Next free-source huntWe check for new free data every weekday.
FinancialMCP serverFirst audited Nov 13, 2026

AgentRoam

Buy travel eSIMs, gift cards and mobile top-ups with crypto — user confirms before any order.The vendor's description, from its MCP Registry listing.

Passed public checksAudited Nov 13, 2026

Every public check ran and passed. Public audit: we connect as an AI client would, list the tools and check what they say. We do not run them. How we audit

Does it work?
YesConnected in 464 ms.
Sign-up?
None neededIt answered without any account or key.
Can it change things?
YesSome tools say they can change things. Your AI client should ask you first.
Endpointhttps://agentroam.ai/api/mcp

Source code Website Streamable HTTP · protocol 2025-03-26 · server version 0.2.0

What we checked, the evidence, and the tools it offers.

What we checked

Security

  • Passed: Connections are encrypted (HTTPS).

  • Passed: No hidden instructions found in tool text.

Safety labels

  • Note: 3 tools are labelled as able to change things.

    Expected for tools that send, write or buy. Your AI client should ask before calling them.

    • validate_order
    • create_order
    • purchase_wizard
  • Passed: Every tool says whether it only reads or can change things.

Tools

  • Passed: 11 tools listed.

  • Passed: Every tool describes its inputs with a valid schema.

Protocol

  • Note: Protocol version 2025-03-26.

  • Passed: The MCP handshake works (Streamable HTTP).

  • Passed: Unknown requests are refused.

Connection

  • Passed: The server responds.

Tools (11)

As the server describes them. The labels are the server's own: it says whether each tool only reads or can change things.

  • search_productsSearch the AgentRoam travel-crypto catalog: gift cards (Airbnb, Uber, airlines, 500+ US brands), eSIM data plans (110+ destinations incl. Europe/Global region plans) and mobile top-ups (carriers in 1…Read-only
  • get_priceLive crypto price for one product/denomination. Payment coins include USDT, USDC, BTC (incl. Lightning), ETH, SOL, DAI, PYUSD, LTC, TRX, TON, DOGE and SUI across many networks; get_payment_methods re…Read-only
  • validate_orderDry-run an order and mint a one-time confirm_token (valid 10 minutes). Returns a human-readable purchase summary for the buyer to approve, plus the one-time token that create_order requires. Creates…Can change things
  • create_orderCreates the real order. Requires a confirm_token minted by validate_order. Returns the payment wallet address, exact crypto amount, 30-minute expiry, and an order-status URL. The purchased code/QR is…Can change things
  • list_esim_plansLive eSIM data plans for a destination (110+ countries, plus "eu" Europe and "ww" Global multi-country plans) with USD prices and crypto amounts. In clients that support widgets, the response also re…Read-only
  • get_order_statusPoll order state (WAITING_FOR_PAYMENT → PARTIAL → COMPLETED, or CANCELED/EXPIRED). Requires the status_token from create_order.Read-only
  • list_brandsBrowse all available brands/carriers for a country: gift cards (500+ US brands) and mobile top-up carriers (100+ countries). Creates no order.Read-only
  • list_productsList a brand's live products/denominations with prices in the chosen coin — including the exact denomination labels the pricing and order tools expect (eSIM destinations are covered by list_esim_plan…Read-only
  • get_currenciesList all supported payment cryptocurrencies (the response carries the current set).Read-only
  • get_payment_methodsFull payment matrix: every supported coin × network combination currently available, with the exact network strings orders require. The response includes live totals for coins, networks and combinati…Read-only
  • purchase_wizardStateful text-only purchase flow for clients without widget support. Called repeatedly with the same session_token, one question at a time, until status is "complete"; the first call takes empty argu…Can change things

Audit history

  1. Nov 13Passed

What we sent

Every request in this audit, with the answer and how long it took. We never send credentials and never call a tool.

RequestAnswerTime
initializeHTTP 200464 ms
initializedHTTP 202316 ms
tools/listHTTP 200137 ms
resources/listHTTP 200123 ms
unknown-methodHTTP 200123 ms

Run this server, or disagree with the result?

Fix the issue and it shows in the next weekly audit, or email us to ask for a re-audit or to dispute a finding. Read how we audit for what each check means.