Skip to content
anlyon.dev

ScorpTech x402 API

com.it.scorptech/x402scorptech.it.comstreamable-httpv1.0.0Scanned

112 x402 pay-per-call tools: web data, security/OSINT, SEC and public data, Solana/EVM lookups

112 tools: 8 do something that can't be undone, 79 change things and 25 only read.

Tools: 0 delete, 8 irreversible, 79 write, 25 read.
  • Reads private data · 3
  • Reads text others write · 112
  • Can send data out · 23
  • 13 findings

Anlyon alternative

87 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →
Compare with similar serversMarkdownJSONReport this listing

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

112 tools

Can't be undone 8Claude Code: ask
  • evm_token_transfersLatest ERC-20 or ERC-721 Transfer events for a token contract (optionally filtered to one wallet, in/out/both) on six EVM chains.Reads text others write1 finding

    Why it is in this group

    • The name "evm_token_transfers" says "transfer": a word for a change that another call does not undo.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "evm_token_transfers" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "evm_token_transfers" says "transfer": a word for a change that another call does not undo.

      What this check looks for
    Description, as the server wrote it
    Latest ERC-20 or ERC-721 Transfer events for a token contract (optionally filtered to one wallet, in/out/both) on six EVM chains. Adaptive eth_getLogs window with automatic shrink on provider range caps. Returns decoded from/to/value or tokenId, approx age, mint/burn tags. Read-only. Price: $0.01 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/evm-token-transfers

    Annotations the server declares

    • title: Evm Token Transfers
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • fda_adverse_eventsFDA adverse-event reports (openFDA): drug FAERS, device MAUDE, food/supplement CAERS.Reads text others writeCan send data out1 finding

    Why it is in this group

    • The input addresses people (input.to): what it sends cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a destination (input.to): what the tool writes goes there.

    Findings

    • Warn

      The server marks "fda_adverse_events" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The input addresses people (input.to): what it sends cannot be taken back.

      What this check looks for
    Description, as the server wrote it
    FDA adverse-event reports (openFDA): drug FAERS, device MAUDE, food/supplement CAERS. Filter by drug, product, reaction, dates or raw openFDA search; compact reports or counts on any field (e.g. top reactions for a drug). Price: $0.01 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/fda-adverse-events

    Annotations the server declares

    • title: Fda Adverse Events
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • fda_deviceFDA device records (openFDA): 510(k) clearances, PMA approvals, device classification (product code, class, regulation) and GUDID device identifiers.Reads text others writeCan send data out1 finding

    Why it is in this group

    • The input addresses people (input.to): what it sends cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a destination (input.to): what the tool writes goes there.

    Findings

    • Warn

      The server marks "fda_device" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The input addresses people (input.to): what it sends cannot be taken back.

      What this check looks for
    Description, as the server wrote it
    FDA device records (openFDA): 510(k) clearances, PMA approvals, device classification (product code, class, regulation) and GUDID device identifiers. Search by name, product code, applicant, K/PMA number or raw search; count by any field. GMDN removed. Price: $0.01 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/fda-device

    Annotations the server declares

    • title: Fda Device
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • fda_recallsFDA recalls (openFDA): drug, device and food enforcement reports (class, status, firm, reason, distribution, lots) plus the device recall database (root cause).Reads text others writeCan send data out1 finding

    Why it is in this group

    • The input addresses people (input.to): what it sends cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a destination (input.to): what the tool writes goes there.

    Findings

    • Warn

      The server marks "fda_recalls" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The input addresses people (input.to): what it sends cannot be taken back.

      What this check looks for
    Description, as the server wrote it
    FDA recalls (openFDA): drug, device and food enforcement reports (class, status, firm, reason, distribution, lots) plus the device recall database (root cause). Filter by firm, product, class, status, state, dates; count by any field. Newest first. Price: $0.01 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/fda-recalls

    Annotations the server declares

    • title: Fda Recalls
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • format_convertConvert data between CSV, TSV, JSON, YAML and XML in one call (auto-detects the input format).Reads text others writeCan send data out1 finding

    Why it is in this group

    • The name "format_convert" says "convert": a word for a change.
    • The input addresses people (input.to): what it sends cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a destination (input.to): what the tool writes goes there.

    Findings

    • Warn

      The server marks "format_convert" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "format_convert" says "convert": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Convert data between CSV, TSV, JSON, YAML and XML in one call (auto-detects the input format). CSV header handling and delimiter detection, type inference (numbers, booleans, null), nested objects flattened to dotted CSV columns, XML attributes as @keys and repeated elements as arrays, safe YAML subset (no anchors/tags), optional spreadsheet formula-injection guard. Body: {input, from, to, options}; 256 KB limit, clear errors with line numbers on malformed input. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: POST https://scorptech.it.com/api/x402/v1/format-convert

    Annotations the server declares

    • title: Format Convert
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • fx_rateFiat currency exchange rate (ECB reference rates via Frankfurter, with ExchangeRate-API fallback for 150+ currencies), optional amount conversion and historical date.Reads text others writeCan send data out1 finding

    Why it is in this group

    • The input addresses people (input.to): what it sends cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a destination (input.to): what the tool writes goes there.

    Findings

    • Warn

      The server marks "fx_rate" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The input addresses people (input.to): what it sends cannot be taken back.

      What this check looks for
    Description, as the server wrote it
    Fiat currency exchange rate (ECB reference rates via Frankfurter, with ExchangeRate-API fallback for 150+ currencies), optional amount conversion and historical date. Read-only. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/fx-rate

    Annotations the server declares

    • title: Fx Rate
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • macro_indicatorsMacro indicators by country and year: GDP, real GDP growth, GDP per capita, inflation, unemployment, population, government debt and current account, side by side from the World Ba…Reads text others writeCan send data out1 finding

    Why it is in this group

    • The input addresses people (input.to): what it sends cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a destination (input.to): what the tool writes goes there.

    Findings

    • Warn

      The server marks "macro_indicators" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The input addresses people (input.to): what it sends cannot be taken back.

      What this check looks for
    Description, as the server wrote it
    Macro indicators by country and year: GDP, real GDP growth, GDP per capita, inflation, unemployment, population, government debt and current account, side by side from the World Bank (WDI actuals) and the IMF World Economic Outlook (DataMapper, incl. projections). Up to 10 countries (ISO2/ISO3) and 8 indicators per call. Price: $0.01 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/macro-indicators

    Annotations the server declares

    • title: Macro Indicators
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • usaspending_awardsFederal contracts, IDVs, grants, loans and direct payments from USAspending.gov by recipient, awarding agency (name or abbreviation such as DOD, NASA, HHS), NAICS code or keyword, …Reads text others writeCan send data out1 finding

    Why it is in this group

    • The input addresses people (input.recipient): what it sends cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a destination (input.recipient): what the tool writes goes there.

    Findings

    • Warn

      The server marks "usaspending_awards" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The input addresses people (input.recipient): what it sends cannot be taken back.

      What this check looks for
    Description, as the server wrote it
    Federal contracts, IDVs, grants, loans and direct payments from USAspending.gov by recipient, awarding agency (name or abbreviation such as DOD, NASA, HHS), NAICS code or keyword, for a date range (default last 12 months). Returns the top awards by amount or start date with award id, recipient and UEI, amount, outlays, dates, agency and sub-agency, award type, NAICS/PSC and a link, plus the total matching award count. Price: $0.01 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/usaspending-awards

    Annotations the server declares

    • title: Usaspending Awards
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
Changes things 79Claude Code: ask
  • bls_seriesAny BLS time series by id (CPI, payrolls, unemployment, state/metro LAUS, PPI, JOLTS, ECI ...) for a year range: observations newest first with preliminary flags and footnotes, lat…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Any BLS time series by id (CPI, payrolls, unemployment, state/metro LAUS, PPI, JOLTS, ECI ...) for a year range: observations newest first with preliminary flags and footnotes, latest value, MoM / YoY change. Up to 25 series per call. Includes BLS retrieval date and disclaimer. Price: $0.01 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/bls-series

    Annotations the server declares

    • title: Bls Series
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • census_geographiesUS Census Bureau geocoder: a one-line US street address (or a lat/lon) to matched address and coordinates plus Census geographies: state and county with FIPS codes, census tract, b…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    US Census Bureau geocoder: a one-line US street address (or a lat/lon) to matched address and coordinates plus Census geographies: state and county with FIPS codes, census tract, block group and block GEOID, place/city, congressional district, state legislative districts, ZCTA, metro/micro area and urban area where available. Public-domain US government data; useful for district lookups, data joins and address normalisation. Price: $0.01 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/census-geographies

    Annotations the server declares

    • title: Census Geographies
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • cisa_kevCISA Known Exploited Vulnerabilities check: is a CVE (or up to 100) in CISA's KEV catalog, with date added, federal remediation due date, past-due flag, known ransomware use, requi…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    CISA Known Exploited Vulnerabilities check: is a CVE (or up to 100) in CISA's KEV catalog, with date added, federal remediation due date, past-due flag, known ransomware use, required action and CWEs. Or search the catalog by vendor/product, recently added (?days=) or ransomware use. Complements /v1/cve-lookup (NVD). Price: $0.01 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/cisa-kev

    Annotations the server declares

    • title: Cisa Kev
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • company_profileCompany profile from its own website: name, description, logo, social profiles, contact emails/phones, postal address, schema.org Organization JSON-LD, OpenGraph/Twitter cards, plu…Reads text others writeCan send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Company profile from its own website: name, description, logo, social profiles, contact emails/phones, postal address, schema.org Organization JSON-LD, OpenGraph/Twitter cards, plus RDAP domain registration basics (registered, expires, registrar). SSRF-safe fetch of the public page. Price: $0.03 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/company-profile

    Annotations the server declares

    • title: Company Profile
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • contact_extractExtract public business contact details from a website: email addresses (mailto, visible text incl.Reads text others writeCan send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Extract public business contact details from a website: email addresses (mailto, visible text incl. [at]/[dot] obfuscation, Cloudflare-protected, JSON-LD) tagged role/personal and same-domain, phone numbers (tel: links, JSON-LD, text), social profiles (LinkedIn, X/Twitter, Facebook, Instagram, YouTube, GitHub, TikTok, Mastodon, ...; share links ignored), JSON-LD organization name/address and contact-form URLs. Follows up to 3 same-site contact/impressum/about pages. SSRF-safe fetching; respect GDPR/CAN-SPAM when using results. Price: $0.02 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/contact-extract

    Annotations the server declares

    • title: Contact Extract
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • ct_subdomainsCertificate Transparency subdomain enumeration via crt.sh JSON API.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Certificate Transparency subdomain enumeration via crt.sh JSON API. Returns unique hostnames (capped) issued under the domain. Price: $0.008 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/ct-subdomains

    Annotations the server declares

    • title: Ct Subdomains
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • dns_dumpAll common DNS records for a domain via Cloudflare DNS-over-HTTPS: A, AAAA, NS, MX, TXT, CAA.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    All common DNS records for a domain via Cloudflare DNS-over-HTTPS: A, AAAA, NS, MX, TXT, CAA. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/dns-dump

    Annotations the server declares

    • title: Dns Dump
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • dns_propagationDNS propagation check: resolves one record type for a domain across Cloudflare 1.1.1.1, Google 8.8.8.8 and Quad9 9.9.9.9 (DNS-over-HTTPS, in parallel) and reports consensus, per-re…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    DNS propagation check: resolves one record type for a domain across Cloudflare 1.1.1.1, Google 8.8.8.8 and Quad9 9.9.9.9 (DNS-over-HTTPS, in parallel) and reports consensus, per-resolver answers, TTLs, rcodes and differences. Price: $0.01 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/dns-propagation

    Annotations the server declares

    • title: Dns Propagation
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • dockerfile_lintOffline Dockerfile linter: parses stages/continuations and runs 20+ best-practice and security rules (latest tag, curl|bash, secrets in ENV/ARG, runs-as-root, chmod 777, ADD-vs-COP…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Offline Dockerfile linter: parses stages/continuations and runs 20+ best-practice and security rules (latest tag, curl|bash, secrets in ENV/ARG, runs-as-root, chmod 777, ADD-vs-COPY, apt cache, no HEALTHCHECK, multi-stage hints). Returns 0-100 score, letter grade and actionable fixes. Does not build or pull images. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: POST https://scorptech.it.com/api/x402/v1/dockerfile-lint

    Annotations the server declares

    • title: Dockerfile Lint
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • domain_availabilityBulk domain availability: for up to 20 domains, asks the authoritative registry over RDAP (server chosen from the IANA RDAP bootstrap).Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Bulk domain availability: for up to 20 domains, asks the authoritative registry over RDAP (server chosen from the IANA RDAP bootstrap). RDAP 404 = available; registered names return registrar, IANA id, creation/expiry dates, status and nameservers. TLDs without RDAP fall back to a DNS NS check; subdomains are flagged. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/domain-availability

    Annotations the server declares

    • title: Domain Availability
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • domain_intelOne-call domain due-diligence: RDAP registration age/expiry/registrar, A/AAAA/NS/MX/CAA, live TLS certificate (issuer, expiry, SANs, trust), Certificate-Transparency subdomain enum…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    One-call domain due-diligence: RDAP registration age/expiry/registrar, A/AAAA/NS/MX/CAA, live TLS certificate (issuer, expiry, SANs, trust), Certificate-Transparency subdomain enumeration, and risk flags (new domain, expiring cert, no CAA). Good for phishing/scam triage of links before an agent visits or pays them. Price: $0.01 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/domain-intel

    Annotations the server declares

    • title: Domain Intel
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • earthquakesRecent earthquakes from the USGS: filter by bounding box or center point + radius, minimum magnitude and time window (last N days or start/end dates).Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Recent earthquakes from the USGS: filter by bounding box or center point + radius, minimum magnitude and time window (last N days or start/end dates). Returns magnitude, place, time, coordinates, depth, tsunami flag, PAGER alert, felt reports and USGS event links. Price: $0.01 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/earthquakes

    Annotations the server declares

    • title: Earthquakes
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • email_authEmail authentication & deliverability posture for a domain: SPF (qualifier, lookup count, duplicates), DMARC policy/rua/pct, DKIM probe across common selectors, MTA-STS, TLS-RPT, B…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Email authentication & deliverability posture for a domain: SPF (qualifier, lookup count, duplicates), DMARC policy/rua/pct, DKIM probe across common selectors, MTA-STS, TLS-RPT, BIMI, MX; scored with actionable issues. Useful for spoofing-risk and vendor checks. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/email-auth

    Annotations the server declares

    • title: Email Auth
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • eol_checkIs this software version still supported?Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Is this software version still supported? End-of-life status from endoflife.date for 400+ products (languages, frameworks, databases, OSes, runtimes, cloud services): status (supported, security-only, eol, unmaintained), release, active-support and EOL dates, days until/since EOL, LTS flag, latest patch for the cycle and whether you are on it, the recommended upgrade cycle, and plain advice. Fuzzy product matching with suggestions; batch up to 10 product@version items. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/eol-check

    Annotations the server declares

    • title: Eol Check
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • epss_scoreFIRST EPSS exploit-prediction scores for up to 100 CVEs: probability of exploitation in the next 30 days, percentile rank and a simple band, for the latest model run or a past date…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    FIRST EPSS exploit-prediction scores for up to 100 CVEs: probability of exploitation in the next 30 days, percentile rank and a simple band, for the latest model run or a past date. Complements /v1/cve-lookup and /v1/cisa-kev for vulnerability prioritisation. Price: $0.01 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/epss-score

    Annotations the server declares

    • title: Epss Score
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • evm_allowanceERC-20 allowance matrix for an owner across up to 10 tokens × 10 spenders (defaults: major stables/WETH × Uniswap Permit2, 1inch, CoW, 0x, OpenSea Seaport — verified deployed on-ch…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    ERC-20 allowance matrix for an owner across up to 10 tokens × 10 spenders (defaults: major stables/WETH × Uniswap Permit2, 1inch, CoW, 0x, OpenSea Seaport — verified deployed on-chain). Also reports ERC-721/1155 setApprovalForAll. Flags unlimited (max-uint) approvals. Read-only; no log scan. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/evm-allowance

    Annotations the server declares

    • title: Evm Allowance
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • evm_balanceNative ETH and ERC-20 token balances for an address on Ethereum, Base or Arbitrum via public RPC.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Native ETH and ERC-20 token balances for an address on Ethereum, Base or Arbitrum via public RPC. Defaults to major tokens (USDC, USDT, WETH, DAI/ARB) or pass up to 20 token contracts. Read-only. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/evm-balance

    Annotations the server declares

    • title: Evm Balance
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • evm_contract_infoEVM contract introspection on Ethereum, Base, Arbitrum, OP Mainnet, Polygon or BNB Chain via public RPC: bytecode size/hash, EIP-1167 / EIP-1967 / ZeppelinOS / EIP-7702 proxy detec…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    EVM contract introspection on Ethereum, Base, Arbitrum, OP Mainnet, Polygon or BNB Chain via public RPC: bytecode size/hash, EIP-1167 / EIP-1967 / ZeppelinOS / EIP-7702 proxy detection, ERC-165/20/721/1155(/2981) standards, name/symbol/decimals/supply, owner()/paused(), and a bytecode selector scan against 145 known signatures that surfaces capabilities (mint, blacklist, fee setters, trading switches, upgrade) and a 0-100 risk score. Static analysis only — not a honeypot simulation. Read-only. Price: $0.01 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/evm-contract-info

    Annotations the server declares

    • title: Evm Contract Info
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • evm_gasLive gas tracker across Ethereum, Base, Arbitrum, OP Mainnet, Polygon and BNB Chain: head block age, base fee, 10th/50th/90th percentile priority fees from eth_feeHistory, suggeste…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Live gas tracker across Ethereum, Base, Arbitrum, OP Mainnet, Polygon and BNB Chain: head block age, base fee, 10th/50th/90th percentile priority fees from eth_feeHistory, suggested maxFeePerGas tiers, and estimated cost of a native transfer and an ERC-20 transfer. Read-only. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/evm-gas

    Annotations the server declares

    • title: Evm Gas
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • evm_selector_decodeDecode EVM function selectors, calldata and event topics: looks up 4-byte selectors (or 32-byte event topics) in 4byte.directory plus a built-in table of well-known signatures, re-…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Decode EVM function selectors, calldata and event topics: looks up 4-byte selectors (or 32-byte event topics) in 4byte.directory plus a built-in table of well-known signatures, re-hashes every candidate with Keccak-256 to drop bad entries, and for full calldata ABI-decodes the arguments (address with EIP-55 checksum, uint/int as exact decimal strings, bool, bytes, string, arrays, tuples), ranking candidates that decode cleanly first. Also computes the selector/topic for a given signature. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/evm-selector-decode

    Annotations the server declares

    • title: Evm Selector Decode
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • evm_tx_infoDecode an EVM transaction (Ethereum, Base, Arbitrum): status, block, timestamp, confirmations, from/to, value, gas used, effective gas price, fee, method selector name, and decoded…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Decode an EVM transaction (Ethereum, Base, Arbitrum): status, block, timestamp, confirmations, from/to, value, gas used, effective gas price, fee, method selector name, and decoded ERC-20 Transfer/Approval events. Read-only, public RPC. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/evm-tx-info

    Annotations the server declares

    • title: Evm Tx Info
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • food_barcodeFood product facts by barcode (EAN-13, EAN-8, UPC-A, UPC-E; GTIN check digit validated) from Open Food Facts (ODbL): name, brand, quantity, categories, ingredients text, allergens …Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Food product facts by barcode (EAN-13, EAN-8, UPC-A, UPC-E; GTIN check digit validated) from Open Food Facts (ODbL): name, brand, quantity, categories, ingredients text, allergens and traces, additives, Nutri-Score grade, NOVA processing group, Green-Score, nutrients per 100 g (energy, fat, saturates, carbohydrates, sugars, fibre, protein, salt), labels, origin and image URL. Community data: always check the packaging for allergens. Price: $0.01 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/food-barcode

    Annotations the server declares

    • title: Food Barcode
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • fund_holdingsMutual fund / ETF portfolio from its latest public SEC Form N-PORT: top holdings by value (name, CUSIP, ISIN, LEI, shares, USD value, % of net assets, asset and issuer category, co…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Mutual fund / ETF portfolio from its latest public SEC Form N-PORT: top holdings by value (name, CUSIP, ISIN, LEI, shares, USD value, % of net assets, asset and issuer category, country, maturity/coupon for debt), asset-class / country / issuer / currency mix, top-10 concentration, net assets and monthly returns per share class. Look up by fund ticker (VOO, QQQ, BND), series id or class id. Price: $0.01 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/fund-holdings

    Annotations the server declares

    • title: Fund Holdings
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • geocodeGeocode an address or place name to latitude/longitude (US Census Geocoder for US street addresses, Photon/OpenStreetMap worldwide), or reverse-geocode lat/lon to an address (with …Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Geocode an address or place name to latitude/longitude (US Census Geocoder for US street addresses, Photon/OpenStreetMap worldwide), or reverse-geocode lat/lon to an address (with US county/tract). Read-only. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/geocode

    Annotations the server declares

    • title: Geocode
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • github_healthGitHub repository health summary via public API: stars/forks/issues, license, languages, last push age, latest release & commit, heuristic healthScore and notes.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    GitHub repository health summary via public API: stars/forks/issues, license, languages, last push age, latest release & commit, heuristic healthScore and notes. Unauthenticated rate limits apply. Price: $0.008 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/github-health

    Annotations the server declares

    • title: Github Health
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hash_encodeHashing, HMAC and encoding toolkit: digests (MD5, SHA-1/2/3, Keccak-256 as used by Ethereum, RIPEMD-160, Whirlpool, CRC32/CRC32C, Adler-32, FNV-1a, xxHash32/64/3/128, MurmurHash3),…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Hashing, HMAC and encoding toolkit: digests (MD5, SHA-1/2/3, Keccak-256 as used by Ethereum, RIPEMD-160, Whirlpool, CRC32/CRC32C, Adler-32, FNV-1a, xxHash32/64/3/128, MurmurHash3), HMAC (SHA-1/2/3, MD5) with hex or base64 output, encode/decode between UTF-8, hex, base64, base64url, base32, base58 and URL encoding, identification of what a string is (hash type by length, UUID version, JWT, bcrypt/argon2, EVM address with EIP-55 checksum, Bitcoin/Solana address, base64, timestamps) and UUID v4/v7 or random-bytes generation. Offline. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: POST https://scorptech.it.com/api/x402/v1/hash-encode

    Annotations the server declares

    • title: Hash Encode
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • headers_auditGraded HTTP security-header audit of a URL: HSTS, CSP quality, XFO, nosniff, Referrer/Permissions/COOP/CORP/COEP, cookie flags, redirect chain, server info leaks, with fix recommen…Reads text others writeCan send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Graded HTTP security-header audit of a URL: HSTS, CSP quality, XFO, nosniff, Referrer/Permissions/COOP/CORP/COEP, cookie flags, redirect chain, server info leaks, with fix recommendations. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/headers-audit

    Annotations the server declares

    • title: Headers Audit
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • holidays_business_daysPublic holidays for 100+ countries (optionally one state/region) and business-day math in one call: list holidays for a year, add or subtract N business days, check if a date is a …Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Public holidays for 100+ countries (optionally one state/region) and business-day math in one call: list holidays for a year, add or subtract N business days, check if a date is a business day, or count business days between two dates, skipping weekends (configurable, e.g. fri,sat) and public holidays. Price: $0.01 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/holidays-business-days

    Annotations the server declares

    • title: Holidays Business Days
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hsts_preloadHSTS preload check for a domain: current status on the Chromium preload list (hstspreload.org), the official preloadable errors/warnings, and our own live checks of the site's HSTS…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    HSTS preload check for a domain: current status on the Chromium preload list (hstspreload.org), the official preloadable errors/warnings, and our own live checks of the site's HSTS header (max-age >= 1 year, includeSubDomains, preload, single header) and HTTP->HTTPS same-host redirect, fetched SSRF-safely. Price: $0.01 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/hsts-preload

    Annotations the server declares

    • title: Hsts Preload
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • html_to_markdownConvert an HTML string to clean Markdown (GFM tables, fenced code, nested lists).Reads text others write1 finding

    Why it is in this group

    • The description's first verb is "convert": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "html_to_markdown" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The description's first verb is "convert": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Convert an HTML string to clean Markdown (GFM tables, fenced code, nested lists). No fetch. Body: { "html": "...", "base_url"?: "https://...", "extract_main"?: false }. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: POST https://scorptech.it.com/api/x402/v1/html-to-markdown

    Annotations the server declares

    • title: Html To Markdown
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • http_probeFast HTTP GET probe: final URL, status, timing, response bytes, and a subset of interesting headers (server, cache, HSTS, CDN).Reads text others writeCan send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Fast HTTP GET probe: final URL, status, timing, response bytes, and a subset of interesting headers (server, cache, HSTS, CDN). Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/http-probe

    Annotations the server declares

    • title: Http Probe
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • image_resizeResize / convert an image (GD): width/height up to 4096, fit contain|cover|fill|inside, output png|jpeg|webp|gif, quality, EXIF auto-orient, metadata stripped.Reads text others write1 finding

    Why it is in this group

    • The name "image_resize" says "resize": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "image_resize" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "image_resize" says "resize": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Resize / convert an image (GD): width/height up to 4096, fit contain|cover|fill|inside, output png|jpeg|webp|gif, quality, EXIF auto-orient, metadata stripped. Body: { "image": "<base64>", "width": 256 }. Max ~190KB input image (the service caps POST bodies at 256KB, base64 included). Price: $0.01 USDC per successful call (x402, Solana). Same tool over HTTPS: POST https://scorptech.it.com/api/x402/v1/image-resize

    Annotations the server declares

    • title: Image Resize
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • ip_intelIP ASN + geolocation from free public sources (ipapi.co + RIPE Stat prefix-overview).Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    IP ASN + geolocation from free public sources (ipapi.co + RIPE Stat prefix-overview). Country/city/coords, ASN/org, announced prefix. Public IPs only. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/ip-intel

    Annotations the server declares

    • title: Ip Intel
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • ip_reputationIP blocklist reputation for up to 50 IPv4/IPv6 addresses: membership in the Tor exit list, Spamhaus DROP/DROPv6, abuse.ch Feodo Tracker botnet C2 and FireHOL level1 (cached publish…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    IP blocklist reputation for up to 50 IPv4/IPv6 addresses: membership in the Tor exit list, Spamhaus DROP/DROPv6, abuse.ch Feodo Tracker botnet C2 and FireHOL level1 (cached published lists), with matched range/SBL reference, categories and a simple 0-100 risk score. Blocklist membership only; complements /v1/ip-intel (geo/ASN). Price: $0.01 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/ip-reputation

    Annotations the server declares

    • title: Ip Reputation
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • json_repairRepair broken or LLM-style JSON into valid JSON: strips markdown fences and surrounding prose, comments, trailing/missing commas, single or smart quotes, unquoted keys and values, …Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Repair broken or LLM-style JSON into valid JSON: strips markdown fences and surrounding prose, comments, trailing/missing commas, single or smart quotes, unquoted keys and values, Python/JS literals (True/None/undefined), NaN/Infinity, unescaped inner quotes and control characters, truncated output (closes open strings/arrays/objects) and mismatched brackets. Reports every fix applied, the original parse error, type and size stats, and optionally runs a JSONPath query ($.a.b[0], [*], .., slices, unions, filters) on the result. Offline; 200 KB. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: POST https://scorptech.it.com/api/x402/v1/json-repair

    Annotations the server declares

    • title: Json Repair
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • jwt_decodeDecode a JWT (JWS or JWE header), POST only (token in the JSON body, never in a URL): header, claims, alg/kid, exp/nbf/iat status with leeway, aud/iss checks, and security findings…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Decode a JWT (JWS or JWE header), POST only (token in the JSON body, never in a URL): header, claims, alg/kid, exp/nbf/iat status with leeway, aud/iss checks, and security findings (alg none, HMAC alg-confusion risk, jku/x5u/jwk header keys, missing exp, odd kid). Optionally verifies the signature against a JWKS URL you supply, or one discovered from the token's https iss via OpenID discovery (fetched SSRF-safely): RS256/384/512, PS256/384/512, ES256/384/512, ES256K and EdDSA. Never trusts alg none. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: POST https://scorptech.it.com/api/x402/v1/jwt-decode

    Annotations the server declares

    • title: Jwt Decode
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • mx_checkMX / mail-routing check: sorted MX with inferred provider (Google, M365, Proofpoint, etc.), A/AAAA, SPF presence, null-MX detection.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    MX / mail-routing check: sorted MX with inferred provider (Google, M365, Proofpoint, etc.), A/AAAA, SPF presence, null-MX detection. Complements /v1/email-auth. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/mx-check

    Annotations the server declares

    • title: Mx Check
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • nft_metadataERC-721 / ERC-1155 token metadata: tokenURI/uri (ipfs/arweave/data/https), ownerOf, collection name/symbol/supply, EIP-2981 royalty.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    ERC-721 / ERC-1155 token metadata: tokenURI/uri (ipfs/arweave/data/https), ownerOf, collection name/symbol/supply, EIP-2981 royalty. Metadata JSON is fetched SSRF-safe via target_fetch (public-IP pinned). Returns name, description, image (+ http gateway URL), attributes. Read-only. Price: $0.01 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/nft-metadata

    Annotations the server declares

    • title: Nft Metadata
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • openfda_drugFDA drug facts by brand/generic name or NDC from openFDA: label sections (boxed warning, indications, dosage, contraindications, warnings, adverse reactions, interactions, or any S…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    FDA drug facts by brand/generic name or NDC from openFDA: label sections (boxed warning, indications, dosage, contraindications, warnings, adverse reactions, interactions, or any SPL field), FAERS adverse-event report totals with serious count and top reported reactions, and the latest enforcement recalls with class and reason. Not for clinical use; the response carries FDA's disclaimer. Price: $0.01 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/openfda-drug

    Annotations the server declares

    • title: Openfda Drug
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • opengraphExtract Open Graph, Twitter Card, title/description, canonical, icons and JSON-LD @types from a public URL.Reads text others writeCan send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Extract Open Graph, Twitter Card, title/description, canonical, icons and JSON-LD @types from a public URL. Ideal for link unfurling agents. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/opengraph

    Annotations the server declares

    • title: Opengraph
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • osv_scanKnown vulnerabilities for ONE package version from OSV.dev (GitHub Advisory DB, PyPA, Go, RustSec, OSS-Fuzz, distro feeds): advisory id + CVE aliases, severity (GHSA label or compu…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Known vulnerabilities for ONE package version from OSV.dev (GitHub Advisory DB, PyPA, Go, RustSec, OSS-Fuzz, distro feeds): advisory id + CVE aliases, severity (GHSA label or computed CVSS v3 base score), CVSS vectors, CWEs, fixed versions, a heuristic minimal safe upgrade, and links. npm, PyPI, Go, crates.io, Maven, Packagist, RubyGems, NuGet, Pub, Hex, distros. Use POST for a whole dependency list or lockfile. Price: $0.02 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/osv-scan

    Annotations the server declares

    • title: Osv Scan
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • osv_scan_batchDependency vulnerability scan (SCA) via OSV.dev querybatch: send up to 500 packages, or paste a lockfile (package-lock.json, yarn.lock, composer.lock, requirements.txt, Pipfile.loc…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Dependency vulnerability scan (SCA) via OSV.dev querybatch: send up to 500 packages, or paste a lockfile (package-lock.json, yarn.lock, composer.lock, requirements.txt, Pipfile.lock, poetry.lock, uv.lock, Cargo.lock, go.mod, go.sum, Gemfile.lock; auto-detected). Returns a severity summary plus, per vulnerable package, advisories with CVE aliases, CVSS, fixed versions and a heuristic safe upgrade. 256 KB body limit. Price: $0.02 USDC per successful call (x402, Solana). Same tool over HTTPS: POST https://scorptech.it.com/api/x402/v1/osv-scan

    Annotations the server declares

    • title: Osv Scan
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • package_risknpm or PyPI package risk/typosquat check: registry metadata, weekly downloads (npm), deprecation, license/repo presence, edit-distance to popular packages, and whether close-name v…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    npm or PyPI package risk/typosquat check: registry metadata, weekly downloads (npm), deprecation, license/repo presence, edit-distance to popular packages, and whether close-name variants already exist. Heuristic — not a malware scanner. Price: $0.01 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/package-risk

    Annotations the server declares

    • title: Package Risk
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • password_strengthOffline password strength audit (POST only, so the password never appears in a URL or access log; never echoed or stored): zxcvbn-style score 0-4, estimated guesses and entropy, cr…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Offline password strength audit (POST only, so the password never appears in a URL or access log; never echoed or stored): zxcvbn-style score 0-4, estimated guesses and entropy, crack-time estimates, weak patterns (common/breached passwords incl. l33t and reversed, keyboard walks, sequences, repeats, dates, personal info) and NIST SP 800-63B checks. Body: { "password": "...", "user_inputs"?: ["alice", "alice@example.com"] }. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: POST https://scorptech.it.com/api/x402/v1/password-strength

    Annotations the server declares

    • title: Password Strength
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • phishing_scoreHeuristic phishing-likelihood score for a URL/domain: brand typosquat distance, subdomain depth, punycode, RDAP age, HTTPS reachability.Reads text others writeCan send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Heuristic phishing-likelihood score for a URL/domain: brand typosquat distance, subdomain depth, punycode, RDAP age, HTTPS reachability. Returns scored signals — not a verdict. Low Bazaar crowding. Price: $0.008 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/phishing-score

    Annotations the server declares

    • title: Phishing Score
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • pii_detectDetect and redact PII in text: emails, phone numbers (E.164, NANP, keyword-anchored national), credit cards (Luhn + issuer prefix/length, brand), US SSNs (SSA validity rules) and I…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Detect and redact PII in text: emails, phone numbers (E.164, NANP, keyword-anchored national), credit cards (Luhn + issuer prefix/length, brand), US SSNs (SSA validity rules) and IBANs (registry length + mod-97). Returns counts per type, findings with code-point offsets, confidence and masked values, and a redacted copy using stable labels ([EMAIL_1]) or inline masks. Raw values are only echoed with reveal:true. Offline; 200 KB text limit. Price: $0.01 USDC per successful call (x402, Solana). Same tool over HTTPS: POST https://scorptech.it.com/api/x402/v1/pii-detect

    Annotations the server declares

    • title: Pii Detect
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • prompt_injection_scanOffline prompt-injection / jailbreak / exfiltration scanner: 10 rule families (ignore-instructions, reveal-system, role-hijack, delimiter-escape, tool/secret dump, encoding smuggle…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Offline prompt-injection / jailbreak / exfiltration scanner: 10 rule families (ignore-instructions, reveal-system, role-hijack, delimiter-escape, tool/secret dump, encoding smuggle, policy bypass, authority claim, continuation trap, multilingual) plus hidden-Unicode and long-base64 heuristics. Returns verdict (clean|suspicious|critical), 0-100 score and match spans. Batch up to 20 texts. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: POST https://scorptech.it.com/api/x402/v1/prompt-injection-scan

    Annotations the server declares

    • title: Prompt Injection Scan
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • qr_generateGenerate a QR code (PNG or SVG, base64 + data URI) for any UTF-8 text up to 2953 bytes.Reads text others write1 finding

    Why it is in this group

    • The name "qr_generate" says "generate": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "qr_generate" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "qr_generate" says "generate": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Generate a QR code (PNG or SVG, base64 + data URI) for any UTF-8 text up to 2953 bytes. Options: ecc L|M|Q|H, size (px/module), margin, format png|svg, fg/bg hex colours. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/qr-generate

    Annotations the server declares

    • title: Qr Generate
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • rdap_ageLightweight RDAP registration age lookup: registered/expiry dates, ageDays, daysToExpiry, registrar, status flags via rdap.org bootstrap.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Lightweight RDAP registration age lookup: registered/expiry dates, ageDays, daysToExpiry, registrar, status flags via rdap.org bootstrap. Faster/cheaper than full domain-intel when you only need age. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/rdap-age

    Annotations the server declares

    • title: Rdap Age
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • readability_extractExtract the main article from a web page (Readability-style content scoring, no headless browser): clean body text with paragraph breaks plus title, byline, site name, published/mo…Reads text others writeCan send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Extract the main article from a web page (Readability-style content scoring, no headless browser): clean body text with paragraph breaks plus title, byline, site name, published/modified dates, language, excerpt, lead image, word count and reading time. Navigation, ads, share bars, comments and related-links blocks are stripped; JSON-LD articleBody is used when it is fuller. SSRF-safe fetch. Price: $0.01 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/readability-extract

    Annotations the server declares

    • title: Readability Extract
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • redirect_chainFollow HTTP redirects (max 10) with SSRF protections; report each hop status, Location, Server and Content-Type.Reads text others writeCan send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Follow HTTP redirects (max 10) with SSRF protections; report each hop status, Location, Server and Content-Type. Detect open-redirect chains and tracking bounces. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/redirect-chain

    Annotations the server declares

    • title: Redirect Chain
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • regex_testOffline PCRE2 regex tester (JS-compatible i/m/s/u flags): match (with offsets + capture groups), replace, or split.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Offline PCRE2 regex tester (JS-compatible i/m/s/u flags): match (with offsets + capture groups), replace, or split. Hard caps on backtracking/recursion and a structural ReDoS warning. Pattern max 2 KB, subject max 200 KB. Returns count, matches/result/parts and engine notes. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: POST https://scorptech.it.com/api/x402/v1/regex-test

    Annotations the server declares

    • title: Regex Test
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • repo_postureSecurity posture of a public GitHub repository from the OpenSSF Scorecard API: aggregate 0-10 score and rating, every check (Code-Review, Branch-Protection, Dangerous-Workflow, Tok…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Security posture of a public GitHub repository from the OpenSSF Scorecard API: aggregate 0-10 score and rating, every check (Code-Review, Branch-Protection, Dangerous-Workflow, Token-Permissions, Pinned-Dependencies, Signed-Releases, Vulnerabilities, SAST, Fuzzing, Security-Policy, ...) with score, risk level, status and reason, a list of failing important checks, plus GitHub signals: SECURITY.md location, license, archived, stars, last push. Price: $0.02 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/repo-posture

    Annotations the server declares

    • title: Repo Posture
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • sanctions_screenSanctions screening of a person or company NAME against the official consolidated lists: US OFAC SDN + non-SDN, UK Sanctions List (FCDO/OFSI), EU Financial Sanctions Files and the …Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Sanctions screening of a person or company NAME against the official consolidated lists: US OFAC SDN + non-SDN, UK Sanctions List (FCDO/OFSI), EU Financial Sanctions Files and the UN Security Council Consolidated List, loaded from the official files (no third-party aggregator). Transliteration-aware fuzzy matching; returns scored matches with list source, programmes/regimes, aliases, dates of birth, countries and listing date, plus each list's publication date. Price: $0.01 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/sanctions-screen

    Annotations the server declares

    • title: Sanctions Screen
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • sec_13fInstitutional holdings from a fund manager's latest SEC 13F-HR: the information table parsed from EDGAR, aggregated by CUSIP (issuer, class, shares, USD value, portfolio weight, pu…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Institutional holdings from a fund manager's latest SEC 13F-HR: the information table parsed from EDGAR, aggregated by CUSIP (issuer, class, shares, USD value, portfolio weight, put/call, voting authority), with filing period, totals, amendment and recent-filing links. Look up by manager name or CIK, or pin a specific accession. Price: $0.02 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/sec-13f

    Annotations the server declares

    • title: Sec 13f
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • sec_financialsNormalized financial statements for any SEC filer by ticker or CIK, straight from EDGAR XBRL: revenue, gross profit, operating income, net income, EPS, assets, liabilities, equity,…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Normalized financial statements for any SEC filer by ticker or CIK, straight from EDGAR XBRL: revenue, gross profit, operating income, net income, EPS, assets, liabilities, equity, cash, debt, operating cash flow, capex and free cash flow per fiscal year or quarter, with margins, current ratio, leverage, ROE and YoY growth. Handles concept switches (ASC 606) and IFRS 20-F filers; lists the XBRL concepts used. Price: $0.01 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/sec-financials

    Annotations the server declares

    • title: Sec Financials
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • sec_form4Insider trading from SEC Form 4: the latest Form 4 filings for a ticker or CIK parsed from EDGAR ownershipDocument XML.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Insider trading from SEC Form 4: the latest Form 4 filings for a ticker or CIK parsed from EDGAR ownershipDocument XML. Reporting owner and role, every transaction (code + meaning, shares, price, value, acquired/disposed, holdings after, derivative details) and open-market buy/sell totals. Price: $0.01 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/sec-form4

    Annotations the server declares

    • title: Sec Form4
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • sentimentSentiment analysis with VADER (Hutto & Gilbert 2014; MIT), the lexicon-and-rules model tuned for social media, reviews and short text: compound score (-1..1), positive/neutral/nega…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Sentiment analysis with VADER (Hutto & Gilbert 2014; MIT), the lexicon-and-rules model tuned for social media, reviews and short text: compound score (-1..1), positive/neutral/negative proportions and a label, handling negation, intensifiers, ALL-CAPS, "but" contrast, punctuation emphasis, slang, emoticons and emoji. Per-sentence breakdown, or batch up to 50 texts with a summary. Scores match the reference implementation. Offline, English. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: POST https://scorptech.it.com/api/x402/v1/sentiment

    Annotations the server declares

    • title: Sentiment
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • seo_auditOn-page SEO audit of one URL with a 0-100 score, letter grade and prioritised issues (high/medium/low): title and meta description length, robots meta and X-Robots-Tag noindex, can…Reads text others writeCan send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    On-page SEO audit of one URL with a 0-100 score, letter grade and prioritised issues (high/medium/low): title and meta description length, robots meta and X-Robots-Tag noindex, canonical, lang, viewport, charset, favicon, H1/heading outline, image alt coverage, internal/external/nofollow links, OpenGraph and Twitter cards, JSON-LD/microdata types, hreflang, mixed content, word count, plus robots.txt allow/deny for the URL and declared sitemaps. SSRF-safe fetching. Price: $0.01 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/seo-audit

    Annotations the server declares

    • title: Seo Audit
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • sol_balanceSOL and SPL token balances (classic SPL Token + Token-2022) for a Solana wallet address, via public Solana RPC.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    SOL and SPL token balances (classic SPL Token + Token-2022) for a Solana wallet address, via public Solana RPC. Read-only. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/sol-balance

    Annotations the server declares

    • title: Sol Balance
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • sol_token_metaSolana SPL / Token-2022 mint metadata: decimals, total supply, mint & freeze authority, Token-2022 extensions, and name/symbol/uri from on-chain metadata (Token-2022 or Metaplex), …Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Solana SPL / Token-2022 mint metadata: decimals, total supply, mint & freeze authority, Token-2022 extensions, and name/symbol/uri from on-chain metadata (Token-2022 or Metaplex), with Jupiter token list fallback. Read-only. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/sol-token-meta

    Annotations the server declares

    • title: Sol Token Meta
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • sol_token_riskHeuristic risk screen for a Solana token mint: mint/freeze authority, Token-2022 extensions (permanent delegate, transfer hook/fee, default-frozen, pausable...), metadata mutabilit…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Heuristic risk screen for a Solana token mint: mint/freeze authority, Token-2022 extensions (permanent delegate, transfer hook/fee, default-frozen, pausable...), metadata mutability, holder concentration, DEX liquidity and pair age (DexScreener), Jupiter verification. Returns a 0-100 score with itemised flags. Read-only; not a security guarantee. Price: $0.01 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/sol-token-risk

    Annotations the server declares

    • title: Sol Token Risk
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • solana_txDecode a Solana mainnet transaction via public RPC: status, fee, compute units, parsed instructions, inner instructions, account keys, logs.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Decode a Solana mainnet transaction via public RPC: status, fee, compute units, parsed instructions, inner instructions, account keys, logs. No API key. Unique on Bazaar. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/solana-tx

    Annotations the server declares

    • title: Solana Tx
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • ssl_blacklistabuse.ch SSL Blacklist (SSLBL): check whether a TLS certificate SHA1 fingerprint is blacklisted as malware / botnet C&C infrastructure (listing date and reason, e.g.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    abuse.ch SSL Blacklist (SSLBL): check whether a TLS certificate SHA1 fingerprint is blacklisted as malware / botnet C&C infrastructure (listing date and reason, e.g. "QuasarRAT C&C"), check an IP against the SSLBL botnet C2 IP list, or list the most recent blacklisted certificates filtered by reason. Several thousand certificates; CC0, commercial use allowed. Cached locally, refreshed every 30 minutes. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/ssl-blacklist

    Annotations the server declares

    • title: Ssl Blacklist
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • tech_stackLightweight technology fingerprint from public HTML/headers: CMS, frameworks (Next/Nuxt/React/Vue), CDNs, analytics, payments, generator meta, script/stylesheet samples.Reads text others writeCan send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Lightweight technology fingerprint from public HTML/headers: CMS, frameworks (Next/Nuxt/React/Vue), CDNs, analytics, payments, generator meta, script/stylesheet samples. No invasive probing. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/tech-stack

    Annotations the server declares

    • title: Tech Stack
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • text_chunkSplit text into retrieval-ready chunks for RAG and embeddings: recursive (paragraph > line > sentence > clause > word), markdown-aware (splits on headings, keeps the heading path p…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Split text into retrieval-ready chunks for RAG and embeddings: recursive (paragraph > line > sentence > clause > word), markdown-aware (splits on headings, keeps the heading path per chunk, respects code fences), sentence, or fixed windows; sized in estimated tokens or characters with overlap. Returns each chunk with Unicode start/end offsets, character and token estimates, plus totals. Deterministic and offline; 200 KB input. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: POST https://scorptech.it.com/api/x402/v1/text-chunk

    Annotations the server declares

    • title: Text Chunk
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • text_statsText statistics: characters, words, unique words, sentences, paragraphs, reading/speaking time, Flesch readability (English), language detection (27 languages/scripts), top keyword…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Text statistics: characters, words, unique words, sentences, paragraphs, reading/speaking time, Flesch readability (English), language detection (27 languages/scripts), top keywords. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/text-stats

    Annotations the server declares

    • title: Text Stats
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • timezone_convertConvert a time between IANA time zones with DST awareness: local time, UTC offset, abbreviation and DST flag on both sides, the offset difference and day shift, and each zone's nex…Reads text others write1 finding

    Why it is in this group

    • The name "timezone_convert" says "convert": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "timezone_convert" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "timezone_convert" says "convert": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Convert a time between IANA time zones with DST awareness: local time, UTC offset, abbreviation and DST flag on both sides, the offset difference and day shift, and each zone's next DST/offset transition (when, which way, how much). Flags nonexistent (spring-forward gap) and ambiguous (fall-back) wall times. Accepts ISO 8601, HH:MM, epoch seconds/milliseconds or "now"; up to 10 target zones. Offline (PHP's bundled tz database). Price: $0.01 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/timezone-convert

    Annotations the server declares

    • title: Timezone Convert
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • treasury_ratesUS Treasury rates: the daily par yield curve (1M-30Y, from treasury.gov) with day-over-day change in bp, 2s10s spread and 3m10y inversion flag, optional TIPS real yield curve, plus…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    US Treasury rates: the daily par yield curve (1M-30Y, from treasury.gov) with day-over-day change in bp, 2s10s spread and 3m10y inversion flag, optional TIPS real yield curve, plus Debt to the Penny (total public debt, debt held by the public, intragovernmental holdings) from the Fiscal Data API. Latest by default or as of a past date. Price: $0.01 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/treasury-rates

    Annotations the server declares

    • title: Treasury Rates
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • us_macroUS macro dashboard from BLS in one call: CPI and core CPI, unemployment, nonfarm payrolls, hourly earnings, participation, PPI and JOLTS openings.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    US macro dashboard from BLS in one call: CPI and core CPI, unemployment, nonfarm payrolls, hourly earnings, participation, PPI and JOLTS openings. Latest value, month, MoM / YoY change and 13-month history. Includes BLS retrieval date and disclaimer. Price: $0.01 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/us-macro

    Annotations the server declares

    • title: Us Macro
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • vin_decodeDecode a 17-character Vehicle Identification Number: offline structure check (allowed characters, ISO 3779 check digit, region and WMI, model-year code) plus NHTSA vPIC decoding (m…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Decode a 17-character Vehicle Identification Number: offline structure check (allowed characters, ISO 3779 check digit, region and WMI, model-year code) plus NHTSA vPIC decoding (make, model, model year, trim, body class, vehicle type, doors, drive type, engine cylinders/displacement/fuel, transmission, manufacturer, plant city/country, GVWR, safety equipment) and optional open NHTSA safety recalls for that make/model/year. Public US government data. Price: $0.01 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/vin-decode

    Annotations the server declares

    • title: Vin Decode
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • wallet_risk_basicBasic heuristic risk screen for a Solana or EVM (Ethereum/Base/Arbitrum) wallet: activity & age, bundled OFAC-SDN / mixer list matches for the address and recent counterparties, an…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Basic heuristic risk screen for a Solana or EVM (Ethereum/Base/Arbitrum) wallet: activity & age, bundled OFAC-SDN / mixer list matches for the address and recent counterparties, and (EVM) live token-approval exposure (unlimited allowances, approvals to EOAs or flagged spenders). Read-only; heuristic only, not a compliance determination or security guarantee. Price: $0.02 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/wallet-risk-basic

    Annotations the server declares

    • title: Wallet Risk Basic
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • waybackCheck Internet Archive Wayback Machine availability for a URL (closest snapshot timestamp + archived URL).Reads text others writeCan send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Check Internet Archive Wayback Machine availability for a URL (closest snapshot timestamp + archived URL). Public availability API. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/wayback

    Annotations the server declares

    • title: Wayback
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • weather_globalWorldwide weather forecast for any latitude/longitude from MET Norway Locationforecast 2.0 (the Norwegian Meteorological Institute; CC BY 4.0): current conditions (temperature, hum…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Worldwide weather forecast for any latitude/longitude from MET Norway Locationforecast 2.0 (the Norwegian Meteorological Institute; CC BY 4.0): current conditions (temperature, humidity, wind speed and direction, pressure, cloud cover, next-hour precipitation, condition text) and up to 9 daily summaries (min/max, precipitation total, max wind, dominant condition), optional hourly series, metric or imperial units, local-time grouping by any IANA zone. Cached per MET Norway Expires headers. Use /v1/weather-nws for US NWS alerts. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/weather-global

    Annotations the server declares

    • title: Weather Global
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • weather_nwsUS weather from the National Weather Service for a latitude/longitude: 7-day (or hourly) forecast periods with temperature, precipitation chance, wind and text forecast, plus all a…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    US weather from the National Weather Service for a latitude/longitude: 7-day (or hourly) forecast periods with temperature, precipitation chance, wind and text forecast, plus all active NWS watches, warnings and advisories for that point. US states, territories and coastal waters only. Price: $0.01 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/weather-nws

    Annotations the server declares

    • title: Weather Nws
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • wikipediaWikipedia in one call: search any of 340+ language editions (titles, descriptions, snippets, thumbnails) and get the top hit's summary, or fetch a summary by exact title.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Wikipedia in one call: search any of 340+ language editions (titles, descriptions, snippets, thumbnails) and get the top hit's summary, or fetch a summary by exact title. Returns title, short description, lead extract, canonical URL, thumbnail/lead image, Wikidata id, coordinates and last-modified, with the CC BY-SA attribution block. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/wikipedia

    Annotations the server declares

    • title: Wikipedia
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • x402_probex402 preflight for AI agents: inspect any paid endpoint BEFORE paying.Reads text others writeCan send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    x402 preflight for AI agents: inspect any paid endpoint BEFORE paying. Fetches the unpaid 402, decodes PAYMENT-REQUIRED (v2 header or v1 body), normalises price to USD, lists networks/assets/payTo/feePayer, validates the offer and Bazaar discovery schema, checks PayAI and Coinbase CDP discovery listing, and returns an OK/RISKY/BROKEN verdict. Never pays the target. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/x402-probe

    Annotations the server declares

    • title: X402 Probe
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
Only reads 25Show 25 read-only tools
  • airport_statusUS airport delay status from the FAA NAS Status feed (ground delay programs, ground stops, closures, arrival/departure delays) plus OurAirports metadata (name, city, ICAO/IATA, lat…Reads text others writeNo findings

    Why it is in this group

    • The name "airport_status" says "status": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    US airport delay status from the FAA NAS Status feed (ground delay programs, ground stops, closures, arrival/departure delays) plus OurAirports metadata (name, city, ICAO/IATA, lat/lon). Pass ?airport=SFO (IATA) or KSFO (ICAO), or omit for a nationwide overview. Public-domain sources. Price: $0.01 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/airport-status

    Annotations the server declares

    • title: Airport Status
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • clinical_trialsSearch ClinicalTrials.gov (API v2) by condition, keyword, location, sponsor, recruitment status (or open/closed) and phase.Reads text others writeNo findings

    Why it is in this group

    • The description's first verb is "search": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Search ClinicalTrials.gov (API v2) by condition, keyword, location, sponsor, recruitment status (or open/closed) and phase. Returns NCT id, title, status, phases, study type, conditions, interventions, lead sponsor, start and completion dates, enrollment, results flag, a short summary and up to 5 sites (ranked by your location), with total count and a page token. Informational only, not medical advice. Price: $0.02 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/clinical-trials

    Annotations the server declares

    • title: Clinical Trials
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • cron_explainExplain a standard 5-field cron expression in plain English and list its next N run times (default 5, max 20) in any IANA zone, DST-correct.Reads text others writeNo findings

    Why it is in this group

    • The name "cron_explain" says "explain": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Explain a standard 5-field cron expression in plain English and list its next N run times (default 5, max 20) in any IANA zone, DST-correct. Supports lists, ranges, steps (*/n, a-b/n), month/weekday names, 0 or 7 = Sunday and @yearly/@monthly/@weekly/@daily/@hourly/@reboot; applies cron's day-of-month OR day-of-week rule and notes it. Rejects invalid and never-firing expressions with a precise reason. Price: $0.01 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/cron-explain

    Annotations the server declares

    • title: Cron Explain
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • cve_lookupSearch NIST NVD CVE API 2.0 by product/keyword with optional CVSSv3 severity filter.Reads text others writeNo findings

    Why it is in this group

    • The name "cve_lookup" says "lookup": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Search NIST NVD CVE API 2.0 by product/keyword with optional CVSSv3 severity filter. Returns CVE ids, scores, vectors, descriptions and reference URLs. Public NVD data. Price: $0.01 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/cve-lookup

    Annotations the server declares

    • title: Cve Lookup
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • email_validateValidate an email address without sending mail: RFC 5321/5322 syntax, MX/A lookup (null-MX aware), disposable-domain detection (~10k domains), role-account and free-provider flags,…Reads text others writeNo findings

    Why it is in this group

    • The name "email_validate" says "validate": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Validate an email address without sending mail: RFC 5321/5322 syntax, MX/A lookup (null-MX aware), disposable-domain detection (~10k domains), role-account and free-provider flags, typo suggestion (gmial.com -> gmail.com), overall verdict. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/email-validate

    Annotations the server declares

    • title: Email Validate
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • ens_resolveResolve an ENS name to its Ethereum address (plus optional text records like avatar, url, com.twitter), or reverse-resolve an address to its forward-verified primary ENS name.Reads text others writeNo findings

    Why it is in this group

    • The name "ens_resolve" says "resolve": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe description's first sentence says "resolve" and "url": it reads web pages, which anyone can write.
    Description, as the server wrote it
    Resolve an ENS name to its Ethereum address (plus optional text records like avatar, url, com.twitter), or reverse-resolve an address to its forward-verified primary ENS name. Read-only, public RPC. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/ens-resolve

    Annotations the server declares

    • title: Ens Resolve
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • eu_vat_validateValidate an EU VAT number live against the European Commission VIES service: valid/invalid, plus registered trader name and address where the member state discloses them.Reads text others writeNo findings

    Why it is in this group

    • The name "eu_vat_validate" says "validate": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Validate an EU VAT number live against the European Commission VIES service: valid/invalid, plus registered trader name and address where the member state discloses them. Accepts IE6388047V style input or ?country= + number; GR is mapped to EL, XI = Northern Ireland. Price: $0.01 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/eu-vat-validate

    Annotations the server declares

    • title: Eu Vat Validate
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • evm_readRead-only eth_call of any view/pure function from a human signature (e.g.Reads text others writeNo findings

    Why it is in this group

    • The name "evm_read" says "read": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Read-only eth_call of any view/pure function from a human signature (e.g. balanceOf(address)(uint256) or `function name() view returns (string)`). ABI-encodes args, decodes outputs (address/uint/int/bool/string/bytes/arrays), and surfaces Error(string) / Panic(uint256) revert reasons. Six chains. No state change. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/evm-read

    Annotations the server declares

    • title: Evm Read
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • federal_registerSearch the U.S.Reads text others writeNo findings

    Why it is in this group

    • The description's first verb is "search": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Search the U.S. Federal Register (federalregister.gov) for rules, proposed rules, notices, presidential documents and executive orders by keyword, agency (name, short name such as EPA, or slug), type, publication date range and significance. Returns document number, title, type, agencies, action, abstract, citation, effective and comment-close dates, EO number and signing date, docket ids, RINs and HTML/PDF links. Price: $0.01 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/federal-register

    Annotations the server declares

    • title: Federal Register
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • feed_discoverFind a website's RSS/Atom/JSON feeds and read the latest items: parses <link rel="alternate"> tags, likely feed links and (if none) probes common feed paths, then parses the feed (…Reads text others writeCan send data outNo findings

    Why it is in this group

    • The description's first verb is "find": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe description's first sentence says "find" and "website": it reads web pages, which anyone can write.
    • untrusted-inputThe input takes a URL (input.url), and the tool reads it: it reads web pages, which anyone can write.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.

    Claude Code: ask, because it is tagged outbound.

    Description, as the server wrote it
    Find a website's RSS/Atom/JSON feeds and read the latest items: parses <link rel="alternate"> tags, likely feed links and (if none) probes common feed paths, then parses the feed (RSS 2.0, RSS 1.0/RDF, Atom 1.0, JSON Feed) into clean JSON items with title, link, published date (ISO), author, summary, categories and enclosure. Also accepts a feed URL directly. SSRF-safe fetches. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/feed-discover

    Annotations the server declares

    • title: Feed Discover
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • iban_validateValidate an IBAN offline: ISO 7064 mod-97 checksum, per-country length and BBAN structure from the SWIFT IBAN registry (100+ countries plus national/experimental ones), national ch…Reads text others writeNo findings

    Why it is in this group

    • The name "iban_validate" says "validate": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Validate an IBAN offline: ISO 7064 mod-97 checksum, per-country length and BBAN structure from the SWIFT IBAN registry (100+ countries plus national/experimental ones), national check digits for BE, ES, FR (+territories), IT/SM and NO; returns country, SEPA membership, bank code, branch code and account number, and the expected check digits on a typo. Optional BIC/SWIFT structure check (ISO 9362) and BIC-vs-IBAN country match. No data leaves the server. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/iban-validate

    Annotations the server declares

    • title: Iban Validate
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • image_infoInspect an image without decoding pixels: format, dimensions (EXIF-orientation aware), megapixels, animation, sha256, EXIF summary (camera, exposure, GPS).Reads text others writeNo findings

    Why it is in this group

    • The description's first verb is "inspect": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Inspect an image without decoding pixels: format, dimensions (EXIF-orientation aware), megapixels, animation, sha256, EXIF summary (camera, exposure, GPS). Body: { "image": "<base64>" }. Max ~190KB input image (the service caps POST bodies at 256KB, base64 included). Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: POST https://scorptech.it.com/api/x402/v1/image-info

    Annotations the server declares

    • title: Image Info
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • robots_sitemapFetch and parse robots.txt plus discovered sitemaps for a domain: user-agents, allow/disallow samples, sitemap index vs urlset, URL counts and sample locs.Reads text others writeNo findings

    Why it is in this group

    • The description's first verb is "fetch": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe description's first sentence says "fetch" and "url": it reads web pages, which anyone can write.
    Description, as the server wrote it
    Fetch and parse robots.txt plus discovered sitemaps for a domain: user-agents, allow/disallow samples, sitemap index vs urlset, URL counts and sample locs. Useful for crawl planning and AI agent politeness checks. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/robots-sitemap

    Annotations the server declares

    • title: Robots Sitemap
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • schema_validateValidate JSON data against a JSON Schema (Ajv + formats).Reads text others writeNo findings

    Why it is in this group

    • The name "schema_validate" says "validate": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Validate JSON data against a JSON Schema (Ajv + formats). Body: { "schema": {...}, "data": {...} }. Returns valid boolean and error list. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: POST https://scorptech.it.com/api/x402/v1/schema-validate

    Annotations the server declares

    • title: Schema Validate
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • ssl_cert_infoInspect a live TLS certificate: subject, issuer, SANs, validity window, days to expiry, SHA-256 fingerprint, key type/size, full presented chain, negotiated TLS version/cipher, cha…Reads text others writeNo findings

    Why it is in this group

    • The description's first verb is "inspect": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Inspect a live TLS certificate: subject, issuer, SANs, validity window, days to expiry, SHA-256 fingerprint, key type/size, full presented chain, negotiated TLS version/cipher, chain trust and RFC 6125 hostname match. Implicit-TLS ports 443/465/587/636/853/993/995/5223/8443. Price: $0.01 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/ssl-cert-info

    Annotations the server declares

    • title: Ssl Cert Info
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • text_diffDiff two texts: unified line diff byte-compatible with GNU diff -u (hunks, context, "No newline at end of file"), or word-level / character-level diff with [-removed-]{+added+} inl…Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "text_diff" says "diff": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "diff" and "file": it reads files.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Diff two texts: unified line diff byte-compatible with GNU diff -u (hunks, context, "No newline at end of file"), or word-level / character-level diff with [-removed-]{+added+} inline markup and merged ops. Myers shortest edit script with a patience fallback for very different inputs; options to ignore whitespace, case and CRLF/LF. Returns added/removed/unchanged counts and a similarity ratio. Offline; 20,000 lines or tokens per text. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: POST https://scorptech.it.com/api/x402/v1/text-diff

    Annotations the server declares

    • title: Text Diff
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • ticker_resolverResolve a stock ticker (or CIK) to the SEC CIK, registrant name, exchange and sibling share classes from SEC EDGAR's company_tickers_exchange list, plus the issuer's Legal Entity I…Reads text others writeNo findings

    Why it is in this group

    • The description's first verb is "resolve": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Resolve a stock ticker (or CIK) to the SEC CIK, registrant name, exchange and sibling share classes from SEC EDGAR's company_tickers_exchange list, plus the issuer's Legal Entity Identifier (LEI) from GLEIF matched by normalised legal name, with match confidence, registration status, jurisdiction and alternatives. BRK.B / BRK-B forms accepted. Price: $0.01 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/ticker-resolver

    Annotations the server declares

    • title: Ticker Resolver
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • url_markdownFetch a public HTML page and convert main/article content to Markdown (Turndown).Reads text others writeCan send data outNo findings

    Why it is in this group

    • The description's first verb is "fetch": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe name "url_markdown" says "url": it reads web pages, which anyone can write.
    • untrusted-inputThe description's first sentence says "fetch" and "html": it reads web pages, which anyone can write.
    • untrusted-inputThe input takes a URL (input.url), and the tool reads it: it reads web pages, which anyone can write.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.

    Claude Code: ask, because it is tagged outbound.

    Description, as the server wrote it
    Fetch a public HTML page and convert main/article content to Markdown (Turndown). Scripts/styles stripped; output capped. Good for RAG/agent ingestion. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/url-markdown

    Annotations the server declares

    • title: Url Markdown
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • validate_batchOffline format validator for up to 100 values: email, URL, IPv4/IPv6, domain, UUID (version/variant), credit card (Luhn + brand, number masked in output), IBAN (mod-97 + country le…Reads text others writeNo findings

    Why it is in this group

    • The name "validate_batch" says "validate": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Offline format validator for up to 100 values: email, URL, IPv4/IPv6, domain, UUID (version/variant), credit card (Luhn + brand, number masked in output), IBAN (mod-97 + country length), phone (E.164), JSON, base64/base64url. POST JSON body only (never in the URL): single {"type","value"} or batch {"items":[{"type","value"},...]}. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: POST https://scorptech.it.com/api/x402/v1/validate-batch

    Annotations the server declares

    • title: Validate Batch
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • web_to_textFetch a public web page and return its main content as clean plain text (boilerplate stripped, lists as bullets, tables tab-separated) plus title, description, language, word count…Reads private dataReads text others writeCan send data outNo findings

    Why it is in this group

    • The description's first verb is "fetch": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "fetch" and "table": it reads databases.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe name "web_to_text" says "web": it reads web pages, which anyone can write.
    • untrusted-inputThe description's first sentence says "fetch" and "web": it reads web pages, which anyone can write.
    • untrusted-inputThe input takes a URL (input.url), and the tool reads it: it reads web pages, which anyone can write.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.

    Claude Code: ask, because it is tagged outbound.

    Description, as the server wrote it
    Fetch a public web page and return its main content as clean plain text (boilerplate stripped, lists as bullets, tables tab-separated) plus title, description, language, word count. Price: $0.005 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/web-to-text

    Annotations the server declares

    • title: Web To Text
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

7728 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 3 private-data tools breaks every one.

Reads private data3
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write112
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out23
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
deny to break every path
{
  "permissions": {
    "deny": [
      "mcp__x402__sec_edgar_search",
      "mcp__x402__text_diff",
      "mcp__x402__web_to_text"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

13 warn
  • Warnurl_links_extract

    The server marks "url_links_extract" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "url_links_extract" says "link": a word for a change.

    What this check looks for
  • Warnqr_generate

    The server marks "qr_generate" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "qr_generate" says "generate": a word for a change.

    What this check looks for
  • Warnhtml_to_markdown

    The server marks "html_to_markdown" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The description's first verb is "convert": a word for a change.

    What this check looks for
  • Warnimage_resize

    The server marks "image_resize" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "image_resize" says "resize": a word for a change.

    What this check looks for
  • Warnfx_rate

    The server marks "fx_rate" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The input addresses people (input.to): what it sends cannot be taken back.

    What this check looks for
  • Warnmacro_indicators

    The server marks "macro_indicators" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The input addresses people (input.to): what it sends cannot be taken back.

    What this check looks for
Show 7 more findings
  • Warnformat_convert

    The server marks "format_convert" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "format_convert" says "convert": a word for a change.

    What this check looks for
  • Warntimezone_convert

    The server marks "timezone_convert" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "timezone_convert" says "convert": a word for a change.

    What this check looks for
  • Warnusaspending_awards

    The server marks "usaspending_awards" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The input addresses people (input.recipient): what it sends cannot be taken back.

    What this check looks for
  • Warnevm_token_transfers

    The server marks "evm_token_transfers" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "evm_token_transfers" says "transfer": a word for a change that another call does not undo.

    What this check looks for
  • Warnfda_adverse_events

    The server marks "fda_adverse_events" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The input addresses people (input.to): what it sends cannot be taken back.

    What this check looks for
  • Warnfda_recalls

    The server marks "fda_recalls" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The input addresses people (input.to): what it sends cannot be taken back.

    What this check looks for
  • Warnfda_device

    The server marks "fda_device" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The input addresses people (input.to): what it sends cannot be taken back.

    What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http x402 https://scorptech.it.com/api/x402/mcp
claude mcp add --transport http x402 https://scorptech.it.com/api/x402/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__x402__robots_sitemap",
      "mcp__x402__cve_lookup",
      "mcp__x402__schema_validate",
      "mcp__x402__image_info",
      "mcp__x402__sec_edgar_search",
      "mcp__x402__arxiv_search",
      "mcp__x402__hn_search",
      "mcp__x402__ssl_cert_info",
      "mcp__x402__email_validate",
      "mcp__x402__validate_batch",
      "mcp__x402__ens_resolve",
      "mcp__x402__eu_vat_validate",
      "mcp__x402__iban_validate",
      "mcp__x402__pubmed_search",
      "mcp__x402__openalex_search",
      "mcp__x402__cron_explain",
      "mcp__x402__ticker_resolver",
      "mcp__x402__clinical_trials",
      "mcp__x402__federal_register",
      "mcp__x402__text_diff",
      "mcp__x402__evm_read",
      "mcp__x402__airport_status"
    ],
    "ask": [
      "mcp__x402__headers_audit",
      "mcp__x402__email_auth",
      "mcp__x402__domain_intel",
      "mcp__x402__tech_stack",
      "mcp__x402__rdap_age",
      "mcp__x402__phishing_score",
      "mcp__x402__package_risk",
      "mcp__x402__github_health",
      "mcp__x402__opengraph",
      "mcp__x402__url_markdown",
      "mcp__x402__mx_check",
      "mcp__x402__ip_intel",
      "mcp__x402__solana_tx",
      "mcp__x402__wayback",
      "mcp__x402__dns_dump",
      "mcp__x402__ct_subdomains",
      "mcp__x402__redirect_chain",
      "mcp__x402__http_probe",
      "mcp__x402__x402_probe",
      "mcp__x402__web_to_text",
      "mcp__x402__url_links_extract",
      "mcp__x402__qr_generate",
      "mcp__x402__text_stats",
      "mcp__x402__html_to_markdown",
      "mcp__x402__image_resize",
      "mcp__x402__sec_form4",
      "mcp__x402__company_profile",
      "mcp__x402__weather_nws",
      "mcp__x402__earthquakes",
      "mcp__x402__holidays_business_days",
      "mcp__x402__dns_propagation",
      "mcp__x402__password_strength",
      "mcp__x402__sol_balance",
      "mcp__x402__sol_token_meta",
      "mcp__x402__sol_token_risk",
      "mcp__x402__evm_balance",
      "mcp__x402__evm_tx_info",
      "mcp__x402__fx_rate",
      "mcp__x402__geocode",
      "mcp__x402__wallet_risk_basic",
      "mcp__x402__sanctions_screen",
      "mcp__x402__sec_13f",
      "mcp__x402__treasury_rates",
      "mcp__x402__domain_availability",
      "mcp__x402__ip_reputation",
      "mcp__x402__cisa_kev",
      "mcp__x402__epss_score",
      "mcp__x402__hsts_preload",
      "mcp__x402__macro_indicators",
      "mcp__x402__osv_scan",
      "mcp__x402__osv_scan_batch",
      "mcp__x402__wikipedia",
      "mcp__x402__feed_discover",
      "mcp__x402__evm_selector_decode",
      "mcp__x402__readability_extract",
      "mcp__x402__format_convert",
      "mcp__x402__repo_posture",
      "mcp__x402__timezone_convert",
      "mcp__x402__usaspending_awards",
      "mcp__x402__openfda_drug",
      "mcp__x402__pii_detect",
      "mcp__x402__jwt_decode",
      "mcp__x402__contact_extract",
      "mcp__x402__seo_audit",
      "mcp__x402__weather_global",
      "mcp__x402__github_trending",
      "mcp__x402__json_repair",
      "mcp__x402__sentiment",
      "mcp__x402__food_barcode",
      "mcp__x402__vin_decode",
      "mcp__x402__eol_check",
      "mcp__x402__text_chunk",
      "mcp__x402__hash_encode",
      "mcp__x402__census_geographies",
      "mcp__x402__evm_contract_info",
      "mcp__x402__evm_token_transfers",
      "mcp__x402__evm_allowance",
      "mcp__x402__evm_gas",
      "mcp__x402__nft_metadata",
      "mcp__x402__prompt_injection_scan",
      "mcp__x402__dockerfile_lint",
      "mcp__x402__regex_test",
      "mcp__x402__sec_financials",
      "mcp__x402__fund_holdings",
      "mcp__x402__fda_adverse_events",
      "mcp__x402__fda_recalls",
      "mcp__x402__fda_device",
      "mcp__x402__bls_series",
      "mcp__x402__us_macro",
      "mcp__x402__ssl_blacklist"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as x402. Review it before you use it.

Capability tags behind 112 rules
  • mcp__x402__headers_audit untrusted-input, outbound
  • mcp__x402__email_auth untrusted-input
  • mcp__x402__domain_intel untrusted-input
  • mcp__x402__robots_sitemap untrusted-input
  • mcp__x402__tech_stack untrusted-input, outbound
  • mcp__x402__rdap_age untrusted-input
  • mcp__x402__phishing_score untrusted-input, outbound
  • mcp__x402__cve_lookup untrusted-input
  • mcp__x402__package_risk untrusted-input
  • mcp__x402__github_health untrusted-input
  • mcp__x402__opengraph untrusted-input, outbound
  • mcp__x402__url_markdown untrusted-input, outbound
  • mcp__x402__schema_validate untrusted-input
  • mcp__x402__mx_check untrusted-input
  • mcp__x402__ip_intel untrusted-input
  • mcp__x402__solana_tx untrusted-input
  • mcp__x402__wayback untrusted-input, outbound
  • mcp__x402__dns_dump untrusted-input
  • mcp__x402__ct_subdomains untrusted-input
  • mcp__x402__redirect_chain untrusted-input, outbound
  • mcp__x402__http_probe untrusted-input, outbound
  • mcp__x402__x402_probe untrusted-input, outbound
  • mcp__x402__web_to_text private-data, untrusted-input, outbound
  • mcp__x402__url_links_extract untrusted-input, outbound
  • mcp__x402__qr_generate untrusted-input
  • mcp__x402__text_stats untrusted-input
  • mcp__x402__html_to_markdown untrusted-input
  • mcp__x402__image_info untrusted-input
  • mcp__x402__image_resize untrusted-input
  • mcp__x402__sec_edgar_search private-data, untrusted-input
  • mcp__x402__sec_form4 untrusted-input
  • mcp__x402__company_profile untrusted-input, outbound
  • mcp__x402__weather_nws untrusted-input
  • mcp__x402__arxiv_search untrusted-input
  • mcp__x402__earthquakes untrusted-input
  • mcp__x402__holidays_business_days untrusted-input
  • mcp__x402__hn_search untrusted-input
  • mcp__x402__dns_propagation untrusted-input
  • mcp__x402__ssl_cert_info untrusted-input
  • mcp__x402__email_validate untrusted-input
  • mcp__x402__password_strength untrusted-input
  • mcp__x402__validate_batch untrusted-input
  • mcp__x402__sol_balance untrusted-input
  • mcp__x402__sol_token_meta untrusted-input
  • mcp__x402__sol_token_risk untrusted-input
  • mcp__x402__evm_balance untrusted-input
  • mcp__x402__evm_tx_info untrusted-input
  • mcp__x402__fx_rate untrusted-input, outbound
  • mcp__x402__ens_resolve untrusted-input
  • mcp__x402__geocode untrusted-input
  • mcp__x402__wallet_risk_basic untrusted-input
  • mcp__x402__sanctions_screen untrusted-input
  • mcp__x402__sec_13f untrusted-input
  • mcp__x402__treasury_rates untrusted-input
  • mcp__x402__domain_availability untrusted-input
  • mcp__x402__eu_vat_validate untrusted-input
  • mcp__x402__ip_reputation untrusted-input
  • mcp__x402__cisa_kev untrusted-input
  • mcp__x402__epss_score untrusted-input
  • mcp__x402__hsts_preload untrusted-input
  • mcp__x402__macro_indicators untrusted-input, outbound
  • mcp__x402__osv_scan untrusted-input
  • mcp__x402__osv_scan_batch untrusted-input
  • mcp__x402__iban_validate untrusted-input
  • mcp__x402__wikipedia untrusted-input
  • mcp__x402__pubmed_search untrusted-input
  • mcp__x402__feed_discover untrusted-input, outbound
  • mcp__x402__evm_selector_decode untrusted-input
  • mcp__x402__readability_extract untrusted-input, outbound
  • mcp__x402__openalex_search untrusted-input
  • mcp__x402__format_convert untrusted-input, outbound
  • mcp__x402__repo_posture untrusted-input
  • mcp__x402__timezone_convert untrusted-input
  • mcp__x402__cron_explain untrusted-input
  • mcp__x402__ticker_resolver untrusted-input
  • mcp__x402__usaspending_awards untrusted-input, outbound
  • mcp__x402__openfda_drug untrusted-input
  • mcp__x402__clinical_trials untrusted-input
  • mcp__x402__federal_register untrusted-input
  • mcp__x402__pii_detect untrusted-input
  • mcp__x402__jwt_decode untrusted-input
  • mcp__x402__text_diff private-data, untrusted-input
  • mcp__x402__contact_extract untrusted-input, outbound
  • mcp__x402__seo_audit untrusted-input, outbound
  • mcp__x402__weather_global untrusted-input
  • mcp__x402__github_trending untrusted-input
  • mcp__x402__json_repair untrusted-input
  • mcp__x402__sentiment untrusted-input
  • mcp__x402__food_barcode untrusted-input
  • mcp__x402__vin_decode untrusted-input
  • mcp__x402__eol_check untrusted-input
  • mcp__x402__text_chunk untrusted-input
  • mcp__x402__hash_encode untrusted-input
  • mcp__x402__census_geographies untrusted-input
  • mcp__x402__evm_contract_info untrusted-input
  • mcp__x402__evm_token_transfers untrusted-input
  • mcp__x402__evm_allowance untrusted-input
  • mcp__x402__evm_gas untrusted-input
  • mcp__x402__nft_metadata untrusted-input
  • mcp__x402__evm_read untrusted-input
  • mcp__x402__prompt_injection_scan untrusted-input
  • mcp__x402__airport_status untrusted-input
  • mcp__x402__dockerfile_lint untrusted-input
  • mcp__x402__regex_test untrusted-input
  • mcp__x402__sec_financials untrusted-input
  • mcp__x402__fund_holdings untrusted-input
  • mcp__x402__fda_adverse_events untrusted-input, outbound
  • mcp__x402__fda_recalls untrusted-input, outbound
  • mcp__x402__fda_device untrusted-input, outbound
  • mcp__x402__bls_series untrusted-input
  • mcp__x402__us_macro untrusted-input
  • mcp__x402__ssl_blacklist untrusted-input

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/com.it.scorptech/x402/verify?hash=f04271e5ddc189fcb1067d8af0a99ad0c749d8f88541cbe68a9c5b42bc38be51" | jq -e '.changed == false'

Pinned hash f04271e5ddc1, from Oct 23, 2026, 03:17 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/com.it.scorptech/x402/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for com.it.scorptech/x402
[![anlyon.dev](https://anlyon.dev/badge/com.it.scorptech/x402.svg)](https://anlyon.dev/servers/com.it.scorptech/x402)

Source: MCP Registry. Synced Oct 23, 2026, 03:17 UTC.