{"$schema":"https://static.modelcontextprotocol.io/schemas/mcp-server-card/v1.json","name":"com.clawhard/dev","title":"Clawhard Dev Tools","version":"1.0.0","description":"18 read-only developer checks with exact answers: SPF, DKIM and DMARC from live DNS; who can read and write each Supabase table, with fix SQL; cron next runs with DST warnings; JSON repair, outline and path queries; WCAG and APCA color contrast, passing colors and palettes; current time, time zone conversion and meeting slots; and which AI bots a site or robots.txt lets in. No account or API key.","websiteUrl":"https://dev.clawhard.com","documentationUrl":"https://dev.clawhard.com/llms.txt","iconUrl":"https://clawhard.com/icon-512.png","serverInfo":{"name":"com.clawhard/dev","title":"Clawhard Dev Tools","version":"1.0.0"},"protocolVersion":"2025-06-18","transport":"streamable-http","endpoint":"https://dev.clawhard.com/mcp","remotes":[{"type":"streamable-http","url":"https://dev.clawhard.com/mcp"}],"authentication":{"required":false},"capabilities":{"tools":{"listChanged":false},"prompts":{"listChanged":false},"resources":{"subscribe":false,"listChanged":false}},"tools":[{"name":"stamp_check_email_domain","title":"Check a domain's email authentication (SPF, DKIM, DMARC, MX) from live DNS","description":"Use when the user asks why their email goes to spam, whether their domain is set up to send email, or before they launch a newsletter, cold outreach, transactional email or a new sending service, e.g. \"why are my emails going to spam?\", \"is my SPF/DKIM/DMARC right?\", \"do I meet Gmail and Yahoo's sender requirements?\" or \"I added SendGrid, did I break SPF?\". Reads public DNS (DNS-over-HTTPS) and checks: SPF (exactly one record, every include followed and DNS lookups counted per RFC 7208 against the limit of 10, void lookups, loops, +all/?all, ptr), DMARC (RFC 7489 syntax, policy, pct, alignment, inherited from the parent domain, and whether an external report address authorized it), DKIM (17 common selectors plus any you pass; key type and RSA key size read from the key, revoked or broken keys), and MX (provider, null MX). Returns a grade A-F, a verdict, each check with status pass/warn/fail/info, whether the Gmail, Yahoo and Outlook.com sender rules are met, and copy-ready DNS records to fix problems (e.g. one merged SPF record, a starter DMARC record). DNS cannot list DKIM selectors, so when none of the common selectors is found the result says so and a known selector (the s= value in a DKIM-Signature header) can be passed in. Accepts a domain, an email address or a URL. Results are cached for 5 minutes; pass fresh=true right after the user changes DNS."},{"name":"stamp_check_dns_record","title":"Check an SPF, DMARC or DKIM record before publishing it","description":"Use when you or the user are about to publish or edit an SPF, DMARC or DKIM TXT record, for example after writing a new SPF record that adds a sending service, or when the user pastes a record and asks \"is this right?\". Detects the record type. SPF: syntax per RFC 7208, every include and redirect followed live in DNS and counted against the 10-lookup limit, void lookups, loops, the final all; returns a lookup tree. DMARC: RFC 7489 tags and values (p, sp, pct, rua/ruf, adkim/aspf, fo). DKIM: key type and RSA key size read from the key, revoked (empty p=) or truncated keys. Returns valid true/false, errors, warnings and where to publish it. Pass domain so a/mx terms without a value can be resolved."},{"name":"deadbolt_check_supabase_access","title":"Check who can read and write Supabase tables (RLS, policies, grants)","description":"Use when you write, review or are about to apply Supabase / PostgreSQL migration SQL (CREATE TABLE, RLS, CREATE POLICY, GRANT, views, SECURITY DEFINER functions, storage buckets), or when a user asks whether their Supabase data is exposed, whether RLS is set up right, or why a query returns 42501 permission denied or no rows. Replays the SQL with real Postgres rules and returns, per table, what signed-out (anon) and signed-in (authenticated) users can SELECT/INSERT/UPDATE/DELETE (all rows, own rows, some rows, none, or denied for a missing grant), plus findings with severity and ready-to-run fix SQL: RLS off, policies written but RLS never enabled, using(true) writes, personal columns readable by anyone, views that bypass RLS, SECURITY DEFINER functions anyone can call, user_metadata in policies, public bucket listing, grants missing after the Oct 30 2026 default change. Also accepts the JSON produced by deadbolt_catalog_query for the live database. Deterministic; never connects to any database. Up to 200,000 characters."},{"name":"deadbolt_catalog_query","title":"Get the read-only SQL that snapshots a live Supabase database for Deadbolt","description":"Use when you need to check a live Supabase project rather than migration files: returns a read-only SQL query that reads table RLS settings, grants for anon and authenticated, policies, SECURITY DEFINER functions and storage buckets (never row data) and returns one JSON value. Run it with the user's Supabase SQL Editor or a Supabase MCP execute_sql tool, then pass the JSON to deadbolt_check_supabase_access."},{"name":"tick_next_runs","title":"Next cron run times in a timezone","description":"Use when you or the user just wrote a cron expression (GitHub Actions, Vercel cron, Cloudflare Cron Triggers, systemd, an agent schedule) and need its next fire times. Pass the expression and an IANA timezone (default UTC). Returns the next N runs as local wall times and UTC ISO, a plain-English field breakdown, and DST gap/fold warnings (spring-forward skips, fall-back double fires). Example: {\"expression\":\"0 9 * * 1-5\",\"timezone\":\"America/New_York\",\"count\":5}. Uses the tz database, so DST rules match the region and year. Not for converting a meeting time across cities (use Meridian) or for email DNS (use Stamp)."},{"name":"tick_matches","title":"Would this cron fire at a datetime?","description":"Use when you need a yes/no on whether a cron expression would fire at a specific instant in a timezone — for example before shipping a schedule that crosses a DST transition, or to verify a single expected fire. Example: {\"expression\":\"0 9 * * 1-5\",\"timezone\":\"America/New_York\",\"at\":\"2026-11-06T14:00:00Z\"}. Returns fires true/false, the local wall time of that instant, and DST notes if the local time is in a gap or fold."},{"name":"mend_repair_json","title":"Repair broken or LLM-generated JSON","description":"Use when JSON from an LLM, API, log, config or copy-paste fails to parse (JSON.parse error, \"Unexpected token\", \"Expecting property name\"), or the user pastes JSON with trailing commas, single quotes, unquoted keys, comments, Python True/False/None, NaN, missing commas or brackets, a ```json fence, text around it, or output that was cut off. Deterministic repair: returns valid, formatted JSON plus a list of every fix with line and column. Values are never rewritten, so big numbers, number formatting and key order stay exactly as written. If the text is already valid it says so. Up to 100,000 characters."},{"name":"mend_outline_json","title":"Outline the structure of a large JSON payload","description":"Use when you are about to read a big JSON response, log or export into context, before loading it: returns a compact outline of the structure (keys, types, array lengths, one example per repeated shape) so you can plan a query without spending tokens on the whole document. Repairs the JSON first if needed. Follow with mend_query_json to pull only the values you need. Up to 100,000 characters."},{"name":"mend_query_json","title":"Extract values from JSON by path","description":"Use when you need specific fields from a JSON document without reading all of it: $.users[0].name, $.items[*].id, $.a.b[-1], $.list[1:3], $..email (recursive). Returns each match with its exact path, type and value. Repairs the JSON first if needed, so broken input still works. Up to 100,000 characters."},{"name":"swatch_check_contrast","title":"Check the WCAG contrast of a text and background color","description":"Use when the user asks whether a color combination is readable or accessible, passes WCAG AA or AAA, or has enough contrast (text on a background, button, badge, link color), or what a color is in another format. Returns the exact contrast ratio, pass or fail for normal text, large text and UI components at AA and AAA, the APCA lightness contrast and a plain note. Colors can be hex, rgb(), hsl() or CSS names. Example: {\"foreground\": \"#777777\", \"background\": \"#ffffff\"}. Also returns each color in hex, rgb, hsl and oklch with its nearest CSS name."},{"name":"swatch_fix_contrast","title":"Find the nearest accessible color that passes contrast","description":"Use when a color pair fails contrast and the user wants the smallest change that makes it pass, such as \"make this gray text accessible without changing the look\". Returns the closest text color on that background that reaches the target (AA, AAA, AA-large or ui), and separately the closest background, keeping the hue. Example: {\"foreground\": \"#777777\", \"background\": \"#ffffff\", \"target\": \"AA\"}. Returns already_passes if nothing needs to change."},{"name":"swatch_make_scale","title":"Build a 50-950 color palette from one color","description":"Use when the user asks for a palette, shades, tints, a design-token scale or a Tailwind-style 50 to 950 ramp from a brand color. Returns 11 steps that keep the hue, with the hex, contrast on white and on black, and the best text color for each step. Example: {\"color\": \"#ff5a1f\", \"name\": \"brand\"}."},{"name":"swatch_check_pairs","title":"Check contrast for many color pairs at once","description":"Use when the user has a whole design system, theme or stylesheet and wants every text and background pair checked for accessibility in one go. Takes up to 50 pairs and returns the ratio and AA and AAA results for each, with a count of failures. Example: {\"pairs\": [{\"foreground\": \"#777\", \"background\": \"#fff\", \"label\": \"muted text\"}, {\"foreground\": \"#fff\", \"background\": \"#ff5a1f\", \"label\": \"button\"}]}."},{"name":"meridian_now","title":"Current time in any places or time zones","description":"Use when the user asks what time or date it is right now somewhere. Reads the server clock and returns the current time, date, UTC offset, abbreviation and daylight saving status for each place. Places can be cities (\"Tokyo\"), IANA zones (\"Europe/Paris\"), abbreviations (\"PST\") or \"UTC+5:30\"."},{"name":"meridian_convert_time","title":"Convert a time between time zones, DST-correct","description":"Use when you need to convert a specific wall-clock time from one place to others, for any date. It uses the real tz database, so daylight saving is right for that exact date (the US and Europe switch on different weeks), and it warns when the time does not exist (spring forward) or happens twice (fall back). Time accepts \"15:00\", \"3:30pm\", \"noon\", \"now\" or an ISO local time like 2026-11-05T15:00 (no Z). Date defaults to today in the source zone. Returns {input, utc, source:{...}, converted:[{place, zone, local, time_12h, date, utc_offset, abbreviation, day_note, hours_ahead_of_source}], warning?, summary, open_url}."},{"name":"meridian_meeting_slots","title":"Find meeting times that work across time zones","description":"Use when you need to schedule a call across several places. Scans the day in 15-minute steps and ranks start times so the most people are inside working hours and nobody is at night, using each place's real offset and DST for that date. Returns up to 5 slots with each person's local start and end, and says plainly when no time works for everyone. Defaults: working hours 9 to 17, 60 minutes, date today in the first place."},{"name":"meridian_zone_info","title":"Offset, abbreviation and daylight saving changes for a zone","description":"Use when you need to answer \"what is the UTC offset of X\", \"does X observe daylight saving\" and \"when do the clocks change\". Returns the current offset and abbreviation, whether the place observes DST, every clock change in the year with exact local before and after times, and the next change. Abbreviations like IST or CST are ambiguous, so the answer says which zone was used."},{"name":"doorman_check_ai_bot_access","title":"See which AI bots a website lets in","description":"Use when the user asks whether their site (or any public site), or a robots.txt they pasted, blocks ChatGPT, Claude, Google AI, Perplexity or other AI crawlers, whether AI can read or train on their content, or why AI search does not mention their site. Fetches the live robots.txt and reports, for 22 named AI bots in four groups (AI training, AI search, assistants, search engines), which are let in, kept out or partly blocked, plus the site's content-signal preference and fixes. Example: {\"url\": \"example.com\"} or {\"robots_txt\": \"User-agent: GPTBot\\nDisallow: /\"}. Pass robots_txt instead of url to check a draft or pasted file without fetching anything. Read-only."}],"prompts":[{"name":"stamp_check_my_email_setup","title":"Check my email setup","description":"Check a domain's SPF, DKIM, DMARC and MX, see if mail will reach the inbox, and get the DNS records to fix it."},{"name":"deadbolt_audit_supabase","title":"Audit Supabase access","description":"Check migration SQL for who can read and write each table, list the leaks and give the fix SQL."},{"name":"tick_prove_my_cron","title":"Prove my cron schedule","description":"Show the next run times for a cron expression in a timezone, with DST notes."},{"name":"mend_fix_my_json","title":"Fix broken JSON","description":"Repair JSON that will not parse and list every fix, without changing any value."},{"name":"swatch_audit_my_colors","title":"Check my colors for contrast","description":"Check text and background pairs against WCAG and fix the ones that fail."},{"name":"meridian_plan_a_call","title":"Find a call time across time zones","description":"Find meeting slots that work for people in several places, with daylight saving right for the date."},{"name":"doorman_audit_ai_access","title":"Audit which AI bots a site lets in","description":"Check a site and suggest a robots.txt."}],"publisher":{"name":"Clawhard Studio","url":"https://clawhard.com","contact":"support@clawhard.com"},"privacyPolicyUrl":"https://clawhard.com/privacy","termsOfServiceUrl":"https://clawhard.com/terms"}