# Toolcard

Toolcard checks one MCP tool, or a whole tools list, against a short, cited rule list, and it keeps an anonymous tally of tools that were called or ignored.

A check is not stored. A report stores the tool name, the SHA-256 of the description if you sent one, `called` or `ignored`, an optional client label, and the time. Raw descriptions and schemas are not stored. The public tally does not list tool names.

An empty `findings` list means these checks did not fire. It does not mean the tool is good. Toolcard does not call a model and does not take payment.

## Check

```
curl -s -X POST https://agentghostedme.com/v1/check \
  -H 'content-type: application/json' \
  -d '{"name":"getUser","description":"Get a user","inputSchema":{"type":"object","properties":{"id":{"type":"string"}},"required":["id"]}}'
```

For rules version `2026-10-18.1`, that body returns `shape: endpoint-shaped`, `stored: false`, and finding ids `endpoint-shaped-name`, `thin-description`, and `description-echoes-name`.

Each of those findings includes `resource`. `endpoint-shaped-name` is `toolcard://answers/mcp-tools-mapped-1-to-1-onto-a-rest-api`. `thin-description` and `description-echoes-name` are `toolcard://answers/mcp-server-loads-but-the-agent-never-calls-it`. A `wide-input` finding is `toolcard://answers/picking-the-right-subset-of-parameters`. `missing-input-schema`, `input-schema-not-object`, `duplicate-name`, `overlapping-descriptions`, and `too-many-tools` omit `resource`. Pass `resource` to `resources/read`. It is not an http URL.

`manage_user` with a description of what the tool does and two input properties returns `shape: not-endpoint-shaped` and `findings: []`.

## Check a tools list

```
curl -s -X POST https://agentghostedme.com/v1/check-server \
  -H 'content-type: application/json' \
  -d '{"tools":[{"name":"getUser","description":"Get a user","inputSchema":{"type":"object","properties":{"id":{"type":"string"}}}},{"name":"listUsers","description":"List users","inputSchema":{"type":"object","properties":{"id":{"type":"string"}}}}]}'
```

`POST /v1/check-server` accepts that `tools` array, a JSON-RPC envelope whose `result.tools` is the list, or a server card with a `tools` array. Each tool is checked the same way. Top-level `findings` are only `duplicate-name`, `overlapping-descriptions`, and `too-many-tools`. One list counts as one check. Nothing is stored. The MCP tool is `check_server`.

More than 20 tools fires `too-many-tools`. 20 stays quiet. That cutoff is Toolcard's. Duplicate names compare the trimmed name and keep case. Two descriptions overlap when both have at least 4 content tokens and share at least 80 percent of the shorter set. Send at most 64 tools. The body limit is 128KB.

Live samples: [GET /v1/examples](https://agentghostedme.com/v1/examples). Rule list: [GET /v1/rules](https://agentghostedme.com/v1/rules). The name-check answer, with the same checker, is [MCP tools mapped 1:1 onto a REST API](https://agentghostedme.com/mcp-tools-mapped-1-to-1-onto-a-rest-api.md). The description-check answer is [MCP server loads but the agent never calls the tool](https://agentghostedme.com/mcp-server-loads-but-the-agent-never-calls-it.md). The wide-input answer is [Picking the right subset of parameters](https://agentghostedme.com/picking-the-right-subset-of-parameters.md).

## Report an outcome

```
curl -s -X POST https://agentghostedme.com/v1/outcomes \
  -H 'content-type: application/json' \
  -d '{"name":"manage_user","result":"called","report_id":"report_8f3a12bc"}'
```

`result` is `called` or `ignored`. The same `report_id` is stored once. Do not send secrets or personal data.

Tally: [GET /v1/outcomes/summary](https://agentghostedme.com/v1/outcomes/summary). Counts only. Not a representative sample.

## MCP

`POST https://agentghostedme.com/mcp` accepts one JSON-RPC object. Stateless. No session id. `initialize` is optional. When a client sends it, `result.instructions` says to call `check_tool` or `check_server` and to pass a finding's `resource` to `resources/read`, and it names the three answer URIs. `missing-input-schema`, `input-schema-not-object`, `duplicate-name`, `overlapping-descriptions`, and `too-many-tools` omit `resource`.

Tools: `check_tool`, `check_server`, `report_outcome`, `outcome_summary`.

Three read-only resources: `toolcard://answers/mcp-tools-mapped-1-to-1-onto-a-rest-api`, `toolcard://answers/mcp-server-loads-but-the-agent-never-calls-it`, and `toolcard://answers/picking-the-right-subset-of-parameters`. `resources/list` returns all three. `resources/read` returns the markdown of that answer page. There are no resource templates and no subscriptions. A read stores nothing and does not use the MCP tool-call cap.

If `Accept` is only `text/event-stream`, the response is one SSE event. Otherwise the response is JSON.

Server card: [/.well-known/mcp/server-card.json](https://agentghostedme.com/.well-known/mcp/server-card.json). The `skills` array names [skills/SKILL.md](https://agentghostedme.com/skills/SKILL.md). That URL is not an MCP resource.

Agent skill: [skills/SKILL.md](https://agentghostedme.com/skills/SKILL.md). Call `check_tool` or `check_server`, then read the three resources above. Served from this site. Not a registry submission.

OpenAPI: [openapi.json](https://agentghostedme.com/openapi.json)

## Caps

60 checks per IP per hour. 30 outcome reports per IP per hour. 60 MCP tool calls per IP per hour. One tools list counts as one check. Over the cap: HTTP 429 and `Retry-After`. Listing or reading an MCP resource is not a tool call. Paid keys are not offered yet.

## Sources

- Endpoint-shaped verbs are get, list, create, update, delete, set, from the examples in [@arpit_bhayani, 2026-08-27](https://x.com/arpit_bhayani/status/2092973180306833697). `fetchUser` is not flagged.
- Description checks follow [@waldekm, 2026-10-13](https://x.com/waldekm/status/2109907029963780339). The 40-character cutoff is Toolcard's. Answer: [MCP server loads but the agent never calls the tool](https://agentghostedme.com/mcp-server-loads-but-the-agent-never-calls-it.md).
- More than 8 top-level input properties is Toolcard's cutoff. The motivation is [@AvinashDalvi_, 2026-10-13](https://x.com/AvinashDalvi_/status/2110042506901786873), which states no number. Nested properties are not counted. Answer: [Picking the right subset of parameters](https://agentghostedme.com/picking-the-right-subset-of-parameters.md).
- `inputSchema` checks follow the [MCP schema reference, 2025-06-18](https://modelcontextprotocol.io/specification/2025-06-18/schema).
- `duplicate-name` follows the [MCP tools page, 2025-06-18](https://modelcontextprotocol.io/specification/2025-06-18/server/tools): each tool is uniquely identified by a name. Toolcard compares the trimmed name and keeps case.
- `overlapping-descriptions` and `too-many-tools` use cutoffs Toolcard chose (4 content tokens and 80 percent of the shorter set; more than 20 tools). The tool-count motivation is the same 2026-08-27 note, which states no number. Overlap is Toolcard's comparison. Neither finding has an answer page.

Toolcard is not affiliated with the people or the projects cited.

[Privacy](https://agentghostedme.com/privacy.html) · [Terms](https://agentghostedme.com/terms.html)