Name: Benchline
Author: fabwaseem

Benchline MCP

Open-source developer, PDF, image, SEO and security tools over a stateless HTTP MCP server. No key.

Tool-list grade B Remote · Streamable HTTP No auth needed 82 tools v0.1.1 MIT

No reviews yet by fabwaseemGitHub The publisher’s own endpoint — this marketplace is not in the path

84/100

tool-list score

tools declared

remote

at its publisher

—

calls last 7d

What it does

Open-source developer, PDF, image, SEO and security tools over a stateless HTTP MCP server. No key.

Quickstart

# 1 — add it to Claude Code
claude mcp add --scope user --transport http benchline-mcp https://benchline.fabwaseem.com/mcp

# 2 — ask your agent for something these tools do
#   generate_llms_txt, score_ai_seo, build_open_graph and 79 more

Benchline costs nothing on mcprush: there is no plan to choose here, no cap to set and nothing mcprush can bill you for.

Publishernot claimed

fabwaseem1 server

1 category

All 1 server

Collected from a public index. Nobody has claimed this account, so nothing here was written by its author — claim it if it is yours.

Tool surface

What the model actually sees. Descriptions are diffed on every release — see version history.

Only tools that write or reach the network

Render llms.txt and llms-full.txt from a site name, a summary, and a list of pages. It does not crawl. Grouping follows the page URLs.

Parameter	Type	Required	Notes
siteName	string	yes	—
summary	string	yes	—
pages	array	yes	Pages you already know. This tool does not fetch them.

Fetch a public page plus its robots.txt, sitemap, and llms.txt, then score how ready it is for AI search crawlers. Use this when you have a live URL.

Parameter	Type	Required	Notes
url	string	yes	A public page. The check also reads robots.txt, sitemap.xml, and llms.txt on that origin.

Render one of the Open Graph templates as a PNG and a Next.js opengraph-image.tsx file. Pass a template id from list_og_templates, the fields that template uses, colors, a size, and optional base64 images.

Parameter	Type	Required	Notes
template	string	no	Template id from list_og_templates.
size	string	no	—
title	string	no	—
subtitle	string	no	—
author	string	no	—
role	string	no	—
eyebrow	string	no	—
badge	string	no	—
date	string	no	—
time	string	no	—
price	string	no	—
cta	string	no	—
url	string	no	—
stat	string	no	—
statLabel	string	no	—
quote	string	no	—
episode	string	no	—
readTime	string	no	—
meta	string	no	—
command	string	no	—

List Open Graph card templates with ids, names, categories, defaults, color presets, and field schemas.

Parameter	Type	Required	Notes
category	string	no	—

Decode a signed JSON Web Token into its header, payload, and registered claims. Dates are absolute ISO timestamps. The signature is not checked.

Parameter	Type	Required	Notes
token	string	yes	A signed JWT, with or without a Bearer prefix. The signature is not verified.

Fetch a public robots.txt and report whether the wildcard group blocks the site and whether Sitemap lines are absolute. Use this when you have a URL, not a pasted file.

Parameter	Type	Required	Notes
url	string	yes	A public page or a robots.txt URL. A page URL is resolved to /robots.txt on that origin.

Fetch one public HTML page and report title, description, canonical, Open Graph, Twitter, and JSON-LD. Use this to see what a live URL advertises.

Parameter	Type	Required	Notes
url	string	yes	A public HTML page. Only that URL is fetched.

Build schema.org JSON-LD for one type, plus a script tag and a list of missing fields. Use this when you already know the fields. It does not fetch a page.

Parameter	Type	Required	Notes
type	string	yes	—
values	object	yes	Fields for the chosen schema.org type. Repeatable fields are arrays of objects.

Count tokens with the o200k or cl100k encoder and price the count against the published model table. Claude and Gemini rows are estimates, not those vendors' tokenizers.

Parameter	Type	Required	Notes
text	string	yes	The prompt or document to count.
encoding	string	no	—
modelIds	array	no	Price rows to return. Unknown ids are rejected.
outputTokens	integer	no	—
cachedRatio	number	no	—
requestsPerDay	number	no	—

Turn a cron expression into English, the next UTC run times, and snippets for crontab, GitHub Actions, Vercel, Kubernetes, and node-cron.

Parameter	Type	Required	Notes
expression	string	yes	A cron expression, including @daily or @reboot.
dialect	string	no	—
timeZone	string	no	IANA time zone used to list the next runs. Hosted schedules stay in UTC.
now	string	no	ISO timestamp used as the clock. Omit it to use the current time.

Generate a production Dockerfile, dockerignore, compose file, and next.config snippet for a Next.js app. Defaults match a pnpm standalone image.

Parameter	Type	Required	Notes
packageManager	string	no	—
node	string	no	—
base	string	no	—
standalone	boolean	no	—
prisma	boolean	no	—
migrate	boolean	no	—
healthcheck	boolean	no	—
healthPath	string	no	—
port	integer	no	—
publicEnvs	array	no	—
telemetryDisabled	boolean	no	—
cacheMounts	boolean	no	—
turbo	boolean	no	—

Pretty-print or minify JSON. A number that does not fit in a JavaScript number keeps the digits you sent. Returns the formatted text when it is valid, or the line and column of each syntax error.

Parameter	Type	Required	Notes
json	string	yes	JSON text to format or validate.
indent	string	no	—
sortKeys	boolean	no	Sort object keys. Array order is kept.
minify	boolean	no	—

Convert between JSON, YAML, TOML, and XML. Auto-detects the source. Numbers that do not fit in a JavaScript number keep their digits. Errors include a line and column. TOML refuses null and a non-table root.

Parameter	Type	Required	Notes
text	string	yes	The source document.
from	string	no	—
to	string	no	—

Convert CSV to JSON or JSON to CSV. Supports comma, tab, semicolon, and pipe delimiters, an optional header, type inference, and dotted flattening. Inferred numbers that do not fit in a JavaScript number keep their digits.

Parameter	Type	Required	Notes
text	string	yes	—
direction	string	no	—
delimiter	string	no	Comma, tab, semicolon, pipe, or auto. Auto is a comma when writing CSV.
header	boolean	no	—
inferTypes	boolean	no	Used when converting CSV to JSON.
flatten	boolean	no	Used when converting JSON to CSV. Nested keys become dotted columns.

Compare two texts by line, word, or character, or compare JSON so object key order does not matter. Returns an inline diff, side-by-side rows for line and JSON modes, and a unified patch.

Parameter	Type	Required	Notes
left	string	yes	The original text.
right	string	yes	The changed text.
mode	string	no	—
ignoreWhitespace	boolean	no	—

Encode UTF-8 text as Base64, or decode Base64 and data URIs. URL-safe output uses - and _ and omits padding. Decode reports the sniffed media type and whether the bytes are UTF-8 text.

Parameter	Type	Required	Notes
action	string	no	—
text	string	yes	Text to encode, or Base64 or a data URI to decode.
urlSafe	boolean	no	Encode with the URL-safe alphabet and no padding. Data URIs stay on the standard alphabet.
dataUri	boolean	no	—
mime	string	no	—

Convert an image to JPEG, PNG, WebP, or AVIF. Send base64 or a public URL. Private addresses are refused and the decoded file is capped at 10 MB. Returns the image as base64. HEIC is not decoded here.

Parameter	Type	Required	Notes
file	object	yes	The image. Provide url or data.
target	string	no	—

Re-encode an image at a quality from 1 to 100, optionally capping the longest edge. Send base64 or a public URL. Private addresses are refused and the decoded file is capped at 10 MB. Returns the image as base64.

Parameter	Type	Required	Notes
file	object	yes	The image. Provide url or data.
choice	string	no	—
quality	number	no	—
maxEdge		no	Longest edge in pixels. Omit it to keep the size.

Resize an image by pixels or percent. Fit is contain, cover, or stretch. Send base64 or a public URL. Private addresses are refused and the decoded file is capped at 10 MB. Returns the image as base64.

Parameter	Type	Required	Notes
file	object	yes	The image. Provide url or data.
mode	string	no	—
width		no	—
height		no	—
percent	number	no	—
lockAspect	boolean	no	—
fit	string	no	—

Convert HEX, RGB, HSL, OKLCH, or CMYK into every format, name the nearest Tailwind token, and report the WCAG 2 contrast ratio against a background.

Parameter	Type	Required	Notes
color	string	yes	HEX, rgb(), hsl(), oklch(), cmyk(), or a CSS color name.
background	string	no	Background used for the WCAG contrast ratio.

Convert epoch seconds, milliseconds, microseconds, or nanoseconds to ISO-8601 and RFC 2822 in an IANA time zone, or convert a calendar time back to epoch.

Parameter	Type	Required	Notes
input	string	no	Unix timestamp, ISO-8601, RFC 2822, or now. Leave it empty when year, month, and day are set.
timeZone	string	no	IANA time zone, such as UTC or America/New_York.
unit	string	no	—
year	integer	no	—
month	integer	no	—
day	integer	no	—
hour	integer	no	—
minute	integer	no	—
second	integer	no	—

Count calendar days, elapsed time, and business days between two dates. Business days skip weekends and any YYYY-MM-DD holidays you list.

Parameter	Type	Required	Notes
startDate	string	yes	Start date as YYYY-MM-DD.
endDate	string	yes	End date as YYYY-MM-DD.
startTime	string	no	Start time as HH:MM or HH:MM:SS. Defaults to midnight.
endTime	string	no	End time as HH:MM or HH:MM:SS. Defaults to midnight.
includeEnd	boolean	no	Count the end date as well as the days between.
holidays	string	no	Weekday holidays to exclude from business days, one YYYY-MM-DD per line.

Compute MD5, SHA-1, SHA-256, and SHA-512 for UTF-8 text or base64 bytes. Pass hmacKey for HMAC and expected to see which digest matches.

Parameter	Type	Required	Notes
text	string	no	UTF-8 text to hash. Use this or base64.
base64	string	no	Raw bytes as standard base64.
hmacKey	string	no	UTF-8 HMAC key. Omit it for a plain digest.
expected	string	no	Hex or base64 digest to compare.

Generate UUID version 4 or version 7 from cryptographic randomness, up to 10,000 at once, or inspect the version, variant, and v7 timestamp.

Parameter	Type	Required	Notes
action	string	no	—
version	string	no	—
count	integer	no	—
value	string	no	UUID to inspect when action is inspect.

Percent-encode or decode text, or parse a URL into its host, path, hash, and query parameters.

Parameter	Type	Required	Notes
action	string	no	—
value	string	yes	—
mode	string	no	—
plusAsSpace	boolean	no	When decoding, treat + as a space.

Generate cryptographic passwords or EFF-wordlist passphrases and report the entropy in bits. Randomness comes from the platform CSPRNG.

Parameter	Type	Required	Notes
style	string	no	—
length	integer	no	—
lowercase	boolean	no	—
uppercase	boolean	no	—
digits	boolean	no	—
symbols	boolean	no	—
excludeAmbiguous	boolean	no	—
words	integer	no	—
separator	string	no	—
capitalize	boolean	no	—
digit	boolean	no	—
count	integer	no	—

Convert an octal or symbolic file mode into octal, symbolic notation, and a chmod command, including setuid, setgid, and the sticky bit.

Parameter	Type	Required	Notes
mode	string	yes	Octal such as 755 or 4755, or symbolic such as rwxr-xr-x.
path	string	no	—

Combine PDF files. Each file is base64 or a public URL, and can keep a page range such as 1-3,5. Private addresses are refused. Returns one PDF as base64.

Parameter	Type	Required	Notes
files	array	yes	—

Extract a page range into one PDF, or split into single pages or chunks of N. Send base64 or a public URL. Private addresses are refused. Returns PDF base64 and a ZIP when there are several files.

Parameter	Type	Required	Notes
name	string	no	—
data	string	no	PDF bytes as base64 or a data URI. Decoded size is capped at 10 MB. Provide data or url.
url	string	no	Public URL of a PDF. Private and local addresses are refused. Provide data or url.
filename	string	no	—
mimeType	string	no	—
range	string	no	Pages to keep, such as 1-3,5. Blank keeps every page.
mode	string	no	—
every	integer	no	Used when mode is chunks.

Recompress embedded images in a PDF. Presets are light, medium, and strong. Send base64 or a public URL. Private addresses are refused. An optional target size tries harder. Returns the PDF and the sizes before and after.

Parameter	Type	Required	Notes
data	string	no	PDF bytes as base64 or a data URI. Decoded size is capped at 10 MB. Provide data or url.
url	string	no	Public URL of a PDF. Private and local addresses are refused. Provide data or url.
filename	string	no	—
mimeType	string	no	—
preset	string	no	—
targetBytes		no	Optional size ceiling in bytes, such as 102400.

Turn images, sent as base64 or public URLs in order, into one PDF. JPEG and PNG are embedded directly. Other formats are converted to PNG first. Page size is A4, Letter, or fit. Private addresses are refused. Returns the PDF as base64.

Parameter	Type	Required	Notes
images	array	yes	—
page	string	no	—
orientation	string	no	—
margin	number	no	—

Build a static QR code for text, a URL, Wi-Fi, or a vCard. Returns the payload, an SVG string, and a PNG as base64.

Parameter	Type	Required	Notes
type	string	no	—
text	string	no	—
url	string	no	—
wifi	object	no	—
vcard	object	no	—
ecc	string	no	—
dark	string	no	—
light	string	no	—
margin	integer	no	—
size	integer	no	—

Read the selectable text layer of a PDF. Returns per-page text, markdown-style headings, and an o200k token count. Does not OCR scans. Send base64 or a public URL. Private addresses are refused.

Parameter	Type	Required	Notes
data	string	no	PDF bytes as base64 or a data URI. Decoded size is capped at 10 MB. Provide data or url.
url	string	no	Public URL of a PDF. Private and local addresses are refused. Provide data or url.
filename	string	no	—
mimeType	string	no	—

Reorder, rotate, or drop PDF pages. Each entry names a 1-based source page and a rotation of 0, 90, 180, or 270. The same page may be listed twice. Send base64 or a public URL. Private addresses are refused.

Parameter	Type	Required	Notes
data	string	no	PDF bytes as base64 or a data URI. Decoded size is capped at 10 MB. Provide data or url.
url	string	no	Public URL of a PDF. Private and local addresses are refused. Provide data or url.
filename	string	no	—
mimeType	string	no	—
pages	array	yes	—

Render PDF pages to PNG or JPEG. DPI is 72 to 216. A page range such as 1-3,5 is optional. At most 24 pages and 25 MB of images. Send base64 or a public URL. Private addresses are refused. Returns image base64 and a ZIP when there is more than one page.

Parameter	Type	Required	Notes
data	string	no	PDF bytes as base64 or a data URI. Decoded size is capped at 10 MB. Provide data or url.
url	string	no	Public URL of a PDF. Private and local addresses are refused. Provide data or url.
filename	string	no	—
mimeType	string	no	—
format	string	no	—
dpi	integer	no	—
range	string	no	Pages to render, such as 1-3,5. Blank renders every page, up to 24.
quality	integer	no	JPEG quality from 1 to 100. Ignored for PNG.

Protect a PDF with AES-256, or unlock one when the password is known. action is protect or unlock. password is the user password. ownerPassword is optional. permissions cover printing, copying, modifying, annotating, filling forms, accessibility, and assembly. Send base64 or a public URL. Private addresses are refused.

Parameter	Type	Required	Notes
data	string	no	PDF bytes as base64 or a data URI. Decoded size is capped at 10 MB. Provide data or url.
url	string	no	Public URL of a PDF. Private and local addresses are refused. Provide data or url.
filename	string	no	—
mimeType	string	no	—
action	string	no	—
password	string	no	User password. Required to protect or unlock. Unlock only works when this is the known password.
ownerPassword	string	no	Owner password. Blank uses the user password.
permissions	object	no	—

Convert GitHub-flavored Markdown to HTML, or HTML to Markdown. to is html or markdown. sanitize strips scripts from the text output. The conversion does not fetch a URL.

Parameter	Type	Required	Notes
text	string	no	—
to	string	no	—
sanitize	boolean	no	—

Fetch a public HTML page and return the article as Markdown, plus a title, excerpt, and o200k token count. Private and local addresses are refused. The response is capped at 800 KB.

Parameter	Type	Required	Notes
url	string	yes	Public http or https URL. Private and local addresses are refused.

Read QR codes and barcodes from an image. Send base64 or a public URL. Private addresses are refused and the decoded file is capped at 10 MB. Returns each code's text and format. An image with no code returns an empty list.

Parameter	Type	Required	Notes
file	object	yes	The image. Provide url or data.

Minify an SVG with SVGO. Send markup or a file as base64 or a public URL. Private addresses are refused and the file is capped at 10 MB. The viewBox is kept unless removeViewBox is true. Returns the optimized markup and the byte counts.

Parameter	Type	Required	Notes
svg	string	no	SVG markup. Provide svg or file.
file	object	no	An SVG file. Provide svg or file.
precision	integer	no	—
removeViewBox	boolean	no	—
removeDimensions	boolean	no	—

Read EXIF tags, including GPS, or strip them. action is read or strip. scope is all or gps. gps-only removal keeps the other JPEG tags. Other formats are re-encoded, which drops every tag. Send base64 or a public URL. Private addresses are refused and the decoded file is capped at 10 MB.

Parameter	Type	Required	Notes
file	object	yes	The photo. Provide url or data.
action	string	no	—
scope	string	no	Used when action is strip. gps removes the GPS block from a JPEG. all re-encodes and drops every tag.

Crop an image to a pixel box or a 0 to 1 ratio box. circle cuts a round mask. format is png, jpeg, or webp. Send base64 or a public URL. Private addresses are refused and the decoded file is capped at 10 MB. Returns the image as base64.

Parameter	Type	Required	Notes
file	object	yes	The image. Provide url or data.
x	number	no	—
y	number	no	—
width	number	no	—
height	number	no	—
unit	string	no	px is source pixels. ratio is a 0 to 1 share of the source.
circle	boolean	no	—
format	string	no	—

Build a favicon pack from an image or up to three letters. The ZIP contains favicon.ico, PNG sizes, a web manifest, an HTML snippet, and a Next.js metadata snippet. Letters are drawn with a built-in bitmap font so the result does not depend on a system font. Send base64 or a public URL. Private addresses are refused and the decoded file is capped at 10 MB.

Parameter	Type	Required	Notes
file	object	no	A square-or-any image. Provide file or text.
text	string	no	Up to three letters drawn as the mark. Provide file or text.
background	string	no	—
color	string	no	—
name	string	no	—

Extract text from an image with Tesseract. language defaults to eng. Other codes in the list are fetched when first used. Send base64 or a public URL. Private addresses are refused and the decoded file is capped at 10 MB. Returns the text and a confidence from 0 to 100. An image with no text returns an empty string.

Parameter	Type	Required	Notes
file	object	yes	The image. Provide url or data.
language	string	no	A Tesseract language code such as eng, spa, fra, deu, or jpn.

Remove a solid or near-solid background by flood-filling from the border. color is an optional #rrggbb. The portrait model runs in the browser, not in this handler: MODNet is Apache-2.0, RMBG-1.4 is non-commercial, and the ONNX runtime is too large for the serverless function. Send base64 or a public URL. Private addresses are refused and the decoded file is capped at 10 MB. Returns a PNG as base6

Parameter	Type	Required	Notes
file	object	yes	The image. Provide url or data.
tolerance	number	no	How far a border pixel may be from the background color, in RGB distance.
feather	boolean	no	—
color	string	no	Background color as #rgb or #rrggbb. Blank samples the corners.

Count words, code points, graphemes, sentences, and paragraphs, and compare the length with SEO and social limits.

Parameter	Type	Required	Notes
text	string	yes	Text to count.

Convert text to camelCase, snake_case, kebab-case, CONSTANT_CASE, and AP or Chicago title case. Returns every style unless one is requested.

Parameter	Type	Required	Notes
text	string	yes	Text to convert. Each line is converted on its own.
style	string	no	Return one style. Omit it to return every style.

Generate seeded lorem ipsum, or fake JSON, CSV, or SQL rows from a list of field types.

Parameter	Type	Required	Notes
mode	string	no	—
kind	string	no	—
count	integer	no	—
seed	integer	no	—
rows	integer	no	—
format	string	no	—
table	string	no	—
fields	array	no	—

Run a JavaScript regular expression against a sample and return every match, capture group, a short explanation, and an optional replacement.

Parameter	Type	Required	Notes
pattern	string	yes	JavaScript regular expression body, without slashes.
flags	string	no	—
text	string	yes	Sample to search.
replacement	string	no	When set, the sample is replaced and returned.

Format SQL for PostgreSQL, MySQL, BigQuery, Snowflake, and other dialects. Choose keyword case and an indent of 2 or 4 spaces.

Parameter	Type	Required	Notes
sql	string	yes	SQL to format.
dialect	string	no	—
keywordCase	string	no	—
indent		no	—

Infer a JSON Schema from a sample, or validate JSON against a schema. Returns error paths plus TypeScript and Zod generated from the sample.

Parameter	Type	Required	Notes
json	string	yes	JSON document to infer from or validate.
schema	string	no	JSON Schema. Omit it to infer a schema from the document.

Calculate a reducing-balance loan installment and its amortization schedule. Money is rounded half up to cents. An optional extra monthly payment reduces principal.

Parameter	Type	Required	Notes
principal	string/number	yes	Amount borrowed, such as 100000.
annualRate	string/number	yes	Annual interest rate in percent, such as 10.
months	integer	yes	Term in months.
extraMonthly	string/number	no	Extra principal paid every month.

Calculate percent of a value, what percent one number is of another, percent change, the reverse, an increase or decrease, and margin versus markup.

Parameter	Type	Required	Notes
mode	string	no	of, is, change, reverse, increase, decrease, or margin.
a	string/number	yes	First value. For of and increase, this is the percent.
b	string/number	yes	Second value. For of and increase, this is the amount.

Convert length, mass, volume, temperature, area, speed, time, and data size. Decimal bytes (kB, MB) and binary bytes (KiB, MiB) are separate categories.

Parameter	Type	Required	Notes
category	string	yes	—
from	string	yes	Source unit id, such as m, C, MB, or MiB.
to	string	yes	Target unit id from the same category.
value	string/number	yes	—
precision	integer	no	—

Query A, AAAA, MX, TXT, CNAME, and CAA for a public hostname over DNS-over-HTTPS, and parse SPF and DMARC. Private names are refused. The resolver is Cloudflare or Google.

Parameter	Type	Required	Notes
name	string	yes	Public hostname, such as example.com. Private names are refused.
types	array	no	—
resolver	string	no	—
mail	boolean	no	Also fetch the _dmarc TXT record and parse SPF.

Return the network, broadcast, host range, and host count for an IPv4 or IPv6 CIDR. Optionally test whether an address is inside it, split it, or merge it with other CIDRs.

Parameter	Type	Required	Notes
cidr	string	yes	IPv4 or IPv6 CIDR, such as 192.168.1.0/24 or 2001:db8::/32. A dotted mask may follow the address.
contains	string	no	Address to test for membership.
splitPrefix	integer	no	Longer prefix to split into, at most 256 networks.
merge	array	no	Extra CIDRs to aggregate with cidr.

Hash a password with bcrypt or argon2id, or verify a hash. Returns an htpasswd line when a username is set. The password is not stored or logged. The page in the browser never sends the password; this call only hashes the arguments you send.

Parameter	Type	Required	Notes
password	string	yes	Password to hash or verify. It is used only for this call and is not stored.
algorithm	string	no	—
cost	integer	no	Bcrypt cost factor, from 4 to 12.
iterations	integer	no	—
memory	integer	no	Argon2id memory in KiB.
parallelism	integer	no	—
username	string	no	Optional htpasswd username. A colon is not allowed.
hash	string	no	Existing bcrypt or argon2id hash. When set, the password is verified instead of hashed.

Generate an RSA, EC, or Ed25519 key pair as PEM and JWK, or convert between PEM and JWK. The private key is returned in the result and is not stored. The page in the browser generates keys locally and does not send them.

Parameter	Type	Required	Notes
action	string	no	—
alg	string	no	—
modulusLength		no	—
pem	string	no	SPKI or PKCS8 PEM to convert. Required for to_jwk.
jwk	string	no	JWK JSON to convert. Required for to_pem.

Build a Content-Security-Policy from directives, or lint an existing policy. Returns the header line, a Next.js headers() snippet, and warnings for unsafe sources.

Parameter	Type	Required	Notes
policy	string	no	An existing Content-Security-Policy value to lint. When set, directive fields are ignored.
sources	object	no	—
upgradeInsecureRequests	boolean	no	—
blockAllMixedContent	boolean	no	—

Validate sitemap XML or a public sitemap URL, including a sitemap index and a sample of HTTP statuses. Or generate a urlset from a list of URLs. Private addresses are refused and responses are size-capped.

Parameter	Type	Required	Notes
url	string	no	Public sitemap URL. Private addresses are refused.
xml	string	no	Sitemap XML. Use this or url.
urls	array	no	URLs to place in a generated sitemap. When set, url and xml are ignored.
probe	boolean	no	Request a sample of locations and report HTTP status.

Fetch a public URL, follow redirects, and grade HSTS, Content-Security-Policy, framing, nosniff, and Referrer-Policy. Private addresses are refused. The body is not stored.

Parameter	Type	Required	Notes
url	string	yes	Public http or https URL. Private addresses are refused.

Connect to a public host on port 443 and report certificate expiry, subject alternative names, protocol, and chain. Private addresses are refused. The handshake times out after 8 seconds.

Parameter	Type	Required	Notes
host	string	yes	Public hostname or https URL. Only port 443 is contacted. Private addresses are refused.

Compute RFC 4226/6238 one-time passcodes from a base32 secret. Supports 6/8 digits, SHA1/SHA256/SHA512, and custom periods.

Parameter	Type	Required	Notes
secret	string	yes	Base32 TOTP/HOTP secret
mode	string	no	—
digits		no	—
period	integer	no	TOTP period in seconds
algorithm	string	no	—
at	integer	no	Unix time in milliseconds; defaults to now
counter	integer	no	HOTP counter

Evaluate a JSONPath Plus query against a JSON document and return the matches with their paths. A number that does not fit in a JavaScript number is returned as its original digits, with a precision warning.

Parameter	Type	Required	Notes
json	string	yes	JSON document text
query	string	yes	JSONPath query, e.g. $.store.book[*].author
limit	integer	no	Maximum matches to return

Evaluate integer expressions with C-like precedence (hex/octal/binary literals, bitwise ops, shifts) and report base conversions plus signed/unsigned interpretations.

Parameter	Type	Required	Notes
expression	string	no	Integer expression, e.g. '0xFF & 0x0F \| (1 << 4)'
op	string	no	Bitwise operation (alternative to expression)
a	string	no	First operand, e.g. '0xFF' or '255'
b	string	no	Second operand (not needed for 'not')
bits	string	no	Bit width for masking and signed interpretation

AES-256-GCM encryption with PBKDF2-SHA256 key derivation. Encrypt returns a base64 bundle (salt, IV, ciphertext); decrypt reverses it.

Parameter	Type	Required	Notes
mode	string	yes	—
passphrase	string	yes	—
text	string	no	Plaintext to encrypt (encrypt mode)
bundle	string	no	Base64 bundle from a previous encryption (decrypt mode)
iterations	integer	no	—

Parse a HAR (HTTP Archive) capture and summarize it: request counts, status distribution, slowest and largest requests, top hosts, and per-request timings.

Parameter	Type	Required	Notes
har	string	yes	HAR file contents as JSON text
top	integer	no	How many slowest/largest requests and top hosts to include

Infer types from a JSON document and generate TypeScript interfaces, Zod schemas, Python Pydantic models or dataclasses, and Go structs.

Parameter	Type	Required	Notes
json	string	yes	—
rootName	string	no	—
targets	array	no	—

Minify source code with Terser (JS), csso (CSS), or a structural HTML pass and report before/after byte counts.

Parameter	Type	Required	Notes
language	string	yes	—
code	string	yes	—
jsMangle	boolean	no	—
jsCompress	boolean	no	—
cssLevel		no	—
htmlAggressive	boolean	no	—

Parse a curl command and generate equivalent JavaScript fetch, Python requests, Go, PHP, or Rust code.

Parameter	Type	Required	Notes
command	string	yes	—
target	string	no	—

Send a GraphQL query with optional variables and headers to a public http or https endpoint on port 80 or 443 and return the response data or errors. Local, private, and internal addresses are refused.

Parameter	Type	Required	Notes
endpoint	string	yes	—
query	string	yes	—
variables	object	no	—
headers	object	no	—
timeoutMs	integer	no	—

Validate and parse a ws:// or wss:// URL into its components, and optionally decode a WebSocket close code.

Parameter	Type	Required	Notes
url	string	yes	—
explainCloseCode	integer	no	—

Build a resume PDF from profile, experience, education, and skills. A name plus at least one experience, education, or skills entry is required. Choose the clean, modern, or compact template. Returns the A4 PDF as base64.

Parameter	Type	Required	Notes
resume	object	yes	—
template	string	no	—

Build an invoice or quote PDF from company and client details, line items with quantities and rates, a tax rate, and an optional percent or flat discount. All money is computed in integer cents, so there are no float rounding errors. Returns the PDF as base64 plus the total.

Parameter	Type	Required	Notes
invoice	object	yes	—

Stamp a PNG signature image onto one or more PDF pages at given positions (fractions of the page, x and y measured from the top-left, width as a fraction of page width). The signature keeps its aspect ratio. Returns the signed PDF as base64.

Parameter	Type	Required	Notes
file	object	yes	The PDF to sign.
signature	object	yes	The signature as a PNG image, base64 or a public URL.
placements	array	yes	—

Crop and resize an image to an exact social media preset: instagram-post (1080x1080), instagram-portrait (1080x1350), instagram-story (1080x1920), youtube-thumbnail (1280x720), x-post (1200x675), x-header (1500x500), linkedin-post (1200x627), or facebook-post (1200x630). The cover crop keeps the center subject. Send base64 or a public URL. Private addresses are refused and the decoded file is capp

Parameter	Type	Required	Notes
file	object	yes	The image. Provide url or data.
preset	string	yes	Social platform preset with exact pixel dimensions.

Trim a WAV audio file to a time range with optional fade in and out, returning a 16-bit PCM WAV as base64. Only WAV is accepted; the web UI handles MP3/OGG/M4A.

Parameter	Type	Required	Notes
file	object	yes	—
startSec	number	yes	Trim start in seconds.
endSec	number	yes	Trim end in seconds, after startSec.
fadeInSec	number	no	Linear fade-in length in seconds.
fadeOutSec	number	no	Linear fade-out length in seconds.

Convert money between ISO 4217 currencies using live exchange rates from the Frankfurter API, fetched through the SSRF-safe outbound guard. Supports historical dates.

Parameter	Type	Required	Notes
amount	number	no	—
from	string	no	ISO 4217 currency code.
to	string	no	ISO 4217 currency code.
date	string	no	Historical date; omit for the latest rates.

Render a classic top/bottom-caption meme as a PNG. Give it an image (base64, data URI, or public URL) or pick a gradient style, and it returns captioned meme artwork.

Parameter	Type	Required	Notes
image	object	no	Base image as base64, a data URI, or a public URL. Private addresses are refused. 10 MB cap. Omit to use a gradient style background.
styleId	string	no	Gradient style id when no image is given: sunset, ocean, grape, forest, mono, candy. Default: sunset.
top	string	no	—
bottom	string	no	—
upper	boolean	no	Uppercase captions, classic meme style.
fontScale	number	no	Caption size multiplier.

Create a ZIP archive from files or list and extract the contents of a ZIP archive. Everything is handled in memory; no files are stored.

Parameter	Type	Required	Notes
mode	string	no	—
files	array	no	Files to zip (zip mode).
archive	object	no	Archive to extract (unzip mode).

Arrange up to 9 photos into a collage layout (duo, trio, focus, quad, six, nine) with a gap and background color, and get back a square PNG.

Parameter	Type	Required	Notes
images	array	yes	Photos as base64, data URIs, or public URLs. Private addresses are refused. 10 MB cap each.
layout	string	no	Layout id: duo, duo-stack, trio, focus, quad, six, nine. Unknown ids fall back to quad.
gap	integer	no	Gap between cells in pixels.
background	string	no	—
width	integer	no	Output width in pixels; the collage is square.

Fill an interactive PDF form's text fields, checkboxes, dropdowns, and radios by field name, with an option to flatten the result. Pass inspectOnly to list the fields first.

Parameter	Type	Required	Notes
file	object	yes	PDF as base64, a data URI, or a public URL. Private addresses are refused. 10 MB cap.
values	object	no	Field name to value. Checkboxes take booleans; dropdowns and radios take one of their options.
flatten	boolean	no	Flatten the form so fields become plain page content.
inspectOnly	boolean	no	List the form fields without changing anything.

Free

$0 forever

Every tool — any call limit is its publisher’s, not ours
No card, and mcprush charges nothing for it
Runs at its publisher’s own address — this marketplace is not in the path
Nothing to cap, because mcprush bills nothing

Nothing here is billable: mcprush charges nothing to install Benchline or to call it, at any volume.

BTool-list grade · score 84 / 100

Release 0.1.1 · scanned 20 Oct 2026

Graded from the tools this server lists, not from its source code.

Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.

Threat score98

Client score84

Findings2 threat · 20 capability

Capabilitycritical

Coveragemanifest

Verificationnot in this report

Surface digest85a5a9b8b7126966a95166d59c5397e32324bc4e070ad06252f792395978aa5d

Score vectorthreat 98 → client 84

Term	Level	What it prices	Points
capability-exposure	critical	capability blast radius (critical) — client exposure if the model is manipulated	−10
coverage-honesty	manifest	inspection depth (manifest) — how much of the target the scan could see	−4

score = clamp(round(threatScore − E_cap − E_ver − E_cov), 0, 100). No model, no opinion, no network call at scoring time: the same methodology version against the same bytes always produces this number, and every line above is a field of the report rather than a summary of it.

What the scan could actually read

A grade is only as meaningful as its coverage, so the scanner publishes its own depth before it publishes its result.

The scan read each tool’s name, description, input schema and annotations exactly as the server listed them the last time it answered us; no code was reviewed. We ask the server again about once a month, and a list that changed is graded again.

Tool surfaceread

Implementation sourcenot available

Package metadatanot available

Live transportnot available

The implementation source was not read — this reflects the declared tool metadata only.

Capability — what it could do if the model were manipulated

Tags derived from each tool’s schema and the implementation, not from what the tool calls itself. critical is the level these add up to.

Tool	Capability tags	Why the tag was assigned
generate_llms_txt	no tags
score_ai_seo	untrusted-input	untrusted-input: keyword "fetch", declares openWorldHint: true (interacts with entities outside the server)
build_open_graph	code-exec	code-exec: parameter "command"
list_og_templates	no tags
decode_jwt	no tags
check_robots_txt	untrusted-input	untrusted-input: keyword "fetch", declares openWorldHint: true (interacts with entities outside the server)
inspect_meta_tags	untrusted-input	untrusted-input: keyword "fetch", declares openWorldHint: true (interacts with entities outside the server)
build_json_ld	no tags
count_tokens	no tags
explain_cron	no tags
build_nextjs_dockerfile	no tags
format_json	no tags
convert_data_format	no tags
convert_csv_json	no tags
diff_text	no tags
base64_codec	no tags
convert_image	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
compress_image	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
resize_image	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
convert_color	no tags
convert_unix_timestamp	no tags
date_difference	no tags
hash_data	no tags
generate_uuid	no tags
url_codec	no tags
generate_password	no tags
explain_chmod	no tags
merge_pdf	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
split_pdf	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
compress_pdf	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
images_to_pdf	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
generate_qr_code	no tags
extract_pdf_text	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
organize_pdf	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
render_pdf_pages	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
protect_pdf	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
convert_markdown_html	no tags
fetch_page_markdown	untrusted-input	untrusted-input: keyword "fetch", declares openWorldHint: true (interacts with entities outside the server)
read_barcode	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
optimize_svg	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
read_exif	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
crop_image	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
generate_favicon	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
read_image_text	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
remove_background	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
count_text	no tags
convert_case	no tags
generate_fake_data	no tags
test_regex	no tags
format_sql	sensitive-source	sensitive-source: parameter "sql"
validate_json_schema	no tags
calculate_emi	no tags
calculate_percentage	no tags
convert_units	no tags
lookup_dns	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
calculate_cidr	no tags
hash_password	no tags
generate_keypair	no tags
build_csp	no tags
validate_sitemap	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
check_http_headers	untrusted-input	untrusted-input: keyword "fetch", declares openWorldHint: true (interacts with entities outside the server)
check_ssl	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
generate_totp	no tags
query_jsonpath	no tags
calculate_programmer	no tags
aes_crypt	no tags
analyze_har	no tags
convert_json_to_types	no tags
minify_code	no tags
convert_curl	external-sinkcode-exec	external-sink: keyword "curl"; code-exec: parameter "command"
execute_graphql	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
validate_websocket_url	no tags
generate_resume	no tags
generate_invoice	no tags
sign_pdf	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
resize_social_image	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
trim_audio	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
convert_currency	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
generate_meme	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
zip_files	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
make_collage	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
fill_pdf_form	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)

Toxic-flow graph

The lethal trifecta, checked as a graph rather than as a checklist: untrusted input, a sensitive source and an external sink have to meet before there is a path worth worrying about.

check_http_headers → format_sql → build_open_graph

A cross-tool exfiltration chain exists: check_http_headers → format_sql ⇒ build_open_graph.

Supply chain and provenance

Integrityfirst-seen

Surface digest85a5a9b8b7126966

Scanned2026-10-20

This is the first scan of this surface here, so there is nothing yet to compare it against.

Every result on this tab comes from one deterministic pass over the published package — offline, rule by rule, and auditable line by line above. Same methodology version, same bytes, same score.

Where are you running it?

Tool surface

Release history

Benchline MCP

What it does

Quickstart

Where are you running it?

Tool surface

What counts against your monthly calls

What the scan could actually read

Capability — what it could do if the model were manipulated

Toxic-flow graph

Supply chain and provenance

Release history

See also