Next free-source huntWe check for new free data every weekday.
FinancialMCP serverFirst audited Nov 13, 2026

US Company Intelligence for AI Agents (SEC EDGAR, x402)

SEC EDGAR company briefs for agents: cited synthesis, XBRL metrics. x402/USDC, no account.The vendor's description, from its MCP Registry listing.

Passed, with 1 warningAudited Nov 13, 2026
  • Warning: 72 of 72 tools do not say whether they can change things.

Nothing failed, but there is something to know or fix. Public audit: we connect as an AI client would, list the tools and check what they say. We do not run them. How we audit

Does it work?
YesConnected in 220 ms.
Sign-up?
None neededIt answered without any account or key.
Can it change things?
Doesn't sayIts tools do not say whether they only read, so treat them as able to change things.
Endpointhttps://api.x-402.online/mcp

Website Streamable HTTP · protocol 2025-11-25 · server version 1.0.0

What we checked, the evidence, and the tools it offers.

What we checked

Security

  • Passed: Connections are encrypted (HTTPS).

  • Passed: No hidden instructions found in tool text.

Safety labels

  • Warning: 72 of 72 tools do not say whether they can change things.

    MCP lets a server label each tool as read-only or destructive, so clients can ask the user before risky calls. Unlabelled tools are treated as able to change things.

    • search_news
    • extract
    • extract_verified
    • search
    • amazon
    • llm_pro
    • render
    • agent_task
    • and 64 more

Tools

  • Passed: 72 tools listed.

  • Passed: Every tool describes its inputs with a valid schema.

Protocol

  • Passed: The MCP handshake works (Streamable HTTP).

  • Passed: Protocol version 2025-11-25 (latest).

  • Passed: Unknown requests are refused.

Connection

  • Passed: The server responds.

Tools (72)

As the server describes them. The labels are the server's own: it says whether each tool only reads or can change things.

  • search_newsGet fresh headlines about a topic, with source and age. Fresh news search (Google News via Serper): latest headlines with source, date, snippet. Great for crypto/market/current-events agents. Query:…Doesn't say
  • extractRead the main content of a page your own crawler cannot reach, as clean markdown. Send a URL and receive the main content of the page as clean markdown, stripped of navigation, advertising and boiler…Doesn't say
  • extract_verifiedRead a page and get a deterministic verdict on whether the retrieval can be trusted, with evidence. PRIVATE BETA. Verified browser-based web content retrieval for AI agents. Same retrieval as POST /v…Doesn't say
  • searchGet ranked web results for a query. Real Google web search: top 10 organic results, answer box and knowledge graph, in one call. STANDARD tier, a useful single-step result. Query: ?q=&gl=&hl= — $0.01…Doesn't say
  • amazonGet an Amazon product's title, price and availability by ASIN or search term. Look up an Amazon product by ASIN or search term: title, current price, availability, rating, review count and main image…Doesn't say
  • llm_proGet a long completion with a large output budget, same engine as /v1/llm. Long-form LLM inference: same engine as /v1/llm with a four times larger output budget, up to 8000 tokens, for answers the ch…Doesn't say
  • renderGet the full HTML of a page after its JavaScript has run, as a browser sees it. Send a URL and receive the complete HTML of the page after JavaScript execution, exactly as a browser would see it. The…Doesn't say
  • agent_taskGive an objective and a budget; get a verified result assembled from several capabilities, for one payment. Give an objective, a budget and your requirements; Nexora selects the capabilities, execute…Doesn't say
  • understandAsk a question about a web page and get a verified answer with the extracts that back it. Give a web page and a question, get a verified answer instead of raw text. The page is fetched from a residen…Doesn't say
  • solveSend a task in plain words and let the router pick and run the right capability. One endpoint for any capability. Send a task in plain words, or name a capability and its input, and the gateway resol…Doesn't say
  • us_briefAsk about any US public company and get the answer, not the raw filings. One call returns a summary where every claim cites where it came from, the key points, and the questions the SEC data does not…Doesn't say
  • transcribeTranscribe the actual audio of a YouTube, TikTok or Instagram video with Whisper large-v3. Not caption scraping: the audio is downloaded and run through speech recognition, so it works on videos with…Doesn't say
  • proxy_1gbGet a working HTTP/HTTPS proxy on a real French home line (Caribbean, Outremer Telecom) with 1 GB of traffic, as a key you use in curl -x, valid 30 days. Buy 1 GB of French West Indies residential pr…Doesn't say
  • proxy_5gbSame residential exit as /v1/proxy/1gb with 5 GB of traffic at 3.00 USD per GB, one key, valid 30 days. Buy 5 GB of French West Indies residential proxy bandwidth at 3.00 USD per gigabyte and receive…Doesn't say
  • proxy_20gbSame residential exit with 20 GB of traffic at 2.60 USD per GB, one key, valid 30 days. Buy 20 GB of French West Indies residential proxy bandwidth at 2.60 USD per gigabyte, the best rate in the rang…Doesn't say
  • screenshotCapture a PNG of a page as it renders. Send a URL and receive a PNG screenshot of the fully rendered page, captured by a real Chromium browser exiting through a French residential IP. JavaScript is e…Doesn't say
  • pdfTurn a web page into a PDF document. Send a URL and receive the page as a PDF document, rendered by a real Chromium browser exiting through a French residential IP. JavaScript runs before printing, s…Doesn't say
  • fr_procedures-collectivesIs this French company in insolvency proceedings? Returns a synthetic status, the full history of court judgments (safeguard, receivership, liquidation) and a registry deregistration flag, taken from…Doesn't say
  • fr_analyse-immo_partialGet price per square metre and recent sales around a French address. Lite property analysis for a French address: median price per square metre in the area, estimated value and an investment score. E…Doesn't say
  • fr_kybKnow-your-business dossier on a French company, assembled from official registries for compliance and onboarding: verified legal identity, company form and registration, directors and beneficial owne…Doesn't say
  • us_companyResolve a ticker or CIK to a US company's registered identity. Profile of a US public company from SEC EDGAR: legal name, central index key, ticker symbols, exchange listings, standard industrial cla…Doesn't say
  • chain_blockGet the latest Base block with its age in seconds, base fee and gas used. The latest Base block: number, hash, timestamp, age in seconds (so you know the node is not lagging), base fee, gas used. Pub…Doesn't say
  • chain_gasGet the current Base gas price and the ETH cost of an ETH, ERC-20 or x402 USDC transfer at that price. Current Base gas: gas price, base fee, priority fee, and the ETH cost of an ETH transfer, an ERC…Doesn't say
  • chain_balanceGet ETH, USDC and up to ten ERC-20 balances of one address in a single call, human-readable. ETH plus USDC plus up to ten ERC-20 balances of one address in a single call, decimals resolved, amounts h…Doesn't say
  • chain_tokenGet an ERC-20's name, symbol, decimals, total supply, holder count and USD rate in one call. An ERC-20 on Base in one call: name, symbol, decimals, total supply, USD price, liquidity and icon from De…Doesn't say
  • chain_allowanceGet an ERC-20 allowance with the owner's balance and a sufficiency verdict for the amount you plan to pull. ERC-20 allowance of a spender on an owner (USDC by default), with the owner's balance and,…Doesn't say
  • chain_txGet a transaction's status, parties, fee and every ERC-20 transfer inside it, decoded. A Base transaction by hash: status, block, from, to, value, fee, method, and every ERC-20 transfer inside it dec…Doesn't say
  • social_searchSearch Hacker News and Lemmy posts by query, sort and time window, merged, with score, comments, permalink and excerpt. Community search across Hacker News and Lemmy in one call, no key: posts by que…Doesn't say
  • social_threadGet one Hacker News or Lemmy thread: the post with its text and the comments flattened with depth and score. One community thread by id from /v1/social/search (hn:<id> or lemmy:<id>): the post with i…Doesn't say
  • geo_forwardTurn an address into coordinates: BAN for France (INSEE code, score), OpenStreetMap elsewhere. Address to coordinates: for France the official BAN registry (house number, street, postcode, city, INSE…Doesn't say
  • geo_reverseTurn coordinates into the nearest postal address: BAN in France, OpenStreetMap elsewhere. Coordinates to the nearest address: BAN in France (with INSEE code), Nominatim elsewhere. Query: ?lat=48.8698…Doesn't say
  • crypto_newsCrypto and blockchain news from four newsrooms in one call (Cointelegraph, Decrypt, The Block, CoinDesk), deduplicated and sorted newest first: title, link, publication time, summary and source. Opti…Doesn't say
  • eu_mica-checkIs this crypto firm authorised under MiCA in the EU? One call checks the official ESMA register of crypto-asset service providers (CASP) by company name or LEI: authorised or not, home member state,…Doesn't say
  • vin_decodeDecode a vehicle identification number (VIN) into make, model, model year, trim, body class, engine (cylinders, displacement, fuel, power), drive type, transmission and assembly plant, from the offic…Doesn't say
  • wiki_summaryThe plain-language summary of a Wikipedia article in any language edition: title, short description, lead extract, canonical URL, thumbnail and coordinates when the subject has them. Falls back to th…Doesn't say
  • url_unwrapTrace the redirect chain of a URL to its final destination without downloading page bodies: every hop with its status code, time and Location header, the final URL, whether the domain changed, and lo…Doesn't say
  • markets_predictionOpen prediction markets from Polymarket and Kalshi in one call: question, outcome probabilities, 24 h volume, liquidity, closing time and link, sorted by volume, with an optional keyword filter. Quer…Doesn't say
  • chain_ensENS name resolution in both directions: an .eth name to its address, or an address to its primary ENS name, with the avatar when set. Query: ?name=vitalik.eth or ?address=0xd8dA… — $0.005000/call, pa…Doesn't say
  • chain_abiThe verified ABI of a smart contract on any EVM chain from Sourcify: function signatures, event names, contract name, compiler version and proxy implementations, plus the full ABI JSON ready for a cl…Doesn't say
  • route_directionsPoint-to-point directions between 2 and 10 stops by car, bike or on foot: total and per-leg distance and travel time, snapped stops, route geometry as GeoJSON or polyline Point-to-point directions be…Doesn't say
  • apify_preflightVet an Apify actor before you pay to run it: verdict, 0-100 score, 30-day run success and timeout rates, last run and build age, deprecation, users, rating and current pricing Vet an Apify actor befo…Doesn't say
  • publishHost a generated HTML page on a permanent unguessable link for up to 30 days: static HTML, inline CSS and SVG render; scripts, forms and external requests are blocked Host a generated HTML page (repo…Doesn't say
  • classifyAssign one of 2 to 12 supplied labels to each of up to 20 short messages, with a confidence; labels outside the supplied list are never returned Route short messages to labels you supply: up to 20 me…Doesn't say
  • callbacksA temporary public webhook URL: give it to any service, then long-poll the events that arrived (method, query, headers, body). Free to receive and read, up to 100 events for 1 to 24 hours A temporary…Doesn't say
  • perps_stock-gapsReturn, per stock ticker, the Hyperliquid HIP-3 perp mark and oracle, the reference stock price and the Solana xStock price, with every pairwise gap in basis points and funding Gap table for Hyperliq…Doesn't say
  • fx_ratesOfficial ECB foreign exchange reference rates for about 30 currencies, today or on any past date since 1999, from any base, with amount conversion Official ECB foreign exchange reference rates for ab…Doesn't say
  • stablecoinsStablecoin market in one route: top stablecoins by supply with peg price, deviation and 24h/7d supply change, one coin's peg health with its top chains, or stablecoin supply per blockchain Stablecoin…Doesn't say
  • crypto_marketGlobal crypto market snapshot: total market cap and 24h change, 24h volume, bitcoin dominance, USD stablecoin supply and share, assets tracked, distance from all-time high Global crypto market snapsh…Doesn't say
  • crypto_funding-rateLive perpetual futures funding rates for up to 10 coins from OKX: rate, annualized rate, which side pays, interval, next funding time and bounds Live perpetual futures funding rates for up to 10 coin…Doesn't say
  • token_price-historyToken price history in USD by CoinGecko id or chain:address: a 1-365 day time series with change %, high and low, or the price at an exact past date Token price history in USD for any coin by CoinGec…Doesn't say
  • site_agent-readinessAgent readiness report for a website: 21 read-only checks over access, legibility, transactability, trust and outcome, a 0-100 score, per-pillar scores, each verdict with its evidence, a prioritized…Doesn't say
  • token_verdictRisk verdict on a Base token: grade, 0-100 risk score from weighted and explained flags, honeypot simulation, taxes, owner powers, liquidity, holders, pair age, plus a one-liner and a short take Risk…Doesn't say
  • web_tablesTurn every table on a page into JSON rows you can compute on. Every HTML table on a page as JSON rows, with headers detected and captions kept. Fetched through a French residential IP with a real Chr…Doesn't say
  • web_jsonldRead the structured data a page declares about itself: products, articles, events, organizations. The structured data a page declares about itself: every JSON-LD block parsed, the schema.org types fo…Doesn't say
  • web_contactsCollect the emails, phone numbers and social profiles a page visibly publishes. Emails, phone numbers and social profile links visibly published on a page, read from the rendered DOM and mailto: and…Doesn't say
  • web_pricesFind the current prices shown on a product or listing page, with currency and context. Every monetary amount found on a page with its currency and surrounding context, plus the schema.org Offer price…Doesn't say
  • web_changedTell whether a page changed since the last time you read it. Has a page changed since you last read it? Send a URL and the content_sha256 you kept from a previous call; get back changed: true or fals…Doesn't say
  • email_verifyCheck whether an email address is well-formed and its domain can receive mail, before you send. Five DNS checks on an email address, no message sent: syntax, MX presence and hosts, SPF record, DMARC…Doesn't say
  • domain_healthCheck whether a domain is reachable and healthy: DNS, certificate, redirects, security headers. One call on a domain: A, AAAA, NS, MX and SPF records; the TLS certificate with issuer, expiry and days…Doesn't say
  • x402_inspectCheck that an x402 endpoint still returns a valid payment challenge, and read its price and recipient. Probe an x402 endpoint and report whether it still returns a valid payment challenge: HTTP statu…Doesn't say
  • chain_addressSee the USDC an address received and sent on Base, with x402 settlements identified. ERC-20 transfers of an address on Base, incoming and outgoing, with the x402 settlements identified by their EIP-3…Doesn't say
  • search_sourcesSearch a topic and get the full content of the best pages, in one call. Search, then read the top results, in one call: ranked results from a real web search, and for each of the top pages its main c…Doesn't say
  • web_headingsThe document outline of a page: every heading with its level and anchor, in order. Body: {url}. — $0.005000/call, paid per request via x402 (USDC). Use when asked: "extract headings from this article…Doesn't say
  • web_formsEvery form on a page with its action, method and fields (name, type, label, required, options), so an agent knows what a page asks for before interacting. Read only: nothing is submitted. Body: {url}…Doesn't say
  • web_imagesEvery image on a page with its resolved URL, alt text and dimensions, plus the social preview image. Body: {url}. — $0.005000/call, paid per request via x402 (USDC). Use when asked: "list the images…Doesn't say
  • web_navigationThe navigation structure of a site as seen on a page: header, footer and nav zones with their links and labels. Body: {url}. — $0.005000/call, paid per request via x402 (USDC). Use when asked: "get a…Doesn't say
  • briefGet a short news briefing on a topic where each point cites its numbered source. Send a topic and receive a sourced news briefing in one call: fresh headlines are collected, then summarised into a st…Doesn't say
  • llmGet a short completion from a capable model, paid per call, with a bounded output of 2000 tokens. LLM inference pay-per-call, no account, no API key: prompt in, completion out (DeepSeek v4, up to 200…Doesn't say
  • imageTurn a text prompt into a 1024x1024 JPEG in about four seconds. Text-to-image generation pay-per-call, no account and no API key: send a prompt, receive a 1024x1024 JPEG as a base64 data URL in about…Doesn't say
  • visionAnswer a question about an image, or describe it, from a URL or base64. Image understanding pay-per-call, no account and no API key: send an image URL (or base64) and an optional question, receive a…Doesn't say
  • sms_numberRent a real mobile phone number to receive an SMS or a one-time password. The number is a physical SIM in a handset we operate, not a virtual or VoIP line, so it passes the carrier checks that reject…Doesn't say
  • sms_inboxRead the messages received by a phone number rented through /v1/sms/number: sender, body, and reception time, returned as structured data so an agent can extract a verification code without human hel…Doesn't say

Audit history

  1. Nov 13Warnings

What we sent

Every request in this audit, with the answer and how long it took. We never send credentials and never call a tool.

RequestAnswerTime
initializeHTTP 200220 ms
initializedHTTP 202115 ms
tools/listHTTP 20070 ms
unknown-methodHTTP 20056 ms

Run this server, or disagree with the result?

Fix the issue and it shows in the next weekly audit, or email us to ask for a re-audit or to dispute a finding. Read how we audit for what each check means.