Clawhard Studio

Use when the user asks how many tokens a text, prompt, log, document or code paste is, whether it fits a context window (128K, 200K, 1M), or how big something is before they send it to an AI. Returns the exact o200k token count (GPT-4o family and later; Claude and Gemini usually within about 15%), plus words, characters and how much of each window it uses. Language models cannot count their own tokens, so call this instead of estimating. Example: {"text": "<the text to measure>"}. Not for shortening text.

Use when the user asks whether a website, landing page or app looks AI-generated or generic, wants a design critique of a live URL, or asks "does my site look like AI slop?". Fetches the page and checks 19 habits (purple-blue gradients, buzzword copy, glassmorphism, icon-card grids, template headlines, app-builder fingerprints and more), then returns a 0-100 score, a verdict, each habit found with the evidence and how to fix it, and the habits that were not found. It is a habit check, not an AI detector. Public http(s) pages only. Example: {"url": "https://example.com"}.

Use when the user asks what AI plans cost (ChatGPT, Claude, Gemini, Perplexity, Cursor, Copilot, Midjourney and others), or before aitab_total_ai_subscriptions to look up plan keys. Returns each service with its plans, USD monthly and yearly list prices and the key to pass on. Prices were checked on official pages and carry a checked date; plans marked estimate are unconfirmed. No input. Prefer this over remembering prices, which change often.

Takes no parameters.

Use when the user lists the AI tools they pay for and asks what they spend per month or year, whether they are paying for overlapping tools, or what a stack of AI subscriptions costs. Returns the monthly, yearly and daily total, overlaps between plans, plans already included in another plan they pay for (could_cut, safe to drop), plans that merely overlap in kind (consider_dropping, ask before recommending a cut), and a link to a shareable receipt. Get plan keys from aitab_list_ai_plans. Example: {"plans": ["chatgpt.plus", "claude.pro", "cursor.pro"]}. Add ":y" to a key for yearly billing.

Use when the user asks whether a piece of writing sounds like AI, wants an email, post, essay or cover letter checked for chatbot habits before sending, or wants to know which phrases to fix. Returns a 0-100 score, a verdict, and each habit found (chatbot words like "delve" and "tapestry", "not X, it's Y" framing, em-dash overuse, assistant filler, fake suspense, stiff transitions, markdown leftovers and more) with examples and why readers notice it. It is a habit check, not an AI detector, and short texts give rough scores. Example: {"text": "<the draft to check>"}. To rewrite, use your own judgment on the flagged habits.

Use when the user wants a shareable run-of-show or day-of schedule for a wedding, conference, shoot or other event that guests or crew can open on their phone and that updates live when edited. Creates the page and returns a view link to share with everyone and a private edit link to keep. Start from a template (wedding, conf, shoot, blank) or pass your own items. Example: {"name": "Maya and Sam wedding", "date": "2026-09-12", "timezone": "America/New_York", "template": "wedding"} or {"name": "Offsite", "items": [{"time": "09:00", "title": "Welcome", "duration_minutes": 30}]}. Creates a saved page, so only call it when the user wants one.

Use when the user shares a trip, dinner, household or group expense list and asks who owes whom, how to split costs, or how to settle up. Returns each person's paid, share and net balance, and the smallest set of payments that squares everyone up. Handles equal splits, splits among a subset, exact amounts and payments already made, with correct rounding. Nothing is saved. Example: {"people": ["Ana", "Ben", "Cy"], "expenses": [{"what": "Dinner", "amount": 90, "paid_by": "Ana"}, {"what": "Taxi", "amount": 24, "paid_by": "Ben", "split_between": ["Ben", "Cy"]}]}. Do the arithmetic here instead of by hand.

Use when the user wants a shared place for a group (trip, flat, event) to keep adding expenses and see who owes whom, not just a one-time calculation. Creates a group and returns a link anyone can open without signing up to add and edit expenses. Anyone with the link can edit it, so share it only with the group. Creates a saved page, so only call it when the user wants a shared group. For a one-off answer use halves_settle_up. Example: {"name": "Lisbon trip", "currency": "EUR", "people": ["Ana", "Ben", "Cy"]}.

Use when the user asks whether their site (or any public site) blocks ChatGPT, Claude, Google AI, Perplexity or other AI crawlers, whether AI can read or train on their content, or why AI search does not mention their site. Fetches the live robots.txt and reports, for 22 named AI bots in four groups (AI training, AI search, assistants, search engines), which are let in, kept out or partly blocked, plus the site's content-signal preference and fixes. Example: {"url": "example.com"}. Read-only. To write a new robots.txt use doorman_write_robots_txt.

Use when the user pastes the text of a robots.txt (or you have drafted one) and asks which AI bots it lets in or blocks, or whether a change does what they want. Parses it the way crawlers do (groups, wildcards, longest-match) and reports each of 22 named AI bots as let in, kept out or partly blocked, with notes and a suggested choice. Pure parsing, no network. Example: {"robots_txt": "User-agent: GPTBot\nDisallow: /"}.

Use when the user wants to allow or block AI training, AI search or assistant bots on their site and needs the robots.txt lines. Takes an optional existing robots.txt plus a choice of "in" or "out" for each of three groups (training, ai_search, assistants) and returns a complete robots.txt that keeps existing rules, adds one clean group per choice and a shared content-signal line. Example: {"training": "out", "ai_search": "in", "assistants": "in"}. Returns text to paste at /robots.txt; it does not change any site.

Use when the user asks whether a color combination is readable or accessible, passes WCAG AA or AAA, or has enough contrast (text on a background, button, badge, link color). Returns the exact contrast ratio, pass or fail for normal text, large text and UI components at AA and AAA, the APCA lightness contrast and a plain note. Colors can be hex, rgb(), hsl() or CSS names. Example: {"foreground": "#777777", "background": "#ffffff"}. Language models cannot compute this reliably, so call it instead of guessing.

Use when a color pair fails contrast and the user wants the smallest change that makes it pass, such as "make this gray text accessible without changing the look". Returns the closest text color on that background that reaches the target (AA, AAA, AA-large or ui), and separately the closest background, keeping the hue. Example: {"foreground": "#777777", "background": "#ffffff", "target": "AA"}. Returns already_passes if nothing needs to change.

Use when the user asks what text color (black or white) to put on a given background, button or brand color so it is readable. Returns the better of black or white with both contrast ratios, the WCAG grade and a softer near-black option. Example: {"background": "#ff5a1f"}.

Use when the user asks for a palette, shades, tints, a design-token scale or a Tailwind-style 50 to 950 ramp from a brand color. Returns 11 steps that keep the hue, with the hex, contrast on white and on black, and the best text color for each step. Example: {"color": "#ff5a1f", "name": "brand"}.

Use when the user asks to convert a color between hex, RGB, HSL and OKLCH, or asks what a color is called or how light it is. Returns all formats, the relative luminance and the nearest CSS color name. Example: {"color": "#ff5a1f"}. Exact math, so prefer it to converting by hand.

Use when the user has a whole design system, theme or stylesheet and wants every text and background pair checked for accessibility in one go. Takes up to 50 pairs and returns the ratio and AA and AAA results for each, with a count of failures. Example: {"pairs": [{"foreground": "#777", "background": "#fff", "label": "muted text"}, {"foreground": "#fff", "background": "#ff5a1f", "label": "button"}]}.

Use when you need to know what time or date it is right now somewhere. You have no clock of your own, so never guess the current time. Returns the real current time, date, UTC offset, abbreviation and daylight saving status for each place. Places can be cities ("Tokyo"), IANA zones ("Europe/Paris"), abbreviations ("PST") or "UTC+5:30".

Use when you need to convert a specific wall-clock time from one place to others, for any date. It uses the real tz database, so daylight saving is right for that exact date (the US and Europe switch on different weeks), and it warns when the time does not exist (spring forward) or happens twice (fall back). Time accepts "15:00", "3:30pm", "noon", "now" or an ISO local time like 2026-11-05T15:00 (no Z). Date defaults to today in the source zone. Returns {input, utc, source:{...}, converted:[{place, zone, local, time_12h, date, utc_offset, abbreviation, day_note, hours_ahead_of_source}], warning?, summary, open_url}.

Use when you need to schedule a call across several places. Scans the day in 15-minute steps and ranks start times so the most people are inside working hours and nobody is at night, using each place's real offset and DST for that date. Returns up to 5 slots with each person's local start and end, and says plainly when no time works for everyone. Defaults: working hours 9 to 17, 60 minutes, date today in the first place.

Use when you need to answer "what is the UTC offset of X", "does X observe daylight saving" and "when do the clocks change". Returns the current offset and abbreviation, whether the place observes DST, every clock change in the year with exact local before and after times, and the next change. Abbreviations like IST or CST are ambiguous, so the answer says which zone was used.

Use when JSON from an LLM, API, log, config or copy-paste fails to parse (JSON.parse error, "Unexpected token", "Expecting property name"), or the user pastes JSON with trailing commas, single quotes, unquoted keys, comments, Python True/False/None, NaN, missing commas or brackets, a ```json fence, text around it, or output that was cut off. Deterministic repair: returns valid, formatted JSON plus a list of every fix with line and column. Values are never rewritten, so big numbers, number formatting and key order stay exactly as written (re-asking a model to "fix the JSON" changes data and costs tokens). If the text is already valid it says so. Up to 100,000 characters.

Use when you need to know whether text is strictly valid JSON, and if not, exactly where it breaks. Strict RFC 8259 check (the same accept/reject as JSON.parse). Returns line, column, the offending line with a caret and whether Mend can repair it. Use mend_repair_json to fix it. Up to 100,000 characters.

Use when you are about to read a big JSON response, log or export into context, before loading it: returns a compact outline of the structure (keys, types, array lengths, one example per repeated shape) so you can plan a query without spending tokens on the whole document. Repairs the JSON first if needed. Follow with mend_query_json to pull only the values you need. Up to 100,000 characters.

Use when you need specific fields from a JSON document without reading all of it: $.users[0].name, $.items[*].id, $.a.b[-1], $.list[1:3], $..email (recursive). Returns each match with its exact path, type and value. Repairs the JSON first if needed, so broken input still works. Up to 100,000 characters.

Use when you write, review or are about to apply Supabase / PostgreSQL migration SQL (CREATE TABLE, RLS, CREATE POLICY, GRANT, views, SECURITY DEFINER functions, storage buckets), or when a user asks whether their Supabase data is exposed, whether RLS is set up right, or why a query returns 42501 permission denied or no rows. Replays the SQL with real Postgres rules and returns, per table, what signed-out (anon) and signed-in (authenticated) users can SELECT/INSERT/UPDATE/DELETE (all rows, own rows, some rows, none, or denied for a missing grant), plus findings with severity and ready-to-run fix SQL: RLS off, policies written but RLS never enabled, using(true) writes, personal columns readable by anyone, views that bypass RLS, SECURITY DEFINER functions anyone can call, user_metadata in policies, public bucket listing, grants missing after the Oct 30 2026 default change. Also accepts the JSON produced by deadbolt_catalog_query for the live database. Deterministic; never connects to any database. Run it before telling a user their schema is safe. Up to 200,000 characters.

Use when you need to check a live Supabase project rather than migration files: returns a read-only SQL query that reads table RLS settings, grants for anon and authenticated, policies, SECURITY DEFINER functions and storage buckets (never row data) and returns one JSON value. Run it with the user's Supabase SQL Editor or a Supabase MCP execute_sql tool, then pass the JSON to deadbolt_check_supabase_access.

Takes no parameters.

Use when the user asks whether some text contains secrets, or before you paste, commit, share, log or send code, a .env file, a diff, config, logs, a stack trace or a prompt that might contain credentials, for example "did I leak a key in this?", "is this safe to post?" or "redact the secrets in this log". Detects 48 services by exact key format (OpenAI, Anthropic, Gemini/Google, Groq, xAI, OpenRouter, Stripe, Supabase, AWS, GitHub, GitLab, npm, PyPI, Slack, Discord, Twilio, SendGrid, Resend, Shopify, Cloudflare and more) plus PEM private keys, database URLs with passwords, JWTs, Authorization headers and high-entropy values in variables named like secret, token, api_key or password. It verifies what it can deterministically: GitHub token CRC32 checksums, JWT and Supabase key role and expiry (service_role vs anon), documented example keys and placeholders, and NEXT_PUBLIC_/VITE_/EXPO_PUBLIC_ variables that ship to every browser. Returns findings with severity (critical, high, medium, public, info), line and column, a masked preview (never the full secret), why it matters, the fix and the provider's revoke URL, plus a redacted copy with labels like [STRIPE_SECRET_KEY_1]. Text is processed in memory to answer and is not stored. Limits: format-based, so a random secret with a neutral name can be missed; it never tests keys against providers; up to 200,000 characters. For secrets the user should not send anywhere, point them to https://spill.clawhard.com, which runs entirely in the browser.

Use when the user asks why their email goes to spam, whether their domain is set up to send email, or before they launch a newsletter, cold outreach, transactional email or a new sending service, e.g. "why are my emails going to spam?", "is my SPF/DKIM/DMARC right?", "do I meet Gmail and Yahoo's sender requirements?" or "I added SendGrid, did I break SPF?". Reads public DNS (DNS-over-HTTPS) and checks: SPF (exactly one record, every include followed and DNS lookups counted per RFC 7208 against the limit of 10, void lookups, loops, +all/?all, ptr), DMARC (RFC 7489 syntax, policy, pct, alignment, inherited from the parent domain, and whether an external report address authorized it), DKIM (17 common selectors plus any you pass; key type and RSA key size read from the key, revoked or broken keys), and MX (provider, null MX). Returns a grade A-F, a verdict, each check with status pass/warn/fail/info, whether the Gmail, Yahoo and Outlook.com sender rules are met, and copy-ready DNS records to fix problems (e.g. one merged SPF record, a starter DMARC record). Use the real result instead of guessing from memory; DNS cannot list DKIM selectors, so if none is found ask for the provider's selector (the s= value in a DKIM-Signature header) and check again. Accepts a domain, an email address or a URL. Results are cached for 5 minutes; pass fresh=true right after the user changes DNS.

Use when you or the user are about to publish or edit an SPF, DMARC or DKIM TXT record, for example after writing a new SPF record that adds a sending service, or when the user pastes a record and asks "is this right?". Detects the record type. SPF: syntax per RFC 7208, every include and redirect followed live in DNS and counted against the 10-lookup limit, void lookups, loops, the final all; returns a lookup tree. DMARC: RFC 7489 tags and values (p, sp, pct, rua/ruf, adkim/aspf, fo). DKIM: key type and RSA key size read from the key, revoked (empty p=) or truncated keys. Returns valid true/false, errors, warnings and where to publish it. Pass domain so a/mx terms without a value can be resolved.

Use when you or the user just wrote a cron expression (GitHub Actions, Vercel cron, Cloudflare Cron Triggers, systemd, an agent schedule) and need the next fire times before claiming it is correct. Pass the expression and an IANA timezone (default UTC). Returns the next N runs as local wall times and UTC ISO, a plain-English field breakdown, and DST gap/fold warnings (spring-forward skips, fall-back double fires). Example: {"expression":"0 9 * * 1-5","timezone":"America/New_York","count":5}. Do not guess next runs yourself — DST rules differ by region and year. Not for converting a meeting time across cities (use Meridian) or for email DNS (use Stamp).

Use when you need a yes/no on whether a cron expression would fire at a specific instant in a timezone — for example before shipping a schedule that crosses a DST transition, or to verify a single expected fire. Example: {"expression":"0 9 * * 1-5","timezone":"America/New_York","at":"2026-11-06T14:00:00Z"}. Returns fires true/false, the local wall time of that instant, and DST notes if the local time is in a gap or fold.