Next free-source huntWe check for new free data every weekday.
OSINTMCP serverFirst audited Nov 13, 2026

ScorpTech x402 API

112 x402 pay-per-call tools: web data, security/OSINT, SEC and public data, Solana/EVM lookupsThe vendor's description, from its MCP Registry listing.

Passed public checksAudited Nov 13, 2026

Every public check ran and passed. Public audit: we connect as an AI client would, list the tools and check what they say. We do not run them. How we audit

Does it work?
YesConnected in 412 ms.
Sign-up?
None neededIt answered without any account or key.
Can it change things?
No, read-onlyAll 1012 tools say they only read.
Endpointhttps://scorptech.it.com/api/x402/mcp

Website Streamable HTTP · protocol 2025-11-25 · server version 1.0.0

What we checked, the evidence, and the tools it offers.

What we checked

Security

  • Passed: Connections are encrypted (HTTPS).

  • Passed: No hidden instructions found in tool text.

Safety labels

  • Passed: Every tool says whether it only reads or can change things.

Tools

  • Passed: 1012 tools listed.

  • Passed: Every tool describes its inputs with a valid schema.

Protocol

  • Passed: The MCP handshake works (Streamable HTTP).

  • Passed: Protocol version 2025-11-25 (latest).

  • Passed: Unknown requests are refused.

Connection

  • Passed: The server responds.

Tools (1012)

As the server describes them. The labels are the server's own: it says whether each tool only reads or can change things.

  • headers_auditGraded HTTP security-header audit of a URL: HSTS, CSP quality, XFO, nosniff, Referrer/Permissions/COOP/CORP/COEP, cookie flags, redirect chain, server info leaks, with fix recommendations. Price: $0.…Read-only
  • email_authEmail authentication & deliverability posture for a domain: SPF (qualifier, lookup count, duplicates), DMARC policy/rua/pct, DKIM probe across common selectors, MTA-STS, TLS-RPT, BIMI, MX; scored wit…Read-only
  • domain_intelOne-call domain due-diligence: RDAP registration age/expiry/registrar, A/AAAA/NS/MX/CAA, live TLS certificate (issuer, expiry, SANs, trust), Certificate-Transparency subdomain enumeration, and risk f…Read-only
  • robots_sitemapFetch and parse robots.txt plus discovered sitemaps for a domain: user-agents, allow/disallow samples, sitemap index vs urlset, URL counts and sample locs. Useful for crawl planning and AI agent poli…Read-only
  • tech_stackLightweight technology fingerprint from public HTML/headers: CMS, frameworks (Next/Nuxt/React/Vue), CDNs, analytics, payments, generator meta, script/stylesheet samples. No invasive probing. Price: $…Read-only
  • rdap_ageLightweight RDAP registration age lookup: registered/expiry dates, ageDays, daysToExpiry, registrar, status flags via rdap.org bootstrap. Faster/cheaper than full domain-intel when you only need age.…Read-only
  • phishing_scoreHeuristic phishing-likelihood score for a URL/domain: brand typosquat distance, subdomain depth, punycode, RDAP age, HTTPS reachability. Returns scored signals — not a verdict. Low Bazaar crowding. P…Read-only
  • cve_lookupSearch NIST NVD CVE API 2.0 by product/keyword with optional CVSSv3 severity filter. Returns CVE ids, scores, vectors, descriptions and reference URLs. Public NVD data. Price: $0.01 USDC per successf…Read-only
  • package_risknpm or PyPI package risk/typosquat check: registry metadata, weekly downloads (npm), deprecation, license/repo presence, edit-distance to popular packages, and whether close-name variants already exi…Read-only
  • github_healthGitHub repository health summary via public API: stars/forks/issues, license, languages, last push age, latest release & commit, heuristic healthScore and notes. Unauthenticated rate limits apply. Pr…Read-only
  • opengraphExtract Open Graph, Twitter Card, title/description, canonical, icons and JSON-LD @types from a public URL. Ideal for link unfurling agents. Price: $0.005 USDC per successful call (x402, Solana). Sam…Read-only
  • url_markdownFetch a public HTML page and convert main/article content to Markdown (Turndown). Scripts/styles stripped; output capped. Good for RAG/agent ingestion. Price: $0.005 USDC per successful call (x402, S…Read-only
  • schema_validateValidate JSON data against a JSON Schema (Ajv + formats). Body: { "schema": {...}, "data": {...} }. Returns valid boolean and error list. Price: $0.005 USDC per successful call (x402, Solana). Same t…Read-only
  • mx_checkMX / mail-routing check: sorted MX with inferred provider (Google, M365, Proofpoint, etc.), A/AAAA, SPF presence, null-MX detection. Complements /v1/email-auth. Price: $0.005 USDC per successful call…Read-only
  • ip_intelIP ASN + geolocation from free public sources (ipapi.co + RIPE Stat prefix-overview). Country/city/coords, ASN/org, announced prefix. Public IPs only. Price: $0.005 USDC per successful call (x402, So…Read-only
  • solana_txDecode a Solana mainnet transaction via public RPC: status, fee, compute units, parsed instructions, inner instructions, account keys, logs. No API key. Unique on Bazaar. Price: $0.005 USDC per succe…Read-only
  • waybackCheck Internet Archive Wayback Machine availability for a URL (closest snapshot timestamp + archived URL). Public availability API. Price: $0.005 USDC per successful call (x402, Solana). Same tool ov…Read-only
  • dns_dumpAll common DNS records for a domain via Cloudflare DNS-over-HTTPS: A, AAAA, NS, MX, TXT, CAA. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com…Read-only
  • ct_subdomainsCertificate Transparency subdomain enumeration via crt.sh JSON API. Returns unique hostnames (capped) issued under the domain. Price: $0.008 USDC per successful call (x402, Solana). Same tool over HT…Read-only
  • redirect_chainFollow HTTP redirects (max 10) with SSRF protections; report each hop status, Location, Server and Content-Type. Detect open-redirect chains and tracking bounces. Price: $0.005 USDC per successful ca…Read-only
  • http_probeFast HTTP GET probe: final URL, status, timing, response bytes, and a subset of interesting headers (server, cache, HSTS, CDN). Price: $0.005 USDC per successful call (x402, Solana). Same tool over H…Read-only
  • x402_probex402 preflight for AI agents: inspect any paid endpoint BEFORE paying. Fetches the unpaid 402, decodes PAYMENT-REQUIRED (v2 header or v1 body), normalises price to USD, lists networks/assets/payTo/fe…Read-only
  • web_to_textFetch a public web page and return its main content as clean plain text (boilerplate stripped, lists as bullets, tables tab-separated) plus title, description, language, word count. Price: $0.005 USD…Read-only
  • url_links_extractExtract every link on a page as absolute URLs (RFC 3986 resolution, <base href> aware), classified internal/external/other with anchor text, rel and nofollow. Options: filter, dedupe, max_links. Pric…Read-only
  • qr_generateGenerate a QR code (PNG or SVG, base64 + data URI) for any UTF-8 text up to 2953 bytes. Options: ecc L|M|Q|H, size (px/module), margin, format png|svg, fg/bg hex colours. Price: $0.005 USDC per succe…Read-only
  • text_statsText statistics: characters, words, unique words, sentences, paragraphs, reading/speaking time, Flesch readability (English), language detection (27 languages/scripts), top keywords. Price: $0.005 US…Read-only
  • html_to_markdownConvert an HTML string to clean Markdown (GFM tables, fenced code, nested lists). No fetch. Body: { "html": "...", "base_url"?: "https://...", "extract_main"?: false }. Price: $0.005 USDC per success…Read-only
  • image_infoInspect an image without decoding pixels: format, dimensions (EXIF-orientation aware), megapixels, animation, sha256, EXIF summary (camera, exposure, GPS). Body: { "image": "<base64>" }. Max ~190KB i…Read-only
  • image_resizeResize / convert an image (GD): width/height up to 4096, fit contain|cover|fill|inside, output png|jpeg|webp|gif, quality, EXIF auto-orient, metadata stripped. Body: { "image": "<base64>", "width": 2…Read-only
  • sec_edgar_searchSEC EDGAR filings search: latest 10-K/10-Q/8-K (or any form) for a company by name, ticker or CIK, with direct document and filing-index links; or full-text search across all EDGAR filings since 2001…Read-only
  • sec_form4Insider trading from SEC Form 4: the latest Form 4 filings for a ticker or CIK parsed from EDGAR ownershipDocument XML. Reporting owner and role, every transaction (code + meaning, shares, price, val…Read-only
  • company_profileCompany profile from its own website: name, description, logo, social profiles, contact emails/phones, postal address, schema.org Organization JSON-LD, OpenGraph/Twitter cards, plus RDAP domain regis…Read-only
  • weather_nwsUS weather from the National Weather Service for a latitude/longitude: 7-day (or hourly) forecast periods with temperature, precipitation chance, wind and text forecast, plus all active NWS watches,…Read-only
  • arxiv_searchSearch arXiv papers: title, authors, full abstract, categories, dates, DOI/journal ref and direct abs + PDF links. Plain keywords or arXiv field syntax (ti:, au:, abs:, cat:, AND/OR), optional catego…Read-only
  • earthquakesRecent earthquakes from the USGS: filter by bounding box or center point + radius, minimum magnitude and time window (last N days or start/end dates). Returns magnitude, place, time, coordinates, dep…Read-only
  • holidays_business_daysPublic holidays for 100+ countries (optionally one state/region) and business-day math in one call: list holidays for a year, add or subtract N business days, check if a date is a business day, or co…Read-only
  • hn_searchSearch Hacker News stories and comments (Algolia HN index): by relevance or newest first, with date range, story/comment/Ask HN/Show HN filter, author and minimum points. Returns title, URL, points,…Read-only
  • dns_propagationDNS propagation check: resolves one record type for a domain across Cloudflare 1.1.1.1, Google 8.8.8.8 and Quad9 9.9.9.9 (DNS-over-HTTPS, in parallel) and reports consensus, per-resolver answers, TTL…Read-only
  • ssl_cert_infoInspect a live TLS certificate: subject, issuer, SANs, validity window, days to expiry, SHA-256 fingerprint, key type/size, full presented chain, negotiated TLS version/cipher, chain trust and RFC 61…Read-only
  • email_validateValidate an email address without sending mail: RFC 5321/5322 syntax, MX/A lookup (null-MX aware), disposable-domain detection (~10k domains), role-account and free-provider flags, typo suggestion (g…Read-only
  • password_strengthOffline password strength audit (POST only, so the password never appears in a URL or access log; never echoed or stored): zxcvbn-style score 0-4, estimated guesses and entropy, crack-time estimates,…Read-only
  • validate_batchOffline format validator for up to 100 values: email, URL, IPv4/IPv6, domain, UUID (version/variant), credit card (Luhn + brand, number masked in output), IBAN (mod-97 + country length), phone (E.164…Read-only
  • sol_balanceSOL and SPL token balances (classic SPL Token + Token-2022) for a Solana wallet address, via public Solana RPC. Read-only. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS:…Read-only
  • sol_token_metaSolana SPL / Token-2022 mint metadata: decimals, total supply, mint & freeze authority, Token-2022 extensions, and name/symbol/uri from on-chain metadata (Token-2022 or Metaplex), with Jupiter token…Read-only
  • sol_token_riskHeuristic risk screen for a Solana token mint: mint/freeze authority, Token-2022 extensions (permanent delegate, transfer hook/fee, default-frozen, pausable...), metadata mutability, holder concentra…Read-only
  • evm_balanceNative ETH and ERC-20 token balances for an address on Ethereum, Base or Arbitrum via public RPC. Defaults to major tokens (USDC, USDT, WETH, DAI/ARB) or pass up to 20 token contracts. Read-only. Pri…Read-only
  • evm_tx_infoDecode an EVM transaction (Ethereum, Base, Arbitrum): status, block, timestamp, confirmations, from/to, value, gas used, effective gas price, fee, method selector name, and decoded ERC-20 Transfer/Ap…Read-only
  • fx_rateFiat currency exchange rate (ECB reference rates via Frankfurter, with ExchangeRate-API fallback for 150+ currencies), optional amount conversion and historical date. Read-only. Price: $0.005 USDC pe…Read-only
  • ens_resolveResolve an ENS name to its Ethereum address (plus optional text records like avatar, url, com.twitter), or reverse-resolve an address to its forward-verified primary ENS name. Read-only, public RPC.…Read-only
  • geocodeGeocode an address or place name to latitude/longitude (US Census Geocoder for US street addresses, Photon/OpenStreetMap worldwide), or reverse-geocode lat/lon to an address (with US county/tract). R…Read-only
  • wallet_risk_basicBasic heuristic risk screen for a Solana or EVM (Ethereum/Base/Arbitrum) wallet: activity & age, bundled OFAC-SDN / mixer list matches for the address and recent counterparties, and (EVM) live token-…Read-only
  • sanctions_screenSanctions screening of a person or company NAME against the official consolidated lists: US OFAC SDN + non-SDN, UK Sanctions List (FCDO/OFSI), EU Financial Sanctions Files and the UN Security Council…Read-only
  • sec_13fInstitutional holdings from a fund manager's latest SEC 13F-HR: the information table parsed from EDGAR, aggregated by CUSIP (issuer, class, shares, USD value, portfolio weight, put/call, voting auth…Read-only
  • treasury_ratesUS Treasury rates: the daily par yield curve (1M-30Y, from treasury.gov) with day-over-day change in bp, 2s10s spread and 3m10y inversion flag, optional TIPS real yield curve, plus Debt to the Penny…Read-only
  • domain_availabilityBulk domain availability: for up to 20 domains, asks the authoritative registry over RDAP (server chosen from the IANA RDAP bootstrap). RDAP 404 = available; registered names return registrar, IANA i…Read-only
  • eu_vat_validateValidate an EU VAT number live against the European Commission VIES service: valid/invalid, plus registered trader name and address where the member state discloses them. Accepts IE6388047V style inp…Read-only
  • ip_reputationIP blocklist reputation for up to 50 IPv4/IPv6 addresses: membership in the Tor exit list, Spamhaus DROP/DROPv6, abuse.ch Feodo Tracker botnet C2 and FireHOL level1 (cached published lists), with mat…Read-only
  • cisa_kevCISA Known Exploited Vulnerabilities check: is a CVE (or up to 100) in CISA's KEV catalog, with date added, federal remediation due date, past-due flag, known ransomware use, required action and CWEs…Read-only
  • epss_scoreFIRST EPSS exploit-prediction scores for up to 100 CVEs: probability of exploitation in the next 30 days, percentile rank and a simple band, for the latest model run or a past date. Complements /v1/c…Read-only
  • hsts_preloadHSTS preload check for a domain: current status on the Chromium preload list (hstspreload.org), the official preloadable errors/warnings, and our own live checks of the site's HSTS header (max-age >=…Read-only
  • macro_indicatorsMacro indicators by country and year: GDP, real GDP growth, GDP per capita, inflation, unemployment, population, government debt and current account, side by side from the World Bank (WDI actuals) an…Read-only
  • osv_scanKnown vulnerabilities for ONE package version from OSV.dev (GitHub Advisory DB, PyPA, Go, RustSec, OSS-Fuzz, distro feeds): advisory id + CVE aliases, severity (GHSA label or computed CVSS v3 base sc…Read-only
  • osv_scan_batchDependency vulnerability scan (SCA) via OSV.dev querybatch: send up to 500 packages, or paste a lockfile (package-lock.json, yarn.lock, composer.lock, requirements.txt, Pipfile.lock, poetry.lock, uv.…Read-only
  • iban_validateValidate an IBAN offline: ISO 7064 mod-97 checksum, per-country length and BBAN structure from the SWIFT IBAN registry (100+ countries plus national/experimental ones), national check digits for BE,…Read-only
  • wikipediaWikipedia in one call: search any of 340+ language editions (titles, descriptions, snippets, thumbnails) and get the top hit's summary, or fetch a summary by exact title. Returns title, short descrip…Read-only
  • pubmed_searchSearch PubMed biomedical literature via NCBI E-utilities (esearch + esummary + efetch): PMID, title, authors, journal, publication date, volume/issue/pages, DOI, PMCID, publication types; abstracts o…Read-only
  • feed_discoverFind a website's RSS/Atom/JSON feeds and read the latest items: parses <link rel="alternate"> tags, likely feed links and (if none) probes common feed paths, then parses the feed (RSS 2.0, RSS 1.0/RD…Read-only
  • evm_selector_decodeDecode EVM function selectors, calldata and event topics: looks up 4-byte selectors (or 32-byte event topics) in 4byte.directory plus a built-in table of well-known signatures, re-hashes every candid…Read-only
  • readability_extractExtract the main article from a web page (Readability-style content scoring, no headless browser): clean body text with paragraph breaks plus title, byline, site name, published/modified dates, langu…Read-only
  • openalex_searchScholarly search over OpenAlex (250M+ works): works with title, authors + ORCID + institutions, year, venue, DOI, citation count, open-access status + OA URL and reconstructed abstract; or authors (w…Read-only
  • format_convertConvert data between CSV, TSV, JSON, YAML and XML in one call (auto-detects the input format). CSV header handling and delimiter detection, type inference (numbers, booleans, null), nested objects fl…Read-only
  • repo_postureSecurity posture of a public GitHub repository from the OpenSSF Scorecard API: aggregate 0-10 score and rating, every check (Code-Review, Branch-Protection, Dangerous-Workflow, Token-Permissions, Pin…Read-only
  • timezone_convertConvert a time between IANA time zones with DST awareness: local time, UTC offset, abbreviation and DST flag on both sides, the offset difference and day shift, and each zone's next DST/offset transi…Read-only
  • cron_explainExplain a standard 5-field cron expression in plain English and list its next N run times (default 5, max 20) in any IANA zone, DST-correct. Supports lists, ranges, steps (*/n, a-b/n), month/weekday…Read-only
  • ticker_resolverResolve a stock ticker (or CIK) to the SEC CIK, registrant name, exchange and sibling share classes from SEC EDGAR's company_tickers_exchange list, plus the issuer's Legal Entity Identifier (LEI) fro…Read-only
  • usaspending_awardsFederal contracts, IDVs, grants, loans and direct payments from USAspending.gov by recipient, awarding agency (name or abbreviation such as DOD, NASA, HHS), NAICS code or keyword, for a date range (d…Read-only
  • openfda_drugFDA drug facts by brand/generic name or NDC from openFDA: label sections (boxed warning, indications, dosage, contraindications, warnings, adverse reactions, interactions, or any SPL field), FAERS ad…Read-only
  • clinical_trialsSearch ClinicalTrials.gov (API v2) by condition, keyword, location, sponsor, recruitment status (or open/closed) and phase. Returns NCT id, title, status, phases, study type, conditions, intervention…Read-only
  • federal_registerSearch the U.S. Federal Register (federalregister.gov) for rules, proposed rules, notices, presidential documents and executive orders by keyword, agency (name, short name such as EPA, or slug), type…Read-only
  • pii_detectDetect and redact PII in text: emails, phone numbers (E.164, NANP, keyword-anchored national), credit cards (Luhn + issuer prefix/length, brand), US SSNs (SSA validity rules) and IBANs (registry leng…Read-only
  • jwt_decodeDecode a JWT (JWS or JWE header), POST only (token in the JSON body, never in a URL): header, claims, alg/kid, exp/nbf/iat status with leeway, aud/iss checks, and security findings (alg none, HMAC al…Read-only
  • text_diffDiff two texts: unified line diff byte-compatible with GNU diff -u (hunks, context, "No newline at end of file"), or word-level / character-level diff with [-removed-]{+added+} inline markup and merg…Read-only
  • contact_extractExtract public business contact details from a website: email addresses (mailto, visible text incl. [at]/[dot] obfuscation, Cloudflare-protected, JSON-LD) tagged role/personal and same-domain, phone…Read-only
  • seo_auditOn-page SEO audit of one URL with a 0-100 score, letter grade and prioritised issues (high/medium/low): title and meta description length, robots meta and X-Robots-Tag noindex, canonical, lang, viewp…Read-only
  • weather_globalWorldwide weather forecast for any latitude/longitude from MET Norway Locationforecast 2.0 (the Norwegian Meteorological Institute; CC BY 4.0): current conditions (temperature, humidity, wind speed a…Read-only
  • github_trendingTrending new GitHub repositories: repos created in the last day, week or month ranked by stars (GitHub REST search API), filterable by language, topic and minimum stars. Returns full name, URL, descr…Read-only
  • json_repairRepair broken or LLM-style JSON into valid JSON: strips markdown fences and surrounding prose, comments, trailing/missing commas, single or smart quotes, unquoted keys and values, Python/JS literals…Read-only
  • sentimentSentiment analysis with VADER (Hutto & Gilbert 2014; MIT), the lexicon-and-rules model tuned for social media, reviews and short text: compound score (-1..1), positive/neutral/negative proportions an…Read-only
  • food_barcodeFood product facts by barcode (EAN-13, EAN-8, UPC-A, UPC-E; GTIN check digit validated) from Open Food Facts (ODbL): name, brand, quantity, categories, ingredients text, allergens and traces, additiv…Read-only
  • vin_decodeDecode a 17-character Vehicle Identification Number: offline structure check (allowed characters, ISO 3779 check digit, region and WMI, model-year code) plus NHTSA vPIC decoding (make, model, model y…Read-only
  • eol_checkIs this software version still supported? End-of-life status from endoflife.date for 400+ products (languages, frameworks, databases, OSes, runtimes, cloud services): status (supported, security-only…Read-only
  • text_chunkSplit text into retrieval-ready chunks for RAG and embeddings: recursive (paragraph > line > sentence > clause > word), markdown-aware (splits on headings, keeps the heading path per chunk, respects…Read-only
  • hash_encodeHashing, HMAC and encoding toolkit: digests (MD5, SHA-1/2/3, Keccak-256 as used by Ethereum, RIPEMD-160, Whirlpool, CRC32/CRC32C, Adler-32, FNV-1a, xxHash32/64/3/128, MurmurHash3), HMAC (SHA-1/2/3, M…Read-only
  • census_geographiesUS Census Bureau geocoder: a one-line US street address (or a lat/lon) to matched address and coordinates plus Census geographies: state and county with FIPS codes, census tract, block group and bloc…Read-only
  • evm_contract_infoEVM contract introspection on Ethereum, Base, Arbitrum, OP Mainnet, Polygon or BNB Chain via public RPC: bytecode size/hash, EIP-1167 / EIP-1967 / ZeppelinOS / EIP-7702 proxy detection, ERC-165/20/72…Read-only
  • evm_token_transfersLatest ERC-20 or ERC-721 Transfer events for a token contract (optionally filtered to one wallet, in/out/both) on six EVM chains. Adaptive eth_getLogs window with automatic shrink on provider range c…Read-only
  • evm_allowanceERC-20 allowance matrix for an owner across up to 10 tokens × 10 spenders (defaults: major stables/WETH × Uniswap Permit2, 1inch, CoW, 0x, OpenSea Seaport — verified deployed on-chain). Also reports…Read-only
  • evm_gasLive gas tracker across Ethereum, Base, Arbitrum, OP Mainnet, Polygon and BNB Chain: head block age, base fee, 10th/50th/90th percentile priority fees from eth_feeHistory, suggested maxFeePerGas tier…Read-only
  • nft_metadataERC-721 / ERC-1155 token metadata: tokenURI/uri (ipfs/arweave/data/https), ownerOf, collection name/symbol/supply, EIP-2981 royalty. Metadata JSON is fetched SSRF-safe via target_fetch (public-IP pin…Read-only
  • evm_readRead-only eth_call of any view/pure function from a human signature (e.g. balanceOf(address)(uint256) or `function name() view returns (string)`). ABI-encodes args, decodes outputs (address/uint/int/…Read-only
  • prompt_injection_scanOffline prompt-injection / jailbreak / exfiltration scanner: 10 rule families (ignore-instructions, reveal-system, role-hijack, delimiter-escape, tool/secret dump, encoding smuggle, policy bypass, au…Read-only
  • airport_statusUS airport delay status from the FAA NAS Status feed (ground delay programs, ground stops, closures, arrival/departure delays) plus OurAirports metadata (name, city, ICAO/IATA, lat/lon). Pass ?airpor…Read-only
  • dockerfile_lintOffline Dockerfile linter: parses stages/continuations and runs 20+ best-practice and security rules (latest tag, curl|bash, secrets in ENV/ARG, runs-as-root, chmod 777, ADD-vs-COPY, apt cache, no HE…Read-only
  • regex_testOffline PCRE2 regex tester (JS-compatible i/m/s/u flags): match (with offsets + capture groups), replace, or split. Hard caps on backtracking/recursion and a structural ReDoS warning. Pattern max 2 K…Read-only
  • sec_financialsNormalized financial statements for any SEC filer by ticker or CIK, straight from EDGAR XBRL: revenue, gross profit, operating income, net income, EPS, assets, liabilities, equity, cash, debt, operat…Read-only
  • fund_holdingsMutual fund / ETF portfolio from its latest public SEC Form N-PORT: top holdings by value (name, CUSIP, ISIN, LEI, shares, USD value, % of net assets, asset and issuer category, country, maturity/cou…Read-only
  • fda_adverse_eventsFDA adverse-event reports (openFDA): drug FAERS, device MAUDE, food/supplement CAERS. Filter by drug, product, reaction, dates or raw openFDA search; compact reports or counts on any field (e.g. top…Read-only
  • fda_recallsFDA recalls (openFDA): drug, device and food enforcement reports (class, status, firm, reason, distribution, lots) plus the device recall database (root cause). Filter by firm, product, class, status…Read-only
  • fda_deviceFDA device records (openFDA): 510(k) clearances, PMA approvals, device classification (product code, class, regulation) and GUDID device identifiers. Search by name, product code, applicant, K/PMA nu…Read-only
  • bls_seriesAny BLS time series by id (CPI, payrolls, unemployment, state/metro LAUS, PPI, JOLTS, ECI ...) for a year range: observations newest first with preliminary flags and footnotes, latest value, MoM / Yo…Read-only
  • us_macroUS macro dashboard from BLS in one call: CPI and core CPI, unemployment, nonfarm payrolls, hourly earnings, participation, PPI and JOLTS openings. Latest value, month, MoM / YoY change and 13-month h…Read-only
  • ssl_blacklistabuse.ch SSL Blacklist (SSLBL): check whether a TLS certificate SHA1 fingerprint is blacklisted as malware / botnet C&C infrastructure (listing date and reason, e.g. "QuasarRAT C&C"), check an IP aga…Read-only
  • pingPaid x402 test route for agents and client developers: the cheapest way to prove your x402 client signs a Solana USDC payment and the facilitator settles it before you call anything expensive. Return…Read-only
  • evm_blockOne EVM block by number, tag (latest, safe, finalized, earliest, pending) or hash on Ethereum, Base, Arbitrum, OP Mainnet, Polygon or BNB Chain: timestamp and age, transaction count, gas used/limit a…Read-only
  • evm_logsDecoded event logs for any contract and event on Ethereum, Base, Arbitrum, OP Mainnet, Polygon or BNB Chain: give the event as a human signature (e.g. "Transfer(address indexed from, address indexed…Read-only
  • evm_address_activityWhere is this address used? One call checks an EVM address on Ethereum, Base, Arbitrum, OP Mainnet, Polygon and BNB Chain: native balance, nonce (transactions sent), contract or EOA, EIP-7702 delegat…Read-only
  • sol_priority_feesSolana priority-fee estimator from getRecentPrioritizationFees (last ~150 slots), globally or for the accounts your transaction writes to: min / p25 / median / p75 / p90 / p95 / max in micro-lamports…Read-only
  • sol_networkSolana mainnet status in one call: current slot and block height, epoch with progress % and estimated time to the next epoch, average slot time, total and non-vote TPS from recent performance samples…Read-only
  • sol_signaturesRecent transaction signatures that touched a Solana address (wallet, token account, mint or program), newest first, via getSignaturesForAddress: signature, slot, block time and age, success or error,…Read-only
  • sol_accountInspect any Solana account: exists or not, SOL balance (lamports), owner program with a readable name, executable flag, data size, rent-exempt minimum and status, and a classification (wallet, token…Read-only
  • sol_tx_statusFast confirmation check for up to 100 Solana transaction signatures in one call (getSignatureStatuses with history search): found or not, processed / confirmed / finalized, success or the on-chain er…Read-only
  • sol_validatorsSolana validator set from getVoteAccounts: active and delinquent counts, total active stake, Nakamoto coefficient (fewest validators controlling > 33.3% of stake), the top validators by stake with co…Read-only
  • crypto_address_validateOffline validator and chain detector for up to 50 crypto addresses: EVM (EIP-55 checksum, returns the checksummed form), Bitcoin (P2PKH, P2SH, SegWit v0 bech32, Taproot bech32m, testnet), Solana (32-…Read-only
  • token_unitsExact (string-math, no floating point) conversion between human token amounts and on-chain base units: wei / gwei / ether, lamports / SOL, sats / BTC, USDC/USDT (6 decimals) or any token with a decim…Read-only
  • abi_encodeBuild EVM calldata offline: function selector + ABI-encoded arguments from a human signature such as transfer(address,uint256) or exactInputSingle((address,address,uint24,address,uint256,uint256,uint…Read-only
  • evm_create_addressPredict EVM contract addresses before deployment: CREATE (deployer + nonce, RLP-encoded; up to 50 consecutive nonces) or CREATE2 (deployer + salt + init code or its keccak256 hash, EIP-1014). Works f…Read-only
  • evm_verify_signatureVerify an Ethereum signature offline: recovers the signer address (secp256k1 ecrecover) from an EIP-191 personal_sign message (UTF-8 or hex) or a raw 32-byte digest (e.g. an EIP-712 hash), compares i…Read-only
  • eip712_hashEIP-712 typed-data hashing and signature check: returns encodeType, typeHash, domain separator, struct hash and the final digest a wallet signs (eth_signTypedData_v4), and with a signature recovers t…Read-only
  • sol_pdaDerive Solana program-derived addresses offline: findProgramAddress (canonical bump search) for any program and typed seeds (utf8, base58 pubkey, hex, u8/u16/u32/u64 little- or big-endian), or the as…Read-only
  • impermanent_lossImpermanent loss calculator for AMM liquidity positions: full-range constant-product pools (Uniswap v2, Raydium, Orca classic) or concentrated ranges (Uniswap v3/v4, Orca Whirlpools, Raydium CLMM, Me…Read-only
  • liquidation_priceLiquidation calculator. mode=perp: isolated-margin long/short liquidation and bankruptcy price from entry price, leverage and maintenance margin rate (optionally size and fees), with distance to liqu…Read-only
  • position_sizeRisk-based position sizing for trading agents: from account balance, risk per trade (percent or fixed amount), entry and stop price returns units to buy/sell, notional, leverage needed, stop distance…Read-only
  • loan_amortizationLoan / mortgage amortization: periodic payment, total interest, payoff date and a yearly or full payment schedule (principal, interest, balance) for any rate, term and payment frequency (monthly, bi-…Read-only
  • npv_irrInvestment appraisal for a cash-flow series: NPV at a discount rate, IRR (all roots for non-conventional flows), MIRR, profitability index, simple and discounted payback; with dates gives Excel-compa…Read-only
  • compound_interestCompound growth / savings calculator: future value of a principal plus monthly contributions at any compounding frequency (incl. continuous), contributions at start or end of month, inflation-adjuste…Read-only
  • black_scholesEuropean option pricing (Black-Scholes-Merton with continuous dividend yield): call and put prices, delta, gamma, vega, theta per day, rho, d1/d2 and probability of finishing in the money; with a mar…Read-only
  • bond_calcFixed-coupon bond math: price from yield or yield to maturity from price (clean and dirty, with accrued interest for fractional periods), current yield, Macaulay and modified duration, convexity and…Read-only
  • technical_indicatorsTechnical analysis on a price series you supply: SMA, EMA, RSI (Wilder), MACD (line, signal, histogram), Bollinger Bands (%B, bandwidth), ATR, Stochastic %K/%D, OBV, VWAP and rate of change, with lat…Read-only
  • portfolio_metricsPortfolio and asset risk/return analytics from price or return series you supply: annualised return (CAGR) and volatility, Sharpe and Sortino ratios, max drawdown, historical and parametric 95% VaR,…Read-only
  • mortgage_affordabilityHow much house can I afford: maximum home price and loan from income, monthly debts, down payment and rate under front-end / back-end debt-to-income limits (default 28/36), with a full monthly PITI b…Read-only
  • unit_economicsSaaS / subscription unit economics: customer lifetime value (margin-adjusted), LTV:CAC ratio, CAC payback months, average lifetime, MRR/ARR, break-even customer count and cash runway, with health rat…Read-only
  • depreciationDepreciation schedules: straight-line, declining balance (any factor, optional switch to straight-line), double-declining, sum-of-the-years-digits and US MACRS GDS (3/5/7/10/15/20-year, half-year con…Read-only
  • json_diffStructural diff of two JSON documents: list of added / removed / changed values with JSON Pointer paths and old/new values, an RFC 6902 JSON Patch that turns a into b, and counts. Arrays are aligned…Read-only
  • json_patchApply a JSON Patch (RFC 6902: add, remove, replace, move, copy, test) or a JSON Merge Patch (RFC 7386) to a JSON document and return the result. Atomic: any failing operation or test returns 422 with…Read-only
  • jsonpathQuery JSON with JSONPath (RFC 9535): dot and bracket names, indexes, slices, wildcards, recursive descent (..) and filters with comparisons, && || !, and length() / count() / match() / search() / val…Read-only
  • json_schema_inferInfer a JSON Schema (draft 2020-12) from one JSON document or many samples: types (integer vs number), nested objects and arrays, required keys (present in every sample), nullable fields, string form…Read-only
  • json_to_typesGenerate typed models from sample JSON: TypeScript interfaces, Zod schemas, Python Pydantic models, Go structs (json tags) or Rust serde structs. Nested objects become named types, optional and nulla…Read-only
  • csv_profileProfile a CSV/TSV dataset: delimiter detection, row and column counts, per-column inferred type (integer, decimal, boolean, date, datetime, string), null/empty counts, distinct values, min/max/mean/m…Read-only
  • csv_to_sqlTurn CSV/TSV into SQL: CREATE TABLE with inferred column types (integer/bigint, numeric, boolean, date, timestamp, varchar/text, NOT NULL where never empty, optional primary key) and batched INSERT s…Read-only
  • sql_formatFormat and lint SQL: consistent keyword case, one clause per line, indented select lists, joins, AND/OR conditions and subqueries, comments and string literals preserved; or minify. The linter flags…Read-only
  • json_canonicalizeRFC 8785 JSON Canonicalization Scheme (JCS): deterministic serialization with keys sorted by UTF-16 code units and ECMAScript number formatting, plus SHA-256 / SHA-512 digests of the canonical bytes…Read-only
  • xml_xpathRun XPath 1.0 queries over XML you supply (RSS/Atom, SOAP, sitemaps, SVG, config) or over HTML for scraping: returns matched elements/attributes/text with their paths, text, attributes and outer mark…Read-only
  • semverSemantic versioning toolkit with npm (node-semver) semantics: validate and parse a version, compare two versions, test a range (^, ~, x-ranges, hyphen ranges, || unions, prerelease rules) and show it…Read-only
  • cidr_calcIPv4 / IPv6 subnet calculator: network and broadcast/last address, netmask, wildcard, first/last usable host, address and host counts, address type (private, CGNAT, documentation, ULA, link-local...)…Read-only
  • ip_range_mergeAggregate IP allow/deny lists: merges any mix of IPv4/IPv6 addresses, CIDRs, "a-b" ranges and "ip netmask" entries into the minimal set of CIDR blocks, optionally subtracts an exclude list, reports a…Read-only
  • user_agent_parseParse User-Agent strings: browser and version, rendering engine, OS and version, device type (mobile, tablet, desktop, TV, console, bot) with vendor/model, and bot detection that names 100+ crawlers…Read-only
  • url_parseParse, normalize and clean URLs offline: scheme, credentials (redacted), host type, port, path segments, decoded query parameters and fragment; registrable domain / subdomain / public suffix; IDN to…Read-only
  • unit_convertUnit conversion across 14 categories with exact defined factors: length, mass, volume (US and imperial), area, speed, time, data (SI kB vs IEC KiB, bits vs bytes), pressure, energy, power, angle, fre…Read-only
  • color_convertConvert a colour between HEX, RGB(A), HSL, HSV, CMYK, CIE Lab and OKLCH (any CSS colour syntax or one of the 148 CSS names in), with relative luminance, contrast against white and black, the readable…Read-only
  • color_paletteGenerate colour palettes from one base colour: complementary, analogous, triadic, split-complementary, tetradic and monochromatic schemes plus an 11-step 50-950 shade scale (Tailwind-style, perceptua…Read-only
  • timestamp_convertConvert any timestamp: auto-detects Unix seconds / milliseconds / microseconds / nanoseconds, ISO 8601 / RFC 3339, RFC 2822, HTTP dates, Excel serial dates and "now", and returns all of them plus loc…Read-only
  • string_caseConvert identifiers and phrases between naming conventions: camelCase, PascalCase, snake_case, SCREAMING_SNAKE_CASE, kebab-case, Train-Case, dot.case, path/case, Title Case (small words kept lower),…Read-only
  • x509_decodeDecode PEM/DER X.509 certificates, chains and CSRs offline: subject/issuer DN, serial, validity and days left, SANs, key type/size/curve, signature algorithm, key usage / EKU / basic constraints, AKI…Read-only
  • ssh_key_infoInspect SSH public keys and OpenSSH certificates from authorized_keys, known_hosts, .pub, RFC 4716 or PEM input: key type, size / curve, SHA256 and MD5 fingerprints exactly as ssh-keygen prints them,…Read-only
  • secret_scanScan code, config, logs, diffs or prompts for leaked credentials before you commit, share or send them to an LLM: 50+ rules (AWS, GitHub, GitLab, Slack, Stripe, Google, OpenAI, Anthropic, xAI, Huggin…Read-only
  • ioc_extractExtract indicators of compromise from threat reports, alerts, logs or emails: IPv4/IPv6 (private ranges optional), domains (TLD-validated, file-name false positives suppressed), URLs, email addresses…Read-only
  • cvss_calcScore and explain any CVSS vector: v4.0 (official FIRST macrovector algorithm, CVSS-B/BT/BE/BTE nomenclature, macrovector and severity breakdown), v3.1 and v3.0 (base, impact / exploitability subscor…Read-only
  • csp_evaluateEvaluate a Content-Security-Policy string the way CSP Evaluator does, before you ship it: parses directives, catches typos, unquoted keywords and deprecated directives, then checks script execution (…Read-only
  • gha_workflow_lintSecurity audit of a GitHub Actions workflow YAML (zizmor / actionlint style): pwn-request checkouts under pull_request_target / workflow_run, script injection from attacker-controlled ${{ github.even…Read-only
  • k8s_manifest_lintSecurity and reliability audit of Kubernetes YAML (multi-document, List kinds; kubesec / kube-score style): privileged containers, root users, privilege escalation, dangerous capabilities, host names…Read-only
  • html_sanitizeSanitize untrusted HTML (LLM output, user comments, scraped pages, email bodies) with a strict allowlist before rendering it: three profiles (strict inline formatting, basic with links and lists, ric…Read-only
  • email_parseParse a raw email (.eml / RFC 5322 + MIME) for triage: decoded headers (RFC 2047), addresses, Received hop chain with relays, IPs, timestamps and delays, originating IP, Authentication-Results (SPF /…Read-only
  • keyword_extractKeyphrase extraction for tagging, SEO and RAG metadata: RAKE (rapid automatic keyword extraction: candidate phrases split at stopwords/punctuation, scored by word degree / frequency) or TextRank (co-…Read-only
  • summarize_extractiveExtractive summary with TextRank (Mihalcea & Tarau 2004): sentences are split (abbreviation / initial / decimal aware), linked by stemmed content-word overlap, ranked with PageRank, and the top N are…Read-only
  • fuzzy_matchFuzzy string matching for entity resolution, dedupe and "did you mean": match one or many queries against up to 5,000 choices with RapidFuzz-style scorers (WRatio weighted blend, ratio / InDel simila…Read-only
  • text_similarityDocument similarity and near-duplicate detection: compare two texts (a, b) or cluster up to 200 texts. Metrics: TF-IDF cosine on stemmed content words, word Jaccard, k-word shingle Jaccard and contai…Read-only
  • entity_extractRule-based entity and value extraction with normalised values: dates (ISO, numeric with dmy/mdy, month names, relative "next Friday" / "in 3 days" resolved against a reference date), times with time…Read-only
  • profanity_filterProfanity, sexual-language and slur filter for chat, usernames, reviews and LLM output: token-level matching (no Scunthorpe false positives) with obfuscation handling (leetspeak f4ck / sh1t, masked l…Read-only
  • scam_text_scoreScam / fraud likelihood for messages, DMs, emails, posts and listings: 16 pattern families (crypto doubling giveaways, seed-phrase and private-key solicitation, wallet-connect / airdrop lures, fake s…Read-only
  • license_detectIdentify a software / content licence from a LICENSE file, source header or SPDX expression and explain what it allows: 40 licences incl. MIT, Apache-2.0, BSD-2/3/4, ISC, 0BSD, GPL/LGPL/AGPL v2/v3, M…Read-only
  • markdown_to_htmlRender Markdown to safe HTML: CommonMark-style blocks (ATX / setext headings, paragraphs, block quotes, nested ordered / bullet lists, fenced and indented code with language classes, thematic breaks)…Read-only
  • text_cleanClean and normalise messy text before embedding, indexing or prompting: repairs mojibake (UTF-8 read as Windows-1252), strips control and invisible characters (zero-width, bidi overrides used in Troj…Read-only
  • geo_distanceGeodesic distance and bearings on the WGS-84 ellipsoid: Vincenty (millimetre accuracy) plus great-circle haversine, initial / final bearing with 16-point compass, midpoint, multi-point path length wi…Read-only
  • coord_convertConvert a location between coordinate formats in one call: decimal degrees, DMS, degrees-decimal-minutes, UTM (Krüger series, WGS-84, Norway / Svalbard zones), MGRS military grid, geohash (with cell…Read-only
  • geo_polygonAnalyse GeoJSON polygons (Polygon, MultiPolygon, Feature or FeatureCollection): geodesic area (m², km², ha, acres; same spherical formula as Turf.js), perimeter, area-weighted centroid, bounding box,…Read-only
  • sun_timesSunrise, sunset, solar noon, day length, civil / nautical / astronomical twilight, golden hour and blue hour for any place and date (NOAA solar calculator equations, about a minute of accuracy), with…Read-only
  • moon_phaseMoon phase for any moment: phase name and emoji, illuminated fraction, phase angle, age in days since new moon, waxing / waning, Earth-Moon distance and apparent size, the next new moon / first quart…Read-only
  • date_calcCalendar-correct date arithmetic in any IANA zone: add or subtract durations (ISO 8601 or plain English, months clamp to month end so Jan 31 + 1 month = Feb 28/29), exact difference between two dates…Read-only
  • duration_parseParse any duration into seconds and every common format: ISO 8601 (P1DT2H30M, PT1.5S, P2W), clock (1:02:03.5, 02:30), Go / compact (1h30m, 2d4h), and plain English ("an hour and a half", "2.5 days",…Read-only
  • rrule_expandExpand an iCalendar RFC 5545 RRULE (recurring event rule, as used by Google Calendar, Outlook, CalDAV) into concrete occurrences in any IANA zone, DST-correct, with an English description. Supports F…Read-only
  • meeting_plannerFind the best meeting times across time zones: give 2-20 IANA zones (optionally with per-person hours like Asia/Tokyo@08:00-18:00) and a date; returns the windows where everyone is inside working hou…Read-only
  • fitness_calcBody and training calculator in one call, metric or imperial: BMI with WHO category and healthy-weight range, BMR (Mifflin-St Jeor, revised Harris-Benedict, Katch-McArdle), TDEE by activity level, ca…Read-only
  • html_tablesExtract HTML tables from a public URL (SSRF-safe fetch) or an HTML string into clean JSON: header detection (thead or leading th rows, multi-row headers joined), rowspan / colspan expansion, captions…Read-only
  • html_selectScrape a public page (SSRF-safe fetch) or an HTML string with a CSS selector (CSS3 plus :has, :contains, :nth-child(an+b), attribute operators) or raw XPath: returns each match's text, attributes and…Read-only
  • schema_org_extractExtract all schema.org structured data from a public page (SSRF-safe fetch) or HTML: JSON-LD (including @graph), microdata (nested itemscope / itemref) and RDFa Lite, normalised to typed items, plus…Read-only
  • security_txtFetch and validate a site's security.txt (RFC 9116) for vulnerability disclosure: tries /.well-known/security.txt then the legacy /security.txt (SSRF-safe), parses Contact / Expires / Encryption / Po…Read-only
  • llms_txtRead a site's llms.txt (the llmstxt.org convention that tells AI agents where the useful docs are), SSRF-safe: title, summary, details and every section's links (title, absolute URL, notes; "Optional…Read-only
  • openapi_summarySummarise an OpenAPI 3.x or Swagger 2.0 API from a URL (SSRF-safe) or an inline JSON / YAML spec, so an agent can learn an API fast: title, version, servers / base URLs, auth schemes (API key, bearer…Read-only
  • ics_parseParse an iCalendar (.ics) feed from a URL (SSRF-safe; Google / Outlook / Apple calendar exports) or inline text into JSON: calendar name and zone, events with start / end in any IANA zone, all-day fl…Read-only
  • link_checkFind broken links on a public web page (or in supplied HTML, e.g. a draft before publishing): fetches the page (SSRF-safe), extracts links (optionally images / scripts / stylesheets too), then checks…Read-only

And 812 more tools. The full list is in the agent view.

Audit history

  1. Nov 13Passed

What we sent

Every request in this audit, with the answer and how long it took. We never send credentials and never call a tool.

RequestAnswerTime
initializeHTTP 200412 ms
initializedHTTP 202328 ms
tools/listHTTP 200647 ms
unknown-methodHTTP 200179 ms

Run this server, or disagree with the result?

Fix the issue and it shows in the next weekly audit, or email us to ask for a re-audit or to dispute a finding. Read how we audit for what each check means.