Next free-source huntWe check for new free data every weekday.
OSINTMCP serverFirst audited Nov 13, 2026

Grokzilla micro pay

32 x402 pay-per-call tools: SEO, agent audits, JSON/text utils, OSINT. USDC on Base; $1=300 callsThe vendor's description, from its MCP Registry listing.

Passed, with 1 warningAudited Nov 13, 2026
  • Warning: 41 of 43 tools do not say whether they can change things.

Nothing failed, but there is something to know or fix. Public audit: we connect as an AI client would, list the tools and check what they say. We do not run them. How we audit

Does it work?
YesConnected in 203 ms.
Sign-up?
None neededIt answered without any account or key.
Can it change things?
Doesn't sayIts tools do not say whether they only read, so treat them as able to change things.
Endpointhttps://grokzilla.shop/mcp

Source code Website Streamable HTTP · protocol 2025-11-25 · server version 0.1.0

What we checked, the evidence, and the tools it offers.

What we checked

Security

  • Passed: Connections are encrypted (HTTPS).

  • Passed: No hidden instructions found in tool text.

Safety labels

  • Warning: 41 of 43 tools do not say whether they can change things.

    MCP lets a server label each tool as read-only or destructive, so clients can ask the user before risky calls. Unlabelled tools are treated as able to change things.

    • osint_graph
    • seo
    • seo_v2
    • seo_compare
    • agent_ready_audit
    • agent_ready_kit
    • agent_ready_recheck
    • ai_detector
    • and 33 more

Tools

  • Passed: 43 tools listed.

  • Passed: Every tool describes its inputs with a valid schema.

Protocol

  • Passed: The MCP handshake works (Streamable HTTP).

  • Passed: Protocol version 2025-11-25 (latest).

  • Passed: Unknown requests are refused.

Connection

  • Passed: The server responds.

Tools (43)

As the server describes them. The labels are the server's own: it says whether each tool only reads or can change things.

  • list_skillsList the public skill catalog: id, name, description, price, method, HTTP endpoint, docs URL, and MCP tool name. Free and read-only.Read-only
  • get_skillFetch one public skill by id, including its input schema and an example request. Free and read-only. Unknown ids return a tool error.Read-only
  • osint_graphResolves one public name on Wikidata and returns a relationship graph from a fixed property list (instance of, country, headquarters, founder, chief executive, ownership, employer, education, members…Doesn't say
  • seoFetches a URL and returns an on-page SEO score from real checks (title, meta, headings, alt text, keywords, and more). If the page cannot be fetched, returns an error status (403/404/5xx), is a CDN/W…Doesn't say
  • seo_v2On-page SEO + AEO audit with paste-ready fixes: 0-100 score across technical, content, metadata, structured data and AI-answer readiness, ~25 checks with severity, and generated title/meta, canonical…Doesn't say
  • seo_compareRuns SEO Optimizer v2 on your page and up to 3 competitor pages and returns a per-check gap table. Not charged if your page blocks us or is unreachable (422, charged:false). Price $0.0503 via x402.Doesn't say
  • agent_ready_auditAudits how ~17 AI crawlers and agents (GPTBot, ClaudeBot, PerplexityBot, Google-Extended, ChatGPT-User, ...) can reach and read a site: robots rules per bot, live user-agent probes, llms.txt, sitemap…Doesn't say
  • agent_ready_kitAgent-Ready Audit plus generated files: llms.txt, llms-full.txt, merged robots.txt AI section, sitemap.xml, JSON-LD and meta/OG per page, agent card, and an install guide (zip). Unknown facts stay TO…Doesn't say
  • agent_ready_recheckRe-runs an Agent-Ready audit from its report_id (30 days) and returns what got fixed or regressed. Not charged if the site blocks us or is unreachable (422, charged:false). Price $0.0102 via x402.Doesn't say
  • ai_detectorEstimate whether text (or a web page's text) is AI-written using a trained classifier: about 78% accurate on a held-out benchmark (not a guarantee). Uncertain results suggest a rerun on a longer sect…Doesn't say
  • json_flattenDeterministic nested JSON to flat path-value map. Arrays, custom separators, depth limits. Price $0.006 via x402.Doesn't say
  • json_sortRecursively sort object keys and return canonical compact JSON. Deterministic, no network. Price $0.003 via x402.Doesn't say
  • text_diffLightweight deterministic line/word/char diff. Structured ops plus a one-line delta summary. Price $0.006 via x402.Doesn't say
  • url_normalizeCanonicalize URLs: strip tracking params, force HTTPS, sort query, extract components. Price $0.005 via x402.Doesn't say
  • html_cleanStrip scripts/styles and return readable text or markdown from HTML. mode normalized: text with NFKC and zero-width/bidi characters stripped. Price $0.008 via x402.Doesn't say
  • json_schema_validateCheap schema gate: type, required, properties, array items, plus format checks (email, date, date-time, uri, ipv4, ipv6, uuid, hostname). Price $0.006 via x402.Doesn't say
  • keyword_extractDeterministic term ranking from free text. Stopword-filtered. ngrams 2-3 adds scored multi-word phrases. Price $0.008 via x402.Doesn't say
  • token_countApproximate cl100k/o200k token counts for budget decisions. Price $0.004 via x402.Doesn't say
  • sha256Hash a string (SHA-256 by default; algo: sha512, sha3_256 or blake2b_256) and return hex plus a short prefix. Deterministic, no network. Price $0.003 via x402.Doesn't say
  • uuid_mintMint 1-32 IDs for agent job IDs and idempotency keys: UUID v4 (default), v7 or v1 (time-ordered), or ULID (format: ulid). v7 and ULID batches sort in mint order. Price $0.003 via x402.Doesn't say
  • slugifyTurn free text into a URL-safe lowercase slug. Deterministic, no network. Price $0.003 via x402.Doesn't say
  • pii_redactRedact emails, phone numbers, SSN-shaped strings, Luhn-valid card numbers and IPv4 addresses with typed placeholders. Deterministic, no network. Price $0.003 via x402.Doesn't say
  • csv_normalizeParse CSV into JSON rows keyed by trimmed snake_case headers, plus a type hint per column (integer, number, boolean, date, datetime, string). Deterministic, no network. Price $0.003 via x402.Doesn't say
  • base64Encode UTF-8 text or decode it back: base64 (default; standard or URL-safe), base32, base58 (Bitcoin alphabet), hex or URI percent-encoding (codec). Deterministic, no network. Price $0.003 via x402.Doesn't say
  • epoch_convertConvert epoch seconds or milliseconds (detected by magnitude) or an ISO-8601 string into epoch_s, epoch_ms, UTC ISO and ISO in any IANA time zone. Deterministic, no network. Price $0.003 via x402.Doesn't say
  • url_to_markdownFetch one public web page and return its title and clean Markdown (headings, links, lists, code, tables). Honors robots.txt, SSRF-guarded, HTML only, 1 MB / 5 s caps. No JavaScript rendering. Price $…Doesn't say
  • token_riskHeuristic risk checks for a Base ERC-20: contract code, metadata, proxy, owner/renounced, mint/blacklist/pause/fee selectors, deepest Uniswap/Aerodrome pool, and simulated sell/buy transfers with mea…Doesn't say
  • json_repairRepair malformed or truncated JSON from LLMs, JS or Python: strips ```json fences and comments, fixes trailing commas, single quotes, unquoted keys, True/False/None, missing commas and unclosed strin…Doesn't say
  • cron_nextValidate a 5-field cron expression (lists, ranges, steps, JAN-DEC/SUN-SAT names, @daily/@hourly macros) and return its next 1-20 run times in any IANA time zone (DST-aware), as local ISO, UTC ISO and…Doesn't say
  • token_priceVerified USD price for a Base ERC-20: DeFiLlama cross-checked against the deepest on-chain Uniswap/Aerodrome pool. Returns price, spread, staleness, confidence. Refused, not charged, if sources disag…Doesn't say
  • email_checkCheck an email address for deliverability: syntax, canonical form, MX, SPF, DMARC, disposable domain. One verdict with reasons and sources. DNS-over-HTTPS only, no mailbox probing. Not charged if the…Doesn't say
  • news_briefTopic in, deduplicated story clusters out: headline, every outlet URL and first-seen time, from GDELT and publisher RSS. Headlines and links only, no article text. Not charged when nothing matches or…Doesn't say
  • ip_intelOne public IP or CIDR in: normalized network, size, membership checks, plus holder, abuse contact and origin ASN from RIR RDAP and RIPEstat, and country from DB-IP Lite (CC BY 4.0, attributed). Priva…Doesn't say
  • llm_cost_quoteText or token counts in, cost per model out, cheapest first, from OpenRouter's public price list with a price-fetched-at timestamp. Applies time-of-day pricing. Not charged if the price list is unava…Doesn't say
  • address_validateValidate an EVM, Solana, or Bitcoin address locally (EIP-55 checksum, base58, bech32). Optional eth_getCode on Base to label eoa vs contract. No RPC required by default. Price $0.001 via x402.Doesn't say
  • gas_priceEIP-1559 base fee and priority fee percentiles (p25/p50/p90) for Base and/or Ethereum via eth_feeHistory. Cached 10s. Optional eth-transfer USD estimate on Base. Price $0.001 via x402.Doesn't say
  • erc20_metaRead ERC-20 name, symbol, decimals, totalSupply (and optional holder balanceOf) via multicall3 on Base or Ethereum. 400 if the address is not a contract. Price $0.002 via x402.Doesn't say
  • dns_lookupDNS-over-HTTPS lookup (A/AAAA/MX/TXT/NS/CNAME/CAA) via Google Public DNS with Cloudflare fallback. Rejects IP literals and private names. Price $0.002 via x402.Doesn't say
  • name_resolveResolve ENS (.eth) on Ethereum and Basenames (.base.eth) on Base, forward or reverse. Returns address, name, source, forward_verified, optional avatar. Price $0.003 via x402.Doesn't say
  • tx_statusTransaction receipt status, block, and confirmations on Base or Ethereum via eth_getTransactionReceipt. Validates 0x tx hash before payment. Short-cached. Price $0.002 via x402.Doesn't say
  • hex_decodeLocal-only hex decode to utf-8, bytes32, address, and 4-byte selector note. No network fetch (no 4byte.directory). Price $0.001 via x402.Doesn't say
  • block_numberLatest eth_blockNumber for Base and/or Ethereum, optional block timestamp. Cached ~2s. Price $0.001 via x402.Doesn't say
  • whois_rdapDomain registration lookup via IANA RDAP DNS bootstrap only (registrar, status, nameservers, events). Rejects IP literals and private names. Rate-limited, ~5s timeout, SSRF-safe (no private redirects…Doesn't say

Audit history

  1. Nov 13Warnings

What we sent

Every request in this audit, with the answer and how long it took. We never send credentials and never call a tool.

RequestAnswerTime
initializeHTTP 200203 ms
initializedHTTP 20284 ms
tools/listHTTP 200204 ms
unknown-methodHTTP 20071 ms

Run this server, or disagree with the result?

Fix the issue and it shows in the next weekly audit, or email us to ask for a re-audit or to dispute a finding. Read how we audit for what each check means.