What are the rate limits?

Ten runs per hour per IP for the tools that fetch, render, or call a model, and sixty per hour for the Tech Stack Detector, which only fetches one page. The meeting planner, UTM builder, and MD5 endpoint have no application rate limit; they compute locally on the server with bounded inputs and do not store results. Results are cached for 24 hours per URL, and a cached answer does not spend a slot, so asking about a URL somebody already checked is free.

How long does a call take?

Between about a second for the Tech Stack Detector and up to a minute for the checks that render a page or call a model. Each tool tells your client its own ceiling in its description, so set your timeout from that rather than assuming a normal HTTP call.

Website check results are cached against the URL for 24 hours. Meeting planning, UTM building, and MD5 hashing do not store results. No account, no history, no log of who asked. Screenshots are the one exception: the PNG lives in our bucket behind a link that expires in about a day.

Can I use this in a product?

For yourself, your team, and your clients' sites, yes. What the rate limit is there to prevent is somebody reselling the endpoint as their own tool, or pointing a crawler at it. If you need volume beyond the hourly limits, get in touch rather than working around them.

Why is a tool missing from the list?

The list on this page is generated from the same catalogue the MCP server answers with, and a tool only appears once its engine is verified working, so a tool we do not yet trust is absent rather than quietly wrong. One tool has no endpoint at all by design: the Markdown Viewer runs entirely in your browser, so nothing you open in it ever reaches a server.

Free forever

MCP server and API for the free tools

Find meeting times across cities, check websites, and build campaign links from your agent. One URL, no account, no API key.

14 tools. Nothing stored beyond a 24 hour cache. Markdown copy for agents.

Add it to your client

One URL, Streamable HTTP transport, no authentication. In Claude Code that is a single command; every other client takes the same URL in its own config.

Claude Code — run once, in any projectbash

claude mcp add --transport http superflow https://usesuperflow.ai/api/mcp

Claude Desktop, Cursor, VS Code, and older clients

Claude Desktop

claude_desktop_config.jsonjson

{
  "mcpServers": {
    "superflow": {
      "type": "http",
      "url": "https://usesuperflow.ai/api/mcp"
    }
  }
}

Settings → Developer → Edit Config, then restart the app.

Cursor

~/.cursor/mcp.json, or .cursor/mcp.json in a projectjson

{
  "mcpServers": {
    "superflow": {
      "url": "https://usesuperflow.ai/api/mcp"
    }
  }
}

VS Code

Run oncebash

code --add-mcp '{"name":"superflow","type":"http","url":"https://usesuperflow.ai/api/mcp"}'

Anything older

Bridge a stdio-only client onto the HTTP endpointjson

{
  "mcpServers": {
    "superflow": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://usesuperflow.ai/api/mcp"]
    }
  }
}

Only needed for clients that predate the Streamable HTTP transport.

The tools

What your agent sees after connecting. Website checks take a URL; meeting planning takes locations and a date. Each tool lists its arguments below.

MCP tool	What it does	Arguments
find_meeting_times	Time Zone Converter & Meeting Planner. Find overlapping working hours and meeting times across cities or countries.	locations, date, durationMinutes?, workStart?, workEnd?, workDays?, limit?
check_ai_visibility	AI Visibility Checker. Check whether AI assistants (ChatGPT, Claude, Perplexity, Google AI) can reach, read, and cite a web page.	url?, refresh?, runId?
check_robots_txt_for_ai	robots.txt AI Checker. Test a site's robots.txt against every AI crawler that matters (GPTBot, ClaudeBot, PerplexityBot, Google-Extended, CCBot, Googlebot, Bingbot and the rest) and report which are allowed, which are blocked, and which rule decided it.	url?, refresh?, runId?
generate_llms_txt	llms.txt Generator. Generate llms.txt and llms-full.txt for a site, following the llmstxt.org convention.	url?, refresh?, runId?
page_to_markdown	Markdown for Agents. Fetch one web page and convert it to clean CommonMark, with the navigation, cookie banners, and boilerplate stripped out.	url?, refresh?, runId?
generate_json_ld	JSON-LD Generator. Read a page and write a schema.org JSON-LD block for it, then validate that block against the same checks a validator would run.	url?, refresh?, runId?
validate_json_ld	JSON-LD Validator. Read the structured data already on a page and check it against Schema.org and what search engines actually accept.	url?, refresh?, runId?
check_social_preview	Social Preview Checker. Read a page's Open Graph and Twitter card tags and report how the link will render on X, LinkedIn, Facebook, Slack, Discord, and Google.	url?, refresh?, runId?
detect_tech_stack	Tech Stack Detector. Identify the platform, framework, CMS, ecommerce apps, analytics, CDN, and hosting behind a site by fingerprinting one page's HTML and response headers.	url, refresh?
check_favicon	Favicon Checker. Check whether a site's favicon actually works.	url, refresh?
capture_full_page_screenshot	Full Page Screenshot. Capture a full-height PNG of a page in a real headless browser, scrolling first so lazy-loaded content renders.	url?, refresh?, runId?
generate_alt_text	Alt Text Generator. Find every image on a page and draft alt text for the ones that need it, using a vision model that actually looks at the image.	url?, refresh?, runId?
build_utm_url	UTM Builder. Build a campaign URL with utm parameters, normalised to one tagging convention, and report which GA4 default channel group the link will land in.	url, source?, medium?, campaign?, id?, term?, content?, caseRule?, spaceRule?, stripPunctuation?
hash_md5	MD5 Hash Generator. Hash text to an MD5 hex digest.	text

The HTTP API

The same tools without MCP. Send a JSON body with the tool's arguments and receive JSON. For cached website checks, add "refresh": true to skip the 24 hour cache and run again.

Examplebash

curl -sS https://usesuperflow.ai/api/tools/meeting-planner \
  -H 'Content-Type: application/json' \
  -d '{"locations":["San Francisco California","New York City","London United Kingdom"],"date":"2026-09-09","durationMinutes":30}'

Endpoint	Returns	Limit	Allow
POST /api/tools/meeting-planner	{ ok, date, dateZone, durationMinutes, locations[], overlapMinutes, overlapWindows[], slots[] with UTC/local times and copyText, totalAvailableStarts, hasMore, planUrl, availability }	No application rate limit. Up to 8 locations, 20 returned starts, and a 16 KB request body; no result storage.	10s
POST /api/tools/ai-visibility	{ ok, report: { score, grade, scoredOutOf, categories[], findings[] with why and fix, detection }, cached, ageSeconds }	10 runs per hour per IP	75s
POST /api/tools/robots-txt-ai-checker	{ ok, report: { accessScore, crawlers[] with the rule that decided each verdict, firewall, findings[] }, cached, ageSeconds }	10 runs per hour per IP	75s
POST /api/tools/llms-txt-generator	{ ok, report: { siteName, llmsTxt, llmsFullTxt, pagesDiscovered, pagesIncluded, truncated }, cached, ageSeconds }	10 runs per hour per IP	75s
POST /api/tools/markdown-for-agents	{ ok, report: { markdown, title, description, wordCount, bytes, truncated, httpStatus }, cached, ageSeconds }	10 runs per hour per IP	75s
POST /api/tools/json-ld-generator	{ ok, report: { detectedType, jsonLd, jsonLdString, validation: { findings[], passed }, model } }	10 runs per hour per IP	75s
POST /api/tools/json-ld-validator	{ ok, report: { blockCount, invalidBlockCount, declaredTypes[], eligibility[], categories[], findings[] } }	10 runs per hour per IP	75s
POST /api/tools/social-preview	{ ok, report: { previews[] per platform, tags, summary, findings[] }, cached, ageSeconds }	10 runs per hour per IP	75s
POST /api/tools/tech-stack	{ platformName, theme, apps[], fonts[], analytics[], hosting[], renderMode, url, status, fetchedAt }	60 runs per hour per IP	30s
POST /api/tools/favicon-checker	{ hasWorkingFavicon, tabIcon, icons[] with format, dimensions, bytes and problem, manifest, themeColor, checks[] with id, status and fix, counts }	60 runs per hour per IP	30s
POST /api/tools/full-page-screenshot	{ imageUrl, expiresAt, bytes, width, height, deviceType }	10 runs per hour per IP	90s
POST /api/tools/alt-text-generator	{ images[] with src, hadAlt, currentAlt, suggestedAlt, isDecorative, skippedReason; counts; model }	10 runs per hour per IP	90s
POST /api/tools/utm-builder	{ url, normalized, channel, issues[] with level, field and message }	None. The work is local and costs nothing.	10s
POST /api/tools/md5	{ md5, algorithm, bytes }	None. The work is local and costs nothing.	10s

What a failure looks like

A failed run is still JSON. Depending on the endpoint it comes back either as { ok: false, code, message } with a 4xx, or as HTTP 200 carrying an error field and an errorCode. Both carry a message written for a human to read as-is. There is never a stack trace and never an empty 500. Over MCP both shapes surface as a tool error, so an agent does not have to know which endpoint uses which.

The codes worth branching on are invalid-url (including anything private, local, or not on the public internet), rate-limited (carries retryAfterSeconds), blocked (bot protection answered instead of the site), and budget-exhausted (the monthly model spend on the two AI-backed tools, which fails closed rather than inventing an answer).

Common questions

No. There is no signup, no key, and no OAuth step. The endpoint is open and the tools are free. What limits use is a per-IP rate limit, not a credential.