mcp-toolbelt is a remote MCP server that gives an AI agent 29 tools, among them ai_crawler_policy_check, broken_link_check, check_open_ports. It answers at https://papacasper.com/mcp over streamable HTTP, and it listed its tools to an anonymous client, so no sign-in was needed for that. Our probes reached it 10 of 10 times since 5 September 2026; the last check, on 18 October 2026, succeeded.
29 pay-per-call DNS, SEO, SSL, security, WHOIS, mail, and AI tools for AI agents. x402, no API key.
Description as the publisher wrote it.
| Tool | What it does |
|---|---|
ai_crawler_policy_check | Check a site's robots.txt for explicit directives targeting known AI crawlers (GPTBot, ClaudeBot, CCBot, PerplexityBot, Google-Extended, Bytespider, Amazonbot, and others used for LLM training or AI search/answer products), and check for an Inputs: url |
broken_link_check | Crawl a site starting from a URL (same-origin pages only, bounded by maxPages) and check every linked URL for broken status codes. Returns broken links with the page(s) they were found on. Note: some external sites (e.g. social platforms) b Inputs: url, maxPages, checkExternal |
check_open_ports | TCP-connect scan a host for open ports. Defaults to a list of ~20 common service ports (SSH, HTTP/S, mail, DBs, etc.) if none are given. For checking your own infrastructure's exposure — capped at 100 ports per call. Inputs: host, ports |
check_robots_sitemap | Check whether a site has a valid robots.txt and sitemap.xml, and return their raw contents (truncated). Inputs: url |
cors_policy_check | Send a probe request with a foreign Origin header to a URL and report its CORS response headers. Flags wildcard-origin + credentials combinations and arbitrary-origin reflection, both common CORS misconfigurations. Inputs: url |
dns_propagation_check | Query a DNS record for a domain against several major public resolvers (Google, Cloudflare, Quad9, OpenDNS) in parallel and compare the answers. Flags mismatches, which usually mean propagation is still in progress after a DNS change. Inputs: domain, recordType |
domain_availability_check | Check whether a domain is registered, plus scan common typo-squat variants (adjacent-key substitution, letter omission/doubling, transposition) across popular TLDs (.com, .net, .org, .io, .co, .ai, .app, .dev) for brand-protection or domain Inputs: domain, checkSquats |
domain_health_check | Check a domain's registration expiry (via WHOIS) and DNS health: nameservers, A/AAAA, MX, SPF, and DMARC records. Flags common misconfigurations. Inputs: domain |
domain_report | Bundle: runs seo_audit, domain_health_check (WHOIS + DNS: nameservers, A/AAAA, MX, SPF, DMARC), and email_deliverability_check (DKIM, SPF lookup-count, DMARC strength, DNSBL) against a domain in one call, one charge. Cheaper than calling th Inputs: domain |
email_address_validate | Validate a single email address: RFC syntax check, MX record lookup on the domain, disposable/temporary-email-provider detection, and role-account detection (info@, admin@, etc.). Per-address check — different from email_deliverability_chec Inputs: email |
email_deliverability_check | Deep-dive email deliverability check for a domain: MX records + reverse-DNS (PTR) on each MX host, common DKIM selector probing, SPF lookup-count (RFC 7208 caps at 10), DMARC policy strength, and DNSBL blacklist lookups (Spamhaus Zen, SpamC Inputs: domain |
favicon_manifest_check | Check a site for favicon, apple-touch-icon, web app manifest, and theme-color presence — a quick completeness check for browser/OS chrome and PWA metadata. Inputs: url |
github_repo_health_check | Check a GitHub repository's health signals: stars, forks, open issues, license, archived/disabled status, and days since last push. Flags likely-abandoned or unlicensed repos. Useful before depending on a repo. Inputs: owner, repo |
ip_geolocation_asn_lookup | Resolve a hostname to its IPv4 addresses and look up each one's ASN, network prefix, country code, and network owner via Team Cymru's DNS-based WHOIS service (no API key). Country-level only — not city/street geolocation. Inputs: host |
json_ld_schema_validator | Fetch a URL, extract every JSON-LD (<script type="application/ld+json">) block, and validate basic structure — @context/@type presence plus required fields for common schema.org types (Article, Product, Organization, WebSite, LocalBusiness, Inputs: url |
package_vulnerability_check | Look up a package (optionally pinned to a version) against OSV.dev's aggregated vulnerability database (GitHub Advisories, PyPA, RustSec, Go vuln DB, etc.) for known CVEs/advisories. Supports npm, PyPI, crates.io, RubyGems, Go, Maven, NuGet Inputs: ecosystem, name, version |
page_performance_check | Fetch a URL and measure time-to-first-byte, total fetch time, and response size. Flags missing compression, missing Cache-Control, oversized payloads, and slow TTFB. Inputs: url |
pagespeed_insights | Run Google's real PageSpeed Insights (Lighthouse + Chrome UX Report) against a URL: performance score, Core Web Vitals (LCP, CLS, INP/TBT), and real-user field data where available. Authoritative version of a local timing check — hits Googl Inputs: url, strategy |
redirect_chain_check | Follow a URL through every HTTP redirect hop and report the full chain, final destination, and issues like redirect loops, too many hops, or HTTPS-to-HTTP downgrades. Inputs: url |
safe_browsing_check | Check a URL against Google Safe Browsing's malware/phishing/unwanted-software/PUA blocklists. Requires GOOGLE_SAFE_BROWSING_API_KEY to be configured server-side (free Google Cloud API key). Inputs: url |
security_headers_audit | Fetch a URL and audit its response for security-relevant HTTP headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy). Flags missing/misconfigured headers with a score. Inputs: url |
seo_audit | Fetch a URL and run an SEO audit: title/meta description length, canonical tag, Open Graph + Twitter Card tags, html lang attribute, viewport meta, heading structure, image alt-text coverage, internal/external link counts and generic-anchor Inputs: url |
sitemap_url_validator | Parse a site's sitemap.xml (following one level of sitemap-index nesting) and check the HTTP status of every listed URL. Concurrency-limited, capped at 200 URLs checked per call. Reports broken/redirecting URLs found in the sitemap. Inputs: url |
ssl_cert_check | Connect to a host over TLS and report its certificate's expiry date, days remaining, issuer, and subject. Inputs: hostname, port |
ssl_labs_grade | Full SSL Labs-style TLS assessment: overall letter grade, protocol support (TLS 1.0-1.3), cipher strength, certificate chain issues, and known vulnerabilities (Heartbleed, POODLE, etc.) for each endpoint. Slower than ssl_cert_check (can tak Inputs: hostname |
structured_data_extract | Fetch a URL and extract structured data deterministically: JSON-LD blocks, OpenGraph/meta tags, and optional caller-supplied CSS-selector fields (e.g. { price: '.product-price', title: 'h1' }). No LLM involved — pure HTML parsing via CSS se Inputs: url, selectors, attr |
tech_stack_fingerprint | Fetch a URL and fingerprint its likely tech stack from response headers (server, x-powered-by, x-generator) and HTML markers (generator meta tag, framework/CMS-specific script or class patterns). Best-effort — not exhaustive, no additional Inputs: url |
url_to_markdown | Fetch a URL and return its main text content as clean, readable plain text/markdown-ish output. Strips scripts, styles, and HTML tags. Inputs: url |
websocket_endpoint_check | Test a WebSocket endpoint (ws:// or wss://): attempts the handshake, reports success/failure, time-to-open in ms, and close code/reason. Useful for verifying a WebSocket server is reachable and completes its upgrade handshake before you wir Inputs: url |
Every block below points at https://papacasper.com/mcp. Pick your client and copy.
claude mcp add --transport http mcp-toolbelt https://papacasper.com/mcp
{
"mcpServers": {
"mcp-toolbelt": {
"command": "npx",
"args": ["-y", "mcp-remote", "https://papacasper.com/mcp"]
}
}
}{
"mcpServers": {
"mcp-toolbelt": {
"url": "https://papacasper.com/mcp"
}
}
}{
"servers": {
"mcp-toolbelt": {
"type": "http",
"url": "https://papacasper.com/mcp"
}
}
}{
"context_servers": {
"mcp-toolbelt": {
"url": "https://papacasper.com/mcp"
}
}
}{
"mcpServers": {
"mcp-toolbelt": {
"serverUrl": "https://papacasper.com/mcp"
}
}
}{
"mcpServers": {
"mcp-toolbelt": {
"url": "https://papacasper.com/mcp"
}
}
}name: mcp-toolbelt
version: 0.0.1
schema: v1
mcpServers:
- name: mcp-toolbelt
type: streamable-http
url: https://papacasper.com/mcp{
"mcpServers": {
"mcp-toolbelt": {
"httpUrl": "https://papacasper.com/mcp"
}
}
}{
"mcpServers": {
"mcp-toolbelt": {
"type": "http",
"url": "https://papacasper.com/mcp"
}
}
}{
"mcpServers": {
"mcp-toolbelt": {
"url": "https://papacasper.com/mcp"
}
}
}goose://extension?url=https%3A%2F%2Fpapacasper.com%2Fmcp&type=streamable_http&id=mcp-toolbelt&name=mcp-toolbelt
It answered our last check on 18 October 2026 in 346 ms. Over 10 checks since 5 September 2026 it answered 10. Status here comes from Neuronto's own probes, not from the publisher.
Yes. It is published by papacasper.com and served from papacasper.com, the vendor's own domain: https://papacasper.com/mcp.
29, as returned by the server's own tools/list on 31 August 2026: ai_crawler_policy_check, broken_link_check, check_open_ports, check_robots_sitemap, cors_policy_check, dns_propagation_check, domain_availability_check, domain_health_check, and 21 more.
It answered our last check on 18 October 2026 in 346 ms. Over 10 checks since 5 September 2026 it answered 10.
Put the server under mcpServers in ~/.cursor/mcp.json with the URL https://papacasper.com/mcp. The exact JSON is above, with the same setup for Claude Code, Claude Desktop, VS Code, Windsurf, Zed, Gemini CLI and the rest.
It listed its tools to an anonymous client, so reading the tool list needs no key. Individual tools can still ask for credentials in their own inputs.
Publisher: com.papacasper. Endpoint host: papacasper.com. ARD identifier: urn:air:com.papacasper:mcp:mcp-toolbelt.
First indexed 31 August 2026. The tools are exactly what the server returned; nothing on this page
is inferred from its name. Ranking in Neuronto search is never for sale.