Pigfox MCP endpoint

Call pigfox tools from an MCP client — Claude Desktop, an agent framework, or anything else that speaks the Model Context Protocol — with a bearer token, per-call metering, and a spend ceiling you cannot accidentally exceed.

Connect

The endpoint is https://pigfox.com/api/mcp, served over Streamable HTTP. Create a token at your API tokens page (you will need to be signed in), then point your client at it:

{
  "mcpServers": {
    "pigfox": {
      "url": "https://pigfox.com/api/mcp",
      "headers": {
        "Authorization": "Bearer pfx_YOUR_TOKEN_HERE"
      }
    }
  }
}

A request with no token, an unrecognised token, or a revoked token is refused before any tool runs and costs nothing.

Tools

Four tools are exposed today. Each is the same engine as its page on this site, so a result here and a result there are the same result.

Tool	What it does	Per call
security-headers-grader	Grade a site's HTTP security headers (CSP, HSTS, framing, nosniff, and more).	Free
ssl-certificate-checker	Inspect a domain's live TLS certificate: issuer, SANs, expiry, chain, and TLS version.	Free
redirect-chain-tracer	Trace every hop a URL redirects through and flag downgrades, loops, and meta-refresh.	Free
homepage-density-optimizer	Find the optimal number of homepage items by maximizing traffic × conversion, with a closed-form Lambert-W solution.	1 credit

The rest of the pigfox tool catalogue is not exposed over MCP yet. Most of those tools are reachable only through a form — a file upload, a multi-field questionnaire — and each needs a real adapter written and tested before it can be called by a machine. Four that work is the honest state of it; more will follow.

What a call costs

Credits are the same credits the rest of the site uses, drawn from the same balance. A free tool costs nothing. A paid tool costs one credit — the same price the web page charges for the same work, so there is nothing to arbitrage between the two doors. An active subscription covers MCP calls exactly as it covers the web tools: nothing is held and nothing is debited.

A tool that runs and reports a failure is still billed, because it ran. A call that is refused before dispatch — no credit, over a limit, unknown tool — is never billed.

Limits

These bound what one client can spend. They are deliberately denominated in credits rather than in requests, because the caller here is usually an agent: an agent that hits an error retries rather than stopping, and it is perfectly willing to wait between attempts, which is exactly the pattern a per-second rate limit cannot see.

• Session ceiling: 50 credits. The cumulative cost one MCP session may reach. This is the control that actually stops a retry loop.
• Per-call cap: 5 credits. The most any single call may cost. No tool exposed today costs more than one, so this is a guard against a mispriced tool rather than a live constraint.
• Rate: 20 calls immediately, then 1 per second. This protects the server's capacity. It is the weakest of the three and is not what protects your balance.

What this does not do

• It does not expose every pigfox tool — four of them, listed above.
• It does not implement the protocol itself. Transport and schema handling come from the official MCP Go SDK; the metering, authentication and ceilings come from pigfox/mcp-metered, which is open source.
• It does not quote a latency or throughput figure, because none has been measured.
• If a call's outcome cannot be determined — the connection drops mid-call, say — its credit is held rather than automatically returned, and is reconciled by hand. Returning credit for an outcome nobody knows would make an abandoned call a free call.

Create a token See credit packs