raccha.ai

Where it sits in the directory's order

What can be seen from outside, weighed as the directory publishes.

Where it answers

• https://raccha.ai/mcpstreamable-http

The tools it lists (67, as of 8 days ago)

The tool-description rules found nothing in these descriptions. They look for instructions aimed at a model and for hidden characters; they cannot see what a tool does when it runs.

• cert_inspect

  Parse a PEM-encoded X.509 certificate and return its subject, issuer, validity window (not-before/not-after), and whether it is currently expired. Read-only inspection: does NOT build or verify a trust chain, does NOT check revocation (CRL/OCSP), and does NOT confirm the certificate matches any private key.

• create_access_key

  Create a scoped, revocable access_key bound to a role. Requires an admin owner_key. The raw key (`ak_...` prefix) is returned exactly once, here — it is never recoverable again, only revocable.

• create_org

  Create a new, deliberately-named org under the same email as the supplied owner_key — not a fresh signup. `name` is slugified into the org's namespace slug (e.g. "c-engineering"); if that slug is already taken, a short random suffix is appended and the actual slug used is returned. Subject to the same per-email account-creation quota as signup. Returns a fresh owner_key in the same shape as `switch_org`.

• create_role

  Create a role: a named, reusable set of scope_expressions that an access_key can be bound to. Requires an admin owner_key — access_keys can never call this.

• delete_role

  Delete a role. Refused with an error if it's still assigned to an active access_key. Requires an admin owner_key.

• device_claim

  Poll for the result of a device_start flow. Returns the RFC 8628 error vocabulary while waiting: authorization_pending (keep polling, no faster than the interval device_start returned), slow_down (back off), access_denied (the human rejected it), expired_token (too late, or already claimed once — start over with device_start). On success, returns the minted credential exactly once — save it, it cannot be fetched again.