Skip to content
Tamperboxtamper[box] docs

Tamperbox MCP

A code-mode MCP server with two tools over a documented catalog of Tamperbox operations.

Open Markdown

Tamperbox MCP exposes two tools: search and execute. Both accept an async JavaScript function body. The smaller interface lets agents inspect exact schemas before they send inputs to the API.

Tool model

Section titled “Tool model”
Section titled “search”

Runs against the bundled OpenAPI document. It exposes spec and a resolved operations array. It does not call the Tamperbox API, and apiCalls stays at 0.

execute

Section titled “execute”

Runs code in an isolated QuickJS WebAssembly environment. The code can call documented endpoints through tamperbox.request({ method, path, query?, body? }).

const result = await tamperbox.request({
  method: 'POST',
  path: '/v1/tools/dns_lookup',
  body: { name: 'example.com', type: 'A', resolver: 'google' },
});
return result;

Transports

Section titled “Transports”

The package supports stdio for local clients and Streamable HTTP for hosted integrations. The public production endpoint is https://mcp.tamperbox.dev/mcp.

What it does not do

Section titled “What it does not do”

The server cannot call arbitrary URLs, add arbitrary headers, publish DNS changes, send email, or establish JWT trust through decoding. Unknown routes and arguments are rejected against the bundled contract.