MCP servers › com.it.scorptech › x402

MCP server · registry snapshot 2026-10-24 · last tested 2026-10-24

com.it.scorptech/x402

112 x402 pay-per-call tools: web data, security/OSINT, SEC and public data, Solana/EVM lookups — the publisher's description

1 of 2 record checks metRead-only · tools listed 2026-10-24version 1.0.0streamable HTTP1,012 tools

Summary

com.it.scorptech/x402 is a remote MCP server listed in the official MCP registry at version 1.0.0. On 2026-10-24 ProtocolProbe connected to it in read-only mode and read its inventory: 1,012 tools, 0 resources and 0 prompts.

Record checks

1 of 2 record checks met · 7 do not apply

met: Registry entry is active and says how to run it
not met: Source repository link opens
not applicable: Repository is not archived
not applicable: Code pushed to the repository in the 90 days before our check
not applicable: Repository publishes a security policy (SECURITY.md)
not applicable: Package names its licence with a standard (SPDX) identifier
not applicable: The version the registry lists can be installed and is not withdrawn
not applicable: npm package carries build provenance (attestation)
not applicable: No known critical or high advisory in the package or its dependencies

From public records, not a safety rating. Each check with its reason

Key facts

Runs: remote (hosted by the publisher)
Transport: streamable HTTP
Sign-in: none needed to open a session
Tools: 1,012
Last tested: 2026-10-24

Add to your client

How fresh this is

Live-tested: yes, a real session (not a text-only review)
Last tested: 2026-10-24
Mode: read-only (no tool calls)
Latest version: 1.0.0, published 2026-10-23 (registry, as of the 2026-10-24 snapshot)
First listed version: 2026-10-23 (earliest version still in the registry; older removed versions would be earlier)
Registry data: snapshot 2026-10-24
Package and repository: checked 2026-10-24
Engine: mcp-runtime-engine@0.1.0 · sdk@1.32.0

Changes since the last refresh

New in the registry: not in the list of 2026-10-23, listed on 2026-10-24 with version 1.0.0 (published 2026-10-23).

Source: the official MCP Registry list on 2026-10-23 and on 2026-10-24.

What it is

What does this server offer?

Observed inventory

1,012tools

0resources

0prompts

None of its 1,012 tools are described as changing anything. For 1,012 the reading was uncertain, so no mark is shown.

headers_audit
“Graded HTTP security-header audit of a URL: HSTS, CSP quality, XFO, nosniff, Referrer/Permissions/COOP/CORP/COEP, cookie flags, redirect chain, server info leaks, with fix recommendations.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
1 input, 1 required
- urlstringrequired“Public http(s) URL or bare hostname to audit”
email_authon 2 other servers
“Email authentication & deliverability posture for a domain: SPF (qualifier, lookup count, duplicates), DMARC policy/rua/pct, DKIM probe across common selectors, MTA-STS, TLS-RPT, BIMI, MX; scored wit…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
1 input, 1 required
- domainstringrequired“Domain name, e.g.”
domain_intelon 12 other servers
“One-call domain due-diligence: RDAP registration age/expiry/registrar, A/AAAA/NS/MX/CAA, live TLS certificate (issuer, expiry, SANs, trust), Certificate-Transparency subdomain enumeration, and risk f…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
1 input, 1 required
- domainstringrequired“Registrable domain, e.g.”
robots_sitemapon 1 other server
“Fetch and parse robots.txt plus discovered sitemaps for a domain: user-agents, allow/disallow samples, sitemap index vs urlset, URL counts and sample locs.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
1 input, 1 required
- domainstringrequired“Domain to inspect”
tech_stackon 7 other servers
“Lightweight technology fingerprint from public HTML/headers: CMS, frameworks (Next/Nuxt/React/Vue), CDNs, analytics, payments, generator meta, script/stylesheet samples.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
1 input, 1 required
- urlstringrequired“Public http(s) URL”
rdap_age
“Lightweight RDAP registration age lookup: registered/expiry dates, ageDays, daysToExpiry, registrar, status flags via rdap.org bootstrap.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
1 input, 1 required
- domainstringrequired
phishing_score
“Heuristic phishing-likelihood score for a URL/domain: brand typosquat distance, subdomain depth, punycode, RDAP age, HTTPS reachability.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
1 input, 1 required
- urlstringrequired“URL or domain to score”
cve_lookupon 9 other servers
“Search NIST NVD CVE API 2.0 by product/keyword with optional CVSSv3 severity filter.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
2 inputs, 1 required
- productstringrequired“Product or keyword”
- severitystring“Optional LOW|MEDIUM|HIGH|CRITICAL”
package_risk
“npm or PyPI package risk/typosquat check: registry metadata, weekly downloads (npm), deprecation, license/repo presence, edit-distance to popular packages, and whether close-name variants already exi…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
2 inputs, 2 required
- ecosystemstringrequired“npm or pypi”
- namestringrequired“Package name”
github_health
“GitHub repository health summary via public API: stars/forks/issues, license, languages, last push age, latest release & commit, heuristic healthScore and notes.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
1 input, 1 required
- repostringrequired“owner/repo or github.com URL”
opengraph
“Extract Open Graph, Twitter Card, title/description, canonical, icons and JSON-LD @types from a public URL.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
1 input, 1 required
- urlstringrequired
url_markdown
“Fetch a public HTML page and convert main/article content to Markdown (Turndown).”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
1 input, 1 required
- urlstringrequired

Show 88 more tools

schema_validateon 1 other server
“Validate JSON data against a JSON Schema (Ajv + formats).”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
2 inputs, 2 required
- schemaobjectrequired
- datarequired
mx_check
“MX / mail-routing check: sorted MX with inferred provider (Google, M365, Proofpoint, etc.), A/AAAA, SPF presence, null-MX detection.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
1 input, 1 required
- domainstringrequired
ip_intelon 3 other servers
“IP ASN + geolocation from free public sources (ipapi.co + RIPE Stat prefix-overview).”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
1 input, 1 required
- ipstringrequired“Public IPv4 or IPv6”
solana_txon 3 other servers
“Decode a Solana mainnet transaction via public RPC: status, fee, compute units, parsed instructions, inner instructions, account keys, logs.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
1 input, 1 required
- signaturestringrequired“Base58 tx signature”
waybackon 2 other servers
“Check Internet Archive Wayback Machine availability for a URL (closest snapshot timestamp + archived URL).”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
1 input, 1 required
- urlstringrequired
dns_dump
“All common DNS records for a domain via Cloudflare DNS-over-HTTPS: A, AAAA, NS, MX, TXT, CAA.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
1 input, 1 required
- domainstringrequired
ct_subdomains
“Certificate Transparency subdomain enumeration via crt.sh JSON API.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
1 input, 1 required
- domainstringrequired
redirect_chainon 1 other server
“Follow HTTP redirects (max 10) with SSRF protections; report each hop status, Location, Server and Content-Type.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
1 input, 1 required
- urlstringrequired
http_probe
“Fast HTTP GET probe: final URL, status, timing, response bytes, and a subset of interesting headers (server, cache, HSTS, CDN).”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
1 input, 1 required
- urlstringrequired
x402_probe
“x402 preflight for AI agents: inspect any paid endpoint BEFORE paying.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
3 inputs, 1 required
- urlstringrequired“x402 endpoint URL”
- methodstring“HTTP method (default GET)”
- bodystring“optional JSON body for POST probes (default {})”
web_to_text
“Fetch a public web page and return its main content as clean plain text (boilerplate stripped, lists as bullets, tables tab-separated) plus title, description, language, word count.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
3 inputs, 1 required
- urlstringrequired“Public http(s) URL”
- modestring“main (default) or full”
- max_charsinteger“500-500000, default 100000”
url_links_extract
“Extract every link on a page as absolute URLs (RFC 3986 resolution, <base href> aware), classified internal/external/other with anchor text, rel and nofollow.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
4 inputs, 1 required
- urlstringrequired“Public http(s) URL”
- filterstring“all (default) | internal | external | other”
- dedupeboolean“Dedupe ignoring #fragment (default true)”
- max_linksinteger“1-5000, default 1000”
qr_generateon 8 other servers
“Generate a QR code (PNG or SVG, base64 + data URI) for any UTF-8 text up to 2953 bytes.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
7 inputs, 1 required
- textstringrequired“Text/URL to encode, 1-2953 bytes UTF-8”
- eccstring“L | M (default) | Q | H”
- sizeinteger“Pixels per module 1-64, default 8”
- margininteger“Quiet-zone modules 0-16, default 4”
- formatstring“png (default) or svg”
- fgstring“Foreground hex, default 000000”
- bgstring“Background hex, default ffffff”
text_statson 20 other servers
“Text statistics: characters, words, unique words, sentences, paragraphs, reading/speaking time, Flesch readability (English), language detection (27 languages/scripts), top keywords.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
3 inputs, 1 required
- textstringrequired“Text to analyse (query string; keep under ~6 KB for URL limits)”
- wpminteger“Reading speed 50-1000, default 238”
- topinteger“Top keywords 0-50, default 10”
html_to_markdownon 10 other servers
“Convert an HTML string to clean Markdown (GFM tables, fenced code, nested lists).”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
5 inputs, 1 required
- htmlstringrequired“HTML to convert (JSON body; the service caps request bodies at 256 KB)”
- base_urlstring“Optional http(s) URL used only to absolutise links (never fetched)”
- extract_mainboolean“Strip boilerplate, keep main content (default false)”
- include_imagesboolean“default true”
- include_linksboolean“default true”
image_infoon 4 other servers
“Inspect an image without decoding pixels: format, dimensions (EXIF-orientation aware), megapixels, animation, sha256, EXIF summary (camera, exposure, GPS).”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
2 inputs, 1 required
- imagestringrequired“Base64 / data URI / URL-safe base64 image (JPEG, PNG, GIF, WebP, ...); max ~190KB decoded (256KB POST body limit)”
- include_exif_tagsboolean“Include raw EXIF tag map (default true)”
image_resizeon 7 other servers
“Resize / convert an image (GD): width/height up to 4096, fit contain|cover|fill|inside, output png|jpeg|webp|gif, quality, EXIF auto-orient, metadata stripped.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
8 inputs, 1 required
- imagestringrequired“Base64 / data URI image (max ~190KB decoded due to the 256KB POST body limit; max 40 MP source)”
- widthinteger“1-4096 (width or height required)”
- heightinteger“1-4096”
- fitstring“contain (default) | cover | fill | inside”
- formatstring“same (default) | png | jpeg | webp | gif”
- qualityinteger“1-100, default 85”
- backgroundstring“Hex colour used when flattening alpha to JPEG”
- auto_orientboolean“Apply EXIF orientation (default true)”
sec_edgar_search
“SEC EDGAR filings search: latest 10-K/10-Q/8-K (or any form) for a company by name, ticker or CIK, with direct document and filing-index links; or full-text search across all EDGAR filings since 2001…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
6 inputs
- companystring“Company name, ticker (AAPL, BRK-B) or CIK (320193).”
- qstring“Full-text search phrase (EDGAR FTS, quotes for exact phrase), e.g.”
- formsstring“Comma-separated form types, e.g.”
- fromstring“Earliest filing date YYYY-MM-DD”
- tostring“Latest filing date YYYY-MM-DD”
- limitinteger“Max filings (1-100, default 10)”
sec_form4
“Insider trading from SEC Form 4: the latest Form 4 filings for a ticker or CIK parsed from EDGAR ownershipDocument XML.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
3 inputs, 1 required
- companystringrequired“Ticker, CIK or company name of the issuer (or an insider's CIK).”
- limitinteger“Number of most recent Form 4 filings to parse (1-25, default 10)”
- typestring“Filter transactions: all (default), buys (acquired), sells (disposed), open-market (codes P/S only)”
company_profileon 15 other servers
“Company profile from its own website: name, description, logo, social profiles, contact emails/phones, postal address, schema.org Organization JSON-LD, OpenGraph/Twitter cards, plus RDAP domain regis…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
1 input, 1 required
- urlstringrequired“Company website URL or bare domain (public http(s) only)”
weather_nws
“US weather from the National Weather Service for a latitude/longitude: 7-day (or hourly) forecast periods with temperature, precipitation chance, wind and text forecast, plus all active NWS watches, …”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
4 inputs, 2 required
- latnumberrequired“Latitude (-90..90), US location”
- lonnumberrequired“Longitude (-180..180), US location”
- unitsstring“us (F, mph; default) or si (C, km/h)”
- hourlyboolean“true for the next 48 hourly periods instead of 14 day/night periods”
arxiv_searchon 8 other servers
“Search arXiv papers: title, authors, full abstract, categories, dates, DOI/journal ref and direct abs + PDF links.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
5 inputs, 1 required
- querystringrequired“Keywords, or arXiv syntax like ti:transformer AND au:vaswani”
- categorystring“arXiv category filter, e.g.”
- sortstring“relevance (default), submitted or updated (newest first)”
- limitinteger“Max papers (1-50, default 10)”
- startinteger“Offset for paging (default 0)”
earthquakeson 9 other servers
“Recent earthquakes from the USGS: filter by bounding box or center point + radius, minimum magnitude and time window (last N days or start/end dates).”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
13 inputs
- minlatnumber“Bounding box south latitude (use all four box params)”
- maxlatnumber“Bounding box north latitude”
- minlonnumber“Bounding box west longitude”
- maxlonnumber“Bounding box east longitude”
- latnumber“Circle center latitude”
- lonnumber“Circle center longitude”
- radiusKmnumber“Circle radius in km (default 250, max 20001.6)”
- minmagnumber“Minimum magnitude (default 2.5)”
- daysinteger“Look-back window in days when start is not set (1-365, default 7)”
- startstring“Start date YYYY-MM-DD”
- endstring“End date YYYY-MM-DD”
- limitinteger“Max events (1-500, default 50)”
- orderstring“time (newest first, default) or magnitude”
holidays_business_days
“Public holidays for 100+ countries (optionally one state/region) and business-day math in one call: list holidays for a year, add or subtract N business days, check if a date is a business day, or co…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
9 inputs, 1 required
- countrystringrequired“ISO 3166-1 alpha-2 country code, e.g.”
- opstring“holidays (default) | add | is-business-day | count”
- yearinteger“Year for op=holidays (default current year)”
- datestring“YYYY-MM-DD for op=add and op=is-business-day”
- daysinteger“Business days to add for op=add (negative subtracts, max +/-1000)”
- startstring“Range start YYYY-MM-DD for op=count (inclusive)”
- endstring“Range end YYYY-MM-DD for op=count (inclusive)”
- subdivisionstring“ISO 3166-2 region to include regional holidays, e.g.”
- weekendstring“Weekend days, comma-separated (default sat,sun; e.g.”
hn_searchon 5 other servers
“Search Hacker News stories and comments (Algolia HN index): by relevance or newest first, with date range, story/comment/Ask HN/Show HN filter, author and minimum points.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
10 inputs, 1 required
- querystringrequired“Search text”
- typestring“all (default), story, comment, ask_hn, show_hn or poll”
- sortstring“relevance (default) or date (newest first)”
- fromstring“Created on/after YYYY-MM-DD”
- tostring“Created on/before YYYY-MM-DD”
- authorstring“HN username”
- minPointsinteger“Minimum points”
- limitinteger“Results per page (1-50, default 20)”
- pageinteger“Page number (0-49)”
- exactboolean“Disable typo tolerance (default true when sort=date, false otherwise)”
dns_propagationon 5 other servers
“DNS propagation check: resolves one record type for a domain across Cloudflare 1.1.1.1, Google 8.8.8.8 and Quad9 9.9.9.9 (DNS-over-HTTPS, in parallel) and reports consensus, per-resolver answers, TTL…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
3 inputs, 1 required
- domainstringrequired“Domain or hostname (IDN allowed)”
- typestring“Record type (default A)”
- resolversstring“Comma-separated subset of cloudflare,google,quad9 (default all three)”
ssl_cert_info
“Inspect a live TLS certificate: subject, issuer, SANs, validity window, days to expiry, SHA-256 fingerprint, key type/size, full presented chain, negotiated TLS version/cipher, chain trust and RFC 61…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
2 inputs, 1 required
- hoststringrequired“Hostname, host:port or URL (host is extracted).”
- portinteger“TLS port: 443 (default), 465, 587, 636, 853, 993, 995, 5223 or 8443”
email_validateon 7 other servers
“Validate an email address without sending mail: RFC 5321/5322 syntax, MX/A lookup (null-MX aware), disposable-domain detection (~10k domains), role-account and free-provider flags, typo suggestion (g…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
2 inputs, 1 required
- emailstringrequired“Email address to validate (max 320 chars)”
- check_mxboolean“Look up MX/A records (default true)”
password_strength
“Offline password strength audit (POST only, so the password never appears in a URL or access log; never echoed or stored): zxcvbn-style score 0-4, estimated guesses and entropy, crack-time estimates,…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
2 inputs, 1 required
- passwordstringrequired“Password to evaluate, 1-256 chars (JSON body only; never returned)”
- user_inputsarray“Optional personal context (username, email, name) that should not appear in the password”
validate_batchon 2 other servers
“Offline format validator for up to 100 values: email, URL, IPv4/IPv6, domain, UUID (version/variant), credit card (Luhn + brand, number masked in output), IBAN (mod-97 + country length), phone (E.164…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
3 inputs
- typestring“Single-item mode: format to check”
- valuestring“Single-item mode: value to check”
- itemsarray“Batch mode: array (max 100) of {"type","value"} objects”
sol_balance
“SOL and SPL token balances (classic SPL Token + Token-2022) for a Solana wallet address, via public Solana RPC.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
4 inputs, 1 required
- addressstringrequired“Solana wallet address (base58, 32 bytes)”
- include_zeroboolean“Include token accounts with a zero balance; default false”
- include_token2022boolean“Also query Token-2022 program accounts; default true”
- limitinteger“Max token rows returned (largest UI balance first); default 100”
sol_token_meta
“Solana SPL / Token-2022 mint metadata: decimals, total supply, mint & freeze authority, Token-2022 extensions, and name/symbol/uri from on-chain metadata (Token-2022 or Metaplex), with Jupiter token …”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
2 inputs, 1 required
- mintstringrequired“SPL token mint address (base58)”
- include_marketboolean“Add Jupiter token-list data (verified flag, tags, holder count, usd price); default false”
sol_token_risk
“Heuristic risk screen for a Solana token mint: mint/freeze authority, Token-2022 extensions (permanent delegate, transfer hook/fee, default-frozen, pausable...), metadata mutability, holder concentra…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
2 inputs, 1 required
- mintstringrequired“SPL / Token-2022 mint address (base58)”
- include_holdersboolean“Fetch top holders (getTokenLargestAccounts) for concentration analysis; default true”
evm_balanceon 5 other servers
“Native ETH and ERC-20 token balances for an address on Ethereum, Base or Arbitrum via public RPC.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
5 inputs, 1 required
- addressstringrequired“0x EVM address (EIP-55 checksum validated if mixed case)”
- chainstring“chain; default "eth"”
- tokensstring“ERC-20 contract addresses (JSON array or comma-separated).”
- include_defaultsboolean“Also include the default token set when tokens are given; default true”
- include_zeroboolean“Include tokens with zero balance; default true”
evm_tx_info
“Decode an EVM transaction (Ethereum, Base, Arbitrum): status, block, timestamp, confirmations, from/to, value, gas used, effective gas price, fee, method selector name, and decoded ERC-20 Transfer/Ap…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
2 inputs, 1 required
- hashstringrequired“0x-prefixed 32-byte transaction hash”
- chainstring“chain; default "eth"”
fx_rateon 10 other servers
“Fiat currency exchange rate (ECB reference rates via Frankfurter, with ExchangeRate-API fallback for 150+ currencies), optional amount conversion and historical date.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
4 inputs, 2 required
- fromstringrequired“ISO-4217 base currency, e.g.”
- tostringrequired“ISO-4217 quote currency, e.g.”
- amountnumber“Amount of `from` to convert; default 1”
- datestring“Historical date YYYY-MM-DD (ECB currencies only, 1999-01-04 onward)”
ens_resolveon 13 other servers
“Resolve an ENS name to its Ethereum address (plus optional text records like avatar, url, com.twitter), or reverse-resolve an address to its forward-verified primary ENS name.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
3 inputs
- namestring“ENS name, e.g.”
- addressstring“0x address for reverse lookup (use instead of name)”
- textsstring“Text record keys to fetch on forward lookup, e.g.”
geocodeon 38 other servers
“Geocode an address or place name to latitude/longitude (US Census Geocoder for US street addresses, Photon/OpenStreetMap worldwide), or reverse-geocode lat/lon to an address (with US county/tract).”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
6 inputs
- qstring“Address or place for forward geocoding”
- latnumber“Latitude for reverse geocoding”
- lonnumber“Longitude for reverse geocoding”
- providerstring“provider; default "auto"”
- limitinteger“limit; default 3”
- langstring“Photon result language; default "en"”
wallet_risk_basic
“Basic heuristic risk screen for a Solana or EVM (Ethereum/Base/Arbitrum) wallet: activity & age, bundled OFAC-SDN / mixer list matches for the address and recent counterparties, and (EVM) live token-…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
4 inputs, 1 required
- addressstringrequired“Solana base58 address or 0x EVM address (family auto-detected)”
- chainstring“EVM chain (ignored for Solana); default "eth"”
- deepboolean“More history: Solana pages up to 5000 signatures and inspects 15 recent txs; EVM finds first outgoing tx block (~25 extra RPC calls); default false”
- lookback_blocksinteger“EVM log-scan window (capped per chain by what the keyless RPC allows)”
sanctions_screenon 14 other servers
“Sanctions screening of a person or company NAME against the official consolidated lists: US OFAC SDN + non-SDN, UK Sanctions List (FCDO/OFSI), EU Financial Sanctions Files and the UN Security Council…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
5 inputs, 1 required
- namestringrequired“Person or organisation name (any order, Latin or Cyrillic), 3-200 chars”
- typestring“Restrict to entity type: any (default), person, entity, vessel, aircraft”
- listsstring“Comma list of sources: ofac, uk, eu, un, or all (default)”
- minScorenumber“Minimum similarity 0.5-1.0 (default 0.85)”
- limitinteger“Max matches returned (1-50, default 10)”
sec_13f
“Institutional holdings from a fund manager's latest SEC 13F-HR: the information table parsed from EDGAR, aggregated by CUSIP (issuer, class, shares, USD value, portfolio weight, put/call, voting auth…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
3 inputs, 1 required
- fundstringrequired“Investment manager name or CIK (e.g.”
- limitinteger“Top holdings to return by value (1-500, default 25)”
- accessionstring“Specific 13F-HR accession number (e.g.”
treasury_rates
“US Treasury rates: the daily par yield curve (1M-30Y, from treasury.gov) with day-over-day change in bp, 2s10s spread and 3m10y inversion flag, optional TIPS real yield curve, plus Debt to the Penny …”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
3 inputs
- datestring“As-of date YYYY-MM-DD (latest published on or before it); default latest”
- curvestring“nominal (default), real, both or none”
- debtboolean“Include Debt to the Penny (default true)”
domain_availabilityon 1 other server
“Bulk domain availability: for up to 20 domains, asks the authoritative registry over RDAP (server chosen from the IANA RDAP bootstrap).”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
1 input, 1 required
- domainsstringrequired“Comma-separated domains, max 20 (ASCII/punycode).”
eu_vat_validate
“Validate an EU VAT number live against the European Commission VIES service: valid/invalid, plus registered trader name and address where the member state discloses them.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
2 inputs, 1 required
- vatstringrequired“VAT number with 2-letter prefix (spaces/dots allowed), e.g.”
- countrystring“Optional 2-letter member state code when vat has no prefix”
ip_reputationon 5 other servers
“IP blocklist reputation for up to 50 IPv4/IPv6 addresses: membership in the Tor exit list, Spamhaus DROP/DROPv6, abuse.ch Feodo Tracker botnet C2 and FireHOL level1 (cached published lists), with mat…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
1 input, 1 required
- ipstringrequired“One or more public IPs, comma-separated (max 50).”
cisa_kev
“CISA Known Exploited Vulnerabilities check: is a CVE (or up to 100) in CISA's KEV catalog, with date added, federal remediation due date, past-due flag, known ransomware use, required action and CWEs.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
6 inputs
- cvestring“CVE id(s), comma-separated (max 100)”
- vendorstring“Search: vendor/project substring (e.g.”
- productstring“Search: product substring”
- daysinteger“Search: added in the last N days (1-3650)”
- ransomwareboolean“Search: only entries with known ransomware campaign use”
- limitinteger“Search: max results (1-500, default 50)”
epss_scoreon 2 other servers
“FIRST EPSS exploit-prediction scores for up to 100 CVEs: probability of exploitation in the next 30 days, percentile rank and a simple band, for the latest model run or a past date.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
2 inputs, 1 required
- cvestringrequired“CVE id(s), comma-separated (max 100)”
- datestring“Historical score date YYYY-MM-DD (from 2021-04-14); default latest”
hsts_preload
“HSTS preload check for a domain: current status on the Chromium preload list (hstspreload.org), the official preloadable errors/warnings, and our own live checks of the site's HSTS header (max-age >=…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
1 input, 1 required
- domainstringrequired“Registrable domain, e.g.”
macro_indicators
“Macro indicators by country and year: GDP, real GDP growth, GDP per capita, inflation, unemployment, population, government debt and current account, side by side from the World Bank (WDI actuals) an…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
5 inputs, 1 required
- countrystringrequired“ISO 3166 alpha-2 or alpha-3 codes, comma-separated (max 10), e.g.”
- indicatorsstring“Comma list from: gdp, gdp_growth, gdp_per_capita, inflation, unemployment, population, government_debt, current_account (default gdp,gdp_growth,inflation,unemp…”
- frominteger“First year (default to-5)”
- tointeger“Last year (default current year; IMF projections up to +5)”
- sourcestring“both (default), worldbank or imf”
osv_scan
“Known vulnerabilities for ONE package version from OSV.dev (GitHub Advisory DB, PyPA, Go, RustSec, OSS-Fuzz, distro feeds): advisory id + CVE aliases, severity (GHSA label or computed CVSS v3 base sc…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
5 inputs
- ecosystemstring“npm, PyPI, Go, crates.io, Maven, Packagist, RubyGems, NuGet, Pub, Hex, CRAN, Debian:12, ...”
- packagestring“Package name (Maven: group:artifact, Go: module path).”
- versionstring“Installed version; omit to list every advisory for the package”
- purlstring“Alternative to ecosystem+package: a package URL such as pkg:pypi/jinja2@2.4.1”
- detailsboolean“Include full advisory fields (default true)”
osv_scan_batch
“Dependency vulnerability scan (SCA) via OSV.dev querybatch: send up to 500 packages, or paste a lockfile (package-lock.json, yarn.lock, composer.lock, requirements.txt, Pipfile.lock, poetry.lock, uv.…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
5 inputs
- packagesarray“Array of {ecosystem, name, version} or {purl} objects (max 500)”
- lockfilestring“Alternative: the full text of a lockfile/manifest”
- lockfileTypestring“Optional override: package-lock.json, yarn.lock, composer.lock, requirements.txt, Pipfile.lock, poetry.lock, uv.lock, Cargo.lock, go.mod, go.sum, Gemfile.lock”
- detailsboolean“Fetch full advisory details (default true; up to 60 per call, cached)”
- onlyVulnerableboolean“Return only vulnerable packages (default false)”
iban_validateon 10 other servers
“Validate an IBAN offline: ISO 7064 mod-97 checksum, per-country length and BBAN structure from the SWIFT IBAN registry (100+ countries plus national/experimental ones), national check digits for BE, …”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
2 inputs
- ibanstring“IBAN, spaces/dashes allowed (max 64 chars)”
- bicstring“Optional BIC/SWIFT code (8 or 11 chars); can be given alone”
wikipediaon 4 other servers
“Wikipedia in one call: search any of 340+ language editions (titles, descriptions, snippets, thumbnails) and get the top hit's summary, or fetch a summary by exact title.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
5 inputs
- qstring“Search text (alias: query)”
- titlestring“Exact article title for a direct summary (redirects followed); use instead of q”
- langstring“Wikipedia language code (default en), e.g.”
- limitinteger“Search results 1-20 (default 5)”
- summaryboolean“Also fetch the top result's summary (default true)”
pubmed_search
“Search PubMed biomedical literature via NCBI E-utilities (esearch + esummary + efetch): PMID, title, authors, journal, publication date, volume/issue/pages, DOI, PMCID, publication types; abstracts o…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
6 inputs, 1 required
- querystringrequired“PubMed query (alias q); field tags like [MeSH], [au], [ti] allowed”
- limitinteger“Articles 1-50 (default 10)”
- sortstring“relevance (default) or date”
- fromstring“Earliest publication date YYYY[-MM[-DD]]”
- tostring“Latest publication date YYYY[-MM[-DD]]”
- abstractsboolean“Include abstracts (default false; one extra NCBI call; abstracts may be publisher-copyrighted)”
feed_discover
“Find a website's RSS/Atom/JSON feeds and read the latest items: parses <link rel="alternate"> tags, likely feed links and (if none) probes common feed paths, then parses the feed (RSS 2.0, RSS 1.0/RD…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
3 inputs, 1 required
- urlstringrequired“Site URL or feed URL (http/https, public hosts only)”
- itemsinteger“Latest items to return 0-50 (default 10; 0 = discovery only)”
- probeboolean“Probe common feed paths when the page declares none (default true)”
evm_selector_decode
“Decode EVM function selectors, calldata and event topics: looks up 4-byte selectors (or 32-byte event topics) in 4byte.directory plus a built-in table of well-known signatures, re-hashes every candid…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
5 inputs
- selectorstring“4-byte function selector, e.g.”
- calldatastring“Full transaction input data (0x...), decoded against the candidates”
- topicstring“32-byte event topic0 hash”
- signaturestring“A signature like transfer(address,uint256) to hash into its selector/topic”
- limitinteger“Max candidates 1-50 (default 10)”
readability_extract
“Extract the main article from a web page (Readability-style content scoring, no headless browser): clean body text with paragraph breaks plus title, byline, site name, published/modified dates, langu…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
3 inputs, 1 required
- urlstringrequired“Article URL (http/https, public hosts only)”
- maxCharsinteger“Text cap 500-100000 characters (default 20000)”
- paragraphsboolean“Also return the text as a paragraphs array (default false)”
openalex_search
“Scholarly search over OpenAlex (250M+ works): works with title, authors + ORCID + institutions, year, venue, DOI, citation count, open-access status + OA URL and reconstructed abstract; or authors (w…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
9 inputs, 1 required
- qstringrequired“Search text (alias query)”
- typestring“works (default), authors or institutions”
- limitinteger“Results 1-25 (default 10)”
- pageinteger“Page 1-50 (default 1)”
- frominteger“works: earliest publication year”
- tointeger“works: latest publication year”
- oaboolean“works: only open-access (true) or closed (false)”
- sortstring“relevance (default), cited, or date (works only)”
- abstractsboolean“works: include abstract (default true)”
format_convert
“Convert data between CSV, TSV, JSON, YAML and XML in one call (auto-detects the input format).”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
4 inputs, 2 required
- inputstringrequired“The document text (or, for JSON, the value itself)”
- fromstring“auto (default), csv, tsv, json, yaml, xml”
- tostringrequired“csv, tsv, json, yaml or xml”
- optionsobject“header (default true), inferTypes (true), pretty (true), delimiter (, ; | \t), rootName (root), itemName (item), flatten (true), spreadsheetSafe (false)”
repo_posture
“Security posture of a public GitHub repository from the OpenSSF Scorecard API: aggregate 0-10 score and rating, every check (Code-Review, Branch-Protection, Dangerous-Workflow, Token-Permissions, Pin…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
2 inputs, 1 required
- repostringrequired“owner/name or https://github.com/owner/name”
- detailsboolean“Include up to 10 raw Scorecard detail lines per check (default false)”
timezone_converton 7 other servers
“Convert a time between IANA time zones with DST awareness: local time, UTC offset, abbreviation and DST flag on both sides, the offset difference and day shift, and each zone's next DST/offset transi…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
3 inputs, 1 required
- timestring“ISO 8601 (2026-03-08T02:30:00, optional Z or +01:00), HH:MM (today), epoch seconds or milliseconds, or "now" (default)”
- from_zonestring“IANA zone the input wall time is in (default UTC); also accepts fixed offsets like +05:30.”
- to_zonestringrequired“Target IANA zone, or a comma list of up to 10.”
cron_explainon 9 other servers
“Explain a standard 5-field cron expression in plain English and list its next N run times (default 5, max 20) in any IANA zone, DST-correct.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
4 inputs, 1 required
- exprstringrequired“5-field cron expression or macro, e.g.”
- tzstring“IANA zone for the run times (default UTC)”
- countinteger“Number of next runs, 1-20 (default 5)”
- fromstring“Start after this time (ISO 8601 / epoch; default now)”
ticker_resolver
“Resolve a stock ticker (or CIK) to the SEC CIK, registrant name, exchange and sibling share classes from SEC EDGAR's company_tickers_exchange list, plus the issuer's Legal Entity Identifier (LEI) fro…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
3 inputs
- tickerstring“Ticker symbol, e.g.”
- cikstring“Alternative: SEC CIK number”
- leiboolean“Look up the LEI at GLEIF (default true)”
usaspending_awards
“Federal contracts, IDVs, grants, loans and direct payments from USAspending.gov by recipient, awarding agency (name or abbreviation such as DOD, NASA, HHS), NAICS code or keyword, for a date range (d…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
10 inputs
- recipientstring“Recipient name, UEI or DUNS (free text)”
- agencystring“Awarding toptier agency name or abbreviation (DOD, NASA, HHS, VA, DHS, ...)”
- naicsstring“NAICS code(s), comma-separated (contracts/idvs only)”
- keywordstring“Keyword search across award descriptions (min 3 chars).”
- typestring“contracts (default), idvs, grants, loans, direct_payments, other”
- fromstring“Start date YYYY-MM-DD (default 12 months ago; >= 2007-10-01)”
- tostring“End date YYYY-MM-DD (default today)”
- sortstring“amount (default) or date”
- limitinteger“Awards per page 1-50 (default 10)”
- pageinteger“Page 1-100”
openfda_drug
“FDA drug facts by brand/generic name or NDC from openFDA: label sections (boxed warning, indications, dosage, contraindications, warnings, adverse reactions, interactions, or any SPL field), FAERS ad…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
6 inputs
- namestring“Brand or generic drug name (alias: drug)”
- ndcstring“Alternative: product NDC (0573-0164) or package NDC (0573-0164-30)”
- includestring“Comma list of label, events, recalls (default all)”
- sectionsstring“Comma list of openFDA label fields, or "all" (default: key safety sections)”
- limitinteger“Top adverse reactions to return, 1-25 (default 10)”
- maxCharsinteger“Max characters per label section, 100-10000 (default 1200)”
clinical_trialson 1 other server
“Search ClinicalTrials.gov (API v2) by condition, keyword, location, sponsor, recruitment status (or open/closed) and phase.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
9 inputs
- conditionstring“Condition or disease, e.g.”
- termstring“Other keywords (drug, NCT id, ...).”
- locationstring“City, state or country”
- sponsorstring“Lead sponsor or collaborator”
- statusstring“Comma list: open, closed, recruiting, not_yet_recruiting, active_not_recruiting, completed, terminated, ...”
- phasestring“Comma list: early1, 1, 2, 3, 4, na”
- sortstring“relevance (default), updated, start”
- limitinteger“Studies per page 1-50 (default 10)”
- pageTokenstring“nextPageToken from a previous response”
federal_register
“Search the U.S.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
9 inputs
- qstring“Full-text search term.”
- agencystring“Agency name, short name or slug (comma list up to 5)”
- typestring“Comma list: rule, proposed_rule, notice, presidential_document, executive_order”
- fromstring“Published on/after YYYY-MM-DD”
- tostring“Published on/before YYYY-MM-DD”
- significantboolean“Only significant (EO 12866) documents”
- orderstring“newest (default), oldest, relevance (default with q)”
- limitinteger“Documents per page 1-50 (default 10)”
- pageinteger“Page 1-50”
pii_detect
“Detect and redact PII in text: emails, phone numbers (E.164, NANP, keyword-anchored national), credit cards (Luhn + issuer prefix/length, brand), US SSNs (SSA validity rules) and IBANs (registry leng…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
4 inputs, 1 required
- textstringrequired“Text to scan (max 200 KB)”
- typesarray“Subset of email, phone, credit_card, ssn, iban (default all)”
- stylestring“label (default, [EMAIL_1]) or mask (j***@example.com)”
- revealboolean“Include raw matched values in findings (default false)”
jwt_decodeon 32 other servers
“Decode a JWT (JWS or JWE header), POST only (token in the JSON body, never in a URL): header, claims, alg/kid, exp/nbf/iat status with leeway, aud/iss checks, and security findings (alg none, HMAC al…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
6 inputs, 1 required
- tokenstringrequired“Compact JWT in the JSON body (a "Bearer " prefix is stripped).”
- jwks_urlstring“Optional JWKS (or single JWK) URL to verify the signature”
- discoverboolean“Verify via OpenID discovery from the https iss claim when no jwks_url is given”
- leewayinteger“Clock skew allowance in seconds, 0-600 (default 60)”
- audstring“Expected audience to check”
- issstring“Expected issuer to check”
text_diffon 23 other servers
“Diff two texts: unified line diff byte-compatible with GNU diff -u (hunks, context, "No newline at end of file"), or word-level / character-level diff with [-removed-]{+added+} inline markup and merg…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
9 inputs, 2 required
- astringrequired“Original text (aliases: old, before)”
- bstringrequired“New text (aliases: new, after)”
- modestring“unified (default, alias line), word or char”
- contextinteger“Context lines for unified mode, 0-20 (default 3)”
- ignore_whitespaceboolean“Treat runs of whitespace as equal”
- ignore_caseboolean“Case-insensitive comparison”
- ignore_eolboolean“Treat CRLF and LF as equal (default true)”
- a_labelstring“Label for the --- header (default a)”
- b_labelstring“Label for the +++ header (default b)”
contact_extract
“Extract public business contact details from a website: email addresses (mailto, visible text incl.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
3 inputs, 1 required
- urlstringrequired“Website URL or bare domain (http/https; ports 80, 443, 8080, 8443)”
- crawlboolean“Also fetch likely contact/impressum/about pages on the same host (default true)”
- max_pagesinteger“Total pages to fetch including the first, 1-4 (default 3)”
seo_auditon 15 other servers
“On-page SEO audit of one URL with a 0-100 score, letter grade and prioritised issues (high/medium/low): title and meta description length, robots meta and X-Robots-Tag noindex, canonical, lang, viewp…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
2 inputs, 1 required
- urlstringrequired“Page URL or bare domain (http/https)”
- robotsboolean“Also fetch robots.txt and test the URL against it (default true)”
weather_global
“Worldwide weather forecast for any latitude/longitude from MET Norway Locationforecast 2.0 (the Norwegian Meteorological Institute; CC BY 4.0): current conditions (temperature, humidity, wind speed a…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
7 inputs, 2 required
- latnumberrequired“Latitude, decimal degrees (-90..90)”
- lonnumberrequired“Longitude, decimal degrees (-180..180)”
- altitudeinteger“Optional ground altitude in metres (improves temperature in mountains)”
- daysinteger“Daily summaries 1-9 (default 3)”
- unitsstring“metric (default) or imperial”
- hourlyboolean“Include the hourly series for the requested days (default false)”
- tzstring“IANA zone used to group days and format local times (default UTC)”
github_trendingon 6 other servers
“Trending new GitHub repositories: repos created in the last day, week or month ranked by stars (GitHub REST search API), filterable by language, topic and minimum stars.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
5 inputs
- sincestring“daily, weekly (default) or monthly window for repo creation date”
- languagestring“GitHub language name, e.g.”
- topicstring“GitHub topic, e.g.”
- min_starsinteger“Minimum stars (default 0)”
- limitinteger“Repos to return 1-30 (default 10)”
json_repairon 9 other servers
“Repair broken or LLM-style JSON into valid JSON: strips markdown fences and surrounding prose, comments, trailing/missing commas, single or smart quotes, unquoted keys and values, Python/JS literals …”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
3 inputs, 1 required
- textstringrequired“The broken JSON (aliases: json, input).”
- querystring“Optional JSONPath to evaluate on the repaired value”
- prettyboolean“Also return the repaired JSON pretty-printed (default false)”
sentimenton 15 other servers
“Sentiment analysis with VADER (Hutto & Gilbert 2014; MIT), the lexicon-and-rules model tuned for social media, reviews and short text: compound score (-1..1), positive/neutral/negative proportions an…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
3 inputs
- textstring“Text to score (max 100 KB)”
- textsarray“Alternative: up to 50 texts (each max 20 KB, total 200 KB)”
- sentencesboolean“Include a per-sentence breakdown (default true)”
food_barcode
“Food product facts by barcode (EAN-13, EAN-8, UPC-A, UPC-E; GTIN check digit validated) from Open Food Facts (ODbL): name, brand, quantity, categories, ingredients text, allergens and traces, additiv…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
2 inputs, 1 required
- barcodestringrequired“EAN/UPC barcode digits (alias: code)”
- langstring“Preferred language for names/ingredients, ISO 639-1 (default en)”
vin_decodeon 5 other servers
“Decode a 17-character Vehicle Identification Number: offline structure check (allowed characters, ISO 3779 check digit, region and WMI, model-year code) plus NHTSA vPIC decoding (make, model, model y…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
3 inputs, 1 required
- vinstringrequired“17-character VIN (I, O and Q are not allowed)”
- yearinteger“Optional model year hint (resolves the 30-year cycle of the 10th-character year code)”
- recallsboolean“Include NHTSA recalls for the decoded make/model/year (default false)”
eol_check
“Is this software version still supported?”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
3 inputs
- productstring“Product name or endoflife.date slug (python, nodejs, django, postgresql, ubuntu, ...)”
- versionstring“Version or release cycle (3.8, 3.8.10, 18, 22.04); omit for all current cycles”
- itemsstring“Batch alternative: comma list of product@version, up to 10 (python@3.8,nodejs@18)”
text_chunkon 1 other server
“Split text into retrieval-ready chunks for RAG and embeddings: recursive (paragraph > line > sentence > clause > word), markdown-aware (splits on headings, keeps the heading path per chunk, respects …”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
6 inputs, 1 required
- textstringrequired“Text or Markdown to chunk (max 200 KB)”
- strategystring“recursive (default), markdown, sentence or fixed”
- unitstring“tokens (default, estimated ~4 chars/token) or chars”
- chunk_sizeinteger“Max chunk size in the unit (tokens 16-8192, default 512; chars 64-32768, default 2000)”
- overlapinteger“Overlap between consecutive chunks, at most half of chunk_size (default 10%)”
- include_textboolean“Return chunk text (default true); false returns offsets only”
hash_encodeon 1 other server
“Hashing, HMAC and encoding toolkit: digests (MD5, SHA-1/2/3, Keccak-256 as used by Ethereum, RIPEMD-160, Whirlpool, CRC32/CRC32C, Adler-32, FNV-1a, xxHash32/64/3/128, MurmurHash3), HMAC (SHA-1/2/3, M…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
9 inputs
- inputstring“Input string (max 100 KB), interpreted per input_encoding”
- input_encodingstring“utf8 (default), hex, base64, base64url, base32, base58 or url: decode the input to bytes first”
- hashesarray“Digest algorithms, or "all" (default md5, sha1, sha256, sha512, sha3-256, keccak256, crc32b)”
- hmac_keystring“Optional HMAC key (never echoed)”
- hmac_key_encodingstring“utf8 (default), hex, base64, base64url”
- hmac_algorithmsarray“HMAC algorithms (default sha256)”
- encodingsarray“Output encodings (default hex, base64, base64url, base32, base58, url)”
- identifyboolean“Guess what the input string is (default true)”
- generateobject“Optional generation instead of / besides input: {"uuid": "v4"|"v7", "count": 1-100} and/or {"random_bytes": 1-1024}”
census_geographies
“US Census Bureau geocoder: a one-line US street address (or a lat/lon) to matched address and coordinates plus Census geographies: state and county with FIPS codes, census tract, block group and bloc…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
3 inputs
- addressstring“One-line US street address with house number”
- latnumber“Alternative: latitude (with lon)”
- lonnumber“Alternative: longitude (with lat)”
evm_contract_info
“EVM contract introspection on Ethereum, Base, Arbitrum, OP Mainnet, Polygon or BNB Chain via public RPC: bytecode size/hash, EIP-1167 / EIP-1967 / ZeppelinOS / EIP-7702 proxy detection, ERC-165/20/72…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
2 inputs, 1 required
- addressstringrequired
- chainstring
evm_token_transfers
“Latest ERC-20 or ERC-721 Transfer events for a token contract (optionally filtered to one wallet, in/out/both) on six EVM chains.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
1 input, 1 required
- tokenstringrequired
evm_allowanceon 3 other servers
“ERC-20 allowance matrix for an owner across up to 10 tokens × 10 spenders (defaults: major stables/WETH × Uniswap Permit2, 1inch, CoW, 0x, OpenSea Seaport — verified deployed on-chain).”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
1 input, 1 required
- ownerstringrequired
evm_gason 1 other server
“Live gas tracker across Ethereum, Base, Arbitrum, OP Mainnet, Polygon and BNB Chain: head block age, base fee, 10th/50th/90th percentile priority fees from eth_feeHistory, suggested maxFeePerGas tier…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
1 input
- chainsstring
nft_metadataon 2 other servers
“ERC-721 / ERC-1155 token metadata: tokenURI/uri (ipfs/arweave/data/https), ownerOf, collection name/symbol/supply, EIP-2981 royalty.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
2 inputs, 2 required
- contractstringrequired
- tokenIdstringrequired
evm_read
“Read-only eth_call of any view/pure function from a human signature (e.g.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
2 inputs, 1 required
- contractstringrequired
- signaturestring

Each quoted sentence is the first sentence of the publisher’s own description. The kind of tool and the “changes data” mark are our AI model’s reading of that description, not something we tested: two differently worded runs had to agree, otherwise no label is shown, and nobody has checked them by hand. A tool without the “changes data” mark is described as only reading, searching or calculating, or the two runs did not agree. No tool was called. Read the publisher’s full description before relying on it. “Publisher declares” lists the hints the server itself sends with the tool (MCP annotations: read-only, destructive, idempotent, open-world); they are the publisher's claims, not checked by us. Inputs are the parameters in the tool's own input schema: name, declared type, whether it is required, and the first sentence of its description. The first 100 of 1,012 tools are listed. Read 2026-10-24.

How well are its tools described?

Features #4 and #5

How clearly this server's own tool descriptions say what a tool does, and how consistent its tool list is. The first part is an AI model's yes/no reading of each description; the second part is counted. We do not turn it into a grade.

Descriptions

AI reading of each description

No AI reading was available for this server's tools (the two runs did not agree, or the listing was not reviewed).

Counted from the listing

Parameters with a description: 42% of 2,235
Tools with a description: 100% of 1,012
Typical description length: 357 characters

The tool set

Counted from the listing

Tools: 1,012
Size of the list: about 262,273 tokens for an agent to load (characters ÷ 4)
Naming: 824 of 1,012 names use snake_case

AI reading: easy to mix up

No pair found.

The AI items cover 0 of 1,012 tools: for a tool where two differently worded runs disagreed, that item is left out. They were not checked by hand, and no tool was called. “Easy to mix up” means two tools whose names or descriptions overlap without saying how they differ; the AI found none, comparing tools within groups of 40. We do not rate whether the tool set is complete or whether side effects are spelled out, because our AI reading of those was not reliable enough.

How do I add it to my client?

Config from the registry entry

From the remote endpoint (Streamable HTTP)

We connected to this URL on 2026-10-24 (a read-only session: no tool was called).

Add to CursorAn install link in the format Cursor documents, holding the Cursor config below.

Claude Desktop or claude.ai

Settings → Connectors → Add custom connector, then paste:
https://scorptech.it.com/api/x402/mcp

Cursor · .cursor/mcp.json in a project, or ~/.cursor/mcp.json

{
  "mcpServers": {
    "x402": {
      "url": "https://scorptech.it.com/api/x402/mcp"
    }
  }
}

VS Code · .vscode/mcp.json

{
  "servers": {
    "x402": {
      "type": "http",
      "url": "https://scorptech.it.com/api/x402/mcp"
    }
  }
}

VS Code (command line) · Bash or zsh terminal (macOS, Linux)

code --add-mcp '{"name":"x402","type":"http","url":"https://scorptech.it.com/api/x402/mcp"}'

Claude Code

claude mcp add --transport http x402 https://scorptech.it.com/api/x402/mcp

Try it in the MCP Inspector · runs on your machine, opens in your browser · Node 22.19+

npx @modelcontextprotocol/inspector@2.11.0 --server-url https://scorptech.it.com/api/x402/mcp --transport http

The server runs on the operator's infrastructure; it may ask you to sign in when you first connect.
The MCP Inspector lists the server's tools, resources and prompts; a tool you call there runs for real.

Built from the server's registry entry with each client's documented format (checked 2026-10-14; the Cursor link and the VS Code command 2026-10-19; the MCP Inspector command 2026-10-21). Values in < > are yours to fill in; this page never contains a key. Where the server needs a setting the entry does not declare, it can still fail to start.

Does the registry listing match what we found?

Feature #6

The registry verifies a package once, when it is published, and does not re-check it. A difference below is about the listing, not a judgement of the publisher.

Registry says	We found	Result	Source · date
Remote endpoint scorptech.it.com/api/x402/mcp	Session opened	matches	our test · 2026-10-24
No credential declared as required	Opened a session without any credential	matches	our test · 2026-10-24

Choosing

Record checks

Public records · not a safety rating

1 of 2 record checks met · 7 do not apply

MetRegistry entry is active and says how to run itActive, with a package or a remote address.
Not metSource repository link opensThe registry entry gives no repository link.
Does not applyRepository is not archivedNo public GitHub repository to read.
Does not applyCode pushed to the repository in the 90 days before our checkNo public GitHub repository to read.
Does not applyRepository publishes a security policy (SECURITY.md)No public GitHub repository to read.
Does not applyPackage names its licence with a standard (SPDX) identifierRemote server: it ships no package.
Does not applyThe version the registry lists can be installed and is not withdrawnRemote server: it ships no package.
Does not applynpm package carries build provenance (attestation)Remote server: it ships no package.
Does not applyNo known critical or high advisory in the package or its dependenciesRemote server: it ships no package.

Read from public records only: the registry entry, npm/PyPI, GitHub and advisory databases, checked 2026-10-24. No tool was called. Only “met” and “not met” are counted, so the total differs between servers; a check that does not apply or that we could not run is listed, never counted against it. It is not a safety rating. How each check works · Leaderboards

Common questions about com.it.scorptech/x402

Answered from the data above

Does com.it.scorptech/x402 need an API key or sign-in?

It opened a session without any credential on 2026-10-24. The registry entry declares no required credential; no declaration is not a guarantee.

Has com.it.scorptech/x402 been security tested?

Partly. 2 of the 14 checks that apply to it were exercised. We connected and read what the server declares, but did not call its tools: ProtocolProbe calls no server's tools for anything it publishes. This is our choice, not a block by the server. No security verdict is published before verification.

Found this page useful?

Anonymous · no sign-in

A quick, anonymous reaction — no account, no email. One per kind from your browser. The tally updates when the page is next refreshed, and it is only a rough count, never a safety rating or a measured number of people.

Compare with another server

Side by side: registry entry, our read-only session, the tools and the 18 classification fields. Same values as each page; no score.

Security testing

What did we test, and what did we leave out?

18 checks · features #1, #2

Not probed (we call no server's tools)

We connected and read what the server declares, but did not call its tools: ProtocolProbe calls no server's tools for anything it publishes. This is our choice, not a block by the server. No security score is given; a check we did not run is never counted as passed.

The 18 checks at a glanceour test · 2026-10-24

Inventory: exercised
Hidden instructions: exercised
Real execution: not run · our policy
Secret leak: not run · nothing to check it against
Internal addresses: not run · our policy
Unconfirmed changes: not run · our policy
Bad input: not run · our policy
Model requests: not run · nothing to check it against
Sensitive questions: not run · nothing to check it against
Folder boundary: not run · our policy
Log leaks: not run · nothing to check it against
Hidden content: not run · nothing to check it against
Fake assistant turns: not applicable
Token passthrough: not applicable
Token audience: not applicable
Sign-in redirect: not run · our policy
Consent handling: not testable from outside
Sign-in metadata: not applicable

2 exercised12 not run (reason given)4 not applicable

Each check ends in exactly one state: exercised, not run (with the reason), or not applicable (with the reason). 2 of the 14 checks that apply to it were exercised. We do not publish security-check outcomes for named servers.

Exercised · 2

1Inventory
tool-listReads the declared tools, resources and prompts.exercised
2Hidden instructions
description-poisoningLooks for hidden instructions in tool descriptions.exercised

Not run, with the reason · 12

3Real execution
real-executionCalls a tool and checks what really happens.This check calls the server's tools. ProtocolProbe calls no server's tools for anything it publishes; an operator can run this check on their own server with our self-test command.not run · our policy
4Secret leak
canary-leakPlants a fake secret and checks whether it leaks.This check needs at least one successful tool call to have something to check, and no tool was called.not run · nothing to check it against
5Internal addresses
ssrfChecks whether a tool can be steered to internal addresses.This check calls the server's tools. ProtocolProbe calls no server's tools for anything it publishes; an operator can run this check on their own server with our self-test command.not run · our policy
6Unconfirmed changes
write-without-confirmationChecks whether tools that change data act without asking.This check calls the server's tools. ProtocolProbe calls no server's tools for anything it publishes; an operator can run this check on their own server with our self-test command.not run · our policy
7Bad input
error-handlingSends bad input and watches how the server answers.This check calls the server's tools. ProtocolProbe calls no server's tools for anything it publishes; an operator can run this check on their own server with our self-test command.not run · our policy
8Model requests
samplingChecks whether the server asks the client's model to act for it.This check needs at least one successful tool call to have something to check, and no tool was called.not run · nothing to check it against
9Sensitive questions
elicitation-sensitive-dataChecks whether the server asks users for sensitive data.This check needs at least one successful tool call to have something to check, and no tool was called.not run · nothing to check it against
10Folder boundary
root-boundaryChecks whether the server reaches outside the folders it was given.This check calls the server's tools. ProtocolProbe calls no server's tools for anything it publishes; an operator can run this check on their own server with our self-test command.not run · our policy
11Log leaks
logging-side-channelChecks whether log messages carry data they should not.This check needs at least one successful tool call to have something to check, and no tool was called.not run · nothing to check it against
12Hidden content
audience-hidingChecks resources that hide content from the user.This check needs content the server returns, and nothing was read or called.not run · nothing to check it against
16Sign-in redirect
open-redirectChecks the sign-in redirect for abuse.Testing the sign-in redirect means sending probes to the operator's sign-in service, which we do not do.not run · our policy
17Consent handling
confused-deputyChecks consent handling when one service acts for another.Depends on the operator's own consent screen, which differs per server and cannot be tested from outside.not testable from outside

Does not apply to this server · 4

13Fake assistant turns
fake-assistant-turnChecks prompts that pose as the assistant's own words.The server exposes no prompts.not applicable
14Token passthrough
token-passthroughChecks whether the server forwards a user's token to other services.The server opened a session without sign-in, so there is no token flow to check.not applicable
15Token audience
token-audience-validationChecks whether tokens meant for another service are accepted.The server opened a session without sign-in, so there is no token flow to check.not applicable
18Sign-in metadata
oauth-url-schemeChecks the published sign-in metadata for unsafe URLs.No sign-in (OAuth) metadata is published, so there are no sign-in addresses to check.not applicable

Source: our own test, 2026-10-24, mcp-runtime-engine@0.1.0. Which checks count and why follows our published scoring model.

What happened during the test?

Feature #8

The steps in order, as the test record holds them.

0 msStarted a read-only session with the server's remote endpoint
1,959 msConnected after 0 redirects. No credential was sent or needed.
Read the inventory: 1,012 tools, 0 resources, 0 prompts.
12,774 msFinished: 2 checks exercised.

Reference

How is it classified?

18 fields

One value per field, each with its source. Fields written by AI models are marked. A field with no value says why.

TopicAI-classified

pending: added in the weekly update

listed 2026-10-24; not classified yet

Pricing modelAI-classified

pending: added in the weekly update

the website is not read yet

Programming language

does not apply

no existing GitHub repository (server declares no repository link, so there is nothing to fetch)

Hosting type

remote (hosted by the publisher)

registry · 2026-10-24

MCP capability

tools

our test · 2026-10-24

Transport

streamable HTTP

registry · 2026-10-24

Required credentials

none declared

registry · no declaration is not a guarantee

Package registry

does not apply

remote-only server: no package is shipped, so there is no package registry

Freshness

0–30 days

registry updatedAt · 2026-10-24

Lifecycle status

active

registry · 2026-10-24

License class

does not apply

remote-only server: ships no package, so there is nothing to look up in a package registry

Integrity hash

does not apply

remote-only server: ships no package, so there is nothing to look up in a package registry

Signature / provenance

does not apply

remote-only server: ships no package, so there is nothing to look up in a package registry

Dependency advisories

does not apply

ships no package, so there are no dependencies to audit

Popularity

does not apply

remote-only server: ships no package, so there is nothing to look up in a package registry

Publisher signals

not stated

no readable GitHub owner to describe

Maintenance

does not apply

server declares no repository link, so there is nothing to fetch

Environment

the publisher's infrastructure

where it runs, from the hosting type

“Not stated” means the source did not state it; “does not apply” means it does not apply to this kind of server; “our limit” means our own lookup failed. A linked value opens the directory filtered to the same value.

Cite or correct this page

Sources and corrections

Suggested citation

ProtocolProbe. “com.it.scorptech/x402: MCP server record.” Data checked 2026-10-24. https://protocolprobe.com/mcp/servers/com.it.scorptech/x402

Figures are valid for the date shown. Our facts on this page are CC BY 4.0: reuse them with a link and the check date. Quoted text (the publisher’s descriptions, website quotes, tool names) is not ours to license.

As JSON: this record in the API · API documentation.

Badge for your README

[![ProtocolProbe](https://protocolprobe.com/api/v1/badge/com.it.scorptech/x402)](https://protocolprobe.com/mcp/servers/com.it.scorptech/x402)

It shows this server's record-check count: facts from public records, no tool called. It is not a security rating or a pass. It links here and updates after each data reload.

Something wrong, or is this yours?

If a fact here is wrong, tell us and we will re-check it. If you operate this server, you can run our checks on it yourself with the free self-test command; we call no server’s tools ourselves for anything shown here.

Write to hello@protocolprobe.com · corrections log · methodology