# Tamperbox documentation

> Documentation for Tamperbox browser tools, the public API, and the Tamperbox MCP server.

Tamperbox provides browser-local developer utilities and clearly labelled server-side diagnostics. The MCP server exposes two code-mode tools over a documented operation catalog.

## Documentation

- [AAAA Lookup](https://docs.tamperbox.dev/tools/aaaa-lookup.md): Method, finding reference and guide for the Tamperbox AAAA Lookup, which asks Cloudflare for a name's AAAA and A records over DNS over HTTPS, classifies each IPv6 address (global, documentation, unique local, link-local, loopback, unspecified, multicast, IPv4-mapped, NAT64, 6to4, Teredo, special-purpose), looks up the network of each global address from the Team Cymru IP-to-ASN service, and reports non-public addresses, IPv6-only and IPv4-only names.
- [Ads.txt & App-Ads.txt Checker](https://docs.tamperbox.dev/tools/ads-txt-checker.md): Method, finding reference and repair guide for the Tamperbox ads.txt and app-ads.txt checker, which fetches the file from the root of a host on the Tamperbox server, or reads a pasted file in the browser, validates each record against the IAB Tech Lab ads.txt 1.1 layout and cross-checks up to 12 ad systems' sellers.json files.
- [ASN Lookup](https://docs.tamperbox.dev/tools/asn-lookup.md): Method, finding reference and guide for the Tamperbox ASN Lookup, which asks RIPEstat (RIPE RIS route collectors) for the routed prefix and origin networks of a public address or the overview of an AS number, and asks the address registry over RDAP who holds the block.
- [BGP Route Lookup](https://docs.tamperbox.dev/tools/bgp-lookup.md): Method, finding reference and guide for the Tamperbox BGP Route Lookup, which asks RIPEstat (RIPE RIS route collectors) for a prefix's origins, collector visibility, first and last seen, route objects and related prefixes, and lists potential hijacks and route leaks reported by Cloudflare Radar.
- [BIMI Record Checker](https://docs.tamperbox.dev/tools/bimi-checker.md): Method, finding reference and repair guide for the Tamperbox BIMI Record Checker, which reads the default._bimi and _dmarc records through public DNS, fetches the logo and certificate the record names, checks the SVG as text against the Tiny Portable/Secure profile, reads the certificate's logotype extension, validity and names, and requires DMARC enforcement.
- [Broken Link Checker](https://docs.tamperbox.dev/tools/broken-link-checker.md): Method, finding reference and repair guide for the Tamperbox Broken Link Checker, which fetches one page, collects up to 300 unique link, image, script, style sheet, frame and media addresses from its HTML, and requests each from the Tamperbox server with HEAD then GET, 8 seconds per link and 45 seconds in all.
- [CAA Lookup](https://docs.tamperbox.dev/tools/caa-lookup.md): Method, finding reference and guide for the Tamperbox CAA Lookup, which asks Cloudflare for CAA records over DNS over HTTPS, climbing parent names until it finds some (stopping below the top-level domain), or reads pasted records in the browser, then reports who may issue ordinary and wildcard certificates, unknown critical tags, empty issue values, unknown CA identifiers, a missing iodef contact, and logged issuers from a crt.sh search that the policy no longer allows.
- [CDN Detector](https://docs.tamperbox.dev/tools/cdn-detector.md): Method, finding reference and repair guide for the Tamperbox CDN Detector.
- [CNAME Lookup](https://docs.tamperbox.dev/tools/cname-lookup.md): Method, finding reference and guide for the Tamperbox CNAME Lookup, which asks Cloudflare for a name's A records over DNS over HTTPS so the resolver returns every CNAME step, or reads pasted CNAME records in the browser, then reports a target that does not exist (dangling alias), a CNAME at the registrable domain, a loop and chains of more than two aliases.
- [Code mode](https://docs.tamperbox.dev/mcp/code-mode.md): Use focused JavaScript with search and execute to discover schemas, call supported endpoints, and preserve warnings.
- [Connect an MCP client](https://docs.tamperbox.dev/mcp/connect.md): Configure Tamperbox MCP in a compatible client using the npm stdio package or the public HTTP endpoint.
- [Contributing](https://docs.tamperbox.dev/contributing.md): Set up the documentation repository, edit MDX content, verify the Astro build, and open a focused contribution.
- [CORS Tester](https://docs.tamperbox.dev/tools/cors-tester.md): Method, finding reference and repair guide for the Tamperbox CORS Tester, which sends one OPTIONS preflight and, for GET or HEAD only, one request with the Origin header from the Tamperbox server, or reads pasted response headers in the browser, and reports step by step whether a browser would allow the call.
- [DANE & TLSA Checker](https://docs.tamperbox.dev/tools/dane-checker.md): Method, finding reference and repair guide for the Tamperbox DANE & TLSA Checker, which resolves a domain's MX hosts, reads the TLSA records at _25._tcp.<host> with the resolver's DNSSEC AD flag, connects to each server (STARTTLS on port 25) and reports which record matches the presented leaf or issuing certificate.
- [DKIM Record Checker](https://docs.tamperbox.dev/tools/dkim-checker.md): Method, finding reference and repair guide for the Tamperbox DKIM Record Checker, which probes 24 common selectors from the Tamperbox server, reads a pasted DKIM-Signature header to find the exact key behind a message, measures key length from the key bytes, and reports flags, revocation and fingerprints.
- [DMARC Checker & Generator](https://docs.tamperbox.dev/tools/dmarc-checker.md): Method, finding reference and repair guide for the Tamperbox DMARC Checker & Generator, which reads the _dmarc record through public DNS or parses a pasted one, grades policy, percentage, subdomain policy, report addresses and alignment, and drafts the next record on the path from p=none to p=reject.
- [DNS Lookup](https://docs.tamperbox.dev/tools/dns-lookup.md): Method, finding reference and guide for the Tamperbox DNS Lookup, which sends one DNS query for a name and type to Cloudflare, Google or Quad9 over DNS over HTTPS or to the zone's authoritative nameserver over TCP port 53, validates the response, and reports status, flags, TTLs, aliases and the AD flag as the resolver's DNSSEC assertion.
- [DNS Propagation Checker](https://docs.tamperbox.dev/tools/dns-propagation.md): Method, finding reference and guide for the Tamperbox DNS Propagation Checker, which sends one question (A, AAAA, CNAME, MX, TXT or NS) to twelve public resolvers over DNS over HTTPS and to the zone's authoritative nameserver over TCP port 53, compares each public answer with the authoritative one, and reports resolvers holding a different answer with the largest TTL they still hold, resolvers that error, and the all-SERVFAIL pattern of a broken DNSSEC chain.
- [DNS Provider Lookup](https://docs.tamperbox.dev/tools/dns-provider.md): Method, finding reference and repair guide for the Tamperbox DNS Provider Lookup.
- [DNSSEC Checker](https://docs.tamperbox.dev/tools/dnssec-checker.md): Method, finding reference and repair guide for the Tamperbox DNSSEC Checker, which reports a validating resolver's secure, bogus, insecure or indeterminate verdict for a domain and reads the DS, DNSKEY and RRSIG records at every zone cut from the root, or matches pasted DS and DNSKEY records in the browser.
- [Domain Availability Checker](https://docs.tamperbox.dev/tools/domain-availability.md): Method, finding reference and guide for the Tamperbox Domain Availability Checker, which finds the registry for a domain through the IANA RDAP bootstrap, asks it for the domain's RDAP record, treats an RDAP not-found answer as no registration (not a guarantee of availability), and reads registration and expiry dates, EPP status codes, transfer locks and the redemption lifecycle.
- [Domain Health Check](https://docs.tamperbox.dev/tools/domain-health.md): Method, finding reference and repair guide for the Tamperbox Domain Health Check.
- [Email Header Analyzer](https://docs.tamperbox.dev/tools/email-header-analyzer.md): Method, standards conformance, finding reference and guide for the Tamperbox Email Header Analyzer, which parses a message's header block in the browser, orders the Received hops oldest first with the delay each server added and whether the hop was encrypted, reads the topmost Authentication-Results header, compares identities for exact alignment, and looks up hop addresses only on request. It reports what the receiver recorded and does not verify DKIM, SPF, DMARC or ARC itself.
- [Email Provider Lookup](https://docs.tamperbox.dev/tools/email-provider.md): Method, provider-signature reference and investigation guide for the Tamperbox Email Provider Lookup, with explicit gateway and uncertainty boundaries.
- [Exact-Length String Generator](https://docs.tamperbox.dev/tools/string-length-generator.md): Method and guide for the Tamperbox Exact-Length String Generator, which builds a string of exactly N characters, UTF-16 units or UTF-8 bytes from a chosen fill (ASCII, digits, accented Latin, CJK, emoji, mixed widths or combining accents), a limit test set around N, or a counterstring, in the browser. Also reachable as the string_generate operation.
- [Getting started](https://docs.tamperbox.dev/getting-started.md): Choose between browser tools, direct API operations, and MCP code mode, then complete a small safe first run.
- [HAR File Sanitizer](https://docs.tamperbox.dev/tools/har-sanitizer.md): Method, finding reference and guide for the Tamperbox HAR File Sanitizer, which walks a HAR file in the browser, replaces Authorization credentials, cookie values, credential-named headers, query parameters, form and JSON fields, JSON Web Token signatures and personal claims, private keys, AWS, Google, GitHub, Stripe and Slack keys, bearer tokens, email addresses, Luhn-valid card numbers and optionally IPv4 addresses with stable numbered placeholders, decodes Base64 text bodies, reports every replacement by request and place, and lists the requests with failures exportable as Markdown. Also reachable as the har_sanitize operation.
- [Hidden Character Checker](https://docs.tamperbox.dev/tools/hidden-characters.md): Method, finding reference and guide for the Tamperbox Hidden Character Checker, which reads text one Unicode code point at a time in the browser, reports invisible, direction, control, filler, tag, look-alike and decomposed characters with code point and position, counts characters, UTF-16 units, UTF-8 bytes and visible characters, shows the NFC, NFD, NFKC and NFKD forms, and cleans the text with the repairs the reader ticks. Also reachable as the text_inspect operation.
- [HTTP/3 & Compression Checker](https://docs.tamperbox.dev/tools/http3-checker.md): Method, finding reference and repair guide for the Tamperbox HTTP/3 & Compression Checker, which fetches a page from the Tamperbox server once per Accept-Encoding, tests a QUIC-only connection where the probe allows, reads HSTS on the host and its main domain and asks hstspreload.org, or reads pasted response headers in the browser.
- [JSON to YAML Converter](https://docs.tamperbox.dev/tools/json-to-yaml.md): Convert JSON fixtures to YAML locally, reject duplicate keys and unsafe numbers, and verify the parsed data rather than comparing formatting.
- [JWT Decoder & Verifier](https://docs.tamperbox.dev/tools/jwt.md): Method, finding reference and repair guide for the Tamperbox JWT Decoder & Verifier, which decodes a three-part JWS in the browser, verifies HMAC, RSA, RSA-PSS, ECDSA and Ed25519 signatures with a supplied key through Web Crypto, checks exp, nbf, iat, iss and aud, and rebuilds edited test tokens without sending anything.
- [Limits](https://docs.tamperbox.dev/reference/limits.md): Review the default Tamperbox MCP execution budgets and the behavior that occurs when a limit is reached.
- [llms.txt Checker & Generator](https://docs.tamperbox.dev/tools/llms-txt.md): Method, finding reference and repair guide for the Tamperbox llms.txt checker and generator, which fetches /llms.txt, the home page, robots.txt and up to two top-level sitemaps with up to four children each from the Tamperbox server, or reads a pasted file in the browser, checks it against the llmstxt.org proposal, compares it with the sitemap and drafts a file from what the site publishes.
- [Minecraft Server Status Checker](https://docs.tamperbox.dev/tools/minecraft-server-status.md): Method, finding reference and guide for the Tamperbox Minecraft Server Status Checker, which follows the _minecraft._tcp SRV record when no port is given, connects once from Eastern North America, performs the Java Edition Server List Ping and reports the self-reported version, players and message with TCP connect and ping times.
- [Mixed Content & Cookie Checker](https://docs.tamperbox.dev/tools/mixed-content-checker.md): Method, finding reference and repair guide for the Tamperbox Mixed Content & Cookie Checker, which fetches a public page from the Tamperbox server (or reads pasted HTML and headers in the browser), lists every http:// subresource and form on an HTTPS page as blocked, upgraded or warned, and checks every Set-Cookie header for Secure, HttpOnly, SameSite, Domain, lifetime, size and prefix rules.
- [Mojibake Fixer](https://docs.tamperbox.dev/tools/mojibake-fixer.md): Method and guide for the Tamperbox Mojibake Fixer, which finds runs of characters that Windows-1252 or Latin-1 can produce, turns them back into bytes, keeps the result only when the bytes are valid UTF-8, repeats up to three times for text damaged more than once, lists every repaired run, and reports replacement characters as lost data, in the browser. Also reachable as the mojibake_fix operation.
- [MTA-STS & TLS-RPT Checker](https://docs.tamperbox.dev/tools/mta-sts-checker.md): Method, finding reference and repair guide for the Tamperbox MTA-STS & TLS-RPT Checker, which reads the _mta-sts and _smtp._tls records and the MX records through public DNS, fetches the policy file over HTTPS, checks the file's syntax and mode, compares every MX host with the policy's mx lines, and suggests an enforcing policy that covers every server.
- [MX Lookup & Email Domain Checker](https://docs.tamperbox.dev/tools/email-domain.md): Method, finding reference and repair guide for the Tamperbox MX Lookup and Email Domain Checker, including null MX and address fallback.
- [My Connection Info](https://docs.tamperbox.dev/tools/connection-info.md): Method, finding reference and guide for the Tamperbox My Connection Info page, which reads the visitor's connection metadata at Tamperbox's Cloudflare edge (TLS version and cipher, HTTP protocol, TCP or QUIC round trip, edge location, AS number, network and country) and grades each layer.
- [Naughty Strings List](https://docs.tamperbox.dev/tools/naughty-strings.md): Method and guide for the Tamperbox Naughty Strings List, a built-in set of 158 hostile test strings in eleven groups, each with the reason it tests something, searchable by name, reason or code point, with active payloads hidden by default and export as JSON, JavaScript, Python, CSV or one value per line with invisible characters escaped. Also reachable as the naughty_strings operation.
- [NS Lookup](https://docs.tamperbox.dev/tools/ns-lookup.md): Method, finding reference and guide for the Tamperbox NS Lookup, which asks Cloudflare for a zone's NS records over DNS over HTTPS or reads pasted NS records in the browser, names each nameserver's provider from a catalog of 29 providers or as self-hosted, and reports a single nameserver, more than one provider, self-hosted servers and servers not in the catalog.
- [Open Graph Preview](https://docs.tamperbox.dev/tools/open-graph-preview.md): Method, finding reference and repair guide for the Tamperbox Open Graph Preview, which fetches a page and its share image from the Tamperbox server, or reads pasted HTML in the browser, and draws a large card, an X card, a chat unfurl and a search result from its Open Graph, Twitter and HTML tags.
- [Open Port Checker](https://docs.tamperbox.dev/tools/open-port-checker.md): Method, finding reference and guide for the Tamperbox Open Port Checker, which makes one TCP connection, from Eastern North America with a 1.5 second limit, to the public address the visitor's request came from, on one port, and reports open, refused or no answer with next steps.
- [Operation catalog](https://docs.tamperbox.dev/reference/operations.md): Browse Tamperbox operation families and learn which input shapes and evidence boundaries each family uses.
- [Post-Quantum TLS Checker](https://docs.tamperbox.dev/tools/post-quantum-checker.md): Method, finding reference and repair guide for the Tamperbox Post-Quantum TLS Checker, which runs a default TLS handshake and an ML-KEM-only handshake on port 443 from the Tamperbox server, or reads pasted openssl s_client or curl -v output in the browser, and reports whether the session key is protected by an ML-KEM hybrid.
- [Postman Collection Converter](https://docs.tamperbox.dev/tools/postman-converter.md): Method, finding reference and repair guide for the Tamperbox Postman Collection Converter, which converts Postman Collection v2, OpenAPI 3.0 or 3.1 and POSIX cURL commands into one another in the browser, replaces known credential fields with placeholders, and reports what the conversion kept, dropped and could not carry.
- [Redirect Checker](https://docs.tamperbox.dev/tools/redirect-checker.md): Method, finding reference and repair guide for the Tamperbox Redirect Checker, which requests each hop of a redirect chain from the Tamperbox server without cookies, or reads pasted curl -sIL output in the browser, and reports loops, downgrades, temporary codes on permanent moves, long chains and dead ends.
- [Reverse DNS Lookup](https://docs.tamperbox.dev/tools/reverse-dns.md): Method, finding reference and repair guide for the Tamperbox Reverse DNS Lookup, which looks up the PTR record of up to 20 IP addresses (or a domain's own A and AAAA addresses), checks forward confirmation (the iprev test of RFC 8601), flags generic provider names and explains private addresses without a lookup.
- [Robots.txt & Sitemap Checker](https://docs.tamperbox.dev/tools/robots-txt-checker.md): Method, finding reference and repair guide for the Tamperbox robots.txt and sitemap checker, which fetches robots.txt and up to six sitemaps from the Tamperbox server, or reads a pasted file in the browser, evaluates RFC 9309 groups and longest-match rules for 14 search and AI crawler tokens, and tests any path.
- [SaaS Stack Detector](https://docs.tamperbox.dev/tools/saas-stack.md): Method, finding reference and repair guide for the Tamperbox SaaS Stack Detector.
- [Security and privacy](https://docs.tamperbox.dev/reference/security.md): Understand the Tamperbox MCP sandbox, API data path, supported boundaries, and evidence interpretation rules.
- [Security Headers Checker](https://docs.tamperbox.dev/tools/security-headers.md): Method, finding reference and repair guide for the Tamperbox Security Headers Checker, which grades the final response of a public website (fetched by the Tamperbox server after up to 10 redirects) or pasted response headers (read in the browser) on six headers, from A+ to F, and writes the missing lines in server syntax.
- [security.txt Checker](https://docs.tamperbox.dev/tools/security-txt-checker.md): Method, finding reference and repair guide for the Tamperbox security.txt Checker, which fetches https://host/.well-known/security.txt from the Tamperbox server (up to five HTTPS redirects, 64 KiB) or reads a pasted file in the browser, and checks it against RFC 9116.
- [SOA Lookup](https://docs.tamperbox.dev/tools/soa-lookup.md): Method, finding reference and guide for the Tamperbox SOA Lookup, which asks Cloudflare for a name's SOA record over DNS over HTTPS (using the zone's SOA from the authority section for a name inside a zone) or reads a pasted SOA in the browser, explains its seven fields, reads a YYYYMMDDnn serial as a date, and checks refresh (20 minutes to 1 day), retry (2 minutes to 2 hours, shorter than refresh), expire (1 to 4 weeks) and negative caching (5 minutes to 1 day).
- [SPF Checker](https://docs.tamperbox.dev/tools/spf-checker.md): Method, finding reference and repair guide for the Tamperbox SPF Checker, which expands an SPF record through public DNS, counts lookup-causing terms against the limit of 10, reports syntax and hygiene problems, and proposes a flattening plan built from the include tree.
- [SRV Lookup](https://docs.tamperbox.dev/tools/srv-lookup.md): Method, finding reference and guide for the Tamperbox SRV Lookup, which asks Cloudflare for the SRV records at a _service._protocol name over DNS over HTTPS (offering common services for a bare domain) or reads pasted SRV records in the browser, groups targets by priority, computes each target's share from the weights inside its priority, recognises the "." target, and reports port 0 and all-zero weights.
- [SSL Certificate Checker](https://docs.tamperbox.dev/tools/ssl-checker.md): Method, finding reference and repair guide for the Tamperbox SSL Certificate Checker, which probes one TLS connection from the Tamperbox server or reads a pasted PEM chain in the browser and reports trust, names, expiry, chain order, keys and the negotiated protocol.
- [Subdomain Finder](https://docs.tamperbox.dev/tools/subdomain-finder.md): Method, finding reference and repair guide for the Tamperbox Subdomain Finder.
- [Tamperbox documentation](https://docs.tamperbox.dev/index.md): Start here for the Tamperbox documentation map, product boundaries, and the shortest path to a working integration.
- [Tamperbox MCP](https://docs.tamperbox.dev/mcp.md): Understand the Tamperbox MCP architecture, its two tools, supported transports, and trust boundaries.
- [TCP Ping](https://docs.tamperbox.dev/tools/tcp-ping.md): Method, finding reference and guide for the Tamperbox TCP Ping, which resolves a host in up to three regions (Eastern North America, Western Europe, Asia Pacific) and makes three TCP handshakes to the first public address from each, reporting open, refused or unanswered attempts with connect times.
- [Tool pages](https://docs.tamperbox.dev/tools.md): Map of the documented Tamperbox tools, what each tool page shows, and where the full method, finding reference and guide for each tool live.
- [TXT Record Lookup](https://docs.tamperbox.dev/tools/txt-lookup.md): Method, finding reference and guide for the Tamperbox TXT Record Lookup, which asks Cloudflare for the TXT records at a name over DNS over HTTPS or reads pasted records in the browser, names each record by its prefix (SPF, DMARC, DKIM key, MTA-STS, TLS reporting, BIMI or one of 35 verification tokens), and flags more than one SPF record and character-strings over 255 characters.
- [Unix Timestamp Converter](https://docs.tamperbox.dev/tools/unix-timestamp.md): Method, finding reference and guide for the Tamperbox Unix Timestamp Converter, which converts epoch seconds, milliseconds, microseconds and nanoseconds, ISO 8601 and HTTP dates with exact integer arithmetic in the browser, reports a guessed unit or an assumed time zone as a Check, and flags the signed 32-bit range.
- [Website Down Checker](https://docs.tamperbox.dev/tools/website-down-checker.md): Method, finding reference and repair guide for the Tamperbox Website Down Checker, which makes one HTTP request from the Tamperbox server, follows up to five redirects within ten seconds, and reports up, slow, erroring or down with the stage where a request stopped.
- [Website Hosting Checker](https://docs.tamperbox.dev/tools/website-hosting.md): Method, finding reference and repair guide for the Tamperbox Website Hosting Checker.
- [Website Technology Detector](https://docs.tamperbox.dev/tools/website-technology.md): Method, finding reference and repair guide for the Tamperbox Website Technology Detector.
- [What Is My IP Address?](https://docs.tamperbox.dev/tools/what-is-my-ip.md): Method, finding reference and guide for the Tamperbox What Is My IP page, which reads the source address, family, network, AS number and estimated country of the visitor's connection on the Tamperbox server, and on request runs an IPv4-only and an IPv6-only echo request to ipify from the browser.
- [WHOIS & RDAP Lookup](https://docs.tamperbox.dev/tools/whois-lookup.md): Method, finding reference and guide for the Tamperbox WHOIS & RDAP Lookup, which finds the responsible registry through the IANA RDAP bootstrap lists, fetches the RDAP record for a domain or IP address (or reads pasted RDAP JSON in the browser), and shows the registrar, dates, EPP statuses, nameservers, DS records, registry events, abuse contact and raw JSON, with registration checks for domains.
- [Workflow patterns](https://docs.tamperbox.dev/workflows.md): Apply safe discovery-first patterns for transforms, diagnostics, parallel checks, and multi-step artifacts.
- [YAML to JSON Converter](https://docs.tamperbox.dev/tools/yaml-to-json.md): Convert YAML fixtures to JSON locally, disclose presentation loss, reject ambiguous constructs, and verify the resolved data rather than the source spelling.

## Primary interfaces

- [Tamperbox tools](https://tamperbox.dev): Browser tools and diagnostic checks.
- [Tamperbox MCP](https://github.com/oceanrescue/tamperbox-mcp): Public MCP server source, examples, and release information.
- [Documentation repository](https://github.com/oceanrescue/tamperbox-doc): Source and issue tracking for this site.