# apimesh [Health: Active]

**Category:** 💰 Finance & Fintech  
**Repository:** https://github.com/mbeato/conway  
**GitHub Stars:** 6  
**npm Downloads (last month):** 226  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/apimesh

## Description
12 x402-payable API tools for AI agents. Pay per call with USDC on Base.

## Tools
Capabilities this server exposes over MCP:

- **web_checker** — Check if a brand name is available across 5 domain TLDs (.com, .io, .xyz, .dev, .ai), GitHub, npm, PyPI, and Reddit in one call. Free preview: GET https://check.apimesh.xyz/preview?name=... returns .com availability only
- **http_status_checker** — Check the live HTTP status of any URL, optionally verify against an expected code. Useful for uptime monitoring, redirect validation, and link checking
- **favicon_checker** — Check whether a website has a favicon and get its URL, format, and status. Useful for link previews and site branding validation
- **microservice_health_check** — Check health and response times of up to 10 service URLs in parallel. Free preview: GET https://microservice-health-check.apimesh.xyz/preview?url=... checks 1 service for free
- **robots_txt_parser** — Fetch and parse a website's robots.txt into structured rules, sitemaps, and crawl directives
- **core_web_vitals** — Get Core Web Vitals and Lighthouse performance scores for any URL. Returns LCP, CLS, INP field data plus performance, accessibility, best-practices, and SEO scores. Free preview: GET https://core-web-vitals.apimesh.xyz/preview?url=... returns performance score only
- **security_headers** — Audit HTTP security headers for any URL. Checks 10 headers (CSP, HSTS, X-Frame-Options, etc.) with weighted grading A+ through F and remediation suggestions. Free preview: GET https://security-headers.apimesh.xyz/preview?url=... checks 3 key headers for free
- **redirect_chain** — Trace the full redirect chain for any URL. Returns each hop with status code, location, and latency. Detects loops and extracts the final canonical URL. Free preview: GET https://redirect-chain.apimesh.xyz/preview?url=... traces up to 5 hops for free
- **email_security** — Check email security configuration for any domain. Analyzes SPF, DMARC, DKIM (probes 10 common selectors), and MX records with provider detection. Free preview: GET https://email-security.apimesh.xyz/preview?domain=... checks SPF and DMARC for free
- **seo_audit** — Run a comprehensive on-page SEO audit on any URL. Analyzes title, meta description, headings, images, links, content, canonical, OG tags, JSON-LD, and robots directives with a 0-100 score. Free preview: GET https://seo-audit.apimesh.xyz/preview?url=... returns title, meta, H1, and score for free
- **indexability_checker** — Check if a URL is indexable by search engines. Performs 5-layer analysis: robots.txt rules, HTTP status, meta robots, X-Robots-Tag, and canonical tag. Free preview: GET https://indexability.apimesh.xyz/preview?url=... checks HTTP status and meta robots for free
- **brand_assets** — Extract brand assets from any domain. Returns logo URL, favicon, theme colors, OG image, and site name. Free preview: GET https://brand-assets.apimesh.xyz/preview?domain=... returns Google favicon URL for free
- **email_verify** — Verify an email address: syntax validation, MX record check, disposable domain detection, role-address detection, free provider detection, and deliverability assessment. Free preview: GET https://email-verify.apimesh.xyz/preview?email=... checks syntax and disposable status for free
- **tech_stack** — Detect the technology stack of any website. Analyzes HTTP headers and HTML to identify CMS, frameworks, languages, analytics, CDN, hosting, JavaScript libraries, and CSS frameworks. Free preview: GET https://tech-stack.apimesh.xyz/preview?url=... detects technologies from HTTP headers only
- **wallet_usage** — Check your wallet's APIMesh spend and cap status. Returns daily/7d/30d spend totals, active spend cap with remaining budget, and recent requests. No authentication required.
- **web_resource_validator** — Validate presence and correctness of common web resources (robots.txt, sitemap.xml, openapi.json, agent.json) for any domain. Returns availability status for the requested resource.
- **website_security_header_info** — Analyze security-related HTTP headers for any website. Checks Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, Referrer-Policy, and Permissions-Policy with issue detection.
- **website_vulnerability_scan** — Comprehensive website security audit combining hostname analysis, SSL certificate validation, HTTP security headers, cookie security, and Content Security Policy analysis. Returns an overall security score (0-100) with actionable recommendations. Supports basic, detailed, and full scan levels.
- **mock_jwt_generator** — Generate test JWTs with custom claims and expiry for local development. Returns a signed HS256 token. Useful for testing auth flows without a real identity provider.
- **regex_builder** — Build and test regex patterns. POST /build creates a regex from a pattern string or components. POST /test validates a pattern against test strings. Useful for generating and debugging regular expressions.
- **status_code_checker** — Check the live HTTP status code of any URL. Returns the actual status code, reason phrase, and response headers. Simpler than http_status_checker — no expected-code validation.
- **swagger_docs_creator** — Generate OpenAPI 3.0 documentation for an API endpoint. Provide the path, method, summary, and optionally parameters/requestBody/responses to get a complete OpenAPI spec fragment.
- **user_agent_analyzer** — Parse a User-Agent string into structured data: browser name/version, OS name/version, device type, and bot detection. Useful for analytics and request filtering.
- **yaml_validator** — Validate YAML syntax and structure. Returns parsed result on success or detailed error with line/column on failure. Useful for CI pipelines and config file validation.
- **wallet_set_cap** — Set a spend cap on your wallet. Once the daily or monthly USDC limit is reached, further paid API calls return 429 before payment is attempted. Set limits to null to remove a cap.
- **subdomain_vulnerability_rankings** — Paid comprehensive subdomain enumeration and vulnerability ranking
- **csp_policy_heuristics** — Paid comprehensive audit with advanced heuristic analysis, web crawling, scoring, and detailed recommendations
- **ssl_tls_risk_analyzer** — Aggregates SSL/TLS configuration details from public scans, DNS records, and certificate transparency logs, then performs a risk assessment
- **subdomain_vulnerability_ranking** — Paid comprehensive subdomain enumeration and vulnerability ranking
- **subdomain_exposure_score** — Paid comprehensive full subdomain exposure scoring and audit report
- **ip_infrastructure_analyst** — Analyze an IP address for ASN, ISP, geolocation, and routing info; returns comprehensive report with scoring and recommendations
- **subdomain_exposure_scorer** — Comprehensive enumeration and exposure scoring of all detected subdomains for a domain
- **ssl_tls_threat_assessment** — Comprehensive TLS security threat assessment for a domain
- **privacy_policy_qualify** — Fetch and analyze privacy policies across domains for GDPR/CCPA compliance and data sharing signals
- **dns_propagation_mapper** — Comprehensive DNS propagation audit across multiple global DNS resolvers with delay correlation, misconfiguration detection, scoring, grading, and recommendations
- **ip_infrastructure_analyzer** — Comprehensive IP infrastructure analysis: ASN, ISP, geolocation, routing checks, scoring, recommendations
- **ip_geolocation_enrichment** — Enrich an IP address with detailed ASN, ISP, geolocation, and routing data
- **website_authenticity_assessment** — Comprehensive website authenticity assessment combining SSL cert validation, DNS records, redirect chain analysis, and server headers
- **ssl_and_tls_hardening_score** — Run full SSL, TLS, and HTTP security header comprehensive hardening score with actionable recommendations
- **security_headers_checker** — Perform a comprehensive security headers audit with detailed scoring and remediation
- **subdomain_exposure_ranking** — Comprehensive paid scan: exhaustive subdomain enumeration from DNS, CT logs, plus HTTP endpoint probing, header analysis, TLS version checks, outdated service detection, with full scoring and rich recommendations
- **ssl_tls_hardening_forecast** — Analyze SSL/TLS info and forecast renewal and security outlook with detailed alerts and recommendations
- **subdomain_exposure_rankings** — Paid, comprehensive analysis of subdomain exposure and security ranking
- **ssl_tls_expiry_forecast** — Comprehensive SSL/TLS certificate and protocol expiry forecast for multiple domains
- **network_route_mapper** — Paid comprehensive analysis of network routing paths including ASN hops, geolocation, latency, suspicion scoring, and remediation
- **subdomain_exposure_heatmap** — Exhaustive subdomain enumeration from multiple sources, risk analysis, exposure scoring, recommendations and heatmap report
- **dns_propagation_simulator** — Simulate DNS record propagation across multiple DNS resolvers with delay estimation and misconfiguration detection
- **ssl_tls_configuration_ranker** — Perform a deep, comprehensive SSL/TLS configuration audit of a target site
- **privacy_policy_enricher** — Fetch and analyze a privacy policy URL, combining multiple signals for GDPR and CCPA compliance, data sharing practices, and privacy features
- **privacy_risk_score** — Comprehensive privacy risk analysis of a domain's publicly available privacy policies and disclosures
- **http_method_enumeration** — Full enumeration of HTTP methods supported by a target URL with scoring and analysis
- **web_misconfiguration_scan** — Run a comprehensive security misconfiguration scan against the specified URL
- **dependency_license_audit** — Comprehensive license audit across multiple project manifests and license databases with risk scoring
- **ssl_tls_configuration_forecast** — Comprehensive paid SSL/TLS configuration forecast and security score for a domain
- **subdomain_risk_ranking** — Perform a deep, comprehensive subdomain enumeration and risk ranking audit
- **content_shuffle_detector** — Paid comprehensive audit with multiple fetches, deep NLP content variation analysis, content diffing, and scoring to detect content shuffling and obfuscation
- **api_schema_diff** — Compare multiple API schema versions (REST or GraphQL) to highlight differences and score compatibility
- **api_linting** — Run a comprehensive linting and validation on provided OpenAPI spec and implementation URLs
- **port_scanner_aggregate** — Deep scan of a list of IP addresses or CIDR ranges with multi-source aggregation and vulnerability scoring
- **cdn_infrastructure_enricher** — Comprehensive paid audit integrating DNS, HTTP headers, IP and regional info with detailed scoring and recommendations
- **web_configuration_audit** — Comprehensive paid audit with detailed scoring, grade, meta tags, and .env leak detection
- **subdomain_vulnerability_ranker** — Exhaustive subdomain enumeration, vulnerability inference, scoring, and recommendations
- **ssl_tls_inception_score** — Comprehensive SSL/TLS certificate and protocol audit for the specified hostname or URL
- **dns_propagation_heatmap** — Paid comprehensive DNS propagation audit across multiple resolver types, including scoring and actionable recommendations
- **api_schema_delta** — Compare multiple API schemas from given URLs and return detailed diff and evolution analysis
- **port_scanner** — Perform a deep port scan on a target IP or hostname
- **ssl_tls_hardening_assessor** — Get a comprehensive SSL/TLS and DNS record security assessment for a hostname
- **api_endpoint_discovery** — Comprehensively crawl and analyze API endpoints on the specified domain
- **api_response_heuristics** — Comprehensive API response heuristic analysis with scoring and recommendations
- **api_standard_compliance** — Perform a comprehensive API standard compliance analysis on the target API response URL
- **content_security_policy_check** — Perform a comprehensive security header and content security policy audit
- **cross_origin_resource_policymapper** — Perform comprehensive CORS headers audit across multiple endpoints
- **dns_propagation_inspector** — Comprehensive DNS propagation audit across global resolvers with detailed result analysis
- **performance_security_compliance_report** — Comprehensive payable audit combining performance metrics, security headers, SSL cert and DNS analysis with scoring and prioritized fix suggestions
- **site_security_baseline** — Comprehensive baseline audit with combined security headers, SSL, and configuration checks
- **ssl_expiry_forecast** — Paid endpoint combining certificate transparency logs, DNS, SSL cert data to forecast expiry across multiple domains

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "apimesh": {
    "command": "npx",
    "args": ["-y","@mbeato/apimesh-mcp-server"]
  }
}
```

## Documentation

## What apimesh MCP server does

The apimesh MCP server gives AI agents access to APIMesh’s collection of focused web analysis and developer utility APIs. The published package exposes 67 MCP tools, while the APIMesh service lists 102 APIs. These cover website performance, security headers, SEO, indexability, redirects, email security, brand assets, technology detection, service health, and related checks.

Developer-oriented tools include regex generation and testing, YAML validation, mock JWT generation, user-agent parsing, HTTP status-code lookup, and OpenAPI documentation generation. APIMesh also lists autonomously built APIs for broader site, domain, security, and performance reports. The service can add APIs as its automated system identifies demand.

## How it works

Each APIMesh API is hosted on its own subdomain under `apimesh.xyz`. The MCP server presents these remote operations to an MCP-compatible client, allowing an agent to select a tool and pass inputs such as a URL, domain, email address, service list, status code, or natural-language regex description.

Paid requests use one of three payment paths. With x402, an endpoint returns payment details, the agent signs a USDC payment on Base, and the request is retried with an `X-PAYMENT` header. Stripe MPP supports machine payments using cards or stablecoins. Developers can instead buy credits through Stripe checkout and authenticate with an API key. The README identifies Coinbase CDP as the x402 facilitator.

## Setup and configuration

Run the server with npm and expose its tools to an MCP client:

```bash
npx @mbeato/apimesh-mcp-server
```

For clients using a JSON configuration, register a server named `apimesh` with `npx` as the command and `@mbeato/apimesh-mcp-server` as its argument. The README gives examples for Claude Desktop and Cursor configuration files. It also identifies Windsurf and Cline as supported clients, along with any MCP-compatible client.

Some APIs provide preview routes that do not require payment or signup. The documented examples cover Core Web Vitals, security headers, SEO auditing, and name availability. These previews are direct HTTP requests rather than a separate MCP configuration step.

## Tools and capabilities

The available API groups support tasks such as:

- Measuring Core Web Vitals and performance, accessibility, and SEO grades
- Auditing HTTP security headers, SSL-related signals, cookies, and CSP
- Inspecting SEO metadata, robots rules, canonical URLs, and indexability
- Checking SPF, DKIM, DMARC, MX records, email syntax, and disposable domains
- Detecting CMSs, frameworks, analytics systems, CDNs, hosting, and JavaScript libraries
- Validating YAML, creating regexes, generating mock JWTs, and producing OpenAPI 3.0 documentation
- Checking redirects, HTTP status codes, favicons, service health, and web resource presence

The HTTP API also includes wallet spend summaries, transaction history, and configurable wallet caps. These endpoints are documented as free and require no authentication.

## Limitations and notes

The apimesh MCP server does not make the listed paid APIs free: normal calls require x402 payment, Stripe MPP payment, or API-key credits. x402 uses USDC on Base, identified as chain ID 8453. Traditional API-key access requires purchasing credits through the APIMesh signup flow.

Payment handling, wallet funding, and API-key setup therefore depend on the selected payment method and the remote APIMesh service. API prices vary by operation, with the examples in the README ranging from $0.001 to $0.01 per request.

_Full upstream README: https://allmcps.com/mcp/apimesh/readme_