ca.tonbot.tolca/tolca

by tolca.tonbot.ca · remote · no sign-in to list tools · v1.0.0 · published by ca.tonbot.tolca

Verify a company before paying it: OFAC sanctions, UK/Canada registries, contractor licences (x402)

Changes · 8

Compare Registry entry

11 tools: 8 change things and 3 only read.

Scanned Oct 21, 2026

Deletes or cancels0Claude Code: deny
Can't be undone0Claude Code: ask
Changes things8Claude Code: ask: see these tools
Only reads3Claude Code: allow: see these tools

2 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http tolca https://tolca.tonbot.ca/mcp

Findings

Matches of fixed checks, with the text they matched.

2 warn

Warnqc_contractor_check
The server marks "qc_contractor_check" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
Matched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The description's first verb is "call": a word for a change.
What this check looks for
Warnverify_business
The server marks "verify_business" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
Matched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The description's first verb is "call": a word for a change.
What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

11 tools

Changes things 8Creates or changes something that can be changed back.Claude Code: ask

extractTurn messy text into clean JSON matching the schema you provide (field names and types).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Turn messy text into clean JSON matching the schema you provide (field names and types). Pay-per-call over x402 in USDC on Base; payment challenge answered in ~5 ms, 7-day average processing ~1.5 s across Tolca services. Costs $0.02 USDC per call (x402 v2, Base). Send the HTTP header PAYMENT-SIGNATURE with your x402 payment, or call POST https://tolca.tonbot.ca/v1/extract with an x402 client.
Annotations the server declares
- title: extract
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
homework_checkCan this homework be done by an AI?No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Can this homework be done by an AI? For teachers and schools: paste an assignment (or a public PDF URL) and get an overall AI-completion risk 0-100, a per-question breakdown (risk, why, concrete fix to make it AI-resistant) and general tips. No student data. Input: text or url, optional grade, subject, lang fr|en. / Ce devoir peut-il être fait par une IA? Score par question et corrections concrètes pour l'enseignant. Costs $0.25 USDC per call (x402 v2, Base). Send the HTTP header PAYMENT-SIGNATURE with your x402 payment, or call POST https://tolca.tonbot.ca/v1/homework-check with an x402 client.
Annotations the server declares
- title: homework-check
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
pkg_checkIs this package safe to install?No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Is this package safe to install? One call, one verdict: safe / caution / avoid, with a score, concrete reasons (known vulnerabilities from OSV, deprecation, abandonment, adoption, install scripts, typosquat signals) and a one-line recommendation. Input: name, ecosystem (npm | PyPI), optional version. Free over MCP (100/day shared quota); unlimited via x402 at https://tolca.tonbot.ca/v1/pkg-check ($0.02).
Annotations the server declares
- title: Package safety check (npm / PyPI)
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
pkg_metaPackage metadata in one call, cheapest tier: latest and resolved version, license, first/last publish dates, weekly downloads, deprecation flag, install scripts, maintainers count.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Package metadata in one call, cheapest tier: latest and resolved version, license, first/last publish dates, weekly downloads, deprecation flag, install scripts, maintainers count. npm or PyPI. No vulnerability scan (see pkg-check for the full safe/caution/avoid verdict). Input: name, ecosystem (npm | PyPI), optional version. Costs $0.005 USDC per call (x402 v2, Base). Send the HTTP header PAYMENT-SIGNATURE with your x402 payment, or call POST https://tolca.tonbot.ca/v1/pkg-meta with an x402 client.
Annotations the server declares
- title: pkg-meta
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
qc_contractor_checkCall before hiring, paying or subcontracting a Québec (Canada) contractor.1 finding
Why it is in this group
- The description's first verb is "call": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
  The server marks "qc_contractor_check" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
  Matched text
  annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The description's first verb is "call": a word for a change.
  What this check looks for
Description, as the server wrote it
Call before hiring, paying or subcontracting a Québec (Canada) contractor. One call checks: active RBQ licence (status, categories, restrictions), RENA listing (banned from public contracts), environmental penalties, public contracts awarded on SEAO (count, total, buyers). Verdict ok / review / blocking with reasons and source dates. Input: name, NEQ or RBQ licence number. Official open data. Free over MCP (10/day shared quota); unlimited via x402 at https://tolca.tonbot.ca/v1/qc-contractor-check ($0.1).
Annotations the server declares
- title: Québec contractor check (RBQ + RENA + environmental penalties + SEAO public contracts)
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
qc_licenceCheapest check: does this Québec contractor hold an ACTIVE RBQ licence right now?No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Cheapest check: does this Québec contractor hold an ACTIVE RBQ licence right now? Returns active true/false, licence number, name, NEQ, city, restriction flag and authorized work categories. Use to vet many contractors fast; use qc-contractor-check for RENA and penalties. Input: name, NEQ or RBQ licence number. Costs $0.01 USDC per call (x402 v2, Base). Send the HTTP header PAYMENT-SIGNATURE with your x402 payment, or call POST https://tolca.tonbot.ca/v1/qc-licence with an x402 client.
Annotations the server declares
- title: qc-licence
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
translateTranslate text between French (including Quebec French) and English, with optional tone.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Translate text between French (including Quebec French) and English, with optional tone. Pay-per-call over x402 in USDC on Base; payment challenge answered in ~25 ms, 7-day average processing ~1.5 s across Tolca services. Costs $0.04 USDC per call (x402 v2, Base). Send the HTTP header PAYMENT-SIGNATURE with your x402 payment, or call POST https://tolca.tonbot.ca/v1/translate with an x402 client.
Annotations the server declares
- title: translate
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
verify_businessCall before paying, onboarding or contracting a company (KYB).1 finding
Why it is in this group
- The description's first verb is "call": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
  The server marks "verify_business" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
  Matched text
  annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The description's first verb is "call": a word for a change.
  What this check looks for
Description, as the server wrote it
Call before paying, onboarding or contracting a company (KYB). One call: US restricted-party lists (CSL incl. OFAC SDN), company registries (UK Companies House, Canada federal), legal entity status (GLEIF, worldwide), contractor licences (Québec, Washington, Oregon). Verdict ok / review / blocking / not_found with reasons. Input: name, optional country (ISO-2) and region (WA, OR, QC). Businesses only. Costs $0.05 USDC per call (x402 v2, Base). Send the HTTP header PAYMENT-SIGNATURE with your x402 payment, or call POST https://tolca.tonbot.ca/v1/verify-business with an x402 client.
Annotations the server declares
- title: verify-business
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true

Only reads 3Looks things up and changes nothing.Claude Code: allow

extract_urlFetch a public URL (HTML article, PDF, or JSON) and return JSON matching your schema in one call, with page title and source.No findings
Why it is in this group
- The description's first verb is "fetch": a word for reading.
Description, as the server wrote it
Fetch a public URL (HTML article, PDF, or JSON) and return JSON matching your schema in one call, with page title and source. Pay-per-call over x402 in USDC on Base; payment challenge answered in ~8 ms. Costs $0.03 USDC per call (x402 v2, Base). Send the HTTP header PAYMENT-SIGNATURE with your x402 payment, or call POST https://tolca.tonbot.ca/v1/extract-url with an x402 client.
Annotations the server declares
- title: extract-url
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
summarizeSummarize text (up to 40k chars) into a faithful, tight summary, with optional max_words and target language.No findings
Why it is in this group
- The name "summarize" says "summarize": a word for reading.
Description, as the server wrote it
Summarize text (up to 40k chars) into a faithful, tight summary, with optional max_words and target language. Pay-per-call over x402 in USDC on Base; payment challenge answered in ~10 ms, 7-day average processing ~1.5 s across Tolca services. Costs $0.03 USDC per call (x402 v2, Base). Send the HTTP header PAYMENT-SIGNATURE with your x402 payment, or call POST https://tolca.tonbot.ca/v1/summarize with an x402 client.
Annotations the server declares
- title: summarize
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
web_searchSearch the web and read the top pages in ONE call: 10 results (title, url, snippet, date) plus the clean text of the best pages, with fetch time and sha256.No findings
Why it is in this group
- The name "web_search" says "search": a word for reading.
Description, as the server wrote it
Search the web and read the top pages in ONE call: 10 results (title, url, snippet, date) plus the clean text of the best pages, with fetch time and sha256. French and Canada by default when the query is French; official-sources mode (governments, registries, courts, laws); freshness filter; site: restriction. No results = HTTP 404 = you are not charged. Input: query, optional read (0-5), official, lang, country, freshness, site. Costs $0.008 USDC per call (x402 v2, Base). Send the HTTP header PAYMENT-SIGNATURE with your x402 payment, or call POST https://tolca.tonbot.ca/v1/web-search with an x402 client.
Annotations the server declares
- title: web-search
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http tolca https://tolca.tonbot.ca/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__tolca__summarize",
      "mcp__tolca__extract_url",
      "mcp__tolca__web_search"
    ],
    "ask": [
      "mcp__tolca__pkg_check",
      "mcp__tolca__qc_contractor_check",
      "mcp__tolca__translate",
      "mcp__tolca__extract",
      "mcp__tolca__qc_licence",
      "mcp__tolca__pkg_meta",
      "mcp__tolca__homework_check",
      "mcp__tolca__verify_business"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as tolca. Review it before you use it.

Keep track

Get told when this server's tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/ca.tonbot.tolca/tolca/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Anlyon alternative

8 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Compare with other servers for the same product.

Source: MCP Registry. Synced Oct 21, 2026, 17:46 UTC.

For agents: Markdown · JSON · report this listing