Stackhal

Measured conclusion: Deep-tested. L2 outcome: tools_ok.

Outside-in DNS, email security, SEO, GEO and app-link checks plus developer utilities.

Add to your agent

Copy this into your MCP client config:

{
  "mcpServers": {
    "Stackhal": {
      "url": "https://stackhal.com/mcp",
      "transport": "streamable-http"
    }
  }
}

Measured tools (13)

• validate_app_links read-only

  Inspect and validate Apple App Site Association (apple-app-site-association) and Android Digital Asset Links (assetlinks.json) files, HTTPS hosting rules, and test URL path routing, and compare the origin AASA with the copy on Apple's CDN.

  Parameters:

  • domain (required) — string — The target domain name (e.g. "example.com") hosting universal link and asset link files.
  • test_url — ['null', 'string'] — Optional web URL path to test against Apple AASA components and exclusion routing patterns.

  Hints: read-only yes · destructive not declared · idempotent not declared · open-world yes

• audit_website_seo read-only

  Run a deterministic technical SEO audit for a public website URL. Checks canonicals, title tags, headings, robots.txt, sitemaps, redirects, crawl traps, and indexability.

  Parameters:

  • url (required) — string — The public website URL to audit (e.g. https://example.com).

  Hints: read-only yes · destructive not declared · idempotent not declared · open-world yes

• transpile_to_caddyfile read-only

  Transpile Nginx (nginx.conf, server blocks) or Apache (.htaccess, VirtualHost) web server configuration to clean, idiomatic Caddyfile with migration advisories.

  Parameters:

  • config_content (required) — string — The raw web server configuration string (nginx.conf, server block, .htaccess, or VirtualHost) to transpile.
  • server_type — ['null', 'string'] — Optional source server type: "nginx" or "apache". If omitted, auto-detected from content syntax.

  Hints: read-only yes · destructive not declared · idempotent not declared · open-world no

• calculate_cidr_overlap read-only

  Analyze IPv4/IPv6 CIDR subnets for range collisions, full containment, 2D bit-tree matrix partition, and available free subnet allocation.

  Parameters:

  • cidrs (required) — array — Array of IPv4 or IPv6 CIDR strings to analyze for collisions and tree partition.
  • parent_cidr — ['null', 'string'] — Optional parent CIDR string (e.g. 10.0.0.0/16) to constrain free subnet allocation search.
  • requested_free_prefix — ['null', 'integer'] — Optional target prefix length (e.g. 20, 24) to find available free subnet block inside parent range.

  Hints: read-only yes · destructive not declared · idempotent not declared · open-world no

• diagnose_cors_policy read-only

  Analyze CORS HTTP request and response headers for wildcard/credential security violations, missing Vary: Origin, preflight OPTIONS handling, and header exposure.

  Parameters:

  • request_origin (required) — string — The incoming HTTP request Origin header (e.g. "https://app.example.com").
  • response_headers (required) — array — The server HTTP response headers (as key-value map or list of "Header: Value" strings).
  • with_credentials — ['null', 'boolean'] — Whether the cross-origin request includes cookies or authorization credentials.

  Hints: read-only yes · destructive not declared · idempotent not declared · open-world no

• trace_dns_delegation read-only

  Query live DNS records and inspect the authoritative nameservers returned for a domain.

  Parameters:

  • domain (required) — string — The target domain name (e.g. "example.com") to query using the application host resolver.
  • query_type — ['null', 'string'] — Optional DNS record type: "A" (default), "AAAA", "CNAME", "TXT", "MX", "NS", "SOA", or "CAA".

  Hints: read-only yes · destructive not declared · idempotent not declared · open-world yes

• inspect_domain_security read-only

  Inspect domain email security and deliverability standards: DMARC (BIMI compliance), BIMI DNS & SVG reachability, MTA-STS (RFC 8461), SMTP TLS-RPT (RFC 8460), SPF and MX records.

  Parameters:

  • domain (required) — string — The domain name to inspect (e.g. stripe.com, example.com).

  Hints: read-only yes · destructive not declared · idempotent not declared · open-world yes

• generate_favicon_suite read-only

  Generate modern multi-platform favicon bundle (adaptive dark-mode SVG, multi-resolution ICO, Apple Touch Icon, Android PWA icons, webmanifest) and minimal HTML tags from SVG or image input.

  Parameters:

  • svg_content (required) — string — The raw SVG XML markup string to convert into modern multi-platform favicon suite.
  • dark_mode_strategy — ['null', 'string'] — Optional dark mode strategy: "css_invert_fill" (default), "css_class_swap", or "preserve_colors".

  Hints: read-only yes · destructive not declared · idempotent not declared · open-world no

• analyze_geo_readiness read-only

  Analyze Generative Engine Optimization (GEO) signals and AI crawler readiness for a web page (schema, citations, provenance, answer structure, llms.txt, AI bot robots rules).

  Parameters:

  • url (required) — string — The web page URL to analyze for GEO readiness.

  Hints: read-only yes · destructive not declared · idempotent not declared · open-world yes

• inspect_apple_pkpass read-only

  Inspect and validate Apple Wallet .pkpass JSON structure (pass.json) or package manifests: checks required keys, pass styles, dates, ISO 8601 timezones, transit types, barcodes, and color contrast.

  Parameters:

  • pass_json (required) — string — The raw pass.json JSON string to inspect and validate.

  Hints: read-only yes · destructive not declared · idempotent not declared · open-world no

• generate_apple_pkpass_spec read-only

  Generate a production-ready, fully compliant Apple Wallet pass.json specification based on pass type, metadata, colors, barcode, and field values.

  Parameters:

  • pass_type (required) — string — Pass style type: "boardingPass", "eventTicket", "storeCard", "coupon", or "generic".
  • organization_name (required) — string — Name of the pass issuing organization, e.g. "Acme Airlines".
  • description (required) — string — Human-readable description of the pass, e.g. "Flight from SFO to WAW".
  • label_color — ['null', 'string'] — Label text color as CSS rgb(r, g, b), e.g. "rgb(148, 163, 184)".
  • transit_type — ['null', 'string'] — Transit type for boardingPass: "PKTransitTypeAir", "PKTransitTypeTrain", "PKTransitTypeBus", "PKTransitTypeBoat", "PKTransitTypeGeneric".
  • serial_number — ['null', 'string'] — Unique pass serial number, e.g. "LOT-89421".
  • barcode_format — ['null', 'string'] — Barcode format: "PKBarcodeFormatQR", "PKBarcodeFormatPDF417", "PKBarcodeFormatAztec", "PKBarcodeFormatCode128".
  • barcode_message — ['null', 'string'] — Barcode message payload, e.g. "M1HAL/BAHDAN ELO027".
  • team_identifier — ['null', 'string'] — Apple Developer 10-character Team ID, e.g. "BAHDAN9988".
  • background_color — ['null', 'string'] — Background color as CSS rgb(r, g, b), e.g. "rgb(15, 23, 42)".
  • foreground_color — ['null', 'string'] — Foreground text color as CSS rgb(r, g, b), e.g. "rgb(255, 255, 255)".
  • pass_type_identifier — ['null', 'string'] — Apple Pass Type Identifier starting with "pass.", e.g. "pass.com.example.ticket".

  Hints: read-only yes · destructive not declared · idempotent not declared · open-world no

• repair_apple_pkpass_spec read-only

  Automatically repair and sanitize broken Apple Wallet pass.json manifests: fixes missing formatVersion, prefixes passTypeIdentifier, ensures 10-character team ID, normalizes dates to ISO 8601 with timezones, and auto-corrects low contrast.

  Parameters:

  • pass_json (required) — string — The raw, broken pass.json JSON string to repair.

  Hints: read-only yes · destructive not declared · idempotent not declared · open-world no

• transpile_regex_engine read-only

  Transpile and analyze regular expressions across engines (PCRE, Go RE2, JavaScript, Python re, Rust regex) with compatibility checks and ReDoS safety analysis.

  Parameters:

  • pattern (required) — string — The regular expression pattern string to analyze and transpile.
  • source_engine — ['null', 'string'] — Optional source engine: "pcre" (default), "go_re2", "javascript", "python", "rust".
  • target_engine — ['null', 'string'] — Optional target engine: "go_re2" (default), "pcre", "javascript", "python", "rust".

  Hints: read-only yes · destructive not declared · idempotent not declared · open-world no

Publisher website Repository

Measured by MCPYP probing. Untested fields are omitted, never estimated. Listing is always free; MCPYP never proxies calls or stores user tokens.