Mock REST APIs, fake OAuth2/OIDC provider, uptime monitors + heartbeats, live badge/QR images.
Déduit des transports déclarés par cette annonce (streamable-http). Un client absent de cette liste n’est pas écarté pour autant — c’est simplement quelque chose que Forge ne peut pas confirmer.
La vérification confirme l’identité de l’éditeur (la propriété du dépôt), pas la sûreté du code. L’analyse de sécurité couvre les CVE connues et les scripts d’installation suspects.
Lu depuis un véritable échange MCP initialize → tools/list contre l’endpoint déclaré. Aucun outil n’a été invoqué — tools/list est l’appel d’introspection en lecture seule que le protocole prévoit pour cela. Cela reflète ce que le serveur annonçait à cet instant ; un endpoint hébergé n’est figé sur aucune version et peut changer sans préavis.
https://mockbird.mockbird.workers.dev/mcp19 outils · 170 mscreate_projectCreate a new mock REST API project. Returns {id, adminKey, baseUrl, resources[]}. SAVE the adminKey — it is required for admin operations (add_resource, custom_route, snapshots) and is shown only once. Presets seed a full backend: blog (posts/comments/authors), ecommerce (products/orders/customers/…Create a new mock REST API project. Returns {id, adminKey, baseUrl, resources[]}. SAVE the adminKey — it is required for admin operations (add_resource, custom_route, snapshots) and is shown only once. Presets seed a full backend: blog (posts/comments/authors), ecommerce (products/orders/customers/…
| Paramètre | Type | Description |
|---|---|---|
| name | string | Project name (max 60 chars). Optional. |
| preset | string | Seeded preset; 'blank' = truly empty. Omit for a starter project. Optional. |
| ttl | number | Optional: self-expiring project — auto-deletes after this many seconds (60–604800, i.e. 1 min to 7 days). Perfect for CI/eval sandboxes that must not leak even… |
import_dataCreate a live mock API from existing artifacts. Auto-detects: OpenAPI 3.x / Swagger 2.0 spec (JSON or YAML) → resources with realistic seeded data, and non-CRUD paths (login, /search, RPC verbs like POST /invoices/{id}/send) become custom routes serving the spec's own examples verbatim; json-server…Create a live mock API from existing artifacts. Auto-detects: OpenAPI 3.x / Swagger 2.0 spec (JSON or YAML) → resources with realistic seeded data, and non-CRUD paths (login, /search, RPC verbs like POST /invoices/{id}/send) become custom routes serving the spec's own examples verbatim; json-server…
| Paramètre | Type | Description |
|---|---|---|
| content* | string | The raw spec / db.json / collection / CSV text. |
| name | string | Project name override. Optional. |
| resource | string | CSV only: collection name (default items). |
| seed | number | Records to seed per resource for OpenAPI specs (default 20, max 100). |
| ttl | number | Optional: self-expiring project — auto-deletes after this many seconds (60–604800). Sandboxes for CI/eval runs clean themselves up. |
fork_projectCopy an entire project — resources + records verbatim, custom routes, behavior settings — into a brand-new project with its own id + adminKey. Built for parallel eval/CI runs: keep a template project, fork_project per run with a ttl (crashed runs can't leak sandboxes — the fork deletes itself), let…Copy an entire project — resources + records verbatim, custom routes, behavior settings — into a brand-new project with its own id + adminKey. Built for parallel eval/CI runs: keep a template project, fork_project per run with a ttl (crashed runs can't leak sandboxes — the fork deletes itself), let…
| Paramètre | Type | Description |
|---|---|---|
| project* | string | Source project id to fork (or "demo"). |
| adminKey | string | Source project's adminKey. Not needed when forking "demo". |
| name | string | Name for the fork (default: <source name>-fork). Optional. |
| withSnapshots | boolean | Also copy the source's snapshots into the fork (answer keys travel with it). Optional. |
| ttl | number | Self-expiring fork: auto-deletes after this many seconds (60–604800), even if your run crashes. Optional. |
add_resourceAdd a resource (collection) to a project and seed it with realistic fake data. Either pass template (one of the built-ins, e.g. users, products, posts, comments, orders, todos, reviews, customers, events) or fields: an array of {name, type} where type ∈ uuid|firstName|lastName|fullName|username|ema…Add a resource (collection) to a project and seed it with realistic fake data. Either pass template (one of the built-ins, e.g. users, products, posts, comments, orders, todos, reviews, customers, events) or fields: an array of {name, type} where type ∈ uuid|firstName|lastName|fullName|username|ema…
| Paramètre | Type | Description |
|---|---|---|
| project | string | Project id. Omit (together with adminKey) to auto-create a fresh project. |
| adminKey | string | The project's adminKey. Omit (together with project) to auto-create. |
| name* | string | Resource name, plural (e.g. products). |
| template | string | Built-in template name. Optional (use this OR fields). |
| fields | array | Array of {name, type} (or {name, type:'oneOf', values:[…]}). Optional. |
| seed | number | Records to seed (default 20, max 100). |
project_infoGet a project's public root index: every resource with record counts and URLs, custom routes, auth mode, and export links (openapi.json, types.ts, postman.json, db.json, GraphQL). No adminKey needed. Try project "demo" for the shared public playground.Get a project's public root index: every resource with record counts and URLs, custom routes, auth mode, and export links (openapi.json, types.ts, postman.json, db.json, GraphQL). No adminKey needed. Try project "demo" for the shared public playground.
| Paramètre | Type | Description |
|---|---|---|
| project* | string | Project id (e.g. demo). |
query_recordsGET records from a mock resource. params is an object of query parameters, all optional: exact filters (field=value), operator suffixes (price_gte, date_lte, name_like, status_ne), full-text q, _sort/_order (or _page/_limit for pagination), select (field projection, e.g. "name,price"), _expand=<par…GET records from a mock resource. params is an object of query parameters, all optional: exact filters (field=value), operator suffixes (price_gte, date_lte, name_like, status_ne), full-text q, _sort/_order (or _page/_limit for pagination), select (field projection, e.g. "name,price"), _expand=<par…
| Paramètre | Type | Description |
|---|---|---|
| project* | string | — |
| resource* | string | Resource name (e.g. products). |
| id | string | Single record id. Optional. |
| params | object | Query params as key→value. Optional. |
write_recordprivilégiéCreate, update, or delete records in a mock resource. Writes persist (unlike JSONPlaceholder/FakeStoreAPI). POST creates (auto-id), PUT replaces, PATCH merges, DELETE removes. id required for PUT/PATCH/DELETE.Create, update, or delete records in a mock resource. Writes persist (unlike JSONPlaceholder/FakeStoreAPI). POST creates (auto-id), PUT replaces, PATCH merges, DELETE removes. id required for PUT/PATCH/DELETE.
| Paramètre | Type | Description |
|---|---|---|
| project* | string | — |
| resource* | string | — |
| method* | string | — |
| id | string | Record id (PUT/PATCH/DELETE). |
| body | object | Record fields (POST/PUT/PATCH). |
generate_fake_dataGenerate realistic fake data instantly — stateless, nothing is created or stored, no project or adminKey needed. Ready-made resource shapes (FakerAPI-compatible): persons, users, addresses, companies, books, products, texts, images, places, credit_cards (credit cards are Luhn-valid; book EAN13/ISBN…Generate realistic fake data instantly — stateless, nothing is created or stored, no project or adminKey needed. Ready-made resource shapes (FakerAPI-compatible): persons, users, addresses, companies, books, products, texts, images, places, credit_cards (credit cards are Luhn-valid; book EAN13/ISBN…
| Paramètre | Type | Description |
|---|---|---|
| resource | string | One of persons|users|addresses|companies|books|products|texts|images|places|credit_cards. Default persons. Ignored when fields is set. |
| quantity | number | Rows to generate (1-100, default 5). |
| seed | number | Deterministic seed — same seed returns the same rows. Optional. |
| fields | object | Custom shape: {outputKey: type}, e.g. {"id":"counter","name":"firstName","mail":"email","signup":"dateTime"}. Optional. |
| params | object | Extra FakerAPI-compatible query params, e.g. {"_gender":"female"}, {"_price_min":10,"_price_max":500}, {"_characters":500}, {"_width":640}. Optional. |
custom_routeDefine a custom endpoint on a project (like /health, /config/:key, or a catch-all /webhooks/* request bin). body is a response template: {{query.x}} {{params.x}} {{body.x}} {{headers.x}} {{method}} {{path}} {{now}} {{ts}} {{uuid}} {{rand}}; triple braces {{{body}}} insert raw JSON. Custom routes ta…Define a custom endpoint on a project (like /health, /config/:key, or a catch-all /webhooks/* request bin). body is a response template: {{query.x}} {{params.x}} {{body.x}} {{headers.x}} {{method}} {{path}} {{now}} {{ts}} {{uuid}} {{rand}}; triple braces {{{body}}} insert raw JSON. Custom routes ta…
| Paramètre | Type | Description |
|---|---|---|
| project* | string | — |
| adminKey* | string | — |
| method | string | Default GET. |
| path* | string | e.g. /health, /config/:key, /webhooks/* |
| status | number | Response status (default 200). |
| body | string | Response body template (string; JSON works). |
| contentType | string | Default application/json. |
| delayMs | number | Artificial latency in ms. |
inspect_requestsRead the project's request inspector: the most recent requests that hit the mock API (method, path, query, status, origin, captured headers incl. x-* — authorization redacted to its scheme — and a body snippet for writes). Use it to VERIFY what your app / tests / webhook sender actually sent: point…Read the project's request inspector: the most recent requests that hit the mock API (method, path, query, status, origin, captured headers incl. x-* — authorization redacted to its scheme — and a body snippet for writes). Use it to VERIFY what your app / tests / webhook sender actually sent: point…
| Paramètre | Type | Description |
|---|---|---|
| project* | string | Project id. |
| adminKey | string | Project adminKey (not needed for demo). |
| limit | number | Newest N entries to return (default 20, max 50). |
| method | string | Filter: HTTP method, comma-list ok (e.g. "DELETE" or "PUT,PATCH,DELETE"). |
| path | string | Filter: segment-aware path prefix ("/tasks" matches /tasks and /tasks/5, not /tasksomething). |
| status | number | Filter: exact response status (comma-list ok as a string via status_gte/lte for ranges). |
| status_gte | number | Filter: status >= this (400 = any error). |
| status_lte | number | Filter: status <= this. |
| since | string | Filter: only requests at/after this time (epoch ms or ISO-8601) — record the episode start, assert about only that episode. |
share_projectMint (or manage) a READ-ONLY share link for a project: a browser URL you can hand to a human reviewer — they can browse the data, endpoints, snapshots and the live request inspector, but can't write and never see the adminKey. Agent workflow: build or mutate a sandbox, then share_project and give y…Mint (or manage) a READ-ONLY share link for a project: a browser URL you can hand to a human reviewer — they can browse the data, endpoints, snapshots and the live request inspector, but can't write and never see the adminKey. Agent workflow: build or mutate a sandbox, then share_project and give y…
| Paramètre | Type | Description |
|---|---|---|
| project* | string | Project id. |
| adminKey* | string | The project's adminKey. |
| action | string | Default: create. |
delete_projectprivilégiéPermanently delete a project and ALL its data (records, resources, snapshots, custom routes, webhooks, request log). Irreversible. Good practice for short-lived test projects: clean up when your session is done. Requires the adminKey.Permanently delete a project and ALL its data (records, resources, snapshots, custom routes, webhooks, request log). Irreversible. Good practice for short-lived test projects: clean up when your session is done. Requires the adminKey.
| Paramètre | Type | Description |
|---|---|---|
| project* | string | Project id. |
| adminKey* | string | The project's adminKey. |
snapshotsDeterministic test fixtures + eval grading: save the project's entire dataset under a name, restore it exactly later, or DIFF it against live data (list/delete too). action:"diff" is machine-checkable grading — compares the named snapshot (expected) against live data (actual, or another snapshot vi…Deterministic test fixtures + eval grading: save the project's entire dataset under a name, restore it exactly later, or DIFF it against live data (list/delete too). action:"diff" is machine-checkable grading — compares the named snapshot (expected) against live data (actual, or another snapshot vi…
| Paramètre | Type | Description |
|---|---|---|
| project* | string | — |
| adminKey* | string | — |
| action* | string | — |
| name | string | Snapshot name (required for restore/delete/diff; default for save: snapshot-<n>). |
| against | string | diff only, optional: compare the named snapshot against THIS other snapshot instead of live data. |
| ignore | string | diff only, optional: comma-separated field names excluded from comparison (volatile timestamps etc.), e.g. "updatedAt,id". |
| data | object | save only, optional: AUTHOR the snapshot inline instead of capturing live state — {"tasks":[{...records...}],"labels":[]} (records verbatim, ids preserved, []… |
verdictOne call = the whole eval grade. Composes the state check (snapshot diff vs live data) with trajectory constraints on the request log into a single {pass, checks[]} verdict. Pass snapshot:"expected" to require live data to match that snapshot (author it as the answer key first via snapshots action:…One call = the whole eval grade. Composes the state check (snapshot diff vs live data) with trajectory constraints on the request log into a single {pass, checks[]} verdict. Pass snapshot:"expected" to require live data to match that snapshot (author it as the answer key first via snapshots action:…
| Paramètre | Type | Description |
|---|---|---|
| project* | string | Project id. |
| adminKey* | string | The project's adminKey. |
| name | string | Optional: run a saved verdict spec by name instead of an inline spec (mutually exclusive with snapshot/ignore/trajectory). |
| snapshot | string | Optional: snapshot name to diff live data against — pass means identical. |
| ignore | string | Optional (with snapshot): comma-separated field names excluded from the state comparison, e.g. "updatedAt,createdAt". |
| trajectory | array | Optional: constraint objects — filters (method comma-list, path segment-prefix, status, status_gte, status_lte, since) + expectation (count exact, min, max). E… |
check_api_statusLive status of ~58 public mock/testing APIs — JSONPlaceholder, httpbin.org, ReqRes, FakeStoreAPI, DummyJSON, Postman Echo, httpstat.us, Mocky, Mockbin, CrudCrud, restcountries, and more — checked with a plain keyless GET every 30 minutes from Cloudflare's network (a service answering HTTP 200 error…Live status of ~58 public mock/testing APIs — JSONPlaceholder, httpbin.org, ReqRes, FakeStoreAPI, DummyJSON, Postman Echo, httpstat.us, Mocky, Mockbin, CrudCrud, restcountries, and more — checked with a plain keyless GET every 30 minutes from Cloudflare's network (a service answering HTTP 200 error…
| Paramètre | Type | Description |
|---|---|---|
| service | string | Service id, name, or hostname substring (e.g. httpbin, reqres.in). Optional — omit for the summary. |
uptime_monitorFree downtime alerts for any public URL — no account, armed in one call. action:"create" {url, notify?}: Mockbird GETs the url every 30 minutes from Cloudflare's network (8s timeout, 2xx/3xx = up; a timeout/TLS/DNS blip on an otherwise-up url is confirmed with a same-run retry before it counts); wi…Free downtime alerts for any public URL — no account, armed in one call. action:"create" {url, notify?}: Mockbird GETs the url every 30 minutes from Cloudflare's network (8s timeout, 2xx/3xx = up; a timeout/TLS/DNS blip on an otherwise-up url is confirmed with a same-run retry before it counts); wi…
url : Links to undeclared domain: api.example.com| Paramètre | Type | Description |
|---|---|---|
| action* | string | What to do. |
| url | string | create: the public https URL to watch (e.g. https://api.example.com/health). |
| notify | string | create (optional): the webhook URL to alert (Slack/Discord webhook, or any HTTPS endpoint — gets HMAC-signed JSON). Omit it to get a pollable monitor instead. |
| id | string | poll/info/delete: the monitor id (mon-…) returned by create. |
| secret | string | poll/info/delete: the secret returned by create. |
heartbeatDead man's switch for cron jobs, scheduled tasks, and recurring agent runs — the INVERSE of uptime_monitor: the JOB pings Mockbird, and if the ping stops arriving the alert fires once (plus one recovery message when pings resume). action:"create" {name?, period_minutes, grace_minutes?, notify?}: pe…Dead man's switch for cron jobs, scheduled tasks, and recurring agent runs — the INVERSE of uptime_monitor: the JOB pings Mockbird, and if the ping stops arriving the alert fires once (plus one recovery message when pings resume). action:"create" {name?, period_minutes, grace_minutes?, notify?}: pe…
| Paramètre | Type | Description |
|---|---|---|
| action* | string | What to do. |
| name | string | create: a label for the job (shown on the status page), e.g. "nightly backup". |
| period_minutes | number | create: how often the job is supposed to run, in minutes (30–10080). |
| grace_minutes | number | create: extra slack before alerting (5–1440). Default: half the period. |
| notify | string | create (optional): the webhook URL to alert when the ping stops. Omit it to get a pollable heartbeat instead. |
| ping_url | string | ping: the ping URL returned by create (https://…/ping/p-…). |
| id | string | poll/info/delete: the heartbeat id (hb-…) returned by create. |
| secret | string | poll/info/delete: the secret returned by create. |
watch_service_statusSubscribe to down/recovered alerts for any of the public mock/testing APIs tracked by check_api_status (httpbin, JSONPlaceholder, ReqRes, FakeStoreAPI, DummyJSON …). action:"subscribe" {service, notify?}: service is an id from check_api_status (or "*" for all tracked services). With notify, that we…Subscribe to down/recovered alerts for any of the public mock/testing APIs tracked by check_api_status (httpbin, JSONPlaceholder, ReqRes, FakeStoreAPI, DummyJSON …). action:"subscribe" {service, notify?}: service is an id from check_api_status (or "*" for all tracked services). With notify, that we…
| Paramètre | Type | Description |
|---|---|---|
| action* | string | What to do. |
| service | string | subscribe: service id from check_api_status (e.g. "reqres", "httpbin"), or "*" for all tracked services. |
| notify | string | subscribe (optional): webhook URL to alert (Slack/Discord webhook, or any HTTPS endpoint — gets HMAC-signed JSON). Omit it to get a pollable subscription inste… |
| id | string | poll/info/unsubscribe: the watch id (w…) returned by subscribe. |
| secret | string | poll/info/unsubscribe: the secret returned by subscribe. |
image_urlMint a permanent, keyless image URL rendered by Mockbird — README badges (including LIVE record-count badges), chart images, QR codes, Open Graph cards, placeholder images, initials avatars. Deterministic: the same URL renders the same image forever (no account, no expiry, no watermark). Params are…Mint a permanent, keyless image URL rendered by Mockbird — README badges (including LIVE record-count badges), chart images, QR codes, Open Graph cards, placeholder images, initials avatars. Deterministic: the same URL renders the same image forever (no account, no expiry, no watermark). Params are…
| Paramètre | Type | Description |
|---|---|---|
| kind* | string | Which image to mint. |
| params | object | Query params for the endpoint (see the per-kind lists in the tool description). Values are strings or numbers (arrays of numbers join with commas). Passing the… |
| size | string | Optional size path: "WxH" for chart/og/placeholder (e.g. "800x400"), a single number for qr (e.g. "512") or a square placeholder. |
| format | string | Optional. badge is always SVG; chart/qr/og/placeholder default to PNG (og/chart/qr) or SVG (placeholder/avatar) — svg forces the vector twin. |
| project | string | Optional project id (default "demo", the shared public playground). Use your own project id so live badge counts track your data. |
19 outils sur 19 ont publié une description.
Les noms et descriptions d’outils sont écrits par l’éditeur et affichés tels quels, comme du texte inerte. Ce sont les chaînes qu’un client MCP transmet à un modèle, alors Forge y recherche des motifs d’injection de prompt — tout constat apparaît avec l’analyse de sécurité ci-dessus. « Privilégié » est une correspondance de mot-clé sur le nom de l’outil, pas un audit de ce qu’il fait : un nom anodin peut tout de même tout faire.
Mock REST APIs, fake OAuth2/OIDC provider, uptime monitors + heartbeats, live badge/QR images.
Les noms cliquables ouvrent l’index Forge de toutes les entrées observées exposant cet outil. Parcourir tous les outils indexés.
Cette entrée ne publie aucun paquet npm : Forge n'a donc pas d'arbre de dépendances pour elle. C'est une lacune de couverture — pas une affirmation qu'elle n'a aucune dépendance.