Official MCP RegistryListed
Clawhard Studio
Token counts, contrast, time zones, JSON repair, Supabase RLS, leaked API keys, AI-bot access.
First seen 28 Oct 2026. Evidence as of 4 Nov 2026.
28
Tools
From an anonymous probe
1
Source listings
Each with its own history
50
Recorded changes
Since first seen
Tools
| Tool | Description | Behaviour |
|---|---|---|
| aitab_list_ai_plans | Use when the user asks what AI plans cost (ChatGPT, Claude, Gemini, Perplexity, Cursor, Copilot, Midjourney and others), or before aitab_total_ai_subscriptions to look up plan keys. Returns each service with its plans, USD monthly and yearly list prices and the key to pass on. Prices were checked on official pages and carry a checked date; plans marked estimate are unconfirmed. No input. Prefer this over remembering prices, which change often. | Read-only |
| aitab_total_ai_subscriptions | Use when the user lists the AI tools they pay for and asks what they spend per month or year, whether they are paying for overlapping tools, or what a stack of AI subscriptions costs. Returns the monthly, yearly and daily total, overlaps between plans, plans already included in another plan they pay for (could_cut, safe to drop), plans that merely overlap in kind (consider_dropping, ask before recommending a cut), and a link to a shareable receipt. Get plan keys from aitab_list_ai_plans. Example: {"plans": ["chatgpt.plus", "claude.pro", "cursor.pro"]}. Add ":y" to a key for yearly billing. | Read-only |
| deadbolt_catalog_query | Use when you need to check a live Supabase project rather than migration files: returns a read-only SQL query that reads table RLS settings, grants for anon and authenticated, policies, SECURITY DEFINER functions and storage buckets (never row data) and returns one JSON value. Run it with the user's Supabase SQL Editor or a Supabase MCP execute_sql tool, then pass the JSON to deadbolt_check_supabase_access. | Read-only |
| deadbolt_check_supabase_access | Use when you write, review or are about to apply Supabase / PostgreSQL migration SQL (CREATE TABLE, RLS, CREATE POLICY, GRANT, views, SECURITY DEFINER functions, storage buckets), or when a user asks whether their Supabase data is exposed, whether RLS is set up right, or why a query returns 42501 permission denied or no rows. Replays the SQL with real Postgres rules and returns, per table, what signed-out (anon) and signed-in (authenticated) users can SELECT/INSERT/UPDATE/DELETE (all rows, own rows, some rows, none, or denied for a missing grant), plus findings with severity and ready-to-run fix SQL: RLS off, policies written but RLS never enabled, using(true) writes, personal columns readable by anyone, views that bypass RLS, SECURITY DEFINER functions anyone can call, user_metadata in policies, public bucket listing, grants missing after the Oct 30 2026 default change. Also accepts the JSON produced by deadbolt_catalog_query for the live database. Deterministic; never connects to any database. Run it before telling a user their schema is safe. Up to 200,000 characters. | Read-only |
| doorman_check_ai_bot_access | Use when the user asks whether their site (or any public site) blocks ChatGPT, Claude, Google AI, Perplexity or other AI crawlers, whether AI can read or train on their content, or why AI search does not mention their site. Fetches the live robots.txt and reports, for 22 named AI bots in four groups (AI training, AI search, assistants, search engines), which are let in, kept out or partly blocked, plus the site's content-signal preference and fixes. Example: {"url": "example.com"}. Read-only. To write a new robots.txt use doorman_write_robots_txt. | Read-only |
| doorman_check_robots_txt | Use when the user pastes the text of a robots.txt (or you have drafted one) and asks which AI bots it lets in or blocks, or whether a change does what they want. Parses it the way crawlers do (groups, wildcards, longest-match) and reports each of 22 named AI bots as let in, kept out or partly blocked, with notes and a suggested choice. Pure parsing, no network. Example: {"robots_txt": "User-agent: GPTBot\nDisallow: /"}. | Read-only |
| doorman_write_robots_txt | Use when the user wants to allow or block AI training, AI search or assistant bots on their site and needs the robots.txt lines. Takes an optional existing robots.txt plus a choice of "in" or "out" for each of three groups (training, ai_search, assistants) and returns a complete robots.txt that keeps existing rules, adds one clean group per choice and a shared content-signal line. Example: {"training": "out", "ai_search": "in", "assistants": "in"}. Returns text to paste at /robots.txt; it does not change any site. | Read-only |
| halves_create_group_link | Use when the user wants a shared place for a group (trip, flat, event) to keep adding expenses and see who owes whom, not just a one-time calculation. Creates a group and returns a link anyone can open without signing up to add and edit expenses. Anyone with the link can edit it, so share it only with the group. Creates a saved page, so only call it when the user wants a shared group. For a one-off answer use halves_settle_up. Example: {"name": "Lisbon trip", "currency": "EUR", "people": ["Ana", "Ben", "Cy"]}. | Changes data |
| halves_settle_up | Use when the user shares a trip, dinner, household or group expense list and asks who owes whom, how to split costs, or how to settle up. Returns each person's paid, share and net balance, and the smallest set of payments that squares everyone up. Handles equal splits, splits among a subset, exact amounts and payments already made, with correct rounding. Nothing is saved. Example: {"people": ["Ana", "Ben", "Cy"], "expenses": [{"what": "Dinner", "amount": 90, "paid_by": "Ana"}, {"what": "Taxi", "amount": 24, "paid_by": "Ben", "split_between": ["Ben", "Cy"]}]}. Do the arithmetic here instead of by hand. | Read-only |
| mend_check_json | Use when you need to know whether text is strictly valid JSON, and if not, exactly where it breaks. Strict RFC 8259 check (the same accept/reject as JSON.parse). Returns line, column, the offending line with a caret and whether Mend can repair it. Use mend_repair_json to fix it. Up to 100,000 characters. | Read-only |
| mend_outline_json | Use when you are about to read a big JSON response, log or export into context, before loading it: returns a compact outline of the structure (keys, types, array lengths, one example per repeated shape) so you can plan a query without spending tokens on the whole document. Repairs the JSON first if needed. Follow with mend_query_json to pull only the values you need. Up to 100,000 characters. | Read-only |
| mend_query_json | Use when you need specific fields from a JSON document without reading all of it: $.users[0].name, $.items[*].id, $.a.b[-1], $.list[1:3], $..email (recursive). Returns each match with its exact path, type and value. Repairs the JSON first if needed, so broken input still works. Up to 100,000 characters. | Read-only |
| mend_repair_json | Use when JSON from an LLM, API, log, config or copy-paste fails to parse (JSON.parse error, "Unexpected token", "Expecting property name"), or the user pastes JSON with trailing commas, single quotes, unquoted keys, comments, Python True/False/None, NaN, missing commas or brackets, a ```json fence, text around it, or output that was cut off. Deterministic repair: returns valid, formatted JSON plus a list of every fix with line and column. Values are never rewritten, so big numbers, number formatting and key order stay exactly as written (re-asking a model to "fix the JSON" changes data and costs tokens). If the text is already valid it says so. Up to 100,000 characters. | Read-only |
| meridian_convert_time | Use when you need to convert a specific wall-clock time from one place to others, for any date. It uses the real tz database, so daylight saving is right for that exact date (the US and Europe switch on different weeks), and it warns when the time does not exist (spring forward) or happens twice (fall back). Time accepts "15:00", "3:30pm", "noon", "now" or an ISO local time like 2026-11-05T15:00 (no Z). Date defaults to today in the source zone. Returns {input, utc, source:{...}, converted:[{place, zone, local, time_12h, date, utc_offset, abbreviation, day_note, hours_ahead_of_source}], warning?, summary, open_url}. | Read-only |
| meridian_meeting_slots | Use when you need to schedule a call across several places. Scans the day in 15-minute steps and ranks start times so the most people are inside working hours and nobody is at night, using each place's real offset and DST for that date. Returns up to 5 slots with each person's local start and end, and says plainly when no time works for everyone. Defaults: working hours 9 to 17, 60 minutes, date today in the first place. | Read-only |
| meridian_now | Use when you need to know what time or date it is right now somewhere. You have no clock of your own, so never guess the current time. Returns the real current time, date, UTC offset, abbreviation and daylight saving status for each place. Places can be cities ("Tokyo"), IANA zones ("Europe/Paris"), abbreviations ("PST") or "UTC+5:30". | Read-only |
| meridian_zone_info | Use when you need to answer "what is the UTC offset of X", "does X observe daylight saving" and "when do the clocks change". Returns the current offset and abbreviation, whether the place observes DST, every clock change in the year with exact local before and after times, and the next change. Abbreviations like IST or CST are ambiguous, so the answer says which zone was used. | Read-only |
| runsheet_create_schedule | Use when the user wants a shareable run-of-show or day-of schedule for a wedding, conference, shoot or other event that guests or crew can open on their phone and that updates live when edited. Creates the page and returns a view link to share with everyone and a private edit link to keep. Start from a template (wedding, conf, shoot, blank) or pass your own items. Example: {"name": "Maya and Sam wedding", "date": "2026-09-12", "timezone": "America/New_York", "template": "wedding"} or {"name": "Offsite", "items": [{"time": "09:00", "title": "Welcome", "duration_minutes": 30}]}. Creates a saved page, so only call it when the user wants one. | Changes data |
| slopscore_check_website | Use when the user asks whether a website, landing page or app looks AI-generated or generic, wants a design critique of a live URL, or asks "does my site look like AI slop?". Fetches the page and checks 19 habits (purple-blue gradients, buzzword copy, glassmorphism, icon-card grids, template headlines, app-builder fingerprints and more), then returns a 0-100 score, a verdict, each habit found with the evidence and how to fix it, and the habits that were not found. It is a habit check, not an AI detector. Public http(s) pages only. Example: {"url": "https://example.com"}. | Read-only |
| spill_scan_secrets | Use when the user asks whether some text contains secrets, or before you paste, commit, share, log or send code, a .env file, a diff, config, logs, a stack trace or a prompt that might contain credentials, for example "did I leak a key in this?", "is this safe to post?" or "redact the secrets in this log". Detects 48 services by exact key format (OpenAI, Anthropic, Gemini/Google, Groq, xAI, OpenRouter, Stripe, Supabase, AWS, GitHub, GitLab, npm, PyPI, Slack, Discord, Twilio, SendGrid, Resend, Shopify, Cloudflare and more) plus PEM private keys, database URLs with passwords, JWTs, Authorization headers and high-entropy values in variables named like secret, token, api_key or password. It verifies what it can deterministically: GitHub token CRC32 checksums, JWT and Supabase key role and expiry (service_role vs anon), documented example keys and placeholders, and NEXT_PUBLIC_/VITE_/EXPO_PUBLIC_ variables that ship to every browser. Returns findings with severity (critical, high, medium, public, info), line and column, a masked preview (never the full secret), why it matters, the fix and the provider's revoke URL, plus a redacted copy with labels like [STRIPE_SECRET_KEY_1]. Text is processed in memory to answer and is not stored. Limits: format-based, so a random secret with a neutral name can be missed; it never tests keys against providers; up to 200,000 characters. For secrets the user should not send anywhere, point them to https://spill.clawhard.com, which runs entirely in the browser. | Read-only |
| swatch_check_contrast | Use when the user asks whether a color combination is readable or accessible, passes WCAG AA or AAA, or has enough contrast (text on a background, button, badge, link color). Returns the exact contrast ratio, pass or fail for normal text, large text and UI components at AA and AAA, the APCA lightness contrast and a plain note. Colors can be hex, rgb(), hsl() or CSS names. Example: {"foreground": "#777777", "background": "#ffffff"}. Language models cannot compute this reliably, so call it instead of guessing. | Read-only |
| swatch_check_pairs | Use when the user has a whole design system, theme or stylesheet and wants every text and background pair checked for accessibility in one go. Takes up to 50 pairs and returns the ratio and AA and AAA results for each, with a count of failures. Example: {"pairs": [{"foreground": "#777", "background": "#fff", "label": "muted text"}, {"foreground": "#fff", "background": "#ff5a1f", "label": "button"}]}. | Read-only |
| swatch_convert_color | Use when the user asks to convert a color between hex, RGB, HSL and OKLCH, or asks what a color is called or how light it is. Returns all formats, the relative luminance and the nearest CSS color name. Example: {"color": "#ff5a1f"}. Exact math, so prefer it to converting by hand. | Read-only |
| swatch_fix_contrast | Use when a color pair fails contrast and the user wants the smallest change that makes it pass, such as "make this gray text accessible without changing the look". Returns the closest text color on that background that reaches the target (AA, AAA, AA-large or ui), and separately the closest background, keeping the hue. Example: {"foreground": "#777777", "background": "#ffffff", "target": "AA"}. Returns already_passes if nothing needs to change. | Read-only |
| swatch_make_scale | Use when the user asks for a palette, shades, tints, a design-token scale or a Tailwind-style 50 to 950 ramp from a brand color. Returns 11 steps that keep the hue, with the hex, contrast on white and on black, and the best text color for each step. Example: {"color": "#ff5a1f", "name": "brand"}. | Read-only |
| swatch_pick_text_color | Use when the user asks what text color (black or white) to put on a given background, button or brand color so it is readable. Returns the better of black or white with both contrast ratios, the WCAG grade and a softer near-black option. Example: {"background": "#ff5a1f"}. | Read-only |
| tells_check_writing | Use when the user asks whether a piece of writing sounds like AI, wants an email, post, essay or cover letter checked for chatbot habits before sending, or wants to know which phrases to fix. Returns a 0-100 score, a verdict, and each habit found (chatbot words like "delve" and "tapestry", "not X, it's Y" framing, em-dash overuse, assistant filler, fake suspense, stiff transitions, markdown leftovers and more) with examples and why readers notice it. It is a habit check, not an AI detector, and short texts give rough scores. Example: {"text": "<the draft to check>"}. To rewrite, use your own judgment on the flagged habits. | Read-only |
| tokendiet_count_tokens | Use when the user asks how many tokens a text, prompt, log, document or code paste is, whether it fits a context window (128K, 200K, 1M), or how big something is before they send it to an AI. Returns the exact o200k token count (GPT-4o family and later; Claude and Gemini usually within about 15%), plus words, characters and how much of each window it uses. Language models cannot count their own tokens, so call this instead of estimating. Example: {"text": "<the text to measure>"}. Not for shortening text. | Read-only |
Change history
- spill_scan_secrets: tool added
- server instructions changed (+"spill_scan_secrets before pasting, committing or sharing code, .env files, logs or prompts, to find API keys, tokens, private keys and passwords (masked) and get a redacted copy;")
- Description changed (registry)
- tokendiet_trim_text: tool removed
- tokendiet_count_tokens: tool added
- tells_score_text: tool removed
- tells_fix_text: tool removed
- tells_check_writing: tool added
- swatch_pick_text_color: tool added
- swatch_make_scale: tool added
- swatch_fix_contrast: tool added
- swatch_convert_color: tool added
- swatch_check_pairs: tool added
- swatch_check_contrast: tool added
- slopscore_check_website: tool added
- slopscore_check_site: tool removed
- runsheet_list_templates: tool removed
- runsheet_create_schedule: tool added
- runsheet_create: tool removed
- meridian_zone_info: tool added
- meridian_now: tool added
- meridian_meeting_slots: tool added
- meridian_convert_time: tool added
- mend_repair_json: tool added
- mend_query_json: tool added
- mend_outline_json: tool added
- mend_check_json: tool added
- lingo_translate: tool removed
- lingo_list_terms: tool removed
- lingo_brief: tool removed
- halves_settle_up: title changed
- halves_settle_up: description changed (+"Use when the user shares" +"trip, dinner, household or" +"expense list")
- halves_settle_up: annotations changed
- halves_create_group_link: tool added
- halves_create_group: tool removed
- fluff_gist_text: tool removed
- fluff_check_text: tool removed
- doorman_write_robots_txt: tool added
- doorman_check_site: tool removed
- doorman_check_robots_txt: tool added
- doorman_check_robots: tool removed
- doorman_check_ai_bot_access: tool added
- doorman_build_robots: tool removed
- deadbolt_check_supabase_access: tool added
- deadbolt_catalog_query: tool added
- aitab_total_ai_subscriptions: tool added
- aitab_total: tool removed
- aitab_list_plans: tool removed
- aitab_list_ai_plans: tool added
- server instructions changed (+"Studio: small tools for jobs an AI cannot do reliably alone." +"tokendiet_count_tokens for exact token counts and context-window fit; swatch_check_contrast, swatch_fix_contrast, swatch_pick_text_color, swatch_make_scale, swatch_convert_color and swatch_check_pairs for exact WCAG color contrast, the nearest passing color and 50-950 palettes; meridian tools for the real current time, DST-correct time zone conversion and meeting slots; halves_settle_up for the fewest payments that settle a group (halves_create_group_link for a shared page); runsheet_create_schedule for a live shareable event schedule; doorman_check_ai_bot_access, doorman_check_robots_txt and doorman_write_robots_txt to see and set which AI bots a site lets in; mend_repair_json, mend_check_json, mend_outline_json and mend_query_json" +"repair JSON that will not parse without changing values, locate the exact error, outline a big payload, or extract fields by path; deadbolt_check_supabase_access")
| Source | Listing | First seen | Last seen | Versions |
|---|---|---|---|---|
| Official MCP Registry | com.clawhard/studio | 28 Oct 2026 | 4 Nov 2026 | 7 |