CleverUtils MCP Server

Server endpoint

The MCP server speaks JSON-RPC 2.0 over HTTP at:

https://cleverutils.com/mcp

It implements the Streamable HTTP transport (POST for JSON-RPC requests). No session state, no authentication, IP-rate-limited at 1000 requests per day.

Connect from Claude Desktop

{
  "mcpServers": {
    "cleverutils": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://cleverutils.com/mcp"]
    }
  }
}

{
  "mcpServers": {
    "cleverutils": {
      "url": "https://cleverutils.com/mcp"
    }
  }
}

{
  "mcpServers": {
    "cleverutils": {
      "url": "https://cleverutils.com/mcp"
    }
  }
}

Available tools

The server exposes 15 tools. All tool inputs accept either an HTTPS URL (the server fetches with SSRF protection) or a base64-encoded file. Outputs are returned as MCP resource_link blocks pointing to a 2-hour-valid download URL.

Example prompts

Once connected, you can ask the LLM things like:

• "Convert https://example.com/photo.heic to JPG."
• "Upscale this image 4x: https://example.com/icon.png"
• "Remove the background from https://example.com/portrait.jpg and give me the transparent PNG."
• "Transcribe this podcast as SRT subtitles in English: https://example.com/episode.mp3"
• "Compress this PDF to roughly 50% of original size: https://example.com/report.pdf"
• "Merge these three PDFs into one: https://…/a.pdf, https://…/b.pdf, https://…/c.pdf"

How it works

1. LLM picks a tool. Based on your request, the LLM looks at the tool list and chooses (e.g., upscale_image) with the right arguments.
2. Server fetches the file. If you passed a URL, the server downloads it server-side — behind a strict SSRF blocklist (no private IPs, no file://, no DNS rebinding).
3. Conversion runs. The same engine as our website and REST API: ImageMagick, FFmpeg, Real-ESRGAN, Demucs, Whisper, Ghostscript, LibreOffice.
4. Result is returned as a resource link. The LLM gets a structured response containing both human-readable text ("File converted: photo.jpg, 180 KB") and a machine-readable resource_link with a download URL valid for 2 hours.

Test it from your terminal

If you just want to verify the server works without setting up a full MCP client, try this curl:

curl -X POST https://cleverutils.com/mcp \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "initialize",
    "params": {
      "protocolVersion": "2025-06-18",
      "capabilities": {},
      "clientInfo": {"name": "curl", "version": "1.0"}
    }
  }'

curl -X POST https://cleverutils.com/mcp \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/list"}'

curl -X POST https://cleverutils.com/mcp \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",
    "id": 3,
    "method": "tools/call",
    "params": {
      "name": "convert_file",
      "arguments": {
        "file": "https://example.com/photo.heic",
        "to_format": "jpg"
      }
    }
  }'

Limits and quotas

• 1000 tool calls per day per IP
• 150 calls per hour per IP
• 1 second cooldown between consecutive calls
• Max 200 MB per file (smaller for some heavy AI tools)
• Max 20 files in one batch (e.g. merge_pdfs)
• 2 hours retention for converted output URLs
• Heavy AI tools (upscale, vocal-remover, colorize, etc.) have a tighter 50/day cap

Same model as the REST API. See /api/rate-limits for full details.

Security & safety

The server is exposed publicly without authentication, so we take security seriously:

• SSRF protection: file URLs are fetched server-side with a strict blocklist of private IP ranges (RFC1918, link-local, AWS metadata, IPv6 ULA). DNS rebinding is mitigated by pinning the resolved IP. Only http(s):// schemes are allowed.
• Size limits: hard cap at 200 MB per fetch, enforced during streaming download (we abort mid-transfer).
• No persistence: all input files and converted outputs are deleted after 2 hours.
• Anonymous logging: we hash caller IPs (salted SHA-256) for rate limiting and abuse detection. Plaintext IPs are never stored.
• Rate limiting: identical 5-tier limiter as our REST API.

What if I'm the LLM, not the human?

If you (the model) are reading this page because the user pasted the URL, you can:

1. Suggest the user add the server to their MCP config (snippets above).
2. Or, if you have HTTP access already, call POST https://cleverutils.com/mcp with the JSON-RPC body shown in the curl examples — this works without MCP client integration.
3. Always start with tools/list to discover the current tool catalog and parameter schemas.

See also

• CleverUtils API home — the underlying REST API
• REST API quickstart — for non-LLM use
• REST endpoint reference
• Rate limits
• modelcontextprotocol.io — the MCP spec