Next free-source huntWe check for new free data every weekday.
FinancialMCP serverFirst audited Nov 13, 2026

YRUZ x402 tools

Pay-per-call x402 tools: package advisories, EU tenders, Wikidata facts, promo board, web, cryptoThe vendor's description, from its MCP Registry listing.

Passed public checksAudited Nov 13, 2026

Every public check ran and passed. Public audit: we connect as an AI client would, list the tools and check what they say. We do not run them. How we audit

Does it work?
YesConnected in 469 ms.
Sign-up?
None neededIt answered without any account or key.
Can it change things?
YesSome tools say they can change things. Your AI client should ask you first.
Endpointhttps://yruz.one/mcp/x402

Source code Website Streamable HTTP · protocol 2025-11-25 · server version 1.0.0

What we checked, the evidence, and the tools it offers.

What we checked

Security

  • Passed: Connections are encrypted (HTTPS).

  • Passed: No hidden instructions found in tool text.

Safety labels

  • Note: 3 tools are labelled as able to change things.

    Expected for tools that send, write or buy. Your AI client should ask before calling them.

    • promo_create_listing
    • promo_renew_listing
    • promo_takeover_top_spot
  • Passed: Every tool says whether it only reads or can change things.

Tools

  • Passed: 56 tools listed.

  • Passed: Every tool describes its inputs with a valid schema.

Protocol

  • Passed: The MCP handshake works (Streamable HTTP).

  • Passed: Protocol version 2025-11-25 (latest).

  • Passed: Unknown requests are refused.

Connection

  • Passed: The server responds.

Tools (56)

As the server describes them. The labels are the server's own: it says whether each tool only reads or can change things.

  • site_auditWebsite audit in one call: TLS certificate, security headers, HTTPS redirect, HTTP/2 and HTTP/3, compression, response time, redirects, SEO tags and AI-agent readiness (llms.txt, robots rules for AI…Read-only
  • web_extractFetch any public web page and return its main content as clean Markdown (navigation, scripts and boilerplate removed) with title, description, language, canonical URL, author, publish date, headings,…Read-only
  • company_enrichCompany enrichment from a domain or email in one call: company name, description, logo, favicon, social profiles (LinkedIn, X, GitHub, Facebook, Instagram, YouTube ...), contact emails and phones pub…Read-only
  • url_safety_checkShould an agent open, sign or pay this link? Follows every redirect and checks the final site: domain age (RDAP), TLS certificate age and validity, look-alike and punycode domains, brand impersonatio…Read-only
  • domain_intelDomain intelligence in one call: DNS records (A, AAAA, MX, NS, TXT, CAA, SOA), email security (SPF with lookup count, DMARC policy, MTA-STS, TLS-RPT, BIMI, DKIM on common selectors), registration fro…Read-only
  • weather_forecastWeather for any place on Earth: current conditions (temperature, feels-like, wind, humidity, pressure, cloud, precipitation), the next 48 hours hour by hour and a 7-day forecast with highs, lows and…Read-only
  • link_previewLink preview of any URL in one call: title, description, site name, canonical URL, Open Graph and Twitter card fields, preview image, favicon, theme color, oEmbed endpoint and JSON-LD types. Use it t…Read-only
  • broken_linksFind broken links on a web page: fetches the page, collects its links (internal and external) and checks up to 50 of them in parallel, reporting status code, redirect target and response time for eac…Read-only
  • x402_endpoint_checkValidate any x402 endpoint the way buyer agents see it: calls it unpaid, decodes the 402 challenge (v2 PAYMENT-REQUIRED header and v1 JSON body), checks every offer (scheme, network, asset, amount, p…Read-only
  • uptime_checkIs it up, right now, from the internet: HTTP status, final URL after redirects, DNS, connect, TLS and time-to-first-byte timings, HTTP version, response size, content type, server, TLS certificate da…Read-only
  • wallet_balanceUSDC and gas balance of any Solana or Base address, read from the chain: USDC amount, SOL or ETH for fees, whether the USDC account exists, and whether the wallet can pay a given x402 price. Lets an…Read-only
  • crypto_priceLive prices in one fast call for up to 25 assets: any coin by CoinGecko id or ticker symbol (btc, eth, sol, usdc...) and any Solana token by mint address. Returns price, 24h change, 24h high/low, mar…Read-only
  • crypto_trendingWhat the crypto market is doing right now: the most searched coins, the top 24h gainers and losers among the 250 largest coins, global market cap and BTC dominance, and the trending Solana tokens of…Read-only
  • solana_token_checkSafety check of any Solana token before an agent buys it: name, symbol, supply, decimals, token program and extensions, mint and freeze authority, mutable metadata, top-10 holder concentration, holde…Read-only
  • solana_portfolioEvery token a Solana wallet holds, valued in USD: SOL and all fungible SPL and Token-2022 balances with symbol, name, amount, price and value, sorted by value, plus the total portfolio value and the…Read-only
  • solana_tx_explainDecode any Solana transaction into plain language: type (swap, transfer, NFT sale, mint ...), the program or DEX used, who sent what to whom with token symbols and amounts, SOL balance changes, fee a…Read-only
  • network_feesWhat a transaction costs right now: Solana priority fee levels (low to very high, micro-lamports per compute unit) and the USD cost of a typical transfer and swap, plus Base gas price, base fee and t…Read-only
  • deps_get_packageOne package from npm, PyPI or Packagist: latest version, description, declared licence, repository, homepage, deprecation or yanked status, version count, first and last publish date, declared depend…Read-only
  • deps_get_version_historyRelease history of a package in ecosystem order (node-semver, PEP 440, Composer): every version with publish time, prerelease flag, deprecation or yank with its reason, which one is latest, release c…Read-only
  • deps_compare_releasesWhat changes between two releases of a package, from registry metadata: dependencies added, removed and re-ranged, licence change, deprecation, publish dates and the releases in between, and which OS…Read-only
  • deps_check_advisoriesIs this exact package version affected by a published advisory? Queries OSV (GitHub Advisory Database, PyPA, and more) for the version and returns status (affected or not_affected_by_queried_advisori…Read-only
  • deps_batch_checkOSV advisory check of 2-100 package versions in one call, mixed ecosystems: status per package version, advisory ids with summary, severity and fixed versions. Priced 0.002 USDC per unique package ve…Read-only
  • deps_get_dependency_treeBounded transitive dependency graph of an npm package version: every node with the declared range, the resolved version (highest published version satisfying the range, as a fresh install without a l…Read-only
  • deps_audit_projectAudit a project in one call: send package-lock.json (v2/v3), package.json, composer.lock, composer.json or requirements.txt. Lockfiles give exact direct and transitive versions; manifest ranges are r…Read-only
  • deps_get_advisoryOne advisory from OSV by its id or alias (GHSA-..., CVE-..., PYSEC-..., RUSTSEC-...): summary, details, severity (CVSS vectors), aliases, published and modified dates, withdrawn flag, every affected…Read-only
  • deps_get_changesEverything that changed for a package since a date: releases published, deprecations and yanks among them, the current latest, advisories published or modified for the package, and attribute changes…Read-only
  • deps_monitor_checkOne bounded monitoring check of a package: the current fingerprint of its watched attributes (latest version, licence, deprecation, version count, advisories on the latest release), changed true or f…Read-only
  • tenders_searchSearch public tenders and procurement notices published in TED (EU Official Journal S, all EU/EEA countries plus EU-funded procurement such as Serbia): keywords, buyer country, CPV code, contracting…Read-only
  • tenders_get_noticeOne TED notice by its publication number, normalized: notice and form type, lifecycle stage, title and description, buyer with identifiers, CPV codes, procedure type, place of performance, estimated…Read-only
  • tenders_get_historyThe lifecycle of a procurement procedure from one of its notices: every TED notice of the same procedure in order (prior information, call, corrigenda, award, contract modification), the change event…Read-only
  • tenders_get_deadlinesOpen calls for tenders whose submission deadline falls in the next 1-90 days, soonest first, with the earliest qualifying lot deadline, buyer, CPV, estimated value and links. Filter by keywords, buye…Read-only
  • tenders_get_awardsPublished contract award results matching a supplier, buyer, country, CPV or date range: each award with winners, their country and size, award and tender values with currency, decision and contract…Read-only
  • tenders_get_authorityProcurement profile of a contracting authority from its TED notices: notice counts by type (calls, awards, amendments, prior information), the most recent notices, CPV divisions and procedure types i…Read-only
  • tenders_get_supplier_historyAward history of a supplier from TED result notices that name it as a winner: total award notices, a dated timeline of the most recent awards with buyer, country, CPV and values as published, buyers…Read-only
  • tenders_get_changesWhat happened since a date (up to 92 days back) for your filters: counts and the newest notices of each kind, new calls for tenders, amendments and corrigenda with their change reasons, award results…Read-only
  • tenders_monitor_checkOne bounded monitoring check of a procurement procedure from any of its TED notices: the current fingerprint of its watched state (notices in the procedure, stage, lot deadlines, estimated value, win…Read-only
  • reality_searchFind entities on Wikidata by name or alias, with an optional type filter (company, organization, place, software, person): id, label, description, types, the matched name, Wikipedia sitelink count as…Read-only
  • reality_get_entityNormalized profile of one entity: label, description, aliases, types, official identifiers (LEI, ticker, VIAF, OpenCorporates, national registers ...), and the core facts for its kind (inception, cou…Read-only
  • reality_get_historyTime-aware history of an entity: the source's revision log (when, which properties, which kind of edit), when the entity was created, and with as_of the facts the source stated at that past date comp…Read-only
  • reality_compareTwo entities side by side: for every core property the current values of each and whether they are the same, overlap, differ or exist on one side only; shared identifiers (a sign of a duplicate recor…Read-only
  • reality_resolve_entityEntity resolution for a company or organization: from a name plus optional website domain, country, LEI or type, the candidate Wikidata entities with a transparent score, a confidence band (determini…Read-only
  • reality_get_evidenceEvidence bundle for an entity: for each requested property (default: its core facts) every statement with rank, qualifiers and all its references (stated in, reference URL, title, publication and ret…Read-only
  • reality_get_conflictsSource-conflict report for an entity: properties that should hold one current value but hold several (and whether a preferred rank settles it), time series with different values for the same date, de…Read-only
  • reality_monitor_checkOne bounded monitoring check of an entity: the current fingerprint of its core facts (country, headquarters, website, CEO, employees, revenue, population, version ... by kind), changed true or false…Read-only
  • promo_create_listingList a link, API, x402 endpoint, MCP server or dataset on the YRUZ x402 Promo Board for exactly 24 hours (directory, leaderboards, machine-readable catalogue). Send title and url; category and type a…Can change things
  • promo_renew_listingAdd one more 24-hour campaign to your Promo Board listing, starting when the current one ends. Price: 0.01 USDC per call, paid with x402 (USDC on Base or Solana, no account, no API key); invalid inpu…Can change things
  • promo_takeover_top_spotTake over the GLOBAL TOP LINK of the YRUZ Promo Board for 24 hours with your live listing. The price is the server minimum (current top price plus the increment), quoted exactly in the 402; a stale q…Can change things
  • get_exampleInstructions for any paid YRUZ tool: its parameters (required and optional), a valid call, the exact price rule, the payment steps and the response shape (field names and types). No answer data. Pass…Read-only
  • promo_search_listingsDiscovery: search the YRUZ Promo Board listings (live by default) with their 24 h campaign, countdown and top-link status. Same data as GET https://yruz.one/api/promo/listingsRead-only
  • promo_get_featuredDiscovery: the current GLOBAL TOP LINK of the YRUZ Promo Board and the next takeover minimum. Same data as GET https://yruz.one/api/promo/featuredRead-only
  • promo_get_leaderboardDiscovery: every Promo Board ranking (most expensive active link, highest takeover, lifetime spend, most renewed, trending, category leaders) with its definition. Same data as GET https://yruz.one/ap…Read-only
  • promo_get_listingDiscovery: one Promo Board listing with its campaigns and takeovers. Same data as GET https://yruz.one/api/promo/listingRead-only
  • promo_get_pricingDiscovery: current Promo Board prices (listing, renewal, takeover minimum), rails and refund policy. Same data as GET https://yruz.one/api/promo/pricingRead-only
  • promo_get_campaign_historyDiscovery: Promo Board takeover and campaign history, newest first. Same data as GET https://yruz.one/api/promo/historyRead-only
  • yruz_list_servicesDiscovery: the DependencyPulse, TenderGraph and RealityGraph tasks with their task ids, prices and billing units, limits, sources, freshness, MCP tool names and the x402 payment rails (v1 and v2, exa…Read-only
  • yruz_get_source_statusDiscovery: every public source behind the data products (npm, PyPI, Packagist, OSV, TED, Wikidata) with licence, attribution, coverage and its measured health: last success, last failure and failure…Read-only

Audit history

  1. Nov 13Passed

What we sent

Every request in this audit, with the answer and how long it took. We never send credentials and never call a tool.

RequestAnswerTime
initializeHTTP 200469 ms
initializedHTTP 202165 ms
tools/listHTTP 200474 ms
unknown-methodHTTP 200168 ms

Run this server, or disagree with the result?

Fix the issue and it shows in the next weekly audit, or email us to ask for a re-audit or to dispute a finding. Read how we audit for what each check means.