Api

io.github.rog0xPublished by GitHub account rog0xv1.0.2Updated Oct 24, 2026

HTTP client, JWT decode, header analysis for AI agents

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

A local MCP server that gives an AI assistant HTTP/API testing tools: send requests, check endpoint health, decode JWTs, parse URLs and grade security headers.

What you can do
Send HTTP requests with any method, custom headers, body, authentication and timeouts, returning status, headers, body and timing. Check multiple API endpoints in parallel for status, response time, SSL certificate validity and expiry, with a health summary. Decode JWT tokens without verification and report issued-at, expiry and whether the token is expired. Parse a URL into its parts or build one from parts. Analyze response headers for security, caching, CORS and cookie attributes, with a letter grade.
When to use it
Useful when you are debugging or testing APIs and want the assistant to fire real requests, probe endpoint health and certificates, inspect tokens, or review a site's security headers without leaving the chat.
Requirements
Runs as a local process over stdio from the npm package @rog0x/mcp-api-tools; the README shows installing and building it, then registering the built entry point with node in the client configuration. Network access is needed for live requests and header fetching. No accounts, API keys or environment variables are declared.
Before you install
The HTTP request tool can send any method, including POST, PUT, PATCH and DELETE, to any URL, so it can change or delete remote data; review requests before approving. Authentication headers and JWT tokens you pass are sent to the target endpoints and exposed to the assistant. JWT decoding does not verify signatures, so results are informational only. Live header and health checks contact third-party sites.

Installation

In SourceWeft

  1. Open Api in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

@rog0x/mcp-api-tools

HTTP/API testing tools for AI agents, built on the Model Context Protocol.

Tools

http_request

Make any HTTP request (GET, POST, PUT, DELETE, PATCH, HEAD, OPTIONS) with full control over headers, body, authentication, and timeouts. Returns status code, response headers, body, and timing information.

api_health

Check the health of multiple API endpoints in parallel. Returns HTTP status, response time, SSL certificate validity and expiry, and optional response body validation. Includes a summary with counts of healthy, unhealthy, and errored endpoints.

jwt_decode

Decode a JWT token without cryptographic verification. Returns the decoded header and payload, issued-at time, expiry time, and whether the token is currently expired.

url_parse

Parse a URL into its component parts (protocol, host, port, path, query parameters, hash) or build a URL from individual parts.

header_analyzer

Analyze HTTP response headers for security posture (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy), caching directives, CORS configuration, and cookie attributes. Provides a letter grade for security. Can fetch headers from a live URL or analyze a provided headers object.

Installation

bash
npm installnpm run build

Configuration

Claude Desktop

Add to your claude_desktop_config.json:

json
{  "mcpServers": {    "api-tools": {      "command": "node",      "args": ["D:/products/mcp-servers/mcp-api-tools/dist/index.js"]    }  }}

Claude Code

bash
claude mcp add api-tools node D:/products/mcp-servers/mcp-api-tools/dist/index.js

Examples

Make a POST request:

Use http_request to POST to https://httpbin.org/post with JSON body {"key": "value"}

Check API health:

Use api_health to check these endpoints: https://api.github.com, https://httpbin.org/get

Decode a JWT:

Use jwt_decode to decode this token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

Parse a URL:

Use url_parse to break down https://example.com:8080/api/v1?key=value&debug=true#section

Analyze security headers:

Use header_analyzer to check security headers for https://github.com

License

MIT

Source: README.md at commit f7aa509

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v1.0.2LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts