# curlhub.sh

> CLI-first developer utilities you curl straight from the terminal — UUIDs, hashes,
> base64, JWT decode, cron translation, CIDR math, HTTP status lookups, certificate
> inspection, curl-command synthesis, and ephemeral paste / file / webhook endpoints.
> No signup, no key. Every tool answers plain text to curl, JSON to an API client, and
> an HTML page to a browser — same URL, three representations.

## MCP server (for AI assistants)

curlhub speaks the Model Context Protocol, so an MCP-aware client can call it as a tool
instead of scraping pages.

- Endpoint: `https://curlhub.sh/mcp` (JSON-RPC 2.0 over HTTP POST)
- Tool: `validate_and_format_curl(url, method?, headers?, data?)` — build a correctly
  shell-quoted curl command from a structured request description
- No key required. Shares the keyless quota: 60 requests/minute per calling IP, the same
  bucket as the HTTP transform endpoints.

Example client config:

    { "mcpServers": { "curlhub": { "url": "https://curlhub.sh/mcp" } } }

Note: `/mcp` is POST-only and returns 405 to GET — it is an API endpoint, not a page, and
is deliberately absent from the sitemap. Batch arrays are not supported (removed in MCP
2025-06-18).

Browser-based agents: pages also register the same tool via WebMCP
(`document.modelContext`), native in Edge 147 and available in Chrome 149 behind its
origin trial.

## Keyless JSON API

Every tool serves JSON at the same URL — no key, no signup. Ask with
`Accept: application/json` or `?format=json`:

    curl -s https://curlhub.sh/format-curl \
      -H 'Content-Type: application/json' \
      -H 'Accept: application/json' \
      -d '{"method":"POST","url":"https://api.example.com/v1/items",
           "headers":{"Content-Type":"application/json"},
           "data":"{\"name\":\"value\"}"}'

Returns `{command, method, url, headers, warnings}`. 60 requests/minute per IP, shared
across all transform endpoints. Omit the Accept header and the same URL returns plain
text; visit it in a browser and you get the HTML tool page.

## Why /format-curl exists

Models emit curl by hand and get the quoting wrong, and the failure is silent — one
apostrophe inside a header value ends the quoted string and the remainder becomes shell
words. This endpoint does the quoting by construction:

- Every interpolated value is wrapped in POSIX single quotes, with embedded single quotes
  rendered as `'\''`. Inside single quotes the shell treats every other byte literally,
  so `$`, backticks, `\`, `;`, newlines and globs need no special handling. There is
  exactly one metacharacter to get right, and it is handled.
- Bodies are emitted with `--data-binary`, not `-d`, because `-d` strips newlines and
  treats a leading `@` as a filename.
- Refused rather than escaped, because escaping them would produce a command that is
  valid but misleading: non-http(s) schemes (`file://`, `gopher://`, `dict://`), control
  characters or whitespace in the URL, header names that are not RFC 9110 tokens, and
  non-UTF-8 input.
- Nothing is fetched and nothing is stored. Because no outbound request is made, private
  and link-local targets are allowed — building a command for `127.0.0.1` or
  `169.254.169.254` is a normal developer task, not an SSRF.

## Tools

- [/format-curl](https://curlhub.sh/format-curl): build a shell-safe curl command from a method, URL, headers and body
- [/uuid](https://curlhub.sh/uuid): RFC 4122 v4 UUIDs
- [/hash](https://curlhub.sh/hash): MD5 / SHA-1 / SHA-256 / SHA-512 digests of piped input
- [/b64](https://curlhub.sh/b64): base64 encode / decode
- [/jwt](https://curlhub.sh/jwt): decode a JWT's header and claims (no signature verification)
- [/json](https://curlhub.sh/json): pretty-print and validate JSON
- [/cron](https://curlhub.sh/cron): translate a cron expression into English
- [/cidr](https://curlhub.sh/cidr): CIDR range maths — network, broadcast, host count
- [/ip](https://curlhub.sh/ip): the caller's public IP
- [/headers](https://curlhub.sh/headers): echo the request headers as received
- [/ua](https://curlhub.sh/ua): parse a User-Agent string
- [/ssl](https://curlhub.sh/ssl): inspect a TLS certificate chain
- [/status/418](https://curlhub.sh/status/418): what an HTTP status code means
- [/man](https://curlhub.sh/man): community CLI cheat-sheet wiki
- [/help](https://curlhub.sh/help): the full tool list, as text
- [/spec](https://curlhub.sh/spec): machine-readable description of the whole surface

Ephemeral, and they do retain data — each says so on its own page:
[/p](https://curlhub.sh/p) paste, [/u](https://curlhub.sh/u) file upload,
[/hook](https://curlhub.sh/hook) request-capture webhooks.

## Rate limits (verified 2026-08-20)

- Transform tools and `/mcp`: 60 requests/minute per IP, one shared bucket
- Heavier endpoints have their own lower limits — `/whois` 5/min, `/report` 10/hr,
  `/u` upload 5/hr, `/p` paste 15/10min
- Responses carry `X-RateLimit-Limit` and `X-RateLimit-Remaining`; a 429 carries
  `Retry-After`
- Nothing is stored for the pure transforms — no logging of payloads, no outbound calls

## Citation

Stable URL slugs are safe to link and cite: `/{tool}`, `/status/{code}`, `/man/{command}`.