Zero Payload Logging Observability & Logs Disabled SSRF-Isolated Fetcher
42 single-purpose AI safety, security, and EU compliance APIs running on Cloudflare Workers with zero payload logging, sub-millisecond edge compute, and one direct All-Access key.
@tinplate/sdk, tinplate & CI Action
Instead of maintaining brittle regexes, headless scrapers, and tax checksums in every microservice, drop in a single stateless edge endpoint:
Redact PII before prompts leave your VPC, detect prompt injections and jailbreaks (typically under 5 ms in deterministic mode), verify answers against RAG sources, validate tool calls, and sanitize outbound LLM responses.
POST /v1/pii-redactor
Live on Hub
Mask emails, phones, IBANs, cards, and EU IDs with reversible tokens before LLM calls.
POST /v1/prompt-guard
Live on Hub
Catch prompt injections, role hijacks, and encoded jailbreaks in user inputs and RAG chunks.
POST /v1/hallucination-diff
AI Safety & Agents
Fast first filter to catch unsupported numbers, dates, and names in LLM answers vs RAG sources.
POST /v1/tool-call-validator
AI Safety & Agents
Validate and auto-repair broken LLM tool-call arguments against your JSON Schema.
POST /v1/prompt-cache-budgeter
AI Safety & Agents
Estimate tokens, optimize message order for prompt caching, and calculate LLM API costs.
POST /v1/llm-output-guard
Tier 1
Scan and sanitize LLM outputs for prompt leakage, Markdown beacons, XSS, and policy violations.
Audit MCP server manifests for tool poisoning, block dangerous agent shell commands and SQL queries, prevent SSRF and DNS-rebinding targets, scrub leaked secrets from logs, and issue tamper-evident action receipts.
POST /v1/mcp-manifest-linter
Tier 1
Audit MCP server manifests for hidden tool poisoning, shell risks, and excessive permissions.
POST /v1/ssrf-firewall
Security & Secrets
Validate URLs and redirect chains against SSRF, private IPs, and cloud metadata targets.
POST /v1/secret-scanner
Tier 1
Detect and mask leaked API keys, JWTs, and private keys in logs, diffs, and prompts.
POST /v1/agent-action-receipts/issue
AI Safety & Agents
Issue and verify tamper-evident HMAC-signed receipts for autonomous AI agent actions.
POST /v1/content-provenance
AI Safety & Agents
Detect C2PA manifests, AI generator EXIF/XMP tags, and stripped metadata in files or headers.
POST /v1/command-sql-guard
Tier 1
Audit agent shell commands and Text-to-SQL queries for RCE, reverse shells, and destructive SQL.
Repair malformed LLM JSON outputs deterministically, convert noisy HTML into clean RAG Markdown, validate EU VAT/IBAN/LEI/EORI & corporate tax IDs, and audit Email DNS deliverability.
POST /v1/json-heal
Live on Hub
Repair malformed or truncated LLM JSON outputs into valid, schema-checked JSON in 1 ms.
POST /v1/html-to-markdown
Tier 1
Convert noisy web pages or raw HTML into clean, token-efficient Markdown for RAG.
POST /v1/eu-vat-iban/iban
Live on Hub
Validate IBANs, BIC/SWIFT codes, and EU/UK VAT numbers with live EU VIES lookup.
POST /v1/email-dns
Live on Hub
Audit MX, SPF 10-lookup limits, DMARC, DKIM, BIMI, and MTA-STS with a 0–100 score.
POST /v1/invoice-validator
Tier 1
Audit extracted invoices for line-item math errors, VAT mismatches, and Peppol compliance.
POST /v1/eu-id-validator
Tier 1
Validate LEI, EORI, SIREN/SIRET, Steuer-ID, Codice Fiscale, NIF/CIF, NIP, BSN, CRN & EIN checksums.
Try our deterministic security, compliance, and AI data-prep engines directly in your browser before integrating the API:
Audit MX, SPF, DMARC, DKIM & MTA-STS with a 0–100 score—or generate lookup-safe DNS TXT records.
Audit HSTS, CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy, and CORS with a shareable letter grade.
Validate IBAN/BIC, EU VAT numbers, ISO 17442 LEI, EORI, and national corporate tax IDs instantly.
Strip Markdown fences, fix single quotes & trailing commas, close truncated brackets, and validate against JSON Schema.
Translate cron schedules into plain English and preview upcoming DST-aware execution timestamps.
Scan logs and prompts for 28 secret types or redact PII with reversible placeholder tokens.
Audit Model Context Protocol (MCP) tool definitions for hidden prompt injection and over-broad permissions.
Chain up to 5 Tinplate endpoints sequentially with automatic short-circuiting on security blocks.
Convert structured JSON invoices into EN 16931 / Peppol UBL 2.1 XML + SEPA EPC-QR strings in milliseconds.
Determine exact EU VAT rate, net/gross/VAT amounts, reverse-charge status, and EN 16931 tax code instantly.
Every API returns a consistent { ok, data, meta: { request_id, ms } } envelope and has its own interactive documentation page and OpenAPI 3.0.3 specification.
POST /v1/pii-redactor
Live on Hub
Mask emails, phones, IBANs, cards, and EU IDs with reversible tokens before LLM calls.
POST /v1/prompt-guard
Live on Hub
Catch prompt injections, role hijacks, and encoded jailbreaks in user inputs and RAG chunks.
POST /v1/mcp-manifest-linter
Tier 1
Audit MCP server manifests for hidden tool poisoning, shell risks, and excessive permissions.
POST /v1/tool-call-validator
AI Safety & Agents
Validate and auto-repair broken LLM tool-call arguments against your JSON Schema.
POST /v1/hallucination-diff
AI Safety & Agents
Fast first filter to catch unsupported numbers, dates, and names in LLM answers vs RAG sources.
POST /v1/prompt-cache-budgeter
AI Safety & Agents
Estimate tokens, optimize message order for prompt caching, and calculate LLM API costs.
POST /v1/agent-action-receipts/issue
AI Safety & Agents
Issue and verify tamper-evident HMAC-signed receipts for autonomous AI agent actions.
POST /v1/content-provenance
AI Safety & Agents
Detect C2PA manifests, AI generator EXIF/XMP tags, and stripped metadata in files or headers.
POST /v1/llm-output-guard
Tier 1
Scan and sanitize LLM outputs for prompt leakage, Markdown beacons, XSS, and policy violations.
POST /v1/json-heal
Live on Hub
Repair malformed or truncated LLM JSON outputs into valid, schema-checked JSON in 1 ms.
POST /v1/html-to-markdown
Tier 1
Convert noisy web pages or raw HTML into clean, token-efficient Markdown for RAG.
POST /v1/locale-value-parser
AI Data Prep
Normalize messy EU/US prices, dates, percentages, and measurements into structured JSON.
POST /v1/llm-messages-guard
Live on Hub
Sanitize entire multi-turn LLM messages[] arrays in one call before forwarding to OpenAI, Anthropic, or Gemini.
POST /v1/tabular-rag-cleaner
Live on Hub
Neutralize CSV formula injection, redact cell-level PII, and convert tables into RAG-ready Markdown & row chunks.
POST /v1/agent-code-guard
Live on Hub
Audit LLM-generated Python, JS/TS, Shell, or GitHub Actions code for sandbox escapes before execution.
POST /v1/secret-scanner
Tier 1
Detect and mask leaked API keys, JWTs, and private keys in logs, diffs, and prompts.
POST /v1/ssrf-firewall
Security & Secrets
Validate URLs and redirect chains against SSRF, private IPs, and cloud metadata targets.
POST /v1/security-headers
Security & Secrets
Audit CSP, HSTS, and browser security headers with an A+ to F grade and fix snippets.
POST /v1/webhook-verify
Security & Secrets
Verify Stripe, GitHub, Slack, Shopify, and Svix HMAC webhook signatures and timestamps.
POST /v1/command-sql-guard
Tier 1
Audit agent shell commands and Text-to-SQL queries for RCE, reverse shells, and destructive SQL.
POST /v1/jwt-jwk-inspector
Security & Secrets
Audit JWT tokens and JWK sets against RFC 8725 for alg:none, weak secrets, and leaked keys.
POST /v1/email-dns
Live on Hub
Audit MX, SPF 10-lookup limits, DMARC, DKIM, BIMI, and MTA-STS with a 0–100 score.
POST /v1/email-dns-generator
Email & Domain
Lint existing SPF/DMARC strings and generate clean, RFC-compliant DNS TXT records.
POST /v1/consent-tokens/issue
Email & Domain
Issue and verify stateless HMAC unsubscribe tokens and RFC 8058 List-Unsubscribe headers.
POST /v1/eu-vat-iban/iban
Live on Hub
Validate IBANs, BIC/SWIFT codes, and EU/UK VAT numbers with live EU VIES lookup.
POST /v1/invoice-validator
Tier 1
Audit extracted invoices for line-item math errors, VAT mismatches, and Peppol compliance.
POST /v1/hu-business-validator
Compliance & Business
Validate Hungarian adószám, cégjegyzékszám, GIRO bank accounts, and NAV invoice rules.
POST /v1/workday-holiday/between
Compliance & Business
Calculate business days and SLA deadlines across 30+ countries including HU swap Saturdays.
POST /v1/signup-fraud
Compliance & Business
Block disposable emails, alias abuse, and bot signups with a 0–100 fraud risk score.
POST /v1/eu-id-validator
Tier 1
Validate LEI, EORI, SIREN/SIRET, Steuer-ID, Codice Fiscale, NIF/CIF, NIP, BSN, CRN & EIN checksums.
POST /v1/peppol-ubl-invoice
Live on Hub
Generate EN 16931 / Peppol BIS 3.0 UBL 2.1 XML and SEPA EPC-QR payloads from JSON, or parse UBL XML to JSON.
POST /v1/eu-vat-calculator
Live on Hub
Determine exact EU VAT rates, B2B reverse charge, EN 16931 tax category codes, and mandatory invoice legal text.
POST /v1/sanctions-screener
Live on Hub
Screen beneficiaries, vendors, BICs, and wallets against embargo rules and fuzzy sanctions watchlists.
POST /v1/cron-explainer
Developer Utilities
Validate cron expressions, translate to plain English, and compute next N runs with DST.
POST /v1/schema-diff
Developer Utilities
Diff two OpenAPI 3.x or JSON Schemas to catch breaking changes and recommend SemVer bumps.
POST /v1/ua-bot-parser
Developer Utilities
Detect AI training crawlers, RAG bots, headless browsers, and device/OS details from User-Agent.
POST /v1/url-normalizer
Developer Utilities
Canonicalize URLs and strip 120+ ad-tracking and click-ID parameters for clean deduplication.
POST /v1/ics-sanitizer
Developer Utilities
Repair broken .ics calendar feeds, normalize Windows timezones to IANA, and parse VEVENTs.
POST /v1/robots-llms-analyzer
Developer Utilities
Audit which AI crawlers your robots.txt allows and generate a valid llms.txt file.
POST /v1/semver-lockfile-judge
Developer Utilities
Diff two package.json files to flag breaking SemVer bumps and risky dependency changes.
POST /v1/rag-chunker
Developer Utilities
Split Markdown into token-budgeted RAG chunks with heading breadcrumbs and intact code/tables.
POST /v1/regex-safety
Developer Utilities
Audit regular expressions for O(2^n) ReDoS backtracking, explain patterns, and test matches.
Benchmarks, bypass analysis, and implementation writeups from building 42 deterministic edge APIs:
Why most regex prompt-injection filters either miss trivial Unicode/Base64 obfuscations or block legitimate developer prompts—and how we built a two-layer deterministic engine benchmarked across 104 labeled prompts.
Model Context Protocol (MCP) tool descriptions are injected directly into the host LLM's system prompt. Here is how attackers abuse tool metadata—and how to lint MCP manifests before connecting.
Most SaaS teams think their email authentication is healthy because they added an SPF record two years ago. Then Marketing adds a new ESP, total nested DNS lookups cross 10, and SPF fails with PermError.
In Hungary, when a public holiday falls on a Tuesday or Thursday, ministerial decrees turn the adjacent Monday or Friday into a rest day and designate a nearby Saturday as an official working day.