Name: Highland Intel APIs
Author: highlnd-intel

Highland Intel APIs MCP

70 pay-per-call APIs: DNS, email auth, security headers, web search, scraping, AI. x402 USDC/Base

Tool-list grade A Remote · Streamable HTTP No auth needed 70 tools v1.0.0

No reviews yet by highlnd-intel The publisher’s own endpoint — this marketplace is not in the path

90/100

tool-list score

tools declared

remote

at its publisher

—

calls last 7d

What it does

70 pay-per-call APIs: DNS, email auth, security headers, web search, scraping, AI. x402 USDC/Base

Quickstart

# 1 — add it to Claude Code
claude mcp add --scope user --transport http highland-intel-apis-mcp https://api.highlnd-intel.group/mcp

# 2 — ask your agent for something these tools do
#   dns-lookup, mail-auth, header-audit and 67 more

Highland Intel APIs costs nothing on mcprush: there is no plan to choose here, no cap to set and nothing mcprush can bill you for.

Publishernot claimed

highlnd-intel1 server

1 category

All 1 server

Collected from a public index. Nobody has claimed this account, so nothing here was written by its author — claim it if it is yours.

Tool surface

What the model actually sees. Descriptions are diffed on every release — see version history.

Only tools that write or reach the network

A, AAAA, MX, NS and TXT records for a domain over DNS-over-HTTPS. Returns { domain, records: { A, AAAA, MX, NS, TXT } }: each record type as a list of strings. Price: 2 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing.

Parameter	Type	Required	Notes
domain	string	yes	Public domain name, e.g. example.com; IP literals and private suffixes (.local, .internal, .lan, .corp) are refused.

SPF and DMARC presence and policy strength for a domain. Returns { domain, spf, dmarc, dmarcPolicy, findings, pass }: the SPF and DMARC records, the DMARC policy and finding codes. Price: 3 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing.

Parameter	Type	Required	Notes
domain	string	yes	Public domain name, e.g. example.com; IP literals and private suffixes (.local, .internal, .lan, .corp) are refused.

Which security headers a site's HTTPS front page sends, with a simple grade. Returns { domain, status, present, missing, grade, server }: security headers sent and missing, and a grade A, B, C or F. Price: 3 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing.

Parameter	Type	Required	Notes
domain	string	yes	Public domain name, e.g. example.com; IP literals and private suffixes (.local, .internal, .lan, .corp) are refused.

Whether plain HTTP redirects to HTTPS, and whether HSTS is set. Returns { domain, redirectsToHttps, hsts, hstsMaxAge, hstsStrong }: HTTP-to-HTTPS redirect and HSTS status. Price: 2 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing.

Parameter	Type	Required	Notes
domain	string	yes	Public domain name, e.g. example.com; IP literals and private suffixes (.local, .internal, .lan, .corp) are refused.

Fetches /.well-known/security.txt and reports Contact and Expires (RFC 9116). Returns { domain, present, hasContact, expires, expired }: whether security.txt exists, has a Contact and has expired. Price: 2 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing.

Parameter	Type	Required	Notes
domain	string	yes	Public domain name, e.g. example.com; IP literals and private suffixes (.local, .internal, .lan, .corp) are refused.

Three-bullet summary of up to 8,000 characters. Input is PII-redacted first. Returns { summary }: up to three short bullet points as one string. Price: 4 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing.

Parameter	Type	Required	Notes
text	string	yes	Text to process, 1 to 8,000 characters. Emails, phone numbers, card numbers, SINs and IPv4s are redacted before the model sees it.

Picks one label from your list (2 to 20 labels) for a piece of text. Returns { label, labels }: the chosen label (one of yours, or null if none fit) and the labels sent. Price: 3 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing.

Parameter	Type	Required	Notes
text	string	yes	Text to process, 1 to 8,000 characters. Emails, phone numbers, card numbers, SINs and IPv4s are redacted before the model sees it.
labels	array	yes	Candidate labels, 2 to 20, each 1 to 40 characters; the answer is always one of these or null.

Translates text between languages; defaults to English to French for NS/NB customers. Returns { translated, source, target }: the translated text and the language pair used. Price: 4 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing.

Parameter	Type	Required	Notes
text	string	yes	Text to process, 1 to 8,000 characters. Emails, phone numbers, card numbers, SINs and IPv4s are redacted before the model sees it.
source	string	no	ISO 639-1 two-letter lower-case language code of the input text.
target	string	no	ISO 639-1 two-letter lower-case language code to translate into.

Strips emails, phone numbers, card numbers, SINs and IPv4s. Runs locally, no model. Returns { text, counts }: the redacted text with [EMAIL]-style placeholders and a count per kind (email, card, sin, phone, ip). Price: 1 credit (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing.

Parameter	Type	Required	Notes
text	string	yes	Text to redact, up to 32,000 characters.
ip	boolean	no	Also redact IPv4 addresses.

Word, sentence and character counts, reading time and a Flesch reading-ease score. Returns { characters, words, sentences, readingMinutes, fleschReadingEase }. Price: 1 credit (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing.

Parameter	Type	Required	Notes
text	string	yes	Text to measure, up to 64,000 characters.

Validates a JSON value against a JSON-Schema subset and lists every error path. Returns { valid, errors }: true when the value matches, and one message per error path (up to 50). Price: 1 credit (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing.

Parameter	Type	Required	Notes
schema	object	yes	JSON Schema subset to check against: type, required, properties, items, enum, minimum, maximum, minLength, maxLength.
value		yes	Any JSON value to validate (object, array, string, number, boolean or null).

Runs a JavaScript regex over sample text and returns matches and groups (capped sizes). Returns { count, matches }: up to 100 matches, each { match, index, groups }. Price: 1 credit (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing.

Parameter	Type	Required	Notes
pattern	string	yes	JavaScript regular expression source, without slashes, up to 200 characters.
flags	string	no	Regex flags from g, i, m, s, u, y; g is always added.
text	string	yes	Sample text to search, up to 2,000 characters.

Explains a 5-field cron expression in plain English (UTC, as Cloudflare runs it). Returns { cron, explanation }: the expression and a plain-English reading of it. Price: 1 credit (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing.

Parameter	Type	Required	Notes
cron	string	yes	Five-field cron expression (minute hour day-of-month month day-of-week), read as UTC like Cloudflare Cron Triggers.

Line-by-line diff of two texts (up to 500 lines each). Returns { added, removed, diff }: line counts and the diff lines prefixed with space, - or +. Price: 2 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing.

Parameter	Type	Required	Notes
a	string	yes	Original text, up to 32,000 characters and 500 lines.
b	string	yes	Changed text, up to 32,000 characters and 500 lines.

SHA-1/256/384/512 hex digest of UTF-8 text. Returns { algorithm, hex }: the lower-case hex digest. Price: 1 credit (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing.

Parameter	Type	Required	Notes
text	string	yes	Text to hash as UTF-8, up to 64,000 characters.
algorithm	string	no	Digest algorithm.

Adds 14% NS HST to a subtotal, or splits a tax-included total. Confirm the rate with CRA. Returns { subtotalCents, hstCents, totalCents, rate }. Price: 1 credit (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing.

Parameter	Type	Required	Notes
amountCents	integer	yes	Pre-tax subtotal, or the tax-included total when included is true. Integer CAD cents.
rate	number	no	HST rate as a fraction (0.14 is the Nova Scotia rate).
included	boolean	no	amountCents already includes HST: split it instead of adding to it.

Totals line items, applies a discount and HST, and computes a deposit. No customer details taken. Returns { lines, grossCents, discountCents, subtotalCents, hstCents, totalCents, rate, depositCents }. Price: 5 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing.

Parameter	Type	Required	Notes
items	array	yes	Line items, 1 to 100.
discountPct	number	no	Discount on the gross total, in percent.
depositPct	number	no	Deposit as a percent of the tax-included total.

Formats PREFIX-YYYYMM-NNNNN-C with a Luhn check digit, or validates one. Returns { invoice } when formatting, or { valid } when validating. Price: 1 credit (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing.

Parameter	Type	Required	Notes
validate	string	no	An invoice number to check instead of formatting one; when given, the other fields are ignored.
prefix	string	no	Two to six upper-case letters.
sequence	integer	no	Invoice sequence number. Required unless validate is given.
yyyymm	string	no	Year and month as YYYYMM; defaults to the current UTC month.

One HTTPS probe of a public domain: status, latency and whether it looks up. Returns { domain, up, status, ms }: up is true for any status below 500; status is null when the host does not answer. Price: 2 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing.

Parameter	Type	Required	Notes
domain	string	yes	Public domain name, e.g. example.com; IP literals and private suffixes (.local, .internal, .lan, .corp) are refused.
path	string	no	Path to probe, starting with /, letters, digits, _ . / - only.

Neural or keyword web search with highlights, for agents. Up to 10 results, public URLs only. Returns { query, results: [{ title, url, publishedDate, score, highlights }] }: up to 10 results, each with up to 3 highlights of 500 characters. Price: 8 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing.

Parameter	Type	Required	Notes
query	string	yes	Search query, 1 to 500 characters.
numResults	integer	no	Results to return, 1 to 10.
type	string	no	Search mode: auto (default), neural (semantic) or fast.
includeDomains	array	no	Only return results from these domains (up to 20).
excludeDomains	array	no	Never return results from these domains (up to 20).
startPublishedDate	string	no	Only pages published on or after this date (YYYY-MM-DD, UTC).

Clean text of up to 5 public pages, capped per page, for agents to read. Returns { results: [{ url, title, publishedDate, text, characters }] }: one entry per page the provider could read. Price: 6 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing.

Parameter	Type	Required	Notes
urls	array	yes	1 to 5 public http(s) URLs.
maxCharacters	integer	no	Text kept per page, 500 to 10,000 characters.

Pages similar in meaning to a given public URL, with highlights. Up to 10 results. Returns { url, results: [{ title, url, publishedDate, score, highlights }] }. Price: 8 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing.

Parameter	Type	Required	Notes
url	string	yes	Public http(s) URL. Private, loopback, link-local and metadata addresses, internal hostnames and this service's own hosts are refused.
numResults	integer	no	Results to return, 1 to 10.
excludeSourceDomain	boolean	no	Leave out pages from the same domain as the URL (default true).

Main content of one public page as Markdown (up to 50,000 characters), with title and status. Returns { url, finalUrl, title, description, statusCode, markdown, characters, truncated }. Price: 7 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing.

Parameter	Type	Required	Notes
url	string	yes	Public http(s) URL. Private, loopback, link-local and metadata addresses, internal hostnames and this service's own hosts are refused.
maxChars	integer	no	Markdown kept, 1,000 to 50,000 characters.

Discovers the URLs of a public site (up to 200), optionally ranked by a search term. Returns { url, count, links }: up to 200 unique public URLs. Price: 6 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing.

Parameter	Type	Required	Notes
url	string	yes	Public http(s) URL. Private, loopback, link-local and metadata addresses, internal hostnames and this service's own hosts are refused.
search	string	no	Optional term to rank and filter links by, up to 200 characters.
limit	integer	no	Links to return, 1 to 200.
includeSubdomains	boolean	no	Also include links on subdomains of the site.

Scrapes a public page and fills your flat schema (up to 20 typed fields) from it. Values are type-checked. Returns { url, finalUrl, title, data, missing }: one value per field (typed, or null when the page does not say) and the required fields that came back null. Price: 10 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing.

Parameter	Type	Required	Notes
url	string	yes	Public http(s) URL. Private, loopback, link-local and metadata addresses, internal hostnames and this service's own hosts are refused.
schema	object	yes	Flat JSON Schema of what to extract: { type: "object", properties: { <name>: { type: string\|number\|integer\|boolean, description?, enum? } }, required? }. 1 to 20 fields; names match ^[A-Za-z_][A-Za-z0

Profiles one public page: title, summary, organisations and other entities, topics, sentiment and public contact points. Returns { url, finalUrl, title, summary, entities: [{ text, type }], topics, sentiment: { label, score }, contact_points: { emails, phones, pages, social } }. Only role mailboxes (info@, sales@ ...) are returned. Price: 12 credits (1 credit = 1 CAD cent) per successful call; inp

Parameter	Type	Required	Notes
url	string	yes	Public http(s) URL. Private, loopback, link-local and metadata addresses, internal hostnames and this service's own hosts are refused.

Company profile from public web sources: name, description, industry, recent signals and the sources used. Returns { name, domain, description, industry, signals, sources: [{ url, title }] }: up to 5 signals and 8 sources. Organisations only, never people. Price: 14 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing.

Parameter	Type	Required	Notes
domain	string	yes	Public domain name, e.g. example.com; IP literals and private suffixes (.local, .internal, .lan, .corp) are refused.

Named entities of fixed types (person, organization, location, product, event, date, money, law, technology), each found verbatim in your text. Returns { entities: [{ text, type }], counts }: up to 50 entities, each present in the (redacted) text, and a count per type. Price: 10 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing.

Parameter	Type	Required	Notes
text	string	yes	Text to analyse, 1 to 8,000 characters. Emails, phone numbers, card numbers, SINs and IPv4s are redacted first.
types	array	no	Entity types to return; default all nine.

Key phrases of your text, each found verbatim in it; falls back to a frequency ranking if the model answer is unusable. Returns { keywords, source }: up to max phrases and whether they came from the model or the frequency fallback. Price: 10 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing.

Parameter	Type	Required	Notes
text	string	yes	Text to analyse, 1 to 8,000 characters. Emails, phone numbers, card numbers, SINs and IPv4s are redacted first.
max	integer	no	Keywords to return, 1 to 25.

Positive, negative or neutral, with a score from -1 to 1, from a sentiment classifier over up to 8,000 characters. Returns { label, score, positive, negative, chunks }: label is positive, negative or neutral (below 0.6 confidence); score is positive minus negative. Price: 10 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing.

Parameter	Type	Required	Notes
text	string	yes	Text to analyse, 1 to 8,000 characters. Emails, phone numbers, card numbers, SINs and IPv4s are redacted first.

Says whether an IPv4 or IPv6 address is in Cloudflare's published edge ranges, and which range. Returns { ip, version, cloudflare, range, rangesAsOf }: range is the matching CIDR or null. Price: 1 credit (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing.

Parameter	Type	Required	Notes
ip	string	yes	IPv4 (dotted quad) or IPv6 address, without a port or zone id.

Lints a wrangler.jsonc or wrangler.toml: name, entry point, compatibility date, secrets left in vars, routes. Returns { ok, format, findings[{ severity: error|warning|info, code, path, message }] and counts { error, warning, info } }. Values are never echoed, only paths. Price: 2 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing.

Parameter	Type	Required	Notes
config	string	yes	The wrangler.jsonc, wrangler.json or wrangler.toml text, up to 60,000 characters.
format	string	no	Config format; auto treats text starting with { as JSONC, otherwise TOML.

Checks a cron expression against Cloudflare Cron Trigger syntax, explains it, lists the next runs and gives the wrangler snippet. Returns { valid, cron, errors, warnings, explanation, nextRuns (up to 5 ISO times, standard syntax only), snippets { jsonc, toml } }. Price: 1 credit (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing.

Parameter	Type	Required	Notes
cron	string	yes	Cron expression. Cloudflare uses 5 fields in UTC, weekdays 1 to 7 with 1 = Sunday (or SUN-SAT), and allows L, W and #.

Validates a Claude Code .mcp.json: transports, commands, URLs, headers and env, and flags literal secrets by path. Returns { ok, servers[{ name, transport }], findings[{ severity: error|warning|info, code, path, message }] and counts { error, warning, info } }. Values are never echoed. Price: 2 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected be

Parameter	Type	Required	Notes
config		yes	The config as a JSON string (comments and trailing commas allowed) or as an object, up to 60,000 characters.

Lints a CLAUDE.md: size, structure, @imports, and secrets, passwords or email addresses that should not be there. Returns { ok, stats { characters, lines, approxTokens, headings, imports }, findings[{ severity: error|warning|info, code, path, message }] and counts { error, warning, info } }. Paths are line numbers. Price: 2 credits (1 credit = 1 CAD cent) per successful call; input that does not m

Parameter	Type	Required	Notes
text	string	yes	The CLAUDE.md text, up to 60,000 characters.

Validates a Claude Code hooks block (or a whole settings.json): events, matchers, hook types, timeouts and risky commands. Returns { ok, events, hookCount, findings[{ severity: error|warning|info, code, path, message }] and counts { error, warning, info } }. Price: 2 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing.

Parameter	Type	Required	Notes
config		yes	The config as a JSON string (comments and trailing commas allowed) or as an object, up to 60,000 characters.

Writes a ready-to-save Claude Code slash command file with frontmatter, $ARGUMENTS and a step outline. Returns { path, content, usage }: save content at path (.claude/commands/<name>.md). Price: 1 credit (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing.

Parameter	Type	Required	Notes
name	string	yes	Command name: lowercase letters, digits and -, up to 40 characters.
description	string	yes	One-line description shown in the / menu.
argumentHint	string	no	Optional hint for the arguments, e.g. [file] [focus].
allowedTools	array	no	Optional tool rules the command may use, e.g. Read or Bash(git diff:*).

Estimated token counts for cl100k-like, o200k-like, Claude-like and Llama-like tokenizers plus a char/4 baseline. Deterministic estimates, not exact counts. Returns { estimates: { cl100k, o200k, claude, llama, char4 }, chars, bytes, pieces, method, exact: false } Price: 1 credit (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing.

Parameter	Type	Required	Notes
text	string	yes	Text to count, up to 60,000 characters.

Splits text for retrieval by estimated tokens, sentences or markdown headings, with token overlap and stable SHA-256 chunk ids. Returns { chunks: [{ id (sha-256 hex of the chunk text), index, text, tokens, start, end, heading? }], count, mode, size, overlap, family, method } Price: 2 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billin

Parameter	Type	Required	Notes
text	string	yes	Text or markdown to chunk, up to 60,000 characters.
mode	string	no	Split by estimated tokens, by sentence boundaries, or by markdown heading sections (each chunk carries its heading).
size	integer	no	Target maximum estimated tokens per chunk, 32 to 4000.
overlap	integer	no	Estimated tokens repeated from the end of one chunk at the start of the next; must be under half of size.
family	string	no	Tokenizer family used for counts: cl100k, o200k, claude or llama (all estimates).

Checks chat (OpenAI-style), messages (Anthropic-style) or Alpaca JSONL: per-line errors, role order, empty turns, duplicates, token estimates and a training-cost estimate from your price. Returns { format, lines, valid, invalid, ok, errors: [{ line, code, message }] (first 100), errorCount, errorsTruncated, duplicates: [{ line, firstLine }], duplicateCount, tokens: { total, mean, max }, costEstima

Parameter	Type	Required	Notes
jsonl	string	yes	JSONL: one JSON object per line, up to 60,000 characters and 5,000 lines. Blank lines are ignored.
format	string	no	openai (messages with system/user/assistant/tool), anthropic (top-level system + user/assistant messages), alpaca (instruction/input/output), or auto to detect from the first parseable row.
pricePerMillionTokens	number	no	Optional: your training price per million tokens, used only for costEstimate (any currency).
epochs	integer	no	Training epochs for the cost estimate, 1 to 50.

Converts JSONL between OpenAI-style chat, Anthropic-style messages and Alpaca rows. System prompts move between the system message and the top-level field; rows that cannot convert are listed. Returns { from, to, converted, skippedCount, skipped: [{ line, reason }], jsonl } Price: 2 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing

Parameter	Type	Required	Notes
jsonl	string	yes	JSONL: one JSON object per line, up to 60,000 characters and 5,000 lines. Blank lines are ignored.
from	string	no	openai (messages with system/user/assistant/tool), anthropic (top-level system + user/assistant messages), alpaca (instruction/input/output), or auto to detect from the first parseable row.
to	string	yes	Target format: openai, anthropic or alpaca (alpaca takes single user/assistant exchanges only).

Deterministic seeded shuffle and train/val/test split of JSONL rows. The same seed and input always give the same split. Returns { seed, ratios, counts: { train, val, test, skipped }, train, val, test } (each split as JSONL) Price: 1 credit (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing.

Parameter	Type	Required	Notes
jsonl	string	yes	JSONL: one JSON object per line, up to 60,000 characters and 5,000 lines. Blank lines are ignored.
seed	string	no	Shuffle seed; any string.
train	number	no	Share of rows for train. train + val + test must equal 1.
val	number	no	Share of rows for validation.
test	number	no	Share of rows for test.

Embeds 1 to 16 short texts with the fixed Workers AI model @cf/baai/bge-base-en-v1.5 (768 dimensions) for search and clustering. Returns { model, dimensions, count, vectors: number[][] } Price: 3 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing.

Parameter	Type	Required	Notes
inputs	array	yes	1 to 16 texts, each up to 2000 characters.

Ranks up to 15 candidate texts by cosine similarity to a query, using @cf/baai/bge-base-en-v1.5 embeddings. Returns { model, ranked: [{ index, score }] (highest first), scores: number[] (input order) } Price: 3 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing.

Parameter	Type	Required	Notes
query	string	yes	Query text, up to 2000 characters.
candidates	array	yes	1 to 15 candidate texts, each up to 2000 characters.

Flags prompt-injection phrasing, chat-template tokens, hidden characters, PII and secrets per line, and lists {{variables}}. Rule-based, no model call; flagged text is never echoed. Returns { ok, findings: [{ kind, severity, line, detail }], counts: { high, medium, low }, variables } Price: 1 credit (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected befor

Parameter	Type	Required	Notes
prompt	string	yes	Prompt or template text to check, up to 60,000 characters.

Decodes a JWT header and payload without verifying it, with warnings for alg none, missing or past exp, future nbf/iat and risky header fields. Returns { header, payload, signatureBytes, times: { exp, nbf, iat, expired }, verified: false, warnings, note } Price: 1 credit (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing.

Parameter	Type	Required	Notes
token	string	yes	Compact JWS (header.payload.signature). It is decoded only; do not send production tokens you cannot rotate.

Splits a URL into scheme, host, port, path segments, query (repeated keys as arrays) and fragment, with warnings for credentials, plain http and punycode. Passwords are never echoed. Returns { href, protocol, username, hasPassword, hostname, port, pathname, pathSegments, query, hash, origin, isIp, warnings } Price: 1 credit (1 credit = 1 CAD cent) per successful call; input that does not match the

Parameter	Type	Required	Notes
url	string	yes	Absolute URL to parse. It is not fetched.

Encodes UTF-8 text to standard or url-safe base64, or decodes either form; binary results that are not valid UTF-8 come back as hex. Returns encode: { base64, variant, bytes } · decode: { text | null, hex | null, utf8, bytes } Price: 1 credit (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing.

Parameter	Type	Required	Notes
mode	string	yes	encode turns text into base64; decode turns base64 into text (or hex).
data	string	yes	Text to encode, or base64 (standard or url-safe, padding optional) to decode.
variant	string	no	Output alphabet when encoding: standard (+/ and padding) or url (-_ without padding).

Generates 1 to 100 random v4 or time-ordered v7 UUIDs (RFC 9562) from Web Crypto. Returns { version, uuids: string[] } Price: 1 credit (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing.

Parameter	Type	Required	Notes
version	integer	no	4 for random, 7 for Unix-ms time-ordered (sortable, good for database keys).
count	integer	no	How many UUIDs, 1 to 100.

Identifies browser, engine, OS, device class and known crawlers, AI bots and HTTP clients from a User-Agent string. Rule-based; user agents can be spoofed. Returns { browser: { name, version }, engine, os: { name, version }, device, isBot, bot } Price: 1 credit (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing.

Parameter	Type	Required	Notes
userAgent	string	yes	The User-Agent header value.

Sends a GET with an Origin header (and an OPTIONS preflight for non-simple methods, custom headers or credentials) to a public URL and reports the Access-Control-* headers with an allowed/blocked verdict. Returns { url, finalUrl, origin, status, preflight: { status } | null, headers: { acao, acac, acam, acah, vary }, allowed, issues } Price: 2 credits (1 credit = 1 CAD cent) per successful call; i

Parameter	Type	Required	Notes
url	string	yes	Public http(s) URL. Private, loopback, link-local, metadata and our own hosts are refused.
origin	string	no	Origin the browser would send, e.g. https://app.example.com.
method	string	no	Method the browser call would use; non-simple methods trigger a preflight.
requestHeaders	array	no	Request header names the call would send (triggers a preflight when non-empty).
credentials	boolean	no	Whether the call sends cookies or auth (credentials: include).

Checks an OpenAPI 3.0/3.1 document (as JSON): version, info, paths, responses, unique operationIds, declared path parameters and unresolved local $refs. Returns { valid, version, operations, refs, unresolvedRefs, errors: [{ path, message }], warnings: [{ path, message }] } Price: 2 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing.

Parameter	Type	Required	Notes
spec	object	yes	The OpenAPI document as a JSON object (convert YAML first). Request bodies are capped at 64 KiB.

Name, meaning, class, retryability and default cacheability of an HTTP status code, including Cloudflare's 52x codes. Returns { code, name, meaning, class, known, retryable, cacheableByDefault } Price: 1 credit (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing.

Parameter	Type	Required	Notes
code	integer	yes	Status code, 100 to 599.

Fetches a public page (first 512 KB) and returns its link-preview metadata: title, description, image, Open Graph and Twitter tags, canonical URL, icons and missing tags. Returns { url, finalUrl, status, title, description, image, siteName, canonical, icons, lang, og, twitter, missing, truncated } Price: 3 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is

Parameter	Type	Required	Notes
url	string	yes	Public http(s) URL. Private, loopback, link-local, metadata and our own hosts are refused.

Reviews a code snippet and returns concrete issues (bugs, security, performance, style) with severity and a fix for each. Returns { language, summary, issues: [{ severity, line, issue, fix }] } Price: 4 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing.

Parameter	Type	Required	Notes
code	string	yes	Source code to review, up to 6,000 characters.
language	string	no	Language name, or omit to auto-detect.

Turns a unified diff into a Conventional Commits message: type, scope, subject and body. Returns { message, type, scope, subject, body } Price: 2 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing.

Parameter	Type	Required	Notes
diff	string	yes	Unified diff (git diff output), up to 7,000 characters.

Writes a JavaScript regex from a plain-English description, compiles it, and tests it against your sample strings. Returns { pattern, flags, literal, explanation, tests: [{ input, expected, got }], passed, total } Price: 3 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing.

Parameter	Type	Required	Notes
description	string	yes	What the regex should match, in plain English.
should_match	array	no	Strings that must match.
should_not_match	array	no	Strings that must not match.

Explains a SQL query step by step and flags performance and safety risks, with index suggestions. Returns { summary, steps, risks, index_suggestions } Price: 2 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing.

Parameter	Type	Required	Notes
sql	string	yes	One SQL statement, up to 5,000 characters. It is not executed.

Sorts versions by SemVer 2.0 precedence, returns the latest stable and pre-release, and the next major, minor and patch. Returns { sorted, latest_stable, latest, invalid, next: { major, minor, patch, from } } Price: 1 credit (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing.

Parameter	Type	Required	Notes
versions	array	yes	Version strings, optionally v-prefixed.

Fetches a public page and returns clean, LLM-ready Markdown of the main content, with title, word and link counts. No third-party scraper. Returns { url, title, words, links, truncated, markdown } Price: 3 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing.

Parameter	Type	Required	Notes
url	string	yes	Public http(s) URL to fetch. Private and internal hosts are refused.
max_chars	integer	no	Markdown kept, default 20,000.

Pulls the fields you name out of free text (emails, invoices, tickets) and returns strict JSON, null when a field is absent. Returns { data: { <field>: value | null }, found, total } Price: 3 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing.

Parameter	Type	Required	Notes
text	string	yes	Source text, up to 6,000 characters.
fields	array	yes	Field names to extract.

Builds ready-to-paste tool definitions for Anthropic, OpenAI and MCP from a compact parameter spec. Returns { anthropic, openai, mcp } Price: 1 credit (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing.

Parameter	Type	Required	Notes
name	string	yes	Tool name.
description	string	yes	What the tool does.
params	object	no	Map of parameter name to "type[:extra][!] description"; types string, number, integer, boolean, object, enum:a,b, array:itemtype; ! marks required.

Scans untrusted text (web pages, emails, tool output) for prompt-injection patterns before it reaches your agent; returns a risk score and the hits. Returns { risk: none|low|medium|high, score, hits: [{ rule, weight, match, index }] } Price: 1 credit (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing.

Parameter	Type	Required	Notes
text	string	yes	Untrusted text, up to 100,000 characters.

Audits a live page: title and description length, H1s, canonical, robots, lang, viewport, image alts, structured data and links, scored 0-100. Returns { url, status, score, title, description, h1_count, images, images_missing_alt, links, checks: [{ id, pass, weight }] } Price: 3 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing.

Parameter	Type	Required	Notes
url	string	yes	Public http(s) URL to fetch. Private and internal hosts are refused.

Computes the WCAG 2.2 contrast ratio of two colours, pass/fail for AA and AAA, and the nearest passing foreground when it fails. Returns { ratio, aa_normal, aa_large, aaa_normal, aaa_large, ui_components, suggested_foreground } Price: 1 credit (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing.

Parameter	Type	Required	Notes
foreground	string	yes	Text colour, hex.
background	string	yes	Background colour, hex.

Reads a site's robots.txt and says whether a crawler may fetch a path, with the matching rule, the major AI crawlers' access and the sitemaps. Returns { robots_url, robots_status, agent, path, allowed, rule, ai_crawlers, sitemaps } Price: 1 credit (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing.

Parameter	Type	Required	Notes
url	string	yes	Public http(s) URL to fetch. Private and internal hosts are refused.
agent	string	no	Crawler user agent, default *.

Verifies Stripe, GitHub, Slack, Shopify or generic HMAC-SHA256 webhook signatures exactly as the provider computes them, with timestamp tolerance. Returns { provider, valid, timestamp?, age_s?, within_tolerance? } Price: 1 credit (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing.

Parameter	Type	Required	Notes
provider	string	yes	Signature scheme.
secret	string	yes	Webhook signing secret. Use a test secret; it is not stored.
payload	string	yes	Raw request body exactly as received.
signature	string	yes	Signature header value (Stripe-Signature, X-Hub-Signature-256, X-Slack-Signature, X-Shopify-Hmac-Sha256, or hex/base64).
timestamp	string	no	Slack only: X-Slack-Request-Timestamp.
tolerance_s	integer	no	Allowed clock skew for Stripe and Slack, default 300.

Converts a curl command into JavaScript fetch, Python requests, Go net/http or PHP code. Returns { language, request: { url, method, headers, data }, code } Price: 2 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing.

Parameter	Type	Required	Notes
curl	string	yes	A curl command line.
language	string	no	Target language, default javascript.

Generates realistic sample JSON from a JSON Schema or OpenAPI schema object, with field-aware values (emails, UUIDs, dates, URLs). Returns { data } or { data: [...], count } Price: 1 credit (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing.

Parameter	Type	Required	Notes
schema	object	yes	JSON Schema (or OpenAPI schema object) of one response item.
count	integer	no	Items to generate, default 1.

Modern WHOIS over RDAP: registrar, creation and expiry dates, days to expiry, status codes, nameservers and DNSSEC. Returns { domain, registrar, created, updated, expires, days_to_expiry, status, nameservers, dnssec } Price: 2 credits (1 credit = 1 CAD cent) per successful call; input that does not match the schema is rejected before billing.

Parameter	Type	Required	Notes
domain	string	yes	Public domain name, e.g. example.com; IP literals and private suffixes (.local, .internal, .lan, .corp) are refused.

Free

$0 forever

Every tool — any call limit is its publisher’s, not ours
No card, and mcprush charges nothing for it
Runs at its publisher’s own address — this marketplace is not in the path
Nothing to cap, because mcprush bills nothing

Nothing here is billable: mcprush charges nothing to install Highland Intel APIs or to call it, at any volume.

ATool-list grade · score 90 / 100

Release 1.0.0 · scanned 28 Oct 2026

Graded from the tools this server lists, not from its source code.

Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.

Threat score100

Client score90

Findings0 threat · 7 capability

Capabilityhigh

Coveragemanifest

Verificationnot in this report

Surface digestb58b9cdce28d99767b6ab44bf27d7258fb3d9380d175e106b37efc4bf2664791

Score vectorthreat 100 → client 90

Term	Level	What it prices	Points
capability-exposure	high	capability blast radius (high) — client exposure if the model is manipulated	−6
coverage-honesty	manifest	inspection depth (manifest) — how much of the target the scan could see	−4

score = clamp(round(threatScore − E_cap − E_ver − E_cov), 0, 100). No model, no opinion, no network call at scoring time: the same methodology version against the same bytes always produces this number, and every line above is a field of the report rather than a summary of it.

What the scan could actually read

A grade is only as meaningful as its coverage, so the scanner publishes its own depth before it publishes its result.

The scan read each tool’s name, description, input schema and annotations exactly as the server listed them the last time it answered us; no code was reviewed. We ask the server again about once a month, and a list that changed is graded again.

Tool surfaceread

Implementation sourcenot available

Package metadatanot available

Live transportnot available

The implementation source was not read — this reflects the declared tool metadata only.

Capability — what it could do if the model were manipulated

Tags derived from each tool’s schema and the implementation, not from what the tool calls itself. high is the level these add up to.

Tool	Capability tags	Why the tag was assigned
dns-lookup	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
mail-auth	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
header-audit	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
https-redirect	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
security-txt	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
summarize	no tags
classify	no tags
translate	no tags
pii-redact	no tags
text-stats	no tags
json-validate	no tags
regex-test	no tags
cron-explain	no tags
text-diff	no tags
hash	no tags
hst-calc	no tags
quote-build	no tags
invoice-number	no tags
uptime-check	no tags
web-search	untrusted-input	untrusted-input: keyword "web_search", declares openWorldHint: true (interacts with entities outside the server)
web-contents	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
find-similar	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
web-scrape	untrusted-input	untrusted-input: keyword "scrape", declares openWorldHint: true (interacts with entities outside the server)
web-map	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
web-extract	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
enrich-url	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
enrich-company	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
entity-extract	no tags
keywords	no tags
sentiment	no tags
cf-ip-check	no tags
wrangler-lint	no tags
cron-to-cf	no tags
mcp-config-validate	no tags
claude-md-lint	no tags
hooks-validate	no tags
slash-command-scaffold	no tags
token-count	no tags
chunk-text	no tags
dataset-validate	no tags
dataset-convert	no tags
dataset-split	no tags
embed	no tags
similarity	no tags
prompt-lint	no tags
jwt-decode	no tags
url-parse	no tags
base64	no tags
uuid	no tags
user-agent-parse	no tags
cors-check	no tags
openapi-lint	no tags
http-status	no tags
og-preview	no tags
code-review	no tags
commit-message	no tags
regex-from-english	no tags
sql-explain	sensitive-source	sensitive-source: keyword "sql_query", parameter "sql"
semver	no tags
page-markdown	no tags
json-extract	no tags
tool-schema	no tags
prompt-inject-scan	no tags
seo-audit	no tags
contrast-check	no tags
robots-check	untrusted-input	untrusted-input: keyword "fetch", parameter "url" with "fetch" in the description
webhook-verify	external-sink	external-sink: keyword "webhook"
curl-to-code	external-sink	external-sink: keyword "curl"
mock-response	no tags
rdap-lookup	no tags

Toxic-flow graph

The lethal trifecta, checked as a graph rather than as a checklist: untrusted input, a sensitive source and an external sink have to meet before there is a path worth worrying about.

dns-lookup → sql-explain → curl-to-code

A cross-tool exfiltration chain exists: dns-lookup → sql-explain → curl-to-code.

Supply chain and provenance

Integrityfirst-seen

Surface digestb58b9cdce28d9976

Scanned2026-10-28

This is the first scan of this surface here, so there is nothing yet to compare it against.

Every result on this tab comes from one deterministic pass over the published package — offline, rule by rule, and auditable line by line above. Same methodology version, same bytes, same score.

Where are you running it?

Tool surface

Release history

Highland Intel APIs MCP

What it does

Quickstart

Where are you running it?

Tool surface

What counts against your monthly calls

What the scan could actually read

Capability — what it could do if the model were manipulated

Toxic-flow graph

Supply chain and provenance

Release history

See also