# Tamperbox API and MCP

Remote execution sends inputs to our server. The application does not store input/output. Calling agent/provider retention is separate. Use the ad-free [local editor](https://tamperbox.dev/pipeline) for sensitive data. No private keys or HMAC secrets are accepted.

REST: https://api.tamperbox.dev/v1. MCP: https://mcp.tamperbox.dev/mcp. No key is required.

## Limits

1 MiB request; 20 steps; 2 MiB aggregate intermediate/output; 5-second pipeline deadline, plus server execution limit. Anonymous requests: 60/minute per IP per service location (approximate, not an exact global quota). 429 responses include Retry-After. No arbitrary code, remote references or network operations.

## Provenance and hand-off

Successful results contain provider, tool, engineVersion, attribution and a recipe-only editorUrl beside the unchanged artifact. No input is embedded in links. No result is stored.

## Operations

<a id="jwt_decode"></a>

### Decode JWT

Decode a three-part JWT into header and payload. Does not verify its signature, trust, expiration or application policy. No keys are accepted.

POST https://api.tamperbox.dev/v1/tools/jwt_decode

Input media: application/jwt. Output media: application/json.

```json
{
  "input": {
    "mediaType": "application/jwt",
    "value": "eyJhbGciOiJub25lIn0.eyJzdWIiOiJleGFtcGxlIn0."
  },
  "options": {}
}
```

<a id="json_format"></a>

### Format JSON

Format JSON with bounded indentation. Rejects duplicate keys and numbers that cannot be represented safely. Does not validate an application schema.

POST https://api.tamperbox.dev/v1/tools/json_format

Input media: application/json. Output media: application/json.

```json
{
  "input": {
    "mediaType": "application/json",
    "value": "{\"example\":true}"
  },
  "options": {}
}
```

<a id="json_to_yaml"></a>

### Convert JSON to YAML

Convert JSON to YAML without network access. Rejects unsafe numeric precision and duplicate keys. Does not execute embedded text.

POST https://api.tamperbox.dev/v1/tools/json_to_yaml

Input media: application/json. Output media: application/yaml.

```json
{
  "input": {
    "mediaType": "application/json",
    "value": "{\"example\":true}"
  },
  "options": {}
}
```

<a id="timestamp_to_iso"></a>

### Convert timestamp to ISO

Convert an explicit epoch unit or UTC calendar input to ISO text, preserving fractional precision. No live clock or local timezone inference.

POST https://api.tamperbox.dev/v1/tools/timestamp_to_iso

Input media: text/plain. Output media: text/plain.

```json
{
  "input": {
    "mediaType": "text/plain",
    "value": "1700000000"
  },
  "options": {}
}
```

<a id="api_convert"></a>

### Convert API document

Convert supported Postman, OpenAPI or POSIX cURL text. Does not execute requests or fetch references. Conversion can lose unsupported features; secret replacement is incomplete and output needs review.

POST https://api.tamperbox.dev/v1/tools/api_convert

Input media: application/json, application/yaml, text/plain. Output media: application/json, application/yaml, text/plain.

```json
{
  "input": {
    "mediaType": "text/plain",
    "value": "curl https://example.com"
  },
  "options": {
    "target": "openapi-json"
  }
}
```

## Pipeline

POST https://api.tamperbox.dev/v1/pipeline with version: 1, input artifact, steps and optional return step IDs. Steps consume previous output and stop on error.

## Errors

REST uses application/problem+json; code and hint explain correction without echoing input. 400 malformed, 403 origin/host, 404 route, 405 method, 408 body timeout, 413 size, 415 media, 422 validation, 429 rate, 500 internal failure, 503 temporary limit. Pipeline errors preserve separate step and path fields when available. MCP failures use isError; protocol errors remain separate.

[OpenAPI](https://docs.tamperbox.dev/openapi.json) · [Recipe](https://tamperbox.dev/recipes/jwt-to-yaml) · [Privacy](https://tamperbox.dev/privacy)