Name: Apixies Developer API Suite
Author: apixies

Apixies Developer API Suite MCP

50 developer utility APIs as tools: SSL, DNS, WHOIS, email checks, HTML to PDF, sitemaps and more.

Grade A Local · stdio API key 50 tools v1.4.2

No reviews yet by apixiesnpm 1,215 Runs on your machine, nothing hosted

95/100

trust score

downloads a day

local

runs on your machine

726

downloads in 30d

What it does

50 developer utility APIs as tools: SSL, DNS, WHOIS, email checks, HTML to PDF, sitemaps and more.

Quickstart

# 1 — add it to Claude Code
claude mcp add --scope user --env 'APIXIES_API_KEY=${APIXIES_API_KEY}' --transport stdio apixies-developer-api-suite-mcp '--' npx -y @apixies/mcp-server

# 2 — ask your agent for something these tools do
#   check_ssl, check_headers, inspect_email and 47 more

It needs APIXIES_API_KEY: this reads it from your environment, so export it first.

Apixies Developer API Suite costs nothing on mcprush: there is no plan to choose here, no cap to set and nothing mcprush can bill you for.

Publisher

apixies1 server

1 category

All 1 server

Installation

Where are you running it?

Every route below installs the same thing and ends at the same approval screen. This one runs on your machine: your client starts Apixies Developer API Suite as a process under your own user, with your files and your network, so the tool surface below is what it can do to your computer rather than to a server somewhere else. Its scan result is on the Security tab — read the surface before you approve it.

Claude Codedeclared by this listing

This is a public server: you run it yourself and this marketplace is not in the path. You need Node.js — the current LTS (24) is the safe choice; npx comes with it. Claude Code registers it in one command; --scope user makes it available in every project. Claude Code reads APIXIES_API_KEY (Your Apixies API key. Get one free at https://apixies.io/register) from your environment each time it starts the server, so the value stays out of its config: export it in your shell profile (macOS, Linux), or run setx APIXIES_API_KEY … and open a new terminal (Windows). The '--' is in quotes so that PowerShell passes it on.

claude mcp add --scope user --env 'APIXIES_API_KEY=${APIXIES_API_KEY}' --transport stdio apixies-developer-api-suite-mcp '--' npx -y @apixies/mcp-server

Reconnect, or start a new session, and the tools appear in the model’s tool list.

Free on mcprush, and it runs from its publisher’s own package: this marketplace is not in the path, so there is no key of ours to hold and no card to add.

What it asks of you

It reaches a system of yours, so it needs your own credential rather than the publisher’s: APIXIES_API_KEY — Your Apixies API key. Get one free at https://apixies.io/register. You set it in your own client’s config, on your machine — this marketplace never holds it.

What it writes

One config entry your client uses to start the process locally. A local server runs with your file system and your network, which is why it is priced without metering.

What you approve

50 tools, with what each one reads, writes and reaches shown before you agree — the same list on every route above. Read the tool surface.

Tool surface

What the model actually sees. Descriptions are diffed on every release — see version history.

Only tools that write or reach the network

Check the SSL/TLS certificate of a domain. Returns issuer, validity dates, expiry countdown, protocol version, cipher suite, and certificate chain details.

Parameter	Type	Required	Notes
domain	string	yes	Domain name to check (e.g., "stripe.com")
port	number	no	Port number (default: 443)

Check security headers for a URL. Returns present and missing headers (HSTS, CSP, X-Frame-Options, etc.) with a security grade.

Parameter	Type	Required	Notes
url	string	yes	Full URL to check (e.g., "https://github.com")

Inspect an email address. Checks format validity, MX records, domain resolution, disposable domain detection, and role-based address detection.

Parameter	Type	Required	Notes
email	string	yes	Email address to inspect (e.g., "hello@example.com")

Parse a User-Agent string. Detects browser name and version, operating system, device type, and whether it's a bot or crawler.

Parameter	Type	Required	Notes
user_agent	string	yes	User-Agent string to parse

Get geolocation data for an IP address. Returns country, city, region, coordinates, timezone, ISP, and organization.

Parameter	Type	Required	Notes
ip	string	yes	IPv4 or IPv6 address (e.g., "8.8.8.8")

Query DNS records for a domain. Returns A, AAAA, MX, TXT, CNAME, NS, SOA, SRV, CAA, PTR records. Optionally filter by record type.

Parameter	Type	Required	Notes
domain	string	yes	Domain name to query (e.g., "github.com")
type	string	no	Record type filter: A, AAAA, MX, TXT, CNAME, NS, SOA, SRV, CAA, PTR. Omit for all.

Check whether a DNS change has propagated: asks Google, Cloudflare, Quad9, OpenDNS and AdGuard the same question at once and reports which resolvers agree, with TTLs. Different answers can also mean load balancing, not only an unfinished change.

Parameter	Type	Required	Notes
domain	string	yes	Domain name to check (e.g., "github.com")
type	string	no	Record type (default: A)
resolvers	array	no	Resolvers to ask, at least two. Omit for all five.

Follow a URL's redirect chain. Shows every hop with HTTP status code, final destination URL, and total number of redirects.

Parameter	Type	Required	Notes
url	string	yes	URL to trace (e.g., "http://github.com")

Extract meta tags from a URL. Returns OpenGraph tags, Twitter Card tags, standard meta tags, title, and description.

Parameter	Type	Required	Notes
url	string	yes	URL to extract meta tags from (e.g., "https://stripe.com")

Check if a URL is reachable. Returns HTTP status code, response time, content type, and SSL status.

Parameter	Type	Required	Notes
url	string	yes	URL to check (e.g., "https://docs.github.com")

Fetch and parse a domain's robots.txt file. Returns user-agent rules, allowed/disallowed paths, crawl delays, and sitemap URLs.

Parameter	Type	Required	Notes
domain	string	yes	Domain name (e.g., "github.com"). Without https://

Find favicon URLs for a website. Returns all discovered icons with their URLs, types, and sizes.

Parameter	Type	Required	Notes
domain	string	yes	Domain name (e.g., "stripe.com"). Without https://

Validate a URL's format and reachability. Checks syntax, whether it resolves, SSL status, response code, and response time.

Parameter	Type	Required	Notes
url	string	yes	URL to validate (e.g., "https://cloudflare.com")

Validate email authentication records (SPF, DKIM, DMARC) for a domain. Checks if each record exists, is valid, and returns the raw records.

Parameter	Type	Required	Notes
domain	string	yes	Domain name (e.g., "google.com"). Without https://

Measure website performance. Returns DNS lookup time, TCP connect time, SSL handshake time, TTFB, content download time, and total load time.

Parameter	Type	Required	Notes
url	string	yes	URL to analyze (e.g., "https://stripe.com")

Look up WHOIS registration data for a domain. Returns registrar, creation date, expiration date, name servers, and contact info.

Parameter	Type	Required	Notes
domain	string	yes	Domain name (e.g., "github.com"). Without https://

Decode a JWT token without verification. Returns the header, payload with all claims, signature, and expiry information.

Parameter	Type	Required	Notes
token	string	yes	JWT token string (e.g., "eyJhbGciOiJIUzI1NiIs...")

Analyze text content. Returns word count, character count, sentence count, paragraph count, reading time, speaking time, and top word frequency.

Parameter	Type	Required	Notes
text	string	yes	Text content to analyze

Get the public IP address of the MCP server. Returns the IP, version (IPv4/IPv6), and whether it's a private address.

No parameter schema on file.

Convert HTML content to a PDF document. Send HTML markup and receive a PDF. Useful for generating invoices, reports, and documents.

Parameter	Type	Required	Notes
html	string	yes	HTML content to convert to PDF

Convert Markdown text to HTML. Supports GFM (GitHub Flavored Markdown) including tables, code blocks, and task lists.

Parameter	Type	Required	Notes
markdown	string	yes	Markdown text to convert
allow_html	boolean	no	Keep raw HTML from the input (default: false, HTML is escaped). Unsafe link schemes are always dropped.

Format, validate, and analyze JSON. Returns formatted output, minified version, and stats (key count, depth, size, type counts).

Parameter	Type	Required	Notes
input	string	yes	JSON string to format
indent	number	no	Indent spaces (default: 2, range: 0-8)
sort_keys	boolean	no	Sort object keys alphabetically (default: false)
minify	boolean	no	Return minified JSON (default: false)

Convert a JSON array of objects to CSV format. Handles nested objects and custom delimiters.

Parameter	Type	Required	Notes
data	string	yes	JSON array of objects (e.g., '[{"name": "Alice", "age": 30}]')
delimiter	string	no	CSV delimiter: "," (default), ";", " ", or "\|"

Encode or decode a Base64 string. Supports standard and URL-safe Base64.

Parameter	Type	Required	Notes
input	string	yes	Text to encode or Base64 string to decode
action	string	yes	"encode" or "decode"

Parse and format a phone number into E.164, national, and international formats. Validates the number and identifies the country.

Parameter	Type	Required	Notes
phone	string	yes	Phone number (e.g., "+1 (212) 555-1234")
country_code	string	no	ISO 3166-1 alpha-2 country code (e.g., "US", "GB", "DE"). Default: "US"

Validate JSON data against a JSON Schema definition (Draft-07+). Returns whether the data is valid and detailed error messages if not.

Parameter	Type	Required	Notes
data	string	yes	JSON data to validate
schema	string	yes	JSON Schema to validate against

Convert a color between HEX, RGB, and HSL formats. Input any format and get all three representations back.

Parameter	Type	Required	Notes
color	string	yes	Color value in HEX (#FF5733), RGB (rgb(255,87,51)), or HSL (hsl(11,100%,60%))
format	string	no	Preferred output format: "hex", "rgb", or "hsl". Returns all formats regardless.

Convert between Unix timestamps and human-readable dates. Returns ISO 8601, RFC 2822, human-readable, and Unix formats with timezone support.

Parameter	Type	Required	Notes
timestamp	string	yes	Unix timestamp (e.g., "1700000000") or date string (e.g., "2023-11-14")
timezone	string	no	IANA timezone (e.g., "America/New_York", "Europe/London"). Default: "UTC"

URL-encode or decode a string. RFC 3986 compliant encoding for URLs and query strings.

Parameter	Type	Required	Notes
input	string	yes	Text to encode or URL-encoded string to decode
action	string	yes	"encode" or "decode"

Generate a cryptographic hash of the input text. Supports MD5, SHA-1, SHA-256, SHA-384, SHA-512, CRC32, and Whirlpool.

Parameter	Type	Required	Notes
input	string	yes	Text to hash
algorithm	string	no	Hash algorithm: md5, sha1, sha256, sha384, sha512, crc32, whirlpool (default: sha256)

Generate a QR code image from text or a URL. Returns SVG with customizable size, colors, and margin.

Parameter	Type	Required	Notes
text	string	yes	Text or URL to encode in the QR code
size	number	no	Size in pixels (default: 200, range: 50-1000)
format	string	no	Output format: "svg" (the only format)
color	string	no	Foreground color as hex (default: "#1a1a2e")
bg	string	no	Background color as hex (default: "#ffffff")
margin	number	no	Margin/quiet zone size (default: 1, range: 0-10)

Generate UUID identifiers. Supports v4 (random) and v7 (time-sorted). Bulk generation up to 50 at once.

Parameter	Type	Required	Notes
version	string	no	UUID version: "v4" (random, default) or "v7" (time-sorted)
count	number	no	Number of UUIDs to generate (default: 1, max: 50)

Generate cryptographically secure random passwords. Configurable length, character sets, and exclusions.

Parameter	Type	Required	Notes
length	number	no	Password length (default: 16, range: 8-128)
count	number	no	Number of passwords to generate (default: 1, max: 20)
uppercase	boolean	no	Include uppercase letters A-Z (default: true)
lowercase	boolean	no	Include lowercase letters a-z (default: true)
numbers	boolean	no	Include numbers 0-9 (default: true)
symbols	boolean	no	Include symbols !@#$... (default: true)
exclude	string	no	Characters to exclude (e.g., "0O1lI" for ambiguous characters)

Generate Lorem Ipsum placeholder text. Choose between words, sentences, or paragraphs with a configurable count.

Parameter	Type	Required	Notes
type	string	no	Output type: "words", "sentences", or "paragraphs" (default: "paragraphs")
count	number	no	Number of units to generate (default: 3, max: 100)

Capture a screenshot of any webpage as PNG or JPEG. Configurable viewport size, full-page mode, and image quality.

Parameter	Type	Required	Notes
url	string	yes	URL to screenshot (e.g., "https://github.com")
width	number	no	Viewport width in pixels (default: 1280, range: 320-3840)
height	number	no	Viewport height in pixels (default: 800, range: 200-2160). Ignored if full_page is true.
full_page	boolean	no	Capture the entire scrollable page (default: false)
format	string	no	Image format: "png" (default) or "jpeg"
quality	number	no	JPEG quality (default: 80, range: 1-100). Only applies to JPEG format.

Parse a cron expression into a human-readable description and calculate next run times. Supports standard 5-field cron and special strings like @daily, @hourly.

Parameter	Type	Required	Notes
expression	string	yes	Cron expression (e.g., "/5 * * ", "0 9 * MON-FRI")
num_next	number	no	Number of next run times to return (default: 5, max: 20)
timezone	string	no	Timezone for calculations (default: UTC, e.g., "Europe/Zurich")

Convert CSV data to a JSON array of objects. Supports custom delimiters, header detection, and quoted fields.

Parameter	Type	Required	Notes
csv	string	yes	CSV content as a string
has_headers	boolean	no	First row contains column headers (default: true)
delimiter	string	no	Column delimiter: comma, semicolon, tab, or pipe (default: comma)

Convert HTML content to clean Markdown. Supports GitHub Flavored Markdown with tables and strikethrough. Useful for scraping web content for LLM processing.

Parameter	Type	Required	Notes
html	string	yes	HTML content to convert
strip_tags	string	no	Comma-separated tags to strip (e.g., "script,style,nav")
gfm	boolean	no	Use GitHub Flavored Markdown (default: true)

Look up an HTTP status code. Returns the name, description, common causes, how to fix, and RFC reference. Covers all standard codes plus Cloudflare codes.

Parameter	Type	Required	Notes
code	number	yes	HTTP status code (e.g., 404, 429, 502)

Convert YAML content to JSON. Supports multi-document YAML, anchors, aliases, and Kubernetes config files.

Parameter	Type	Required	Notes
yaml	string	yes	YAML content to convert
pretty	boolean	no	Pretty-print JSON output (default: true)

Convert XML content to a JSON object. Handles attributes, namespaces, CDATA sections, and nested elements. Useful for parsing RSS feeds, SOAP responses, and legacy XML data.

Parameter	Type	Required	Notes
xml	string	yes	XML content to convert
pretty	boolean	no	Pretty-print JSON output (default: true)
preserve_attributes	boolean	no	Include XML attributes prefixed with @ (default: true)

Convert a JSON object to well-formed XML. Supports custom root element, attribute conversion, and XML declaration toggle.

Parameter	Type	Required	Notes
json	string	yes	JSON content to convert (must be an object)
root_element	string	no	Root element name (default: "root")
pretty	boolean	no	Pretty-print XML output (default: true)
xml_declaration	boolean	no	Include XML declaration header (default: true)

Test a regular expression pattern against text. Returns all matches, captured groups, named groups, and match positions. Useful for validating patterns before deploying them.

Parameter	Type	Required	Notes
pattern	string	yes	Regex pattern without delimiters (e.g., "^[a-z]+$", "(\w+)@(\w+)\.(\w+)")
text	string	yes	Text to test the pattern against
flags	string	no	Regex flags: i (case-insensitive), m (multiline), s (dotall), u (unicode)
global	boolean	no	Find all matches, not just the first (default: true)

Compare two JSON objects and return a structured diff. Shows additions, deletions, and changes with JSONPath locations. Useful for comparing API responses, config files, or database records.

Parameter	Type	Required	Notes
original	string	yes	Original JSON (before)
modified	string	yes	Modified JSON (after)
ignore_order	boolean	no	Ignore array element ordering (default: false)

Convert Markdown content to a downloadable PDF document. Supports GFM tables, code blocks, and custom page sizes. Returns a URL to the generated PDF.

Parameter	Type	Required	Notes
markdown	string	yes	Markdown content to convert
page_size	string	no	Page size: A4, Letter, Legal (default: A4)
orientation	string	no	Orientation: portrait, landscape (default: portrait)
margin	string	no	Page margin (default: "20mm")
title	string	no	Document title for PDF metadata

Convert a JSON object to YAML format. Useful for generating Kubernetes configs, Docker Compose files, and CI/CD pipeline definitions from JSON data.

Parameter	Type	Required	Notes
json	string	yes	JSON content to convert
indent	number	no	Indentation spaces: 2, 4, or 8 (default: 2)
inline_level	number	no	Depth for inline notation (default: 10, higher = more expanded)

Check if a URL has CORS headers configured. Sends a preflight OPTIONS request and reports allowed origins, methods, headers, and security issues. Useful for debugging frontend API integration problems.

Parameter	Type	Required	Notes
url	string	yes	URL to check for CORS headers (e.g., "https://api.github.com")
origin	string	no	Origin to send in preflight request (default: "https://example.com")

Fetch and parse a sitemap.xml file. Returns all URLs with lastmod, changefreq, and priority metadata. Can follow sitemap index files. Useful for SEO audits and content discovery.

Parameter	Type	Required	Notes
url	string	yes	URL of the sitemap (e.g., "https://example.com/sitemap.xml")
limit	number	no	Max URLs to return (default: 100, max: 1000)
follow_index	boolean	no	Follow and parse child sitemaps in a sitemap index (default: false)

Fetch a web page and extract all structured data (JSON-LD, Microdata, RDFa). Validates against common Schema.org types and reports missing properties. Useful for SEO audits.

Parameter	Type	Required	Notes
url	string	yes	URL of the page to check (e.g., "https://example.com")

Scan an HTTPS page for mixed content (HTTP resources on HTTPS pages). Finds insecure images, scripts, stylesheets, and iframes that cause browser warnings. Reports severity (active vs passive) and line numbers.

Parameter	Type	Required	Notes
url	string	yes	HTTPS URL to scan (e.g., "https://example.com")

Free

$0 forever

Every tool, no call limit
No card, and mcprush charges nothing for it
Source published under MIT
Runs on your machine — nothing of it reaches our gateway
Nothing to cap, because mcprush bills nothing

Nothing here is billable: mcprush charges nothing to install Apixies Developer API Suite or to call it, at any volume.

ATrust score 95 / 100

Release 1.4.2 · scanned 14 Oct 2026

Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.

Threat score100

Client score95

Findings1 threat · 11 capability

Capabilitymoderate

Coveragesource

Verificationnone

Surface digestb06a9ac0a4db978148a8413c75f253b90f893a0e25f4b84166263825e358b1dd

Score vectorthreat 100 → client 95

Term	Level	What it prices	Points
capability-exposure	moderate	capability blast radius (moderate) — client exposure if the model is manipulated	−3
verification-discount	none	publisher verification (unlinked) — no provenance/repo link, but the shipped source was fully read	−2
coverage-honesty	source	inspection depth (source) — how much of the target the scan could see	−0

score = clamp(round(threatScore − E_cap − E_ver − E_cov), 0, 100). No model, no opinion, no network call at scoring time: the same methodology version against the same bytes always produces this number, and every line above is a field of the report rather than a summary of it.

What the scan could actually read

A grade is only as meaningful as its coverage, so the scanner publishes its own depth before it publishes its result.

Tool surfaceread

Implementation sourceread

Package metadataread

Live transportnot available

Tools were statically extracted from the published source (50 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".

Capability — what it could do if the model were manipulated

Tags derived from each tool’s schema and the implementation, not from what the tool calls itself. moderate is the level these add up to.

Tool	Capability tags	Why the tag was assigned
check_ssl	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
check_headers	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
inspect_email	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
parse_user_agent	no tags
geolocate_ip	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
dns_lookup	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
dns_propagation	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
trace_redirects	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
extract_meta_tags	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
check_link	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
parse_robots_txt	untrusted-input	untrusted-input: keyword "fetch", declares openWorldHint: true (interacts with entities outside the server)
fetch_favicon	untrusted-input	untrusted-input: keyword "fetch", declares openWorldHint: true (interacts with entities outside the server)
validate_url	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
validate_email_auth	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
check_performance	untrusted-input	untrusted-input: keyword "download", declares openWorldHint: true (interacts with entities outside the server)
whois_lookup	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
decode_jwt	no tags
analyze_text	no tags
my_ip	no tags
html_to_pdf	no tags
markdown_to_html	no tags
format_json	no tags
json_to_csv	no tags
base64_encode_decode	no tags
format_phone	no tags
validate_json_schema	no tags
convert_color	no tags
convert_timestamp	no tags
encode_decode_url	no tags
generate_hash	no tags
generate_qr	no tags
generate_uuid	no tags
generate_password	no tags
generate_lorem	no tags
take_screenshot	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
parse_cron	no tags
csv_to_json	no tags
html_to_markdown	no tags
http_status_lookup	no tags
yaml_to_json	no tags
xml_to_json	untrusted-input	untrusted-input: keyword "rss"
json_to_xml	no tags
test_regex	no tags
json_diff	no tags
markdown_to_pdf	no tags
json_to_yaml	no tags
check_cors	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
parse_sitemap	untrusted-input	untrusted-input: keyword "fetch", declares openWorldHint: true (interacts with entities outside the server)
validate_structured_data	untrusted-input	untrusted-input: keyword "fetch", declares openWorldHint: true (interacts with entities outside the server)
check_mixed_content	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)

Toxic-flow graph

The lethal trifecta, checked as a graph rather than as a checklist: untrusted input, a sensitive source and an external sink have to meet before there is a path worth worrying about.

The public result for this release does not print the flow graph, so there is nothing to show here. That is not the same as "no paths were found": what the scan did read is above, under coverage.

Supply chain and provenance

Integrityfirst-seen

Surface digestb06a9ac0a4db9781

Scanned2026-10-14

This is the first scan of this surface here, so there is nothing yet to compare it against.

Every result on this tab comes from one deterministic pass over the published package — offline, rule by rule, and auditable line by line above. Same methodology version, same bytes, same score.