RMCP.DEV
← Registry

Security & Testing

leak.town

Manages fake endpoints and captures requests for testing and security purposes.

2 endpoints127 known toolsFirst detected June 24, 2026Last detected July 30, 2026

ENDPOINT 1

https://leak.town/api/mcp

No auth detected

MCP server metadata

Name
leak.town
Version
0.1.0
Capabilities
tools.listChanged
Server instructions

leak.town creates temporary HTTP/DNS/email capture towns for webhook debugging, DNS testing, payload inspection, and pen-testing. QUICK START: call create_town to get a token + url. Pass that token to every other tool. Tokens are the only auth — keep them out of logs. DEFAULT (core) toolset covers: town lifecycle, endpoint CRUD, request inspection, replay. Optional toolsets — call list_toolsets to see what's available, enable_toolset to turn one on: • dns — manage DNS records on the town's subdomain • storage — key-value storage scoped to a town • files — upload/manage static files served by an endpoint • share — read-only share links for showing a town to others • domains — custom domains (requires authToken, not a town token) • shell — remote shell sessions delivered into a captured request • remote_js — instrument a browser via injected JS (DOM, eval, network) • export_import — archive a town's config as a zip and re-import When a user asks about something a tool obviously matches, just call it. When unsure which toolset is relevant, list_toolsets first.

Known tools 36

claim_town

Claim an anonymous (token-only) town for the authenticated user, associating it with their account so it shows up in list_towns.

Inferred read-only
clear_requests

Clear captured requests.

Inferred read-only
create_canary

Create canary endpoint.

Potential side effects
create_content_endpoint

Create content endpoint.

Potential side effects
create_intercept_endpoint

Create an intercept endpoint.

Potential side effects
create_javascript_endpoint

Create JavaScript endpoint.

Potential side effects
create_proxy_endpoint

Create proxy endpoint.

Potential side effects
create_static_files_endpoint

Create an empty static-files endpoint.

Potential side effects
create_template_endpoint

Create template endpoint.

Potential side effects
create_town

Create a new leak.town town.

Potential side effects
create_tunnel_endpoint

Create a tunnel endpoint.

Potential side effects
create_websocket_endpoint

Create a WebSocket endpoint.

Potential side effects
delete_endpoint

Delete endpoint.

Potential side effects
delete_request

Delete a single captured request.

Potential side effects
delete_town

Delete town.

Potential side effects
disable_toolset

Deactivate a previously enabled optional toolset.

Inferred read-only
download_request_body

Get raw request body by ID.

Inferred read-only
download_response_body

Get raw response body by request ID.

Inferred read-only
edit_endpoint

Partial-update an endpoint, preserving fields not specified.

Potential side effects
enable_toolset

Activate one optional toolset so its tools become callable.

Inferred read-only
enable_toolsets

Activate multiple optional toolsets in a single call.

Inferred read-only
extend_town

Extend town lifetime by the server's default duration.

Inferred read-only
get_instance_config

Get public instance configuration: vhosts, default town lifetime, body/email/file size limits, registration mode, and feature toggles.

Potential side effects
get_request_detail

Get request details.

Inferred read-only
get_town_info

Get town info.

Inferred read-only
list_endpoints

List endpoints.

Inferred read-only
list_requests

List captured requests.

Inferred read-only
list_toolsets

Discover tool groups (toolsets) and their current state.

Inferred read-only
list_towns

List towns.

Inferred read-only
reorder_endpoints

Reorder endpoints.

Inferred read-only
replay_request

Replay a request.

Inferred read-only
reset_content

Reset content endpoint.

Inferred read-only
set_town_expiry

Set a town's expiry time.

Inferred read-only
test_webhook_endpoint

Test webhook.

Inferred read-only
update_town_settings

Update town settings.

Potential side effects
upload_content

Upload content body.

Potential side effects

CONNECT WITH APPROVAL

Client installation

Review this server and its permissions before adding it. Secret placeholders must be set locally.

Codex

~/.codex/config.toml

[mcp_servers.leak-town]
url = "https://leak.town/api/mcp"
enabled = true
Claude Code

.mcp.json

{
  "mcpServers": {
    "leak-town": {
      "type": "http",
      "url": "https://leak.town/api/mcp"
    }
  }
}
Claude Desktop

Settings → Connectors → Add custom connector

Name: leak-town
Remote MCP URL: https://leak.town/api/mcp

Add this remote URL as a custom connector in Claude Desktop. Availability depends on the user plan and workspace policy.

Cursor

.cursor/mcp.json

{
  "mcpServers": {
    "leak-town": {
      "url": "https://leak.town/api/mcp"
    }
  }
}
Visual Studio Code

.vscode/mcp.json

Add to Visual Studio Code 
{
  "servers": {
    "leak-town": {
      "type": "http",
      "url": "https://leak.town/api/mcp"
    }
  }
}
Generic MCP

Client-specific MCP configuration

{
  "name": "leak-town",
  "transport": "streamable-http",
  "url": "https://leak.town/api/mcp"
}
MCP Inspector

Run the official MCP Inspector locally and enter the indexed Streamable HTTP endpoint.

ENDPOINT 2

https://leak.town/api/mcp/full

No auth detected

MCP server metadata

Name
leak.town
Version
0.1.0
Capabilities
tools.listChanged
Server instructions

leak.town creates temporary HTTP/DNS/email capture towns for webhook debugging, DNS testing, payload inspection, and pen-testing. QUICK START: call create_town to get a token + url. Pass that token to every other tool. Tokens are the only auth — keep them out of logs. DEFAULT (core) toolset covers: town lifecycle, endpoint CRUD, request inspection, replay. Optional toolsets — call list_toolsets to see what's available, enable_toolset to turn one on: • dns — manage DNS records on the town's subdomain • storage — key-value storage scoped to a town • files — upload/manage static files served by an endpoint • share — read-only share links for showing a town to others • domains — custom domains (requires authToken, not a town token) • shell — remote shell sessions delivered into a captured request • remote_js — instrument a browser via injected JS (DOM, eval, network) • export_import — archive a town's config as a zip and re-import When a user asks about something a tool obviously matches, just call it. When unsure which toolset is relevant, list_toolsets first.

Known tools 91

claim_town

Claim an anonymous (token-only) town for the authenticated user, associating it with their account so it shows up in list_towns.

Inferred read-only
clear_requests

Clear captured requests.

Inferred read-only
copy_file

Copy file.

Inferred read-only
create_canary

Create canary endpoint.

Potential side effects
create_content_endpoint

Create content endpoint.

Potential side effects
create_dns_record

Create DNS record.

Potential side effects
create_intercept_endpoint

Create an intercept endpoint.

Potential side effects
create_javascript_endpoint

Create JavaScript endpoint.

Potential side effects
create_proxy_endpoint

Create proxy endpoint.

Potential side effects
create_share

Create share link.

Potential side effects
create_static_files_endpoint

Create an empty static-files endpoint.

Potential side effects
create_template_endpoint

Create template endpoint.

Potential side effects
create_town

Create a new leak.town town.

Potential side effects
create_tunnel_endpoint

Create a tunnel endpoint.

Potential side effects
create_websocket_endpoint

Create a WebSocket endpoint.

Potential side effects
delete_dns_record

Delete DNS record.

Potential side effects
delete_endpoint

Delete endpoint.

Potential side effects
delete_file

Delete file.

Potential side effects
delete_request

Delete a single captured request.

Potential side effects
delete_town

Delete town.

Potential side effects
disable_toolset

Deactivate a previously enabled optional toolset.

Inferred read-only
download_request_body

Get raw request body by ID.

Inferred read-only
download_response_body

Get raw response body by request ID.

Inferred read-only
edit_endpoint

Partial-update an endpoint, preserving fields not specified.

Potential side effects
edit_file

Edit a file's content and/or headers.

Potential side effects
enable_toolset

Activate one optional toolset so its tools become callable.

Inferred read-only
enable_toolsets

Activate multiple optional toolsets in a single call.

Inferred read-only
export_endpoint

Export a single endpoint as a zip archive (configuration + any associated static files).

Inferred read-only
export_requests

Export captured requests.

Inferred read-only
export_town

Export town config.

Inferred read-only
extend_town

Extend town lifetime by the server's default duration.

Inferred read-only
get_available_hosts

Available town hosts for the calling user: built-in `system_hosts`, the user's own `user_hosts`, and `shared_hosts` granted by other domain owners.

Inferred read-only
get_file_content

Download a file's bytes from a static-files endpoint.

Inferred read-only
get_instance_config

Get public instance configuration: vhosts, default town lifetime, body/email/file size limits, registration mode, and feature toggles.

Potential side effects
get_ns_targets

Get NS targets for domain verification.

Inferred read-only
get_remote_js_hook_script

Get the remote JS instrumentation hook script source.

Inferred read-only
get_request_detail

Get request details.

Inferred read-only
get_town_info

Get town info.

Inferred read-only
import_endpoint

Import a single endpoint from a zip archive previously produced by export_endpoint (pass file_base64 with the base64-encoded zip bytes).

Inferred read-only
import_town

Import a previously-exported town configuration bundle (endpoints, DNS records, settings).

Inferred read-only
leave_domain_share

Leave shared domain.

Inferred read-only
list_dns_records

List DNS records.

Inferred read-only
list_domain_shares

List domain shares.

Inferred read-only
list_endpoints

List endpoints.

Inferred read-only
list_files

List files in a static files endpoint.

Inferred read-only
list_owned_domains

List the calling user's verified domains (under `domains`) and domains other users have shared with them (under `shared_domains`, each with the owner's username and avatar).

Inferred read-only
list_requests

List captured requests.

Inferred read-only
list_toolsets

Discover tool groups (toolsets) and their current state.

Inferred read-only
list_towns

List towns.

Inferred read-only
remote_js_disable

Disable remote JS instrumentation.

Inferred read-only
remote_js_enable

Enable remote JS instrumentation.

Inferred read-only
remote_js_eval

Evaluate JavaScript code in a remote browser session.

Inferred read-only
remote_js_get_browser_storage

Get browser storage (localStorage, sessionStorage, cookies) from a remote browser session.

Inferred read-only
remote_js_get_dom

Get the DOM tree from a remote browser session.

Inferred read-only
remote_js_get_navigation

Get navigation history from a remote browser session.

Inferred read-only
remote_js_get_performance

Get performance metrics from a remote browser session.

Inferred read-only
remote_js_modify_dom

Modify a DOM element in the remote browser.

Potential side effects
remote_js_regenerate_key

Regenerate the remote JS hook key.

Inferred read-only
remote_js_set_browser_storage

Set a browser storage value in a remote browser session.

Inferred read-only
remote_js_status

Get remote JS status.

Inferred read-only
remote_js_take_screenshot

Take a screenshot of the remote browser session.

Inferred read-only
remote_js_terminate

Terminate a remote JS session.

Inferred read-only
remove_domain

Remove domain.

Potential side effects
rename_file

Rename file.

Inferred read-only
reorder_endpoints

Reorder endpoints.

Inferred read-only
replay_request

Replay a request.

Inferred read-only
reset_content

Reset content endpoint.

Inferred read-only
revoke_share

Revoke share link.

Inferred read-only
set_dns_records

Replace all DNS records.

Inferred read-only
set_town_expiry

Set a town's expiry time.

Inferred read-only
share_domain

Share domain.

Inferred read-only
share_status

Get share status.

Inferred read-only
shell_disable

Disable reverse shell listener.

Potential side effects
shell_enable

Enable shell listener.

Potential side effects
shell_exec

Execute a command in a shell session.

Potential side effects
shell_read

Read pending output from a shell session.

Potential side effects
shell_status

Get shell status.

Potential side effects
shell_terminate

Terminate a specific shell session.

Potential side effects
storage_all

Get all storage entries as a key-value map.

Inferred read-only
storage_clear

Clear all values from the town's storage.

Inferred read-only
storage_get

Get a value from the town's key-value storage.

Inferred read-only
storage_list

List all keys in the town's storage.

Inferred read-only
storage_remove

Remove a key from the town's storage.

Potential side effects
storage_set

Set a value in the town's key-value storage.

Inferred read-only
test_webhook_endpoint

Test webhook.

Inferred read-only
unshare_domain

Revoke domain share.

Inferred read-only
update_dns_record

Update DNS record.

Potential side effects
update_town_settings

Update town settings.

Potential side effects
upload_content

Upload content body.

Potential side effects
upload_file

Upload files.

Potential side effects
verify_domain

Verify domain ownership.

Inferred read-only

CONNECT WITH APPROVAL

Client installation

Review this server and its permissions before adding it. Secret placeholders must be set locally.

Codex

~/.codex/config.toml

[mcp_servers.leak-town]
url = "https://leak.town/api/mcp/full"
enabled = true
Claude Code

.mcp.json

{
  "mcpServers": {
    "leak-town": {
      "type": "http",
      "url": "https://leak.town/api/mcp/full"
    }
  }
}
Claude Desktop

Settings → Connectors → Add custom connector

Name: leak-town
Remote MCP URL: https://leak.town/api/mcp/full

Add this remote URL as a custom connector in Claude Desktop. Availability depends on the user plan and workspace policy.

Cursor

.cursor/mcp.json

{
  "mcpServers": {
    "leak-town": {
      "url": "https://leak.town/api/mcp/full"
    }
  }
}
Visual Studio Code

.vscode/mcp.json

Add to Visual Studio Code 
{
  "servers": {
    "leak-town": {
      "type": "http",
      "url": "https://leak.town/api/mcp/full"
    }
  }
}
Generic MCP

Client-specific MCP configuration

{
  "name": "leak-town",
  "transport": "streamable-http",
  "url": "https://leak.town/api/mcp/full"
}
MCP Inspector

Run the official MCP Inspector locally and enter the indexed Streamable HTTP endpoint.

TRUST AND VERIFICATION EVIDENCE

Trust Data Available

BuiltWith Trust API v2 evidence for leak.town was fetched 2026-08-11T18:59:51.851Z and is being refreshed.

Trust status Trusted

leak.town is assessed as Trusted: Domain has an established technology history spanning over a year.

Indexed

Evidence is source-attributed and does not guarantee that a third-party server is safe. Risk labels are conservative metadata heuristics.