Skip to content

Johto Data

by johtodata.com · remote · no sign-in to list tools · v1.0.0 · published by com.johtodata

Johto Data: pay-per-call company, compliance and filings data via x402. Free sample on every tool.

Changes · 9
CompareRegistry entry

10 tools: 9 change things and 1 only read.

Scanned Oct 22, 2026

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http johto-data https://johto-x402-api.johtodata.workers.dev/mcp

Findings

Matches of fixed checks, with the text they matched.

1 warn
  • Warnjobs

    The server marks "jobs" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The description's first verb is "open": a word for a change.

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

10 tools

Changes things 9Claude Code: ask
  • crawlCrawl up to 20 pages under a start URL into Markdown: url, HTTP status, title, description, markdown, token estimate, content hash, truncated flag, depth and load time per page.Reads text others writeCan send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe name "crawl" says "crawl": it reads web pages, which anyone can write.
    • untrusted-inputThe description's first sentence says "crawl": it reads web pages, which anyone can write.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Crawl up to 20 pages under a start URL into Markdown: url, HTTP status, title, description, markdown, token estimate, content hash, truncated flag, depth and load time per page. Not charged if no page is read. ?url=https://docs.example.com&pages=20&max_chars=20000 Use when: you need a docs site or one section of a site (up to 20 pages under a start URL) as Markdown. Don't use when: you need a single page (use /v1/read), more than 20 pages, pages outside the start URL path, or content behind a login or paywall. Price: $0.0045 per call over x402 (USDC on Base). Set sample:true for a free sample.

    Annotations the server declares

    • title: Johto Data crawl
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • jobsOpen jobs from named Lever boards, up to 25 per call: title, location, remote flag, published salary range, employment type, posted date, apply URL.Reads text others write1 finding

    Why it is in this group

    • The description's first verb is "open": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "jobs" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The description's first verb is "open": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Open jobs from named Lever boards, up to 25 per call: title, location, remote flag, published salary range, employment type, posted date, apply URL. Not charged if no job matches. ?companies=lever:zoox&title=engineer&days=7&remote=1&limit=25 Use when: you need current open roles at named companies that hire through Lever, with salary ranges where the employer publishes them. Don't use when: you need a keyword search across all employers, boards on other hiring systems, or candidate profiles. Price: $0.01 per call over x402 (USDC on Base). Set sample:true for a free sample.

    Annotations the server declares

    • title: Johto Data jobs
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • jp-invoice-check$0.002 per call.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    $0.002 per call. Status of one Japanese qualified-invoice issuer registration number (適格請求書発行事業者 登録番号, T + 13 digits) for corporations (法人): registration_number, status (registered, cancelled, expired, not_found), name, registration_date, update_date, cancel_date and expire_date when set, prefecture of the head office, data_as_of and source. Batch: POST {"numbers":[...]} with up to 1000 numbers at $0.0012 per unique number; the price is set from the count before payment. Data as of 2026-10-21, from the National Tax Agency bulk download files (full monthly file plus daily diff files). Sole-proprietor registrations are not covered and return not_found. Free sample: ?sample=1 (25 rows). Invalid numbers (format or check digit) return 400, not charged. Data not loaded returns 503, not charged. 出典：国税庁適格請求書発行事業者公表サイト（国税庁）（https://www.invoice-kohyo.nta.go.jp/）。国税庁適格請求書発行事業者公表サイト（国税庁）（https://www.invoice-kohyo.nta.go.jp/）を加工して作成。Johto Data作成。国が作成したものではありません。 ?t=T1180301018771 Use when: you need to confirm that a Japanese corporate supplier's invoice registration number (T-number) is valid, cancelled or expired before paying an invoice or claiming input tax credit, one at a time or in batches of up to 1,000. Don't use when: you need sole-proprietor (個人事業者) registrations, the full address, the 法人番号 register itself, credit or financial data, or tax advice. Price: $0.002 per call over x402 (USDC on Base). Set sample:true for a free sample.

    Annotations the server declares

    • title: Johto Data jp-invoice-check
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • kybCompany verification from GLEIF LEI and SEC EDGAR: LEI status, registration number, jurisdiction, direct/ultimate parent, CIK, ticker, EIN, SIC, last filing.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Company verification from GLEIF LEI and SEC EDGAR: LEI status, registration number, jurisdiction, direct/ultimate parent, CIK, ticker, EIN, SIC, last filing. Up to 10 rows. Pass one of name, lei, ticker or cik. Not charged if nothing matches. ?name=Tesla, Inc. Use when: you need to confirm a company's legal identity (LEI, registration number, jurisdiction, parents, SEC CIK and ticker) before onboarding or a deal. Don't use when: you need data on people, credit scores, financial statements or sanctions screening. Price: $0.0029 per call over x402 (USDC on Base). Set sample:true for a free sample.

    Annotations the server declares

    • title: Johto Data kyb
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • new-trucking-companiesNew US motor carriers from FMCSA records, company-named entities only (no sole proprietors), up to 25 per call: USDOT, legal name, add date, city/state, fleet size, operation type,…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    New US motor carriers from FMCSA records, company-named entities only (no sole proprietors), up to 25 per call: USDOT, legal name, add date, city/state, fleet size, operation type, authority and insurance status, SAFER link. Not charged if no carrier matches. ?state=TX&days=7&no_insurance=1 Use when: you need newly registered US motor carriers as sales leads, for example for insurance, factoring or fleet services. Don't use when: you need personal contact details (none are returned), long-established carriers, or fleets outside the US. Price: $0.0475 per call over x402 (USDC on Base). Set sample:true for a free sample.

    Annotations the server declares

    • title: Johto Data new-trucking-companies
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • sanctions-screen$0.003 per call.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    $0.003 per call. Screen one person or entity name against the OFAC SDN and UK Sanctions List. Returns verdict (MATCH, POSSIBLE_MATCH, CLEAR), query, and up to 20 matches with name matched, primaryName, list, listId, entityType, programs or regimes, score 0-1, matchType (exact, alias, fuzzy), dob and nationality where listed (OFAC SDN entries; UK Sanctions List entries are names-only), plus listsChecked, listsAsOf and fetchedAt. Fuzzy matching handles typos, word order, diacritics and company suffixes. Optional filters: type, dob, country, threshold, limit. Snapshots: OFAC SDN list 2026-10-21, UK Sanctions List 2026-10-16. A CLEAR verdict is a full answer and is charged. Free sample: ?sample=1. Invalid input returns 400, not charged. A screening aid, not legal advice. Contains public sector information licensed under the Open Government Licence v3.0. ?name=Bank Rossiya&type=any&threshold=0.85&limit=10 Use when: you need to check a counterparty, customer or supplier name against the OFAC SDN and UK Sanctions List before onboarding, paying or shipping. Don't use when: you need any list other than the OFAC SDN and UK Sanctions List, wallet addresses (use /v1/wallet-risk), adverse media, politically exposed persons, ownership data, or a legal determination. Price: $0.003 per call over x402 (USDC on Base). Set sample:true for a free sample.

    Annotations the server declares

    • title: Johto Data sanctions-screen
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • sec-13f$0.003 per call.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    $0.003 per call. 13F-HR holdings for one institutional filer (fund or manager), top positions by value, up to 100 per call (offset pages through the rest): filerName, filerCik, reportDate, filedAt, accessionNumber, and per holding issuer, cusip, titleOfClass, valueUsd, shares, sharesType, putCall, investmentDiscretion, votingSole, votingShared, votingNone and pctOfPortfolio, plus portfolio total and fetchedAt. Newest report period by default; pick any 13F-HR or 13F-HR/A with accession. Pass exactly one of cik or ticker. Free sample: ?sample=1. Not charged if nothing matches or SEC EDGAR is unavailable. Invalid input returns 400, not charged. The largest filers are served from a stored snapshot (snapshotAsOf gives its time); other very large filers may return 503 (not charged). ?cik=1067983&limit=25 Use when: you need what a fund or investment manager reported holding at quarter end: positions by CUSIP with value, shares, put/call and voting authority, ranked by value. Don't use when: you need intra-quarter trades, insider Form 4 trades, short positions, holdings not reported on 13F (non-US listings, most bonds, cash), or ticker symbols for each position (13F reports CUSIPs). Price: $0.003 per call over x402 (USDC on Base). Set sample:true for a free sample.

    Annotations the server declares

    • title: Johto Data sec-13f
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • sec-8k$0.003 per call.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    $0.003 per call. Recent 8-K and 8-K/A filings for one SEC filer, up to 20 per call, newest first: companyName, cik, ticker, formType, filedDate, filedAt, reportDate, accessionNumber, items with item names, fileNumber, documentUrl and filingIndexUrl, plus fetchedAt. Pass exactly one of ticker or cik. Free sample: ?sample=1. Not charged if no filing matches or SEC EDGAR is unavailable. Invalid input returns 400, not charged. ?ticker=AAPL&limit=10&since=2026-01-01 Use when: you need a company's recent 8-K current reports (earnings, executive changes, deals, other material events) with item codes and links to each filing. Don't use when: you need the full filing text, other forms (10-K, 10-Q, Form 4, 13F), a feed across all companies, or filers outside SEC EDGAR. Price: $0.003 per call over x402 (USDC on Base). Set sample:true for a free sample.

    Annotations the server declares

    • title: Johto Data sec-8k
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • wallet-risk$0.0025 per call.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    $0.0025 per call. Screen one EVM address against the OFAC SDN list and the ScamSniffer phishing address list. Returns verdict (BLOCK, REVIEW, CLEAR), riskScore, flags, ofacSanctioned, ofacMatches (OFAC id, currency, programs), scamSnifferListed and listsAsOf. Snapshots: OFAC SDN list 2026-10-21, ScamSniffer phishing address list 2026-10-22. A screening aid, not legal advice. Invalid input returns 400, not charged. ?address=0x... Use when: you want a quick check of one EVM address against the OFAC SDN list and the ScamSniffer phishing address list before you send funds, accept a payment or onboard a wallet. Don't use when: you need Bitcoin, Tron or Solana addresses, name-based sanctions screening, on-chain history, or a legal determination. Price: $0.0025 per call over x402 (USDC on Base). Set sample:true for a free sample.

    Annotations the server declares

    • title: Johto Data wallet-risk
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
Only reads 1Claude Code: allow, ask for 1 outbound
  • readRead one web page as Markdown: url, HTTP status, title, markdown, token estimate and content hash.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "read" says "read": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe description's first sentence says "read" and "web": it reads web pages, which anyone can write.
    • untrusted-inputThe input takes a URL (input.url), and the tool reads it: it reads web pages, which anyone can write.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.

    Claude Code: ask, because it is tagged outbound.

    Description, as the server wrote it
    Read one web page as Markdown: url, HTTP status, title, markdown, token estimate and content hash. One http(s) URL per call. Not charged if the page fails. Caller is responsible for the target site's terms. robots.txt is respected. ?url=https://...&max_chars=20000 Use when: you need one web page as clean Markdown for an LLM or RAG pipeline. Don't use when: you need many pages from one site (use /v1/crawl), or the page needs a login or sits behind a paywall. Price: $0.0019 per call over x402 (USDC on Base). Set sample:true for a free sample.

    Annotations the server declares

    • title: Johto Data read
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data.

Reads private data0
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write10
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out2
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http johto-data https://johto-x402-api.johtodata.workers.dev/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [],
    "ask": [
      "mcp__johto-data__read",
      "mcp__johto-data__crawl",
      "mcp__johto-data__jobs",
      "mcp__johto-data__kyb",
      "mcp__johto-data__new-trucking-companies",
      "mcp__johto-data__wallet-risk",
      "mcp__johto-data__sec-8k",
      "mcp__johto-data__sec-13f",
      "mcp__johto-data__sanctions-screen",
      "mcp__johto-data__jp-invoice-check"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as johto-data. Review it before you use it.

Capability tags behind 10 rules
  • mcp__johto-data__read untrusted-input, outbound
  • mcp__johto-data__crawl untrusted-input, outbound
  • mcp__johto-data__jobs untrusted-input
  • mcp__johto-data__kyb untrusted-input
  • mcp__johto-data__new-trucking-companies untrusted-input
  • mcp__johto-data__wallet-risk untrusted-input
  • mcp__johto-data__sec-8k untrusted-input
  • mcp__johto-data__sec-13f untrusted-input
  • mcp__johto-data__sanctions-screen untrusted-input
  • mcp__johto-data__jp-invoice-check untrusted-input