes (with the Latin word they imitate, from Unicode confusables), whole look-alike words, styled math letters, unusual spaces, line separators, private-use and unassigned code points, and HTML comments that do not render. Legitimate uses are not flagged (emoji ZWJ sequences, flag tag sequences, a single emoji variation selector, joiners in Arabic and Indic text, direction marks next to Hebrew or Arabic). Give text or url (one public https text file; GitHub and GitLab file pages are read as raw). Example: {"url":"https://github.com/owner/repo/blob/main/SKILL.md"} or {"text":"Visit pаypal.com","return_clean":true}. Optional return_clean adds a copy with hidden characters removed and look-alike letters inside mixed words replaced. Decoded hidden text is returned as data. Limits: finds characters and look-alikes, not prompt injection written in plain visible words; up to 200,000 characters (files up to 1 MB, first 200,000 characters scanned).	Use when the user asks whether text, a prompt, a SKILL.md, AGENTS.md, CLAUDE.md, .cursorrules, README, MCP tool description, PR diff, email or web page hides anything, or before an agent follows, installs or merges instructions that came from someone else (signals: "hidden characters", "invisible unicode", "ASCII smuggling", "prompt injection in this file", "Trojan Source", "why does this string not match", "is this domain spelled with a Cyrillic letter"). Inspects every code point and returns a verdict (clean, suspicious, dangerous) with each finding's line, column, code points and Unicode names: Unicode tag characters (decoded back to the hidden ASCII message), variation-selector payloads (decoded bytes), bidirectional overrides and isolates, long zero-width runs, zero-width and other invisible characters, ANSI terminal escapes, control characters, words that mix Latin with Cyrillic or Greek look-alikes (with the Latin word they imitate, from Unicode confusables), whole look-alike words, styled math letters, unusual spaces, line separators, private-use and unassigned code points, and HTML comments that do not render. Legitimate uses are not flagged (emoji ZWJ sequences, flag tag sequences, a single emoji variation selector, joiners in Arabic and Indic text, direction marks next to Hebrew or Arabic). Give text or url (one public https text file; GitHub and GitLab file pages are read as raw). Example: {"url":"https://github.com/owner/repo/blob/main/SKILL.md"} or {"text":"Visit pаypal.com","return_clean":true}. Optional return_clean adds a copy with hidden characters removed and look-alike letters inside mixed words replaced. Decoded hidden text is returned as data. Limits: finds characters and look-alikes, not prompt injection written in plain visible words; up to 200,000 characters (files up to 1 MB, first 200,000 characters scanned).	No	Yes	Yes	Yes

Details

Registry status: Active
Published: Nov 13, 2026
Updated: Nov 13, 2026
Website: https://clawhard.com/⁠ (opens in a new tab)
Repository: Not given
Categories (suggested): Security CommunicationSuggested categories are assigned automatically from the registry text and may be wrong. Verified operators can correct them.
GDPR: Not declared

Are you the operator? Claim this listing