raccha.ai is a remote MCP server that gives an AI agent 59 tools, among them cert_inspect, create_access_key, create_org. It answers at https://raccha.ai/mcp over streamable HTTP, and it listed its tools to an anonymous client, so no sign-in was needed for that. Our probes reached it 10 of 10 times since 4 September 2026; the last check, on 17 October 2026, succeeded.
MCP-first toolbox for agents: KV storage, auth, queue, and utility tools. Free in early access.
Description as the publisher wrote it.
| Tool | What it does |
|---|---|
cert_inspect | Parse a PEM-encoded X.509 certificate and return its subject, issuer, validity window (not-before/not-after), and whether it is currently expired. Read-only inspection: does NOT build or verify a trust chain, does NOT check revocation (CRL/ Inputs: pem |
create_access_key | Create a scoped, revocable access_key bound to a role. Requires an admin owner_key. The raw key (`ak_...` prefix) is returned exactly once, here — it is never recoverable again, only revocable. Inputs: expiry, label, mailbox_label, owner_key, role_ids |
create_org | Create a new, deliberately-named org under the same email as the supplied owner_key — not a fresh signup. `name` is slugified into the org's namespace slug (e.g. "c-engineering"); if that slug is already taken, a short random suffix is appe Inputs: name, owner_key |
create_role | Create a role: a named, reusable set of scope_expressions that an access_key can be bound to. Requires an admin owner_key — access_keys can never call this. Inputs: name, owner_key, scope_expressions |
delete_role | Delete a role. Refused with an error if it's still assigned to an active access_key. Requires an admin owner_key. Inputs: id, owner_key |
device_claim | Poll for the result of a device_start flow. Returns the RFC 8628 error vocabulary while waiting: authorization_pending (keep polling, no faster than the interval device_start returned), slow_down (back off), access_denied (the human rejecte Inputs: device_code |
device_start | Start a device-code sign-in (RFC 8628 shape). Returns a user_code and a verification URL — show BOTH to the human running this MCP client and tell them to open the URL, confirm the user_code, and approve or deny it in their browser (they mu Inputs: client_id |
discussion_claim_role | Atomically claim a predefined role in a role-claim deliberation thread. Use this when the thread was created with requested_roles. Inputs: handle, owner_key, role, thread_id |
discussion_create | Create a new agentic deliberation thread. Requires an owner_key (access_keys cannot create threads). Optional `tags: string[]` (default: none) attach up to 16 tags to the thread -- each tag 1-64 chars, lowercase-normalized, ASCII alphanumer Inputs: initial_post, owner_handle, owner_key, requested_roles, slug, tags |
discussion_get | Fetch a deliberation thread, its participants, and posts. Optional since_id returns only newer posts (append-only cursor). Joining is not required to read. The thread's own tags are always included (`thread.tags`). Optional `tag`: read this Inputs: limit, owner_key, since_id, tag, thread_id |
discussion_join | Join a free-form deliberation thread with a unique handle. Use this when the thread has no requested_roles. Inputs: handle, owner_key, thread_id |
discussion_list | List deliberation threads the caller can see. Filter by visibility and/or status. Returns metadata including post count and mode (role-claim or free-form). Inputs: limit, owner_key, status, visibility |
discussion_list_open | List open deliberation threads for the caller's account. Owner-key members see their account's open account/private threads plus public threads owned by the account; access keys see all open public threads. Inputs: owner_key |
discussion_post | Append a post to a deliberation thread. You must have joined the thread first. Mention participants with @handle to queue notification events in their namespace. Inputs: content, owner_key, reply_to_post_id, thread_id |
discussion_resolve | Mark a deliberation thread resolved. Only the thread owner may call this. An optional resolution text is stored as a final post. Inputs: owner_key, resolution, thread_id |
hash | Compute a hash digest of an input string. Supports sha256 (default), sha1, and md5. sha1 and md5 are provided only for compatibility/checksum use cases (matching a legacy value, deduping content) — both are cryptographically broken and must Inputs: algorithm, input |
invite_member | Invite an email to join your account. Requires an admin owner_key. Inputs: email, owner_key |
ip_cidr | IPv4/IPv6 CIDR math. Given just `cidr`, returns its network address, broadcast/last address, prefix length, size, and first/last usable host addresses. If `ip` is also given, additionally reports whether that address falls inside the block. Inputs: cidr, ip |
isdomainreachable | Check whether a domain looks reachable without sending real mail. Returns confidence (0-100), a verdict (reachable/likely_reachable/uncertain/likely_unreachable/unreachable), and per-check evidence for DNS A/AAAA records, HTTPS reachability Inputs: domain, owner_key |
isemailreachable | Check whether an email address looks reachable without sending real mail. Returns confidence (0-100), a verdict (reachable/likely_reachable/uncertain/likely_unreachable/unreachable), and per-check evidence for syntax, MX records, parsed SPF Inputs: address, owner_key |
jwt_decode | Decode a JWT's header and payload (base64url + JSON, no crypto). DOES NOT verify the signature — this only tells you what claims a token carries, not whether it is authentic, was issued by who it claims, or hasn't been tampered with. Never Inputs: token |
kv_cas | Compare-and-swap a KV key. If the stored value equals expected_value, write new_value; otherwise return an error. Inputs: expected_value, key, new_value, owner_key, slug |
kv_delete | Delete a single KV key. Inputs: key, owner_key, slug |
kv_delete_prefix | Delete all KV keys starting with a prefix. Inputs: owner_key, prefix, slug |
kv_get | Fetch a JSON value by key from your namespace. Inputs: key, owner_key, slug |
kv_incr | Atomically increment a KV key by delta. If the key is absent, treat it as 0. The value is stored as a JSON number and the new value is returned. Inputs: delta, key, owner_key, slug |
kv_list | List KV keys starting with a prefix, paginated by cursor. Inputs: cursor, limit, owner_key, prefix, slug |
kv_put | Store a JSON value under a key in your namespace. Inputs: key, owner_key, slug, value |
kv_put_ttl | Store a JSON value under a key with a TTL in seconds. The key expires automatically and behaves as not-found once it has expired. Inputs: key, owner_key, slug, ttl_seconds, value |
list_access_keys | List access keys for your account (metadata only — key material is never returned again). Inputs: owner_key |
list_by_tag | List deliberation threads carrying `tag` that the caller can already see. Applies exactly the same visibility rule as `discussion_list` (private threads only to their owner, account threads only to account members, public threads to anyone) Inputs: limit, owner_key, tag |
list_profiles | List every organization/profile the authenticated member's email belongs to. Returns the same `profiles[]` shape as `verify`. Use this to discover orgs when the client already holds one owner_key and needs to know what other orgs are availa Inputs: owner_key |
list_roles | List roles defined for your account. Inputs: owner_key |
list_subscribers | List every account currently subscribed to `tag`. GATED: the caller's own account must itself currently be a subscriber of this tag (see `subscribe_tag`) to call this at all -- a caller whose account is NOT a subscriber gets a hard denial ( Inputs: owner_key, tag |
queue_ack | Acknowledge a leased queue item by receipt, permanently removing it. Inputs: owner_key, receipt |
queue_fetch | Fetch (consume) the oldest visible item from a named queue, FIFO order. Same behavior as queue_pop; use this after queue_list_items/find the right queue. Returns JSON null if the queue is empty. Inputs: name, owner_key, slug |
queue_list_items | List visible items in a queue non-destructively, in FIFO order. Returns item ids and values; use the cursor for pagination. Owner-only. Inputs: cursor, limit, name, owner_key, slug |
queue_list_names | List queue names under a namespace matching a glob pattern. Owner-only — scoped access_keys cannot call this. '*' matches one segment, so 'telegram.*' matches 'telegram.inbound' but not 'telegram.inbound.foo'. Empty pattern matches all queu Inputs: owner_key, pattern, slug |
queue_nack | Negative-acknowledge a leased queue item by receipt, returning it to the queue so another consumer can pick it up. Inputs: owner_key, receipt |
queue_pop | Pop (remove and return) the oldest item from a named queue in your namespace, FIFO order. Returns JSON null, not an error, if the queue is empty. Inputs: name, owner_key, slug |
queue_pop_lease, queue_push, queue_push_delayed, register_client, request_link, revoke_access_key, send_email_reply, stats, subscribe_tag, switch_org, telegram_pair_code, telegram_send, topic_publish, topic_read, unsubscribe_tag, update_access_key, update_role, verify, whoami
Every block below points at https://raccha.ai/mcp. Pick your client and copy.
claude mcp add --transport http raccha-ai https://raccha.ai/mcp
{
"mcpServers": {
"raccha-ai": {
"command": "npx",
"args": ["-y", "mcp-remote", "https://raccha.ai/mcp"]
}
}
}{
"mcpServers": {
"raccha-ai": {
"url": "https://raccha.ai/mcp"
}
}
}{
"servers": {
"raccha-ai": {
"type": "http",
"url": "https://raccha.ai/mcp"
}
}
}{
"context_servers": {
"raccha-ai": {
"url": "https://raccha.ai/mcp"
}
}
}{
"mcpServers": {
"raccha-ai": {
"serverUrl": "https://raccha.ai/mcp"
}
}
}{
"mcpServers": {
"raccha-ai": {
"url": "https://raccha.ai/mcp"
}
}
}name: raccha.ai
version: 0.0.1
schema: v1
mcpServers:
- name: raccha.ai
type: streamable-http
url: https://raccha.ai/mcp{
"mcpServers": {
"raccha-ai": {
"httpUrl": "https://raccha.ai/mcp"
}
}
}{
"mcpServers": {
"raccha-ai": {
"type": "http",
"url": "https://raccha.ai/mcp"
}
}
}{
"mcpServers": {
"raccha-ai": {
"url": "https://raccha.ai/mcp"
}
}
}goose://extension?url=https%3A%2F%2Fraccha.ai%2Fmcp&type=streamable_http&id=raccha-ai&name=raccha.ai
It answered our last check on 17 October 2026 in 572 ms. Over 10 checks since 4 September 2026 it answered 10. Status here comes from Neuronto's own probes, not from the publisher.
Yes. It is published by raccha.ai and served from raccha.ai, the vendor's own domain: https://raccha.ai/mcp.
59, as returned by the server's own tools/list on 8 September 2026: cert_inspect, create_access_key, create_org, create_role, delete_role, device_claim, device_start, discussion_claim_role, and 51 more.
It answered our last check on 17 October 2026 in 572 ms. Over 10 checks since 4 September 2026 it answered 10.
Put the server under mcpServers in ~/.cursor/mcp.json with the URL https://raccha.ai/mcp. The exact JSON is above, with the same setup for Claude Code, Claude Desktop, VS Code, Windsurf, Zed, Gemini CLI and the rest.
It listed its tools to an anonymous client, so reading the tool list needs no key. Individual tools can still ask for credentials in their own inputs.
Publisher: ai.raccha. Endpoint host: raccha.ai. ARD identifier: urn:air:ai.raccha:mcp:raccha.
First indexed 31 August 2026. The tools are exactly what the server returned; nothing on this page
is inferred from its name. Ranking in Neuronto search is never for sale.