Clawhard Dev Tools

Use when you need to check a live Supabase project rather than migration files: returns a read-only SQL query that reads table RLS settings, grants for anon and authenticated, policies, SECURITY DEFINER functions and storage buckets (never row data) and returns one JSON value. Run it with the user's Supabase SQL Editor or a Supabase MCP execute_sql tool, then pass the JSON to deadbolt_check_supabase_access.

Use when you write, review or are about to apply Supabase / PostgreSQL migration SQL (CREATE TABLE, RLS, CREATE POLICY, GRANT, views, SECURITY DEFINER functions, storage buckets), or when a user asks whether their Supabase data is exposed, whether RLS is set up right, or why a query returns 42501 permission denied or no rows. Replays the SQL with real Postgres rules and returns, per table, what signed-out (anon) and signed-in (authenticated) users can SELECT/INSERT/UPDATE/DELETE (all rows, own rows, some rows, none, or denied for a missing grant), plus findings with severity and ready-to-run fix SQL: RLS off, policies written but RLS never enabled, using(true) writes, personal columns readable by anyone, views that bypass RLS, SECURITY DEFINER functions anyone can call, user_metadata in policies, public bucket listing, grants missing after the Oct 30 2026 default change. Also accepts the JSON produced by deadbolt_catalog_query for the live database. Deterministic; never connects to any database. Up to 200,000 characters.

Use when the user asks whether their site (or any public site), or a robots.txt they pasted, blocks ChatGPT, Claude, Google AI, Perplexity or other AI crawlers, whether AI can read or train on their content, or why AI search does not mention their site. Fetches the live robots.txt and reports, for 22 named AI bots in four groups (AI training, AI search, assistants, search engines), which are let in, kept out or partly blocked, plus the site's content-signal preference and fixes. Example: {"url": "example.com"} or {"robots_txt": "User-agent: GPTBot\nDisallow: /"}. Pass robots_txt instead of url to check a draft or pasted file without fetching anything. Read-only.

Use when you are about to read a big JSON response, log or export into context, before loading it: returns a compact outline of the structure (keys, types, array lengths, one example per repeated shape) so you can plan a query without spending tokens on the whole document. Repairs the JSON first if needed. Follow with mend_query_json to pull only the values you need. Up to 100,000 characters.

Use when you need specific fields from a JSON document without reading all of it: $.users[0].name, $.items[*].id, $.a.b[-1], $.list[1:3], $..email (recursive). Returns each match with its exact path, type and value. Repairs the JSON first if needed, so broken input still works. Up to 100,000 characters.

Use when JSON from an LLM, API, log, config or copy-paste fails to parse (JSON.parse error, "Unexpected token", "Expecting property name"), or the user pastes JSON with trailing commas, single quotes, unquoted keys, comments, Python True/False/None, NaN, missing commas or brackets, a ```json fence, text around it, or output that was cut off. Deterministic repair: returns valid, formatted JSON plus a list of every fix with line and column. Values are never rewritten, so big numbers, number formatting and key order stay exactly as written. If the text is already valid it says so. Up to 100,000 characters.

Use when you need to convert a specific wall-clock time from one place to others, for any date. It uses the real tz database, so daylight saving is right for that exact date (the US and Europe switch on different weeks), and it warns when the time does not exist (spring forward) or happens twice (fall back). Time accepts "15:00", "3:30pm", "noon", "now" or an ISO local time like 2026-11-05T15:00 (no Z). Date defaults to today in the source zone. Returns {input, utc, source:{...}, converted:[{place, zone, local, time_12h, date, utc_offset, abbreviation, day_note, hours_ahead_of_source}], warning?, summary, open_url}.

Use when you need to schedule a call across several places. Scans the day in 15-minute steps and ranks start times so the most people are inside working hours and nobody is at night, using each place's real offset and DST for that date. Returns up to 5 slots with each person's local start and end, and says plainly when no time works for everyone. Defaults: working hours 9 to 17, 60 minutes, date today in the first place.

Use when the user asks what time or date it is right now somewhere. Reads the server clock and returns the current time, date, UTC offset, abbreviation and daylight saving status for each place. Places can be cities ("Tokyo"), IANA zones ("Europe/Paris"), abbreviations ("PST") or "UTC+5:30".

Use when you need to answer "what is the UTC offset of X", "does X observe daylight saving" and "when do the clocks change". Returns the current offset and abbreviation, whether the place observes DST, every clock change in the year with exact local before and after times, and the next change. Abbreviations like IST or CST are ambiguous, so the answer says which zone was used.

Use when the user or an agent is about to install or import npm or PyPI packages: before npm install or pip install, when adding lines to package.json or requirements.txt, or when a package name came from an AI answer, a tutorial or memory and may be invented. Looks each name up in the live registry and returns whether it exists, the latest version, whether a pinned version exists, weekly downloads, first and last publish dates, deprecation or yanked status, install-time scripts, whether the name is one or two typed characters from a well-known package, and real similar packages when the name does not exist. Example: {"packages":[{"ecosystem":"npm","name":"@anthropic/mcp-client"},{"ecosystem":"pypi","name":"requests","version":"2.32.3"}]}. Up to 10 packages per call; versions must be exact, not ranges. Not a malware or vulnerability scan: "ok" means it exists and nothing looked wrong.

Use when you or the user are about to publish or edit an SPF, DMARC or DKIM TXT record, for example after writing a new SPF record that adds a sending service, or when the user pastes a record and asks "is this right?". Detects the record type. SPF: syntax per RFC 7208, every include and redirect followed live in DNS and counted against the 10-lookup limit, void lookups, loops, the final all; returns a lookup tree. DMARC: RFC 7489 tags and values (p, sp, pct, rua/ruf, adkim/aspf, fo). DKIM: key type and RSA key size read from the key, revoked (empty p=) or truncated keys. Returns valid true/false, errors, warnings and where to publish it. Pass domain so a/mx terms without a value can be resolved.

Use when the user asks why their email goes to spam, whether their domain is set up to send email, or before they launch a newsletter, cold outreach, transactional email or a new sending service, e.g. "why are my emails going to spam?", "is my SPF/DKIM/DMARC right?", "do I meet Gmail and Yahoo's sender requirements?" or "I added SendGrid, did I break SPF?". Reads public DNS (DNS-over-HTTPS) and checks: SPF (exactly one record, every include followed and DNS lookups counted per RFC 7208 against the limit of 10, void lookups, loops, +all/?all, ptr), DMARC (RFC 7489 syntax, policy, pct, alignment, inherited from the parent domain, and whether an external report address authorized it), DKIM (17 common selectors plus any you pass; key type and RSA key size read from the key, revoked or broken keys), and MX (provider, null MX). Returns a grade A-F, a verdict, each check with status pass/warn/fail/info, whether the Gmail, Yahoo and Outlook.com sender rules are met, and copy-ready DNS records to fix problems (e.g. one merged SPF record, a starter DMARC record). DNS cannot list DKIM selectors, so when none of the common selectors is found the result says so and a known selector (the s= value in a DKIM-Signature header) can be passed in. Accepts a domain, an email address or a URL. Results are cached for 5 minutes; pass fresh=true right after the user changes DNS.

Use when the user asks whether a color combination is readable or accessible, passes WCAG AA or AAA, or has enough contrast (text on a background, button, badge, link color), or what a color is in another format. Returns the exact contrast ratio, pass or fail for normal text, large text and UI components at AA and AAA, the APCA lightness contrast and a plain note. Colors can be hex, rgb(), hsl() or CSS names. Example: {"foreground": "#777777", "background": "#ffffff"}. Also returns each color in hex, rgb, hsl and oklch with its nearest CSS name.

Use when the user has a whole design system, theme or stylesheet and wants every text and background pair checked for accessibility in one go. Takes up to 50 pairs and returns the ratio and AA and AAA results for each, with a count of failures. Example: {"pairs": [{"foreground": "#777", "background": "#fff", "label": "muted text"}, {"foreground": "#fff", "background": "#ff5a1f", "label": "button"}]}.

Use when a color pair fails contrast and the user wants the smallest change that makes it pass, such as "make this gray text accessible without changing the look". Returns the closest text color on that background that reaches the target (AA, AAA, AA-large or ui), and separately the closest background, keeping the hue. Example: {"foreground": "#777777", "background": "#ffffff", "target": "AA"}. Returns already_passes if nothing needs to change.

Use when the user asks for a palette, shades, tints, a design-token scale or a Tailwind-style 50 to 950 ramp from a brand color. Returns 11 steps that keep the hue, with the hex, contrast on white and on black, and the best text color for each step. Example: {"color": "#ff5a1f", "name": "brand"}.

Use when you need a yes/no on whether a cron expression would fire at a specific instant in a timezone — for example before shipping a schedule that crosses a DST transition, or to verify a single expected fire. Example: {"expression":"0 9 * * 1-5","timezone":"America/New_York","at":"2026-11-06T14:00:00Z"}. Returns fires true/false, the local wall time of that instant, and DST notes if the local time is in a gap or fold.

Use when you or the user just wrote a cron expression (GitHub Actions, Vercel cron, Cloudflare Cron Triggers, systemd, an agent schedule) and need its next fire times. Pass the expression and an IANA timezone (default UTC). Returns the next N runs as local wall times and UTC ISO, a plain-English field breakdown, and DST gap/fold warnings (spring-forward skips, fall-back double fires). Example: {"expression":"0 9 * * 1-5","timezone":"America/New_York","count":5}. Uses the tz database, so DST rules match the region and year. Not for converting a meeting time across cities (use Meridian) or for email DNS (use Stamp).