Code Review

Return the line-level diff between two texts as added/removed/unified hunks with counts. Use it to review a patch, compare two API responses, or decide whether two documents actually differ before spending tokens on them.

Apply one regular expression to a text blob on the server and return every match with its index and capture groups. Deterministic, so the same input always returns the same answer. Useful for log triage, field extraction and validation at scale.

Convert tabular data between CSV/TSV and a JSON array of objects, in either direction, with detected delimiter and typed columns. Use it when a tool returns CSV but your pipeline needs JSON (or the reverse) and you do not want to run a parser yourself.

Fetch one public URL and return machine-readable page metadata: HTTP status, title, meta/og description, canonical URL, language, link count and a short text sample. Honest 4xx/5xx statuses are returned as data, not as errors. Use it for link previews, source triage and citation checks.

Cleans a CSV/TSV/JSON table: removes duplicate and empty rows, trims whitespace, and returns the cleaned CSV with before/after quality checks and per-column stats. Call it before analysing or importing messy tabular data. Input: {"data": "<csv text>"}.

Returns a one-page research brief with cited source URLs, key findings and open gaps for a question. Call it when an agent needs a sourced answer instead of an unsourced guess. Input: {"question": "..."} (5-400 chars, any language).

Reviews source code and returns line-numbered findings with severity and a concrete fix, combining deterministic static rules (eval, SQL concat, secrets, shell injection) with an AI review. Call it before merging or running untrusted code. Input: {"code": "...", "language": "javascript"}.

Inspect one publicly reachable website or API and return a machine-readable capability report: the entry points it exposes (endpoints, forms, feeds, MCP tools), the evidence behind every finding, and an explicit list of what could not be determined. Only public responses are read; a 401/403 is recorded as auth_required and never bypassed. Use it to plan an integration, document an undocumented API

Full-surface analysis of a target: a website, an API, a shipped JS bundle, or (as a prepared runbook) a local artifact such as an ELF/PE/.NET/Mach-O binary, an Electron app.asar, an APK or a jar. Returns a capability map where every claim carries its evidence, the entry points found, feature flags and client-side secret shapes (shapes only, never values), and an explicit list of what could not be