Next free-source huntWe check for new free data every weekday.
WeatherMCP serverFirst audited Nov 13, 2026

io.github.eltociear/tokenguard-mcp

Real-world data for agents: air quality, geocoding, quakes, holidays, web searchThe vendor's description, from its MCP Registry listing.

Passed, with 1 warningAudited Nov 13, 2026
  • Warning: 9 of 9 tools do not say whether they can change things.

Nothing failed, but there is something to know or fix. Public audit: we connect as an AI client would, list the tools and check what they say. We do not run them. How we audit

Does it work?
YesConnected in 111 ms.
Sign-up?
None neededIt answered without any account or key.
Can it change things?
Doesn't sayIts tools do not say whether they only read, so treat them as able to change things.
Endpointhttps://eltociear-tokenguard.hf.space/mcp

Source code Streamable HTTP · protocol 2025-06-18 · server version 1.2.0

What we checked, the evidence, and the tools it offers.

What we checked

Security

  • Passed: Connections are encrypted (HTTPS).

  • Passed: No hidden instructions found in tool text.

Safety labels

  • Warning: 9 of 9 tools do not say whether they can change things.

    MCP lets a server label each tool as read-only or destructive, so clients can ask the user before risky calls. Unlabelled tools are treated as able to change things.

    • paid_catalogue
    • air_quality
    • geocode
    • earthquakes
    • public_holidays
    • country_indicator
    • elevation
    • web_search
    • and 1 more

Tools

  • Passed: 9 tools listed.

  • Passed: Every tool describes its inputs with a valid schema.

Protocol

  • Note: Protocol version 2025-06-18.

  • Passed: The MCP handshake works (Streamable HTTP).

  • Passed: Unknown requests are refused.

Connection

  • Passed: The server responds.

Tools (9)

As the server describes them. The labels are the server's own: it says whether each tool only reads or can change things.

  • paid_catalogueList the paid API routes this same server offers, with prices and which ones need no input. The MCP tools here are free and general-purpose; the paid routes are specialised (on-chain token safety, li…Doesn't say
  • air_qualityCurrent air quality for a place: PM2.5, PM10, ozone, NO2, SO2, CO and dust, plus the US and European AQI and the US AQI band ('Good', 'Unhealthy'). Takes a place name — no coordinates needed. (Free.…Doesn't say
  • geocodeResolve a place name to coordinates, country, admin region, timezone, elevation and population. (Free. This server also sells a paid API — call `paid_catalogue` for the routes and prices; x402 over U…Doesn't say
  • earthquakesRecent earthquakes from the USGS feed — worldwide, or within a radius of a named place. Returns magnitude, depth, tsunami flag and felt reports. (Free. This server also sells a paid API — call `paid_…Doesn't say
  • public_holidaysPublic holidays for a country and year, with local names and a past/upcoming flag. (Free. This server also sells a paid API — call `paid_catalogue` for the routes and prices; x402 over USDC on Base,…Doesn't say
  • country_indicatorWorld Bank time series for a country: gdp, gdp_per_capita, population, inflation, unemployment, life_expectancy, co2_per_capita or internet_users. (Free. This server also sells a paid API — call `pai…Doesn't say
  • elevationGround elevation in metres for a place name. (Free. This server also sells a paid API — call `paid_catalogue` for the routes and prices; x402 over USDC on Base, no signup.)Doesn't say
  • web_searchSearch the live web and return ranked title/url/snippet results, through an automatic multi-engine failover chain. (Free. This server also sells a paid API — call `paid_catalogue` for the routes and…Doesn't say
  • read_urlFetch a URL and return its main content as clean Markdown, boilerplate stripped. (Free. This server also sells a paid API — call `paid_catalogue` for the routes and prices; x402 over USDC on Base, no…Doesn't say

Audit history

  1. Nov 13Warnings

What we sent

Every request in this audit, with the answer and how long it took. We never send credentials and never call a tool.

RequestAnswerTime
initializeHTTP 200111 ms
initializedHTTP 20284 ms
tools/listHTTP 20033 ms
unknown-methodHTTP 20033 ms

Run this server, or disagree with the result?

Fix the issue and it shows in the next weekly audit, or email us to ask for a re-audit or to dispute a finding. Read how we audit for what each check means.