Skip to content
anlyon.dev

Novarithm Agent Hub: SEO & GEO audits and business checks

com.novarithm.www/agent-hubwww.novarithm.comstreamable-httpv1.0.0Scanned

Live SEO & GEO audits for any URL (technical, keywords, links, local, AI visibility). Pay per call.

28 tools: 4 do something that can't be undone, 23 change things and 1 only read.

Tools: 0 delete, 4 irreversible, 23 write, 1 read.
  • Reads private data · 0
  • Reads text others write · 2
  • Can send data out · 14
  • No findings

Anlyon alternative

27 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →
Compare with similar serversMarkdownJSONReport this listing

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

28 tools

Can't be undone 4Claude Code: ask
  • fx_convert[PAID $0.002 USDC/call, x402, eip155:8453] Convert an amount between two currencies at the official ECB reference rate (today or any date since 1999), incl.Can send data outNo findings

    Why it is in this group

    • The name "fx_convert" says "convert": a word for a change.
    • The input addresses people (input.to): what it sends cannot be taken back.

    What it can reach

    • outboundThe input takes a destination (input.to): what the tool writes goes there.
    Description, as the server wrote it
    [PAID $0.002 USDC/call, x402, eip155:8453] Convert an amount between two currencies at the official ECB reference rate (today or any date since 1999), incl. CFA franc and Gulf pegs. Returns rate, converted amount, rate date and method.
  • fx_timeseries[PAID $0.005 USDC/call, x402, eip155:8453] Daily official ECB rate series for a currency pair over up to 366 days, with min/max/mean/change %.Can send data outNo findings

    Why it is in this group

    • The input addresses people (input.to): what it sends cannot be taken back.

    What it can reach

    • outboundThe input takes a destination (input.to): what the tool writes goes there.
    Description, as the server wrote it
    [PAID $0.005 USDC/call, x402, eip155:8453] Daily official ECB rate series for a currency pair over up to 366 days, with min/max/mean/change %.
  • pre_purchase_check[PAID $0.08 USDC/call, x402, eip155:8453] Bundle before paying: verified price/stock (schema.org), seller trust score (RDAP, TLS, DMARC, policies, phishing lists) and recall status…Can send data outNo findings

    Why it is in this group

    • The name "pre_purchase_check" says "purchase": a word that usually means money moves, which cannot be taken back.

    What it can reach

    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    [PAID $0.08 USDC/call, x402, eip155:8453] Bundle before paying: verified price/stock (schema.org), seller trust score (RDAP, TLS, DMARC, policies, phishing lists) and recall status (CPSC, openFDA, RappelConso) for a product URL, with a proceed/caution/stop decision.
  • verify_usdc_payment[PAID $0.002 USDC/call, x402, eip155:8453] Verify a USDC payment on Base: tx succeeded, USDC sent to the expected recipient (and from the expected sender), at least min_amount, eno…Can send data outNo findings

    Why it is in this group

    • The name "verify_usdc_payment" says "payment": a word that usually means money moves, which cannot be taken back.
    • The input addresses people (input.to): what it sends cannot be taken back.

    What it can reach

    • outboundThe input takes a destination (input.to): what the tool writes goes there.
    Description, as the server wrote it
    [PAID $0.002 USDC/call, x402, eip155:8453] Verify a USDC payment on Base: tx succeeded, USDC sent to the expected recipient (and from the expected sender), at least min_amount, enough confirmations. Returns verdict + decoded transfers. Unknown tx = not charged.
Changes things 23Claude Code: ask
  • a2a_card_check[PAID $0.01 USDC/call, x402, eip155:8453] Fetch and validate a peer agent's A2A Agent Card (v1.0 / v0.3): fields, skills, interfaces, auth, signature, reachability.Can send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    [PAID $0.01 USDC/call, x402, eip155:8453] Fetch and validate a peer agent's A2A Agent Card (v1.0 / v0.3): fields, skills, interfaces, auth, signature, reachability. Score 0-100 + issues.
  • domain_email_health[PAID $0.01 USDC/call, x402, eip155:8453] Email authentication audit of a domain: MX + provider, SPF, DMARC policy, DKIM (common selectors), MTA-STS, TLS-RPT, BIMI, domain age (RDA…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    [PAID $0.01 USDC/call, x402, eip155:8453] Email authentication audit of a domain: MX + provider, SPF, DMARC policy, DKIM (common selectors), MTA-STS, TLS-RPT, BIMI, domain age (RDAP); grade A-F and recommendations.
  • email_check[PAID $0.003 USDC/call, x402, eip155:8453] Validate one email address without sending mail: syntax, domain + MX, disposable, free webmail, role account, SPF/DMARC; verdict delivera…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    [PAID $0.003 USDC/call, x402, eip155:8453] Validate one email address without sending mail: syntax, domain + MX, disposable, free webmail, role account, SPF/DMARC; verdict deliverable / risky / undeliverable / invalid with score and reasons.
  • evaluate_deliverable[PAID $0.25 USDC/call, x402, eip155:8453] Evaluate a deliverable (text, JSON or URL) against a job spec (free text or JSON criteria): verdict pass/partial/fail, score, checked crit…No findings

    Why it is in this group

    • The name "evaluate_deliverable" says "evaluate": a word for a change.
    Description, as the server wrote it
    [PAID $0.25 USDC/call, x402, eip155:8453] Evaluate a deliverable (text, JSON or URL) against a job spec (free text or JSON criteria): verdict pass/partial/fail, score, checked criteria, and a signed EIP-712 attestation whose digest is the ERC-8183 complete/reject reason. No funds held.
  • fx_latest[PAID $0.002 USDC/call, x402, eip155:8453] All official rates for a base currency on the latest (or a given) ECB fixing date, incl.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    [PAID $0.002 USDC/call, x402, eip155:8453] All official rates for a base currency on the latest (or a given) ECB fixing date, incl. pegged currencies.
  • geo_ai_visibility[PAID $0.02 USDC/call, x402, eip155:8453] GEO audit — can ChatGPT, Claude, Perplexity, Gemini cite this site?Can send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    [PAID $0.02 USDC/call, x402, eip155:8453] GEO audit — can ChatGPT, Claude, Perplexity, Gemini cite this site? AI search/user/training bots allowed in robots.txt, text readable without JavaScript, schema.org, metadata, llms.txt, sitemap, agentic-commerce signals. Score + ranked fixes.
  • gtin_recall[PAID $0.01 USDC/call, x402, eip155:8453] Exact recall check for one EAN/UPC/GTIN barcode (check digit validated) across RappelConso, CPSC and openFDA.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    [PAID $0.01 USDC/call, x402, eip155:8453] Exact recall check for one EAN/UPC/GTIN barcode (check digit validated) across RappelConso, CPSC and openFDA.
  • mcp_probe[PAID $0.01 USDC/call, x402, eip155:8453] Real MCP Streamable HTTP handshake (initialize + tools/list, no tool call): reachability, protocol version, tools, schemas, latency, OAuth…Can send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    [PAID $0.01 USDC/call, x402, eip155:8453] Real MCP Streamable HTTP handshake (initialize + tools/list, no tool call): reachability, protocol version, tools, schemas, latency, OAuth metadata.
  • price_availability[PAID $0.03 USDC/call, x402, eip155:8453] Verified price, currency, availability and seller of a product page URL from its schema.org JSON-LD / microdata / OpenGraph data.Can send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    [PAID $0.03 USDC/call, x402, eip155:8453] Verified price, currency, availability and seller of a product page URL from its schema.org JSON-LD / microdata / OpenGraph data. robots.txt respected; blocked or unpriced pages return 'unavailable' (not charged).
  • pricingFree.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Free. Lists every paid tool with its price per call (USDC, Base mainnet).
  • sanctions_crypto_address[PAID $0.005 USDC/call, x402, eip155:8453] Check a crypto address (BTC, ETH/EVM, TRON, LTC, XMR, SOL…) against the digital currency addresses on the OFAC SDN list.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    [PAID $0.005 USDC/call, x402, eip155:8453] Check a crypto address (BTC, ETH/EVM, TRON, LTC, XMR, SOL…) against the digital currency addresses on the OFAC SDN list. Returns listed true/false and the sanctioned entity.
  • sanctions_screen[PAID $0.01 USDC/call, x402, eip155:8453] Screen one person or company name against OFAC SDN, UN, EU and UK sanctions lists at once (fuzzy, aliases).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    [PAID $0.01 USDC/call, x402, eip155:8453] Screen one person or company name against OFAC SDN, UN, EU and UK sanctions lists at once (fuzzy, aliases). Returns potential matches with score, list, programmes, countries, birth years.
  • seller_reputation[PAID $0.02 USDC/call, x402, eip155:8453] Trust score 0-100 for an online store domain or URL: domain age (RDAP), HTTPS, MX/SPF/DMARC, return policy & contact, Tranco rank, phishin…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    [PAID $0.02 USDC/call, x402, eip155:8453] Trust score 0-100 for an online store domain or URL: domain age (RDAP), HTTPS, MX/SPF/DMARC, return policy & contact, Tranco rank, phishing lists, scam patterns. Short JSON with risk, advice, red_flags, reasons.
  • seo_full_audit[PAID $0.06 USDC/call, x402, eip155:8453] Full SEO + GEO audit in one call: technical, keywords & content, internal links (12-page crawl), local presence and AI visibility, weighte…Reads text others writeCan send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • untrusted-inputThe description's first sentence says "crawl": it reads web pages, which anyone can write.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    [PAID $0.06 USDC/call, x402, eip155:8453] Full SEO + GEO audit in one call: technical, keywords & content, internal links (12-page crawl), local presence and AI visibility, weighted 0-100 score and the 12 priority actions across all areas, with module details.
  • seo_keywords_content[PAID $0.01 USDC/call, x402, eip155:8453] On-page keyword & content analysis: focus keyword (given or detected) placement in title/H1/meta/first 100 words/URL, density, top terms a…Can send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    [PAID $0.01 USDC/call, x402, eip155:8453] On-page keyword & content analysis: focus keyword (given or detected) placement in title/H1/meta/first 100 words/URL, density, top terms and phrases, headings outline, FAQ questions, word count, readability. Score + fixes.
  • seo_local_presence[PAID $0.01 USDC/call, x402, eip155:8453] Local SEO / listings readiness from the website: phone (tel: links), postal address, e-mail, Organization/LocalBusiness JSON-LD (address, …Can send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    [PAID $0.01 USDC/call, x402, eip155:8453] Local SEO / listings readiness from the website: phone (tel: links), postal address, e-mail, Organization/LocalBusiness JSON-LD (address, telephone, geo, hours, sameAs), Google Maps/Business and review-platform links, social profiles. Score + fixes.
  • seo_technical_audit[PAID $0.02 USDC/call, x402, eip155:8453] Technical SEO audit of a URL: HTTPS & redirects, www duplicate, canonical, noindex, title/meta/H1, viewport, hreflang, Open Graph, sitemap…Can send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    [PAID $0.02 USDC/call, x402, eip155:8453] Technical SEO audit of a URL: HTTPS & redirects, www duplicate, canonical, noindex, title/meta/H1, viewport, hreflang, Open Graph, sitemap & robots.txt, soft 404, response time, compression, images alt, schema.org, JS-only content. Score 0-100 + ranked fixes.
  • uk_postcode[PAID $0.002 USDC/call, x402, eip155:8453] UK postcode lookup (ONS Postcode Directory via postcodes.io): lat/lon, country, region, local authority, ward, parliamentary constituency…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    [PAID $0.002 USDC/call, x402, eip155:8453] UK postcode lookup (ONS Postcode Directory via postcodes.io): lat/lon, country, region, local authority, ward, parliamentary constituency, NHS ICB, police force, LSOA. Unknown postcode = not charged.
  • us_geocode[PAID $0.003 USDC/call, x402, eip155:8453] Geocode one US street address with the U.S.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    [PAID $0.003 USDC/call, x402, eip155:8453] Geocode one US street address with the U.S. Census Bureau: standardised address, lat/lon, state, county, census tract, block group, ZCTA, metro area, congressional district (official GEOIDs). No match = not charged.
  • usdc_balance[PAID $0.001 USDC/call, x402, eip155:8453] Current USDC balance of an address on Base or Base Sepolia (balanceOf on the official Circle contract).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    [PAID $0.001 USDC/call, x402, eip155:8453] Current USDC balance of an address on Base or Base Sepolia (balanceOf on the official Circle contract).
  • verify_attestation[PAID $0.001 USDC/call, x402, eip155:8453] Verify an attestation token issued by evaluate_deliverable: recovers the EIP-712 signer, checks it is our evaluator, returns verdict, sco…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    [PAID $0.001 USDC/call, x402, eip155:8453] Verify an attestation token issued by evaluate_deliverable: recovers the EIP-712 signer, checks it is our evaluator, returns verdict, score, jobId and the bytes32 reason.
  • x402_probe[PAID $0.01 USDC/call, x402, eip155:8453] Pre-payment check of an x402 endpoint: one unpaid request, decodes the 402 offer (v1/v2): network, USDC or not, USD price, payTo, testnet,…Can send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    [PAID $0.01 USDC/call, x402, eip155:8453] Pre-payment check of an x402 endpoint: one unpaid request, decodes the 402 offer (v1/v2): network, USDC or not, USD price, payTo, testnet, red flags.
Only reads 1Show 1 read-only tool

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data.

Reads private data0
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write2
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out14
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

No check matched anything in these tool definitions. That is not a safety guarantee.

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http agent-hub https://gogeta2-u35175.vm.elestio.app/agents/mcp
claude mcp add --transport http agent-hub https://gogeta2-u35175.vm.elestio.app/agents/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__agent-hub__recall_search"
    ],
    "ask": [
      "mcp__agent-hub__pricing",
      "mcp__agent-hub__us_geocode",
      "mcp__agent-hub__uk_postcode",
      "mcp__agent-hub__a2a_card_check",
      "mcp__agent-hub__mcp_probe",
      "mcp__agent-hub__x402_probe",
      "mcp__agent-hub__email_check",
      "mcp__agent-hub__domain_email_health",
      "mcp__agent-hub__evaluate_deliverable",
      "mcp__agent-hub__verify_attestation",
      "mcp__agent-hub__fx_convert",
      "mcp__agent-hub__fx_timeseries",
      "mcp__agent-hub__fx_latest",
      "mcp__agent-hub__pre_purchase_check",
      "mcp__agent-hub__price_availability",
      "mcp__agent-hub__gtin_recall",
      "mcp__agent-hub__sanctions_screen",
      "mcp__agent-hub__sanctions_crypto_address",
      "mcp__agent-hub__seller_reputation",
      "mcp__agent-hub__seo_technical_audit",
      "mcp__agent-hub__seo_keywords_content",
      "mcp__agent-hub__seo_internal_links",
      "mcp__agent-hub__seo_local_presence",
      "mcp__agent-hub__geo_ai_visibility",
      "mcp__agent-hub__seo_full_audit",
      "mcp__agent-hub__verify_usdc_payment",
      "mcp__agent-hub__usdc_balance"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as agent-hub. Review it before you use it.

Capability tags behind 14 rules
  • mcp__agent-hub__a2a_card_check outbound
  • mcp__agent-hub__mcp_probe outbound
  • mcp__agent-hub__x402_probe outbound
  • mcp__agent-hub__fx_convert outbound
  • mcp__agent-hub__fx_timeseries outbound
  • mcp__agent-hub__pre_purchase_check outbound
  • mcp__agent-hub__price_availability outbound
  • mcp__agent-hub__seo_technical_audit outbound
  • mcp__agent-hub__seo_keywords_content outbound
  • mcp__agent-hub__seo_internal_links untrusted-input, outbound
  • mcp__agent-hub__seo_local_presence outbound
  • mcp__agent-hub__geo_ai_visibility outbound
  • mcp__agent-hub__seo_full_audit untrusted-input, outbound
  • mcp__agent-hub__verify_usdc_payment outbound

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/com.novarithm.www/agent-hub/verify?hash=fae404192b884778a02b49210677fe3b5186e73e30d9ef8d2aa89c671d9ba4c2" | jq -e '.changed == false'

Pinned hash fae404192b88, from Oct 23, 2026, 09:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/com.novarithm.www/agent-hub/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for com.novarithm.www/agent-hub
[![anlyon.dev](https://anlyon.dev/badge/com.novarithm.www/agent-hub.svg)](https://anlyon.dev/servers/com.novarithm.www/agent-hub)

Source: MCP Registry. Synced Oct 23, 2026, 09:17 UTC.