Next free-source huntWe check for new free data every weekday.
FinancialMCP serverFirst audited Nov 13, 2026

io.github.digitalweb33333-creator/x402-endpoints

x402 paid API tools for AI agents on Base: EU/global registries, crypto, wallet & agent trust.The vendor's description, from its MCP Registry listing.

Passed, with 1 warningAudited Nov 13, 2026
  • Warning: 52 of 52 tools do not say whether they can change things.

Nothing failed, but there is something to know or fix. Public audit: we connect as an AI client would, list the tools and check what they say. We do not run them. How we audit

Does it work?
YesConnected in 414 ms.
Sign-up?
None neededIt answered without any account or key.
Can it change things?
Doesn't sayIts tools do not say whether they only read, so treat them as able to change things.
Endpointhttps://x402-endpoints.onrender.com/mcp

Source code Website Streamable HTTP · protocol 2025-11-25 · server version 1.28.1

What we checked, the evidence, and the tools it offers.

What we checked

Security

  • Passed: Connections are encrypted (HTTPS).

  • Passed: No hidden instructions found in tool text.

Safety labels

  • Warning: 52 of 52 tools do not say whether they can change things.

    MCP lets a server label each tool as read-only or destructive, so clients can ask the user before risky calls. Unlabelled tools are treated as able to change things.

    • gleif_lei
    • vies_vat
    • polymarket_odds
    • flights_states
    • ev_charging
    • bodacc_annonces
    • ted_tenders
    • eurlex_search
    • and 44 more

Tools

  • Passed: 52 tools listed.

  • Passed: Every tool describes its inputs with a valid schema.

Protocol

  • Passed: The MCP handshake works (Streamable HTTP).

  • Passed: Protocol version 2025-11-25 (latest).

  • Passed: Unknown requests are refused.

Connection

  • Passed: The server responds.

Tools (52)

As the server describes them. The labels are the server's own: it says whether each tool only reads or can change things.

  • gleif_leiLook up any Legal Entity Identifier (LEI) against the official GLEIF global registry — returns legal name, status, jurisdiction, legal form and registered address, real-time, worldwide coverage. Pric…Doesn't say
  • vies_vatValidate an EU VAT number against the official EU VIES registry across all 27 member states — returns valid/invalid plus the registered company name and address. Distinguishes 'invalid' (number does…Doesn't say
  • polymarket_oddsLive prediction market odds and implied probabilities from Polymarket — give a market id or slug, get each outcome with its probability (0-1), volume, liquidity and resolution status. Price: $0.05 pe…Doesn't say
  • flights_statesReal-time aircraft states worldwide from adsb.fi open data (ADS-B) — give a bounding box, get every aircraft in the area with live position, altitude, speed, heading and ground status. Data by adsb.f…Doesn't say
  • ev_chargingEV charging stations worldwide from Open Charge Map — give a location and radius, get nearby stations with operator, connector type, power (kW), number of points and status. Price: $0.01 per call (x4…Doesn't say
  • bodacc_annoncesSearch the official French BODACC registry (DILA) for company legal announcements: incorporations, modifications, radiations and insolvencies — coverage France, by name, SIREN or RCS. Price: $0.01 pe…Doesn't say
  • ted_tendersSearch the official EU TED (Tenders Electronic Daily) for public procurement notices across the 27+ member states — by keywords, buyer country and CPV code. Price: $0.05 per call (x402 payment, USDC…Doesn't say
  • eurlex_searchSearch official EUR-Lex for EU legislation, treaties, case law and legal acts by keyword — returns CELEX number, title and date. Multilingual (en, fr, de, es, it, nl, pl). Price: $0.01 per call (x402…Doesn't say
  • sanctions_screenScreen a name against the official EU consolidated sanctions list (FISMA) — returns matches with a similarity score and context (EU reference, type, programme), not a binary yes/no. Price: $0.05 per…Doesn't say
  • cve_lookupSecurity vulnerability lookup (CVE) against the official NVD (NIST) database — by exact CVE id or by keyword/product. Returns description, CVSS severity, CWE weaknesses and references. Worldwide. Pri…Doesn't say
  • recalls_searchProduct recall lookup (drugs/devices/food), Class I/II/III, against the official FDA openFDA enforcement reports — by product, firm or reason. Coverage US. Price: $0.01 per call (x402 payment, USDC o…Doesn't say
  • drug_labelDrug interactions, warnings and contraindications lookup from the official FDA openFDA drug labels — by generic or brand name. Returns the key label sections. Coverage US. Price: $0.05 per call (x402…Doesn't say
  • osm_building_footprintOpenStreetMap building footprints via Overpass — give a coordinate (or bounding box) and get building geometry as GeoJSON, footprint area (m²), levels and height by coordinate. Worldwide coverage, Op…Doesn't say
  • climate_risk_scoreDerived climate risk score from Open-Meteo CMIP6 projections — a composite heat/drought/extreme-rain risk score (0-100) by coordinate and scenario, comparing a baseline to a future horizon. Worldwide…Doesn't say
  • polymarket_resolutionPolymarket resolution status via Gamma API — market resolution, winning outcome and resolution source lookup by slug or condition id (or list recent resolved markets). Distinct from live odds: return…Doesn't say
  • solar_building_insightsRooftop solar potential, panel capacity, sunshine hours and carbon offset by coordinate from the official Google Maps Platform Solar API — returns max panel count, usable roof area, annual sunshine h…Doesn't say
  • uk_companies_searchSearch the official UK Companies House register — UK company search, status, type and registered details lookup (KYB) by name or number, or fetch a detailed company profile (registered address, SIC c…Doesn't say
  • patents_searchEuropean patent search and bibliographic lookup by number, title, applicant or inventor against the official European Patent Office (EPO) Open Patent Services — returns publication number, country, k…Doesn't say
  • fr_sirene_lookupFrench company/establishment lookup by SIREN, SIRET or name against the official INSEE Sirene register (France) — returns legal name, administrative status, NAF/APE code, creation date, headcount ban…Doesn't say
  • iban_validateIBAN format validation (ISO 13616 mod-97) — SEPA/EU IBAN structural validation and country/bank-code extraction. Returns valid/invalid with reason, country code, check digits, bank code and grouped f…Doesn't say
  • fr_legifrance_searchOfficial Légifrance (French law, via DILA/PISTE) — French legal texts, codes and articles search and lookup by keyword and corpus (codes, laws/decrees, JORF), or consult a text by id. Complements EUR…Doesn't say
  • ecb_exchange_rateOfficial European Central Bank (ECB) euro reference exchange rates — EUR foreign exchange reference rate lookup by currency (29 currencies), latest or by date. Reference rates (published ~16:00 CET o…Doesn't say
  • crypto_token_safetyToken safety check before buying — is this token a honeypot or a rug pull? Bundles honeypot detection, buy/sell tax, holder concentration, LP lock and liquidity (GoPlus, Honeypot.is, DexScreener) int…Doesn't say
  • crypto_derivatives_radarPerpetual funding rates, open interest and long/short ratios across Binance, Bybit, OKX and Hyperliquid in one call, plus the computed funding-rate arbitrage spread between venues and a crowding sign…Doesn't say
  • crypto_wallet_xrayWallet risk analysis in one call — native + ERC-20 balances, USD portfolio valuation, token count and an OFAC sanctions flag (Blockscout, DexScreener, OFAC list). A full on-chain wallet x-ray with ri…Doesn't say
  • crypto_dex_cex_spreadDEX vs CEX arbitrage spread — the price difference between DEX and CEX with the fee-adjusted NET spread and execution direction, not two raw prices. Compares the most liquid DEX pair (DexScreener) to…Doesn't say
  • web_extractWeb search and webpage extraction for AI agents — returns clean, LLM-ready markdown (deduplicated, with source URLs), not raw HTML. Give 'query' to search the web or 'url' to scrape and extract a pag…Doesn't say
  • crypto_new_pairsNewly launched DEX pairs and pools per chain (GeckoTerminal) with an instant per-pair safety check bundled in (GoPlus honeypot/tax/verified + mini score) — a sniping agent filters rugs without a seco…Doesn't say
  • x402_seller_trustScore an x402 seller wallet BEFORE paying it: verdict TRUSTED/CAUTION/AVOID + confidence from its on-chain settlement graph on Base — settlement count, unique paying counterparties, wallet age, wash-…Doesn't say
  • x402_payment_firewallPre-payment risk firewall for AI agents: validate {recipient, amount, chain} BEFORE sending an x402 payment and get ALLOW/REVIEW/BLOCK in <200ms — OFAC blocklist, sanctioned-mixer check, runaway-over…Doesn't say
  • compliance_wallet_screenCrypto wallet sanctions & compliance screening (AML/KYT): screen any EVM/Solana/Bitcoin/Tron/XRP wallet against the official OFAC SDN crypto list (UN/UK declared) with mixer (Tornado Cash) exposure a…Doesn't say
  • macro_snapshotMacro economic snapshot API — dated Eurozone economic indicators for trading/research agents: euro-area inflation (HICP / CPI), ECB policy interest rates (deposit, refi), unemployment and EUR FX from…Doesn't say
  • solana_token_safetySolana SPL token safety, rug check and honeypot / scam detection before trading: is this Solana token a rug pull, honeypot or scam? Verdict SAFE/RISKY/CRITICAL + 0-100 score combining STATIC checks (…Doesn't say
  • solana_pre_tradeAll-in-one Solana pre-trade decision in ONE call: BUY-SAFE/CAUTION/AVOID fusing four scored modules — token security, EXECUTABLE liquidity depth (estimated slippage at $100/$1k/$10k), deployer histor…Doesn't say
  • crypto_signal_fusionCrypto trading signal (long/short) and market-regime signal in ONE call: LONG/SHORT/NEUTRAL with confidence, fusing the cross-exchange funding rate, crowding (long/short) bias, trend/chop market regi…Doesn't say
  • agent_due_diligenceVet any company, crypto project, counterparty or domain before engaging: one call composes a risk DOSSIER — synthesis + detected signals + sources + 0-100 risk score + GO/CAUTION/STOP verdict + recom…Doesn't say
  • agent_analysis_reportStructured analysis report on any URL, company, product or subject in one call: positioning + strengths + risks + opportunities + 0-100 actionable score + STRONG/MODERATE/WEAK rating + recommendation…Doesn't say
  • agent_clearanceSafety preflight before an agent runs a DESTRUCTIVE, costly or IRREVERSIBLE action (delete, deploy, transfer funds, publish, overwrite): risk assessment + reversibility check + timing + CLEAR/LIMIT/R…Doesn't say
  • agent_output_qaReview and improve an agent's outbound text (email, social post, customer reply) before sending: a multi-criteria scorecard (clarity, spam-safety, tone, length, personalization, CTA, compliance — eac…Doesn't say
  • agent_content_scanScan any external content before an agent INGESTS it (SKILL.md, web page, user input, tool output) for prompt-injection, data exfiltration, dangerous code execution, hidden/invisible unicode and inst…Doesn't say
  • crypto_pre_trade_verdictOne-call GO/CAUTION/NO-GO pre-trade verdict for AI trading agents: fuses token safety (honeypot, rug, tax, holders), counterparty wallet sanctions screening (OFAC/mixer) and cross-exchange market sig…Doesn't say
  • agent_ledgerYour AI agent's books in one call: structured USDC accounting for any wallet on Base (the x402 settlement asset) — revenue (incoming) vs expenses (outgoing), net, transaction count, top paying counte…Doesn't say
  • proof_notarizeNotarize a document or data hash for AI agents: submit a SHA-256 hash (or short content hashed server-side) and get a timestamped, Ed25519-signed proof-of-existence receipt, verifiable offline with n…Doesn't say
  • crypto_token_dossierFull degen token dossier in one call: safety score + honeypot/tax + detailed TOP HOLDERS and concentration + liquidity/FDV/volume/pool-age + contract control (owner, creator, mintable, open-source) +…Doesn't say
  • market_intelAI market intelligence report in one call for research and trading agents: cross-exchange perp derivatives (funding, open interest, long/short), fused directional signals and the euro-area macro snap…Doesn't say
  • crypto_wallet_forensicsMulti-hop wallet forensics for AI agents: traverse an address's ERC-20 counterparty graph across 1-3 hops and get the flow graph (nodes + edges), ranked counterparties (direction, tokens, activity) a…Doesn't say
  • chain_eventsOn-demand, decoded on-chain events for AI agents: query a contract's event logs on Base (eth_getLogs) and get normalized, human-readable events — Transfer, Approval, ERC-1155 TransferSingle/Batch, Un…Doesn't say
  • x402_seller_auditDeep audit of an x402/ACP seller before trusting it: give a seller wallet or domain and get a full report — on-chain settlement reputation (settlements, unique counterparties, wash-trade/sybil, OFAC)…Doesn't say
  • agent_clearance_packetSigned clearance packet an AI agent buys BEFORE a large capital move: one call fuses OFAC/sanctions + mixer screening, multi-hop fund-flow forensics (layering, concentration, hubs) and counterparty s…Doesn't say
  • agent_visibility_auditAudit how discoverable an x402 agent/seller is across the agent registries (CDP Bazaar, 402index): keyword-RELEVANCE rank per category (not raw settled-volume rank), a metadata-quality score of your…Doesn't say
  • agent_rank_checkQuick check of where an x402 seller ranks RIGHT NOW by keyword-relevance in the CDP Bazaar discovery (not the raw settled-volume rank the free explorers show): best rank + per-category-keyword rank i…Doesn't say
  • agent_passportMeasured-vs-declared reputation dossier for an AI agent, Sybil-corrected. Give an ERC-8004 agent id or wallet: reads the on-chain ERC-8004 Identity + Reputation registries on Base, computes the DECLA…Doesn't say

Audit history

  1. Nov 13Warnings

What we sent

Every request in this audit, with the answer and how long it took. We never send credentials and never call a tool.

RequestAnswerTime
initializeHTTP 200414 ms
initializedHTTP 202270 ms
tools/listHTTP 200247 ms
unknown-methodHTTP 200247 ms

Run this server, or disagree with the result?

Fix the issue and it shows in the next weekly audit, or email us to ask for a re-audit or to dispute a finding. Read how we audit for what each check means.