Next free-source huntWe check for new free data every weekday.
OSINTMCP serverFirst audited Nov 13, 2026

io.github.huwhitememes/tollbooth

37 paid x402 MCP tools for OSINT, prediction markets, web intel, and agent security on Base USDC.The vendor's description, from its MCP Registry listing.

Passed, with 1 warningAudited Nov 13, 2026
  • Warning: 120 of 120 tools do not say whether they can change things.

Nothing failed, but there is something to know or fix. Public audit: we connect as an AI client would, list the tools and check what they say. We do not run them. How we audit

Does it work?
YesConnected in 3.6 s.
Sign-up?
None neededIt answered without any account or key.
Can it change things?
Doesn't sayIts tools do not say whether they only read, so treat them as able to change things.
Endpointhttps://agenttoll.dev/mcp

Streamable HTTP · protocol 2025-11-25 · server version 0.13.0

What we checked, the evidence, and the tools it offers.

What we checked

Security

  • Passed: Connections are encrypted (HTTPS).

  • Passed: No hidden instructions found in tool text.

Safety labels

  • Warning: 120 of 120 tools do not say whether they can change things.

    MCP lets a server label each tool as read-only or destructive, so clients can ask the user before risky calls. Unlabelled tools are treated as able to change things.

    • ping
    • scrape
    • detect_stack
    • extract_contacts
    • score_lead
    • check_agent_policy
    • find_agent_resource
    • validate_agent_manifest
    • and 112 more

Tools

  • Passed: 120 tools listed.

  • Passed: Every tool describes its inputs with a valid schema.

Protocol

  • Passed: The MCP handshake works (Streamable HTTP).

  • Passed: Protocol version 2025-11-25 (latest).

  • Passed: Unknown requests are refused.

Connection

  • Passed: The server responds.

Tools (120)

As the server describes them. The labels are the server's own: it says whether each tool only reads or can change things.

  • pingHealth check. Returns pong + server time + tool catalog.Doesn't say
  • scrapeFetch a URL and return clean structured content: title, description, meta tags, text content, headings, links, and tech stack signals. Works on HTML and JSON pages.Doesn't say
  • detect_stackFingerprint a URL for framework, analytics, hosting, payment, CRM, and site-platform signals.Doesn't say
  • extract_contactsExtract visible emails, phone-like strings, social links, and contact/about/pricing/careers URLs from a page.Doesn't say
  • score_leadScore a company domain for outbound fit using HTTPS, DNS, tech stack, contact paths, social links, platform, and copy depth.Doesn't say
  • check_agent_policyCheck robots.txt, llms.txt, security.txt, and agent.json for crawl/discovery signals before an agent touches a site.Doesn't say
  • find_agent_resourceSearch a small curated atlas of agent-useful APIs, self-hosted tools, payment rails, scraping helpers, and automation primitives.Doesn't say
  • validate_agent_manifestValidate an agent manifest for identity, endpoint, tools, pricing, and payment fields.Doesn't say
  • enrich_leadEnrich a company domain. Returns company name, description, detected tech stack, social media links, DNS records, platform detection (WordPress/Shopify/etc.), and contact page links. Useful for lead…Doesn't say
  • x402_market_radarCDP Bazaar radar for x402 builders: live catalog size, AgentToll ranks, keyword gaps, vertical competition, price samples, and next actions.Doesn't say
  • x402_rank_auditAudit one x402 resource across buyer keywords. Returns Bazaar rank, competitors above it, metadata defects, and fixes that can improve discovery.Doesn't say
  • mcp_safety_briefStatic risk brief for an MCP server, OpenAPI spec, or tool manifest before an agent connects it. Returns tool risk, PII and credential hints, allowlist advice, approval policy, and a user-facing safe…Doesn't say
  • x402_seller_readiness_auditAudit whether a paid x402 route is ready for agent buyers. Checks discovery metadata, price visibility, Base USDC terms, seller wallet, receipt language, tool descriptions, and approval copy.Doesn't say
  • mcp_approval_packGenerate the approval prompt and spend policy an agent should show before using a paid or risky tool. Returns maxPayment, seller checks, risk reasons, allowed fields, and what not to send.Doesn't say
  • insider_cluster_briefTurn recent SEC Form 4 filings into an insider-activity cluster brief. Signal intel only.Doesn't say
  • gov_contract_fit_briefScore federal contract awards against a service keyword, agency, or company domain. Returns incumbents, agencies, amounts, and pursuit notes.Doesn't say
  • regulatory_impact_briefSummarize fresh Federal Register and rulemaking signals for one sector with severity, source links, and action read.Doesn't say
  • polymarket_event_scanScan one live Polymarket negRisk event for fee-adjusted outcome-sum violations. Intelligence only; verify CLOB depth and resolution rules before acting.Doesn't say
  • polymarket_market_scanScan high-volume active Polymarket markets for resolution candidates and fee-adjusted YES+NO bundle violations. Intelligence only; verify live books and rules before acting.Doesn't say
  • cross_platform_arb_scanMatch live Polymarket and Kalshi markets for a topic and compare complementary asks after conservative fee estimates. Intelligence only; verify both rulebooks before acting.Doesn't say
  • agent_threat_intelQuery the OWASP Agentic Top 10 threat catalog (ASI01-ASI10). Returns threats, detection hints, mitigations, and mapped detection rule IDs.Doesn't say
  • mcp_supply_chain_iocsQuery known-malicious MCP packages, versions, C2 hosts, and email IOCs. The virus database for MCP.Doesn't say
  • agent_trifecta_scoreScore an agent's lethal trifecta risk (private data + untrusted content + outbound actions). Returns risk level, missing controls, and decomposition advice.Doesn't say
  • agent_security_policiesGet drop-in agent security policy templates by profile (coding-agent, browser-agent, payment-agent, research-agent).Doesn't say
  • geo_intervention_pulseComposite geo/military tension signal: GDELT + BBC/AlJazeera RSS + adsb.lol/mil + Polymarket correlation, 60min window, booster math (multi-source + thermal + vessel + mil-aircraft). Free sources.Doesn't say
  • geo_pulseLegacy alias for geo_intervention_pulse. Composite geopolitical intervention signal — GDELT + BBC + AlJazeera + ADS-B mil + prediction-market boosters (intervention signal pattern). Returns alert_lev…Doesn't say
  • flight_intelExec-jet + military aircraft intel — TEB/VNY/DCA geofence, tail filter, B-52/F-35/E-3 detection via adsb.lol open. M&A / defense Polymarket edge.Doesn't say
  • osint_research_packResearch pack literature discovery factory: GDELT + BBC RSS + HN Algolia + Reddit JSON in parallel, 4-layer verification (existence + recency + multi-source corr + allowlist), combined_score ranking.…Doesn't say
  • research_packLegacy alias for osint_research_pack. Multi-source OSINT research pack — GDELT + BBC + HN + Reddit, 4-layer verification layer (existence+recency+multi-source+domain allowlist) + combined relevance s…Doesn't say
  • scenario_verdictScenario engine seed→entity→3-scenario verdict.json + composite YES prob mapped to market question. Input raw seed text + question, get bear/base/bull scenarios + fair_price_hint.Doesn't say
  • weather_bias_scoreKalshi weather fix: Open-Meteo archive vs forecast bias, ensemble mean anomaly, ticker mapping HIGHNY/HIGHCHI/HIGHMIA. Free CC BY 4.0 feed.Doesn't say
  • weather_biasLegacy alias for weather_bias_score. Weather bias vs recent mean — uses Open-Meteo archive+forecast and ticker mapping for Kalshi HIGH* fade edge.Doesn't say
  • supply_chain_stressPort/chokepoint stress composite: CBP BWT gov API + GDELT choke mentions + AIS chokepoint heuristic + BTS/AAR hints, index 0-95. Trade lead 2-5d freight spike. Free gov no-key.Doesn't say
  • supply_stressLegacy alias for supply_chain_stress. Supply-chain stress index — CBP BWT + GDELT chokepoint mentions + AIS/MarineTraffic hint, port congestion for freight/commodity/middle_east Polymarket edge.Doesn't say
  • regulatory_pulseRegulatory pulse — SEC Atom RSS + openFDA adverse + USPTO TSDR + FCC OET + FAA registry hints for bio/tech Polymarkets. Returns events by org + provenance.Doesn't say
  • attention_momentumAttention momentum — HN Algolia + Reddit JSON velocity scoring, points/hr + momentum_score, viral flag for culture/pop/app-rank/YouTube/npm-dl Polymarkets. Proxies: pypistats, api.npmjs.org.Doesn't say
  • sec_8k_velocitySEC 8-K velocity — EFTS FullTextSearch + Atom current, 1h spike vs 24h mean >3x, Item 1.05/2.02/5.02 boost. Earnings/merger/legal prediction-market lead. 9/sec TokenBucket, UA CompanyName Email per 1…Doesn't say
  • fred_surprisesFRED rates surprise — DGS10 10Y + DGS2 2Y csv public-domain no-key, spread + inversion flag, delta scoring for FOMC Fed funds + rates markets. TokenBucket 2/s polite.Doesn't say
  • treasury_dtsTreasury DTS TGA — operating_cash_balance free gov public-domain, TGA close $B d/d delta, deposits/withdrawals enrichment. Liquidity / debt-ceiling / SPX direction edge, 2nd upstream.Doesn't say
  • openrouter_modelsOpenRouter model catalog — id, name, context_length, pricing, created. Cached 1h, auto-fetched via public API. For model routing decisions.Doesn't say
  • vat_validateEU VAT number validation via official VIES. Validity, legal name, registered address for any EU business VAT ID.Doesn't say
  • trade_flowsUN Comtrade trade flows: import/export values and partner breakdowns by reporter country, HS code and year.Doesn't say
  • fx_ecbEuropean Central Bank reference exchange rates via Frankfurter. Latest or historical.Doesn't say
  • worldbank_indicatorWorld Bank macro indicators by country: GDP, population, inflation and 1400+ series.Doesn't say
  • wiki_pageviewsWikipedia pageview analytics: per-article attention trends or project top-100 by day.Doesn't say
  • x402_rail_watchDated x402 settlement-status ledger with source evidence for each announced rail, plus a live ecosystem pulse, new entrants, and anchor watchlist. Separate shipped payment infrastructure from announc…Doesn't say
  • github_trendingGitHub trending repos — stars >20 + recent push, sorted by stars desc. Public GitHub Search API no-key. Momentum proxy for dev tooling / open source virality.Doesn't say
  • hn_frontpageHN frontpage live — Algolia front_page tag, dwell = points/(age_h+2). Cache 10min. Top stories sorted by dwell for attention-momentum edge.Doesn't say
  • usgs_quakeUSGS all-day earthquakes — mag, place, time, tsunami, felt, coords, depth. Public USGS GeoJSON no-key. Disaster / insurance / commodity market tail-risk pulse.Doesn't say
  • openaq_airOpenAQ air quality — PM2.5/PM10/NO2/O3 by city/country, lastUpdated. v3 API + v2 fallback. Env / health / geo pulse. For PM market disclaimers.Doesn't say
  • court_opinionsSearch US federal court opinions by keyword, court, date via CourtListener (Free Law Project). Keyless.Doesn't say
  • court_docketLook up a federal court docket by ID via CourtListener RECAP archive. Parties, filings, dates.Doesn't say
  • federal_registerSearch the daily Federal Register — proposed rules, final rules, presidential notices.Doesn't say
  • patents_searchFull-text patent search via Google Patents. Titles, assignees, dates, abstracts.Doesn't say
  • regulations_searchSearch open rulemakings and public dockets. Falls back to Federal Register if no API key.Doesn't say
  • search_papersSearch 226M+ academic papers across all fields with AI-ranked relevance via Semantic Scholar Graph API.Doesn't say
  • search_arxivSearch arXiv preprints in CS, physics, math, biology. Titles, authors, abstracts, categories.Doesn't say
  • search_pubmedSearch 37M+ biomedical papers via NCBI PubMed. PMIDs, titles, authors, journals.Doesn't say
  • clinical_trialsSearch 480K+ clinical studies via ClinicalTrials.gov v2. Status, sponsors, phases, results.Doesn't say
  • search_openalexSearch 250M+ works via OpenAlex with institution data, bibliometrics, citation counts.Doesn't say
  • drug_recallsSearch FDA drug/device/food enforcement recalls via openFDA. Severity, classification, recalling firm.Doesn't say
  • adverse_eventsSearch 20M+ FDA adverse drug event reports via openFDA. Patient outcomes, drugs, reactions.Doesn't say
  • product_recallsSearch CPSC consumer product recalls via saferproducts.gov. Hazards, manufacturers, remedies.Doesn't say
  • vehicle_recallsSearch NHTSA vehicle recalls by make, model, or VIN. Campaign numbers, defect descriptions.Doesn't say
  • drug_labelsSearch official FDA drug labels via openFDA. Dosage, warnings, contraindications, active ingredients.Doesn't say
  • wildfiresActive wildfire detections from NASA FIRMS satellites. Lat/lon, brightness, confidence, scan time.Doesn't say
  • weather_alertsActive NOAA NWS severe weather alerts — watches, warnings, advisories by state or zone.Doesn't say
  • tide_dataNOAA tide predictions and observed water levels for coastal stations.Doesn't say
  • space_weatherNOAA space weather — solar flares, geomagnetic storms, solar wind speed, Kp index.Doesn't say
  • water_levelsReal-time USGS river/stream flow and flood data. Gauge height, discharge, percentiles by state.Doesn't say
  • federal_spendingSearch $6T+ federal budget by agency, recipient, or keyword via USAspending.gov API.Doesn't say
  • national_debtUS national debt to the penny via Treasury FiscalData. Total debt, debt by instrument.Doesn't say
  • federal_grantsSearch Grants.gov for open federal funding opportunities. Agency, eligibility, deadline.Doesn't say
  • nonprofit_filingsSearch nonprofit IRS 990 filings via ProPublica Nonprofit Explorer. Revenue, expenses, exec comp.Doesn't say
  • economic_indicatorsGDP, CPI, unemployment, trade data via World Bank API. Multi-year time series.Doesn't say
  • lobbying_recordsSearch FEC lobbying disclosure records. Lobbyists, clients, amounts, issues lobbied.Doesn't say
  • edgar_filingsSearch SEC EDGAR full-text filings by company, form type, or ticker.Doesn't say
  • insider_tradesSEC Form 4 insider transactions.Doesn't say
  • token_stock_quoteLive DEX quotes for tokenized equities (Coinbase B20 stock tokens on Base).Doesn't say
  • fred_seriesFRED economic data series.Doesn't say
  • combinatorial_arbPolymarket negRisk combinatorial arbitrage scan.Doesn't say
  • orderbook_imbalancePolymarket CLOB orderbook imbalance.Doesn't say
  • smart_moneyPolymarket leaderboard and top trader activity.Doesn't say
  • trending_marketsTop trending Polymarket markets by 24h volume with current prices, liquidity, and volume data.Doesn't say
  • odds_feedNormalized live odds across Polymarket and Kalshi in one response: YES/NO prices, spreads, volume, and liquidity.Doesn't say
  • volume_analyticsTop Polymarket markets ranked by 24h volume with liquidity, price, and 24h change.Doesn't say
  • resolution_historyRecently resolved Polymarket markets with final outcomes, resolution dates, and volumes.Doesn't say
  • kalshi_marketsLive Kalshi market list with bid/ask spreads, volume, open interest, and close dates.Doesn't say
  • rebalance_arb_scanScan Polymarket for single-market rebalance arbitrage: YES+NO pricing violations where guaranteed profit exists. Returns long and short opportunities with confidence scores.Doesn't say
  • cve_searchSearch NIST NVD CVE database.Doesn't say
  • company_registrySearch company registries.Doesn't say
  • reddit_searchSearch Reddit.Doesn't say
  • github_repo_intelGitHub repo intelligence.Doesn't say
  • currency_ratesLive currency exchange rates.Doesn't say
  • business_daysBusiness days calculator.Doesn't say
  • judges_searchSearch federal and state judges.Doesn't say
  • trademarks_searchSearch USPTO trademarks.Doesn't say
  • disease_outbreaksCDC disease outbreak data.Doesn't say
  • food_safetyopenFDA food enforcement.Doesn't say
  • federal_contractsFederal contracts via USAspending.gov.Doesn't say
  • paper_detailsPaper metadata via Semantic Scholar.Doesn't say
  • citation_graphCitation graph via Semantic Scholar.Doesn't say
  • gen_video_intelLive Banodoco practitioner-feed intelligence for generative video and image workflows: Wan, VACE, LTX, ComfyUI, FLUX 3, Seedance, Kling, Hunyuan, Qwen Image, settings, comparisons, and gotchas. Intel…Doesn't say
  • model_settings_lookupCommunity-tested settings for generative video and image models: CFG, steps, denoise, fps, resolution, sampler, LoRA, ComfyUI, fp8/quantization, and training notes.Doesn't say
  • space_weather_kpCurrent planetary K-index and geomagnetic storm conditions.Doesn't say
  • weather_forecast_gridDetailed NWS 7-day forecast for US lat/lon.Doesn't say
  • weather_current_globalCurrent weather for any global coordinate.Doesn't say
  • aurora_forecastNOAA aurora oval forecast.Doesn't say
  • marine_conditionsMarine conditions for any ocean coordinate.Doesn't say
  • air_quality_indexPM2.5, UV index, pollutants for any location.Doesn't say
  • postal_code_lookupCity, state, geo for postal/zip codes (60+ countries).Doesn't say
  • ip_geolocationGeolocate an IP address.Doesn't say
  • timezone_currentCurrent time for any IANA timezone.Doesn't say
  • airport_statusAirport details by ICAO code.Doesn't say
  • dns_records_lookupDNS resolution via Cloudflare DoH.Doesn't say
  • isbn_book_lookupBook metadata by ISBN via Open Library.Doesn't say
  • crypto_price_simpleCryptocurrency price via CoinGecko.Doesn't say
  • btc_address_balanceBitcoin address balance and tx history.Doesn't say
  • btc_mempool_feesRecommended Bitcoin network fees.Doesn't say
  • food_recall_checkSearch openFDA food enforcement and recalls.Doesn't say

Audit history

  1. Nov 13Warnings

What we sent

Every request in this audit, with the answer and how long it took. We never send credentials and never call a tool.

RequestAnswerTime
initializeHTTP 2003636 ms
initializedHTTP 2021138 ms
tools/listHTTP 200115 ms
unknown-methodHTTP 20086 ms

Run this server, or disagree with the result?

Fix the issue and it shows in the next weekly audit, or email us to ask for a re-audit or to dispute a finding. Read how we audit for what each check means.