Skip to content

Crypto, web, finance and app data tools

by bess-x402.onrender.com · remote · no sign-in to list tools · v1.7.0 · published by com.onrender.bess-x402

100 tools: Polymarket odds, crypto & DeFi, SEC insiders, FRED, grid carbon, DNS, CVE, weather.

Final · 2Changes · 72Changed
CompareRegistry entry

100 tools: 2 do something that can't be undone, 72 change things and 26 only read.

Scanned Oct 22, 2026 · tools changed Oct 22, 2026

No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http data-tools https://bess-x402.onrender.com/mcp

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

100 tools

Can't be undone 2Claude Code: ask
  • crypto_convertConvert an amount of any token (BTC, ETH, SOL, symbols or chain:address) into one or more fiat currencies (USD, EUR, GBP, AED, JPY, ~35 more), with the price per unit each way.Can send data outNo findings

    Why it is in this group

    • The name "crypto_convert" says "convert": a word for a change.
    • The input addresses people (input.to): what it sends cannot be taken back.

    What it can reach

    • outboundThe input takes a destination (input.to): what the tool writes goes there.
    Description, as the server wrote it
    Convert an amount of any token (BTC, ETH, SOL, symbols or chain:address) into one or more fiat currencies (USD, EUR, GBP, AED, JPY, ~35 more), with the price per unit each way. Use for invoices, accounting or pricing in local currency.
  • time_zone_convertConvert a date-time (or now) from one time zone to several others, by IANA name, city or abbreviation (Dubai, New York, PST, CET): local time, UTC offset, abbreviation, DST flag an…Can send data outNo findings

    Why it is in this group

    • The name "time_zone_convert" says "convert": a word for a change.
    • The input addresses people (input.to): what it sends cannot be taken back.

    What it can reach

    • outboundThe input takes a destination (input.to): what the tool writes goes there.
    Description, as the server wrote it
    Convert a date-time (or now) from one time zone to several others, by IANA name, city or abbreviation (Dubai, New York, PST, CET): local time, UTC offset, abbreviation, DST flag and weekday. Use to schedule meetings across time zones.
Changes things 72Claude Code: ask
  • app_store_detailsDetails of a mobile app on the App Store or Google Play by id, package name or store URL: developer, developer email, rating, installs, price, genre and update date.No findings

    Why it is in this group

    • The name "app_store_details" says "store": a word for a change.
    Description, as the server wrote it
    Details of a mobile app on the App Store or Google Play by id, package name or store URL: developer, developer email, rating, installs, price, genre and update date. Use for app or competitor research.
  • app_store_reviewsUser reviews of a mobile app from the Apple App Store or Google Play, by app id, package name or store URL: rating, text, date, version and developer reply, plus rating counts.No findings

    Why it is in this group

    • The name "app_store_reviews" says "store": a word for a change.
    Description, as the server wrote it
    User reviews of a mobile app from the Apple App Store or Google Play, by app id, package name or store URL: rating, text, date, version and developer reply, plus rating counts. Use to analyse app feedback.
  • bess_arbitrage_revenueBattery storage (BESS) day-ahead arbitrage revenue for a European bidding zone over up to a year of historical prices: annualised revenue per MW, cycles and payback.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Battery storage (BESS) day-ahead arbitrage revenue for a European bidding zone over up to a year of historical prices: annualised revenue per MW, cycles and payback. Use when sizing or screening a battery project or comparing zones. Dates are YYYY-MM-DD.
  • bitcoin_addressBalance of a Bitcoin address (confirmed and pending), total received and sent, transaction count and its latest 10 transactions with net amount.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Balance of a Bitcoin address (confirmed and pending), total received and sent, transaction count and its latest 10 transactions with net amount. Use to check a BTC payment or wallet.
  • bitcoin_feesBitcoin network fee rates in sat/vB for next block, 30 minutes, 1 hour and economy, plus mempool size, block height and the cost of a typical payment.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Bitcoin network fee rates in sat/vB for next block, 30 minutes, 1 hour and economy, plus mempool size, block height and the cost of a typical payment. Use right before sending BTC.
  • chains_tvlBlockchains ranked by DeFi total value locked with share of the market, gas token and chain id.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Blockchains ranked by DeFi total value locked with share of the market, gas token and chain id. Use to compare ecosystems (Ethereum, Solana, Base, Arbitrum...) or track where capital is moving.
  • country_infoFacts about a country by name or ISO code: official name, capital, region, languages, currencies, calling code, borders, area, internet TLD, coordinates, UN membership and flag.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Facts about a country by name or ISO code: official name, capital, region, languages, currencies, calling code, borders, area, internet TLD, coordinates, UN membership and flag. Use to enrich addresses, forms and datasets.
  • crypto_candlesOHLCV candles for a crypto pair from Coinbase Exchange at 1m, 5m, 15m, 1h, 6h or 1d, up to 300, oldest first.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    OHLCV candles for a crypto pair from Coinbase Exchange at 1m, 5m, 15m, 1h, 6h or 1d, up to 300, oldest first. Use for charting, technical indicators (RSI, moving averages) and backtests.
  • crypto_coin_infoFull profile of a coin by symbol or CoinGecko id: description, website, X/Twitter, GitHub, categories, contract addresses per chain, price, market cap, FDV, volume, 24h/7d/30d/1y c…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Full profile of a coin by symbol or CoinGecko id: description, website, X/Twitter, GitHub, categories, contract addresses per chain, price, market cap, FDV, volume, 24h/7d/30d/1y change, all-time high/low and supply. Use for token research or due diligence.
  • crypto_exchangesCentralized crypto exchanges ranked by trust score or adjusted 24h volume: name, volume, markets, supported fiat currencies, website and notices such as hacks.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Centralized crypto exchanges ranked by trust score or adjusted 24h volume: name, volume, markets, supported fiat currencies, website and notices such as hacks. Use to pick a venue or check one.
  • crypto_fear_greedThe Crypto Fear & Greed Index (0 extreme fear to 100 extreme greed) for today, with up to a year of daily history.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    The Crypto Fear & Greed Index (0 extreme fear to 100 extreme greed) for today, with up to a year of daily history. Use as a market-sentiment signal for trading, newsletters or answering how the crypto market feels.
  • crypto_market_overviewTotal crypto market capitalisation, 24h volume, Bitcoin dominance, 24h change and distance from the all-time high, in one call.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Total crypto market capitalisation, 24h volume, Bitcoin dominance, 24h change and distance from the all-time high, in one call. Use for a market summary or risk-on/risk-off context.
  • crypto_newsLatest crypto news from CoinDesk, Cointelegraph, Decrypt and The Block in one feed, newest first, with title, link, time, summary and tags; filter by keyword or coin (BTC, ETH, SOL…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Latest crypto news from CoinDesk, Cointelegraph, Decrypt and The Block in one feed, newest first, with title, link, time, summary and tags; filter by keyword or coin (BTC, ETH, SOL, ETF, Base). Use to explain a price move, brief a trader or monitor a project.
  • crypto_price_historyDaily USD price history of any token (symbol, CoinGecko id or chain:address) for up to 365 days with high, low and % change, or its exact price on a past date.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Daily USD price history of any token (symbol, CoinGecko id or chain:address) for up to 365 days with high, low and % change, or its exact price on a past date. Use for charts, backtests, cost basis or 'what was ETH worth on...' questions.
  • crypto_token_pricesCurrent USD price and 24h change for up to 20 crypto tokens per call, by symbol (BTC, ETH, SOL, PEPE), CoinGecko id or chain:contract address (base:0x833589..., ethereum:0x...).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Current USD price and 24h change for up to 20 crypto tokens per call, by symbol (BTC, ETH, SOL, PEPE), CoinGecko id or chain:contract address (base:0x833589..., ethereum:0x...). Covers thousands of coins and on-chain tokens. Use for portfolio valuation, trading decisions or answering what a token costs now.
  • crypto_top_coinsTop cryptocurrencies by market cap (up to 250) with price, 1h/24h/7d change, volume, all-time high and supply, optionally within a CoinGecko category (layer-1, meme-token, artifici…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Top cryptocurrencies by market cap (up to 250) with price, 1h/24h/7d change, volume, all-time high and supply, optionally within a CoinGecko category (layer-1, meme-token, artificial-intelligence, real-world-assets). Use for market overviews and screeners.
  • cve_detailsDetails of a CVE by id: description, CVSS score, severity and vector, CWE, whether it is in CISA's Known Exploited list, affected products (CPE) and references, from NVD with CVE.o…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Details of a CVE by id: description, CVSS score, severity and vector, CWE, whether it is in CISA's Known Exploited list, affected products (CPE) and references, from NVD with CVE.org fallback. Use for security triage and patch prioritisation.
  • defi_lending_ratesSupply and borrow APYs across DeFi lending markets (Aave, Compound, Morpho, Spark, Venus...) by token, chain or protocol: net borrow rate, utilisation, TVL, total borrowed and max …No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Supply and borrow APYs across DeFi lending markets (Aave, Compound, Morpho, Spark, Venus...) by token, chain or protocol: net borrow rate, utilisation, TVL, total borrowed and max LTV. Sort by supply_apy, borrow_apy (cheapest first) or tvl. Use to find the best place to lend or borrow.
  • defi_protocols_tvlDeFi protocols by total value locked (DefiLlama): look up one protocol (aave, uniswap, lido) or rank them by chain and category (Lending, Dexs, Liquid Staking, Bridge...) with TVL,…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    DeFi protocols by total value locked (DefiLlama): look up one protocol (aave, uniswap, lido) or rank them by chain and category (Lending, Dexs, Liquid Staking, Bridge...) with TVL, 1d/7d change, market cap and chains. Use for DeFi research and protocol comparisons.
  • defi_yieldsBest DeFi yields right now: lending, staking and liquidity pools across all chains and protocols, with APY (base + rewards), 30-day mean APY, TVL, stablecoin flag and impermanent-l…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Best DeFi yields right now: lending, staking and liquidity pools across all chains and protocols, with APY (base + rewards), 30-day mean APY, TVL, stablecoin flag and impermanent-loss risk. Filter by chain, protocol, token and minimum TVL; sort by APY or TVL. Use to find where to earn on USDC, ETH etc.
  • define_wordEnglish dictionary entry for a word: pronunciation (IPA and audio), parts of speech, definitions with examples, synonyms and antonyms, from Wiktionary.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    English dictionary entry for a word: pronunciation (IPA and audio), parts of speech, definitions with examples, synonyms and antonyms, from Wiktionary. Use for writing, learning or word games.
  • detect_languageDetect the language of a text among 55 languages, with probabilities for each candidate and a reliability flag.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Detect the language of a text among 55 languages, with probabilities for each candidate and a reliability flag. Use to route messages, pick a translator or tag content.
  • dex_pairsDEX trading pairs for a token symbol, name or contract address across all chains (DexScreener): price, liquidity, 24h volume, 1h/24h change, buys/sells, FDV, market cap and pair ag…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    DEX trading pairs for a token symbol, name or contract address across all chains (DexScreener): price, liquidity, 24h volume, 1h/24h change, buys/sells, FDV, market cap and pair age, deepest liquidity first. Use to price new or small tokens and check if they can be traded.
  • dex_volumesDecentralized exchange volume: total market 24h/7d and the top DEXs (Uniswap, Aerodrome, Raydium...) with 24h, 7d, 30d volume and daily change, for all chains or one chain.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Decentralized exchange volume: total market 24h/7d and the top DEXs (Uniswap, Aerodrome, Raydium...) with 24h, 7d, 30d volume and daily change, for all chains or one chain. Use to compare DEX activity or chain usage.
  • domain_availabilityCheck up to 20 domain names at once, or one name across several TLDs (com, ai, io...), for registration via RDAP and DNS: available or taken, registrar and expiry.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Check up to 20 domain names at once, or one name across several TLDs (com, ai, io...), for registration via RDAP and DNS: available or taken, registrar and expiry. Use for brainstorming product names and finding free domains.
  • domain_whoisRegistration data of a domain from RDAP, the official WHOIS successor: registrar, creation, update and expiry dates, status codes, nameservers, DNSSEC and registrant organisation/c…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Registration data of a domain from RDAP, the official WHOIS successor: registrar, creation, update and expiry dates, status codes, nameservers, DNSSEC and registrant organisation/country where public. Says whether an unregistered name looks available. Use for domain research, due diligence or phishing checks.
  • earthquakesRecent earthquakes worldwide or within a radius of a point (USGS): magnitude, place, time, depth, tsunami flag, PAGER alert and felt reports, over the last hour, day, week or month…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Recent earthquakes worldwide or within a radius of a point (USGS): magnitude, place, time, depth, tsunami flag, PAGER alert and felt reports, over the last hour, day, week or month. Use for risk monitoring and news.
  • erc20_token_infoFacts about an ERC-20 contract read from the chain (Ethereum, Base, Arbitrum, Optimism, Polygon): name, symbol, decimals, total supply, USD price and fully diluted value.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Facts about an ERC-20 contract read from the chain (Ethereum, Base, Arbitrum, Optimism, Polygon): name, symbol, decimals, total supply, USD price and fully diluted value. Use to verify a token address before trading or integrating it.
  • eu_power_mixLatest electricity generation by source (MW) for a European country (DE, FR, NL, PL, IT, AT, CH, BE...): wind, solar, nuclear, gas, coal, hydro, batteries, total load, net imports,…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Latest electricity generation by source (MW) for a European country (DE, FR, NL, PL, IT, AT, CH, BE...): wind, solar, nuclear, gas, coal, hydro, batteries, total load, net imports, renewable share and CO2 intensity. Use for energy dashboards, trading context or emissions reporting.
  • eu_power_pricesDay-ahead wholesale electricity prices for a European bidding zone (DE-LU, FR, NL, AT, BE, PL, ...) for up to 31 days in local time, with daily min/max/mean and the cheapest and pr…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Day-ahead wholesale electricity prices for a European bidding zone (DE-LU, FR, NL, AT, BE, PL, ...) for up to 31 days in local time, with daily min/max/mean and the cheapest and priciest N-hour window. Use when scheduling EV charging, heat pumps or batteries, or asked what power costs tomorrow.
  • evm_gas_feesCurrent gas fees on Ethereum, Base, Arbitrum, Optimism or Polygon: base fee and slow/standard/fast priority and max fee in gwei plus the cost of a plain transfer.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Current gas fees on Ethereum, Base, Arbitrum, Optimism or Polygon: base fee and slow/standard/fast priority and max fee in gwei plus the cost of a plain transfer. Use before sending a transaction.
  • evm_wallet_balanceBalances of a wallet address or ENS name on Ethereum, Base, Arbitrum, Optimism and Polygon in one call: native ETH/POL, USDC, USDT, DAI and any ERC-20 contracts you add, each with …No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Balances of a wallet address or ENS name on Ethereum, Base, Arbitrum, Optimism and Polygon in one call: native ETH/POL, USDC, USDT, DAI and any ERC-20 contracts you add, each with USD value and a total. Use to check whether a wallet is funded, value a portfolio or confirm a payment arrived.
  • exchange_tickerLive spot price of a crypto pair on Coinbase and Kraken: bid, ask, last, 24h open/high/low and volume, and the price gap between the two exchanges.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Live spot price of a crypto pair on Coinbase and Kraken: bid, ask, last, 24h open/high/low and volume, and the price gap between the two exchanges. Use for an exact executable price or a quick arbitrage check.
  • food_productFood product details from its EAN/UPC barcode: name, brand, quantity, ingredients, allergens, Nutri-Score, NOVA processing group, Eco-Score and nutrients per 100 g, from Open Food …No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Food product details from its EAN/UPC barcode: name, brand, quantity, ingredients, allergens, Nutri-Score, NOVA processing group, Eco-Score and nutrients per 100 g, from Open Food Facts. Use for nutrition apps, shopping assistants or allergy checks.
  • fred_seriesAny FRED economic time series by id or alias: CPI, core PCE, unemployment, payrolls, GDP, fed funds, SOFR, Treasury yields, mortgage rates, M2, oil, VIX, jobless claims...No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Any FRED economic time series by id or alias: CPI, core PCE, unemployment, payrolls, GDP, fed funds, SOFR, Treasury yields, mortgage rates, M2, oil, VIX, jobless claims... Latest value, change, 1-year % change and history. Use for macro analysis and economic questions.
  • fx_ratesOfficial ECB reference exchange rates for about 35 currencies (USD, EUR, GBP, JPY, CNY, INR, AED, SAR and more) for today or any date since 1999, from any base currency, with optio…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Official ECB reference exchange rates for about 35 currencies (USD, EUR, GBP, JPY, CNY, INR, AED, SAR and more) for today or any date since 1999, from any base currency, with optional amount conversion. Use to convert prices, invoices or salaries between currencies.
  • geocodeTurn an address, place or landmark into coordinates with a structured address, or coordinates into the nearest address (reverse), from OpenStreetMap.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Turn an address, place or landmark into coordinates with a structured address, or coordinates into the nearest address (reverse), from OpenStreetMap. Use for maps, delivery, distance calculations or location lookups.
  • hacker_newsHacker News stories by keyword (by relevance or newest) or the current front page: title, link, points, comment count, author, time and discussion URL.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Hacker News stories by keyword (by relevance or newest) or the current front page: title, link, points, comment count, author, time and discussion URL. Use to see what developers are discussing about a topic.
  • insider_tradesRecent insider transactions at a US company from SEC Form 4 filings: insider name and role (CEO, director, 10% owner), buy/sell/award/option exercise, shares, price, value, shares …No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Recent insider transactions at a US company from SEC Form 4 filings: insider name and role (CEO, director, 10% owner), buy/sell/award/option exercise, shares, price, value, shares held after and filing link. Set buys_sells_only to see open-market trades only. Use for insider-buying signals.
  • npm_packageAn npm package's latest version, description, license, repository, dependencies, peer dependencies, TypeScript types, size, publish dates, deprecation and weekly downloads.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    An npm package's latest version, description, license, repository, dependencies, peer dependencies, TypeScript types, size, publish dates, deprecation and weekly downloads. Use to choose or audit a JavaScript dependency.
  • package_vulnerabilitiesKnown security vulnerabilities for an open-source package from OSV (GitHub advisories, PyPA, RustSec, Go): id, CVE aliases, summary, severity, fixed versions, for all versions or o…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Known security vulnerabilities for an open-source package from OSV (GitHub advisories, PyPA, RustSec, Go): id, CVE aliases, summary, severity, fixed versions, for all versions or one version. Ecosystems: npm, PyPI, Go, Maven, crates.io, RubyGems, NuGet, Packagist. Use before installing or upgrading.
  • perp_funding_ratesPerpetual futures on Hyperliquid: hourly funding rate and APR, open interest, 24h volume, mark and oracle price, max leverage, for chosen coins or ranked by open interest, funding …No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Perpetual futures on Hyperliquid: hourly funding rate and APR, open interest, 24h volume, mark and oracle price, max leverage, for chosen coins or ranked by open interest, funding or volume. Use for funding arbitrage, leverage sentiment and basis trades.
  • polymarket_marketOne Polymarket market by slug, id or URL: question, rules, outcome probabilities, best bid/ask, last trade, 1-day change, volume, liquidity and the order book (top bids and asks wi…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    One Polymarket market by slug, id or URL: question, rules, outcome probabilities, best bid/ask, last trade, 1-day change, volume, liquidity and the order book (top bids and asks with sizes and spread) for each outcome. An event slug returns all its markets. Use before placing a trade or to quote exact odds.
  • polymarket_top_marketsMost active open Polymarket events right now, ranked by 24h volume, total volume or liquidity, optionally by tag (crypto, politics, sports, economy, tech, ai).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Most active open Polymarket events right now, ranked by 24h volume, total volume or liquidity, optionally by tag (crypto, politics, sports, economy, tech, ai). Each event lists its markets with live probabilities. Use to see what traders are betting on today.
  • postal_codePlaces for a postal or ZIP code in about 60 countries: place names, state or region and coordinates.No findings

    Why it is in this group

    • The input takes a statement or command to run (input.code), which can change anything it can reach.
    Description, as the server wrote it
    Places for a postal or ZIP code in about 60 countries: place names, state or region and coordinates. Use to validate addresses, fill forms or locate customers.
  • protocol_feesCrypto protocols ranked by fees paid by users or revenue kept (Tether, Circle, Uniswap, Hyperliquid, chains...) over 24h, 7d and 30d, for all chains or one chain.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Crypto protocols ranked by fees paid by users or revenue kept (Tether, Circle, Uniswap, Hyperliquid, chains...) over 24h, 7d and 30d, for all chains or one chain. Use for fundamental analysis and protocol valuation.
  • public_holidaysPublic holidays of 150+ countries and their states/regions, or stock-market holidays (NYSE, ECB TARGET), for any year, and whether a given date is a holiday or business day with th…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Public holidays of 150+ countries and their states/regions, or stock-market holidays (NYSE, ECB TARGET), for any year, and whether a given date is a holiday or business day with the next business day. Use for scheduling, delivery dates, payroll or market-open checks.
  • pypi_packageA Python package on PyPI: latest version, summary, license, required Python, dependencies, release date, project links and daily/weekly/monthly downloads.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    A Python package on PyPI: latest version, summary, license, required Python, dependencies, release date, project links and daily/weekly/monthly downloads. Use to choose or audit a Python dependency.
  • qr_codeGenerate a QR code for any text, URL, wallet address or payment link as SVG or PNG, returned inline as SVG markup and a base64 data URI ready for HTML or chat.No findings

    Why it is in this group

    • The description's first verb is "generate": a word for a change.
    Description, as the server wrote it
    Generate a QR code for any text, URL, wallet address or payment link as SVG or PNG, returned inline as SVG markup and a base64 data URI ready for HTML or chat. Choose size, border and error correction. Use when a user needs a scannable code for a link, Wi-Fi, contact or crypto payment.
  • robots_sitemapA site's robots.txt rules per user agent, whether AI crawlers (GPTBot, ClaudeBot, Google-Extended, CCBot, PerplexityBot) are blocked, and the URLs listed in its sitemap.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    A site's robots.txt rules per user agent, whether AI crawlers (GPTBot, ClaudeBot, Google-Extended, CCBot, PerplexityBot) are blocked, and the URLs listed in its sitemap. Use before crawling a site or for SEO audits.
  • rust_crateA Rust crate on crates.io: latest stable version, description, license, total and 90-day downloads, repository, docs, minimum Rust version and dates.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    A Rust crate on crates.io: latest stable version, description, license, total and 90-day downloads, repository, docs, minimum Rust version and dates. Use to choose or audit a Rust dependency.
  • sec_metric_screenRank every SEC filer by one reported metric for a period, straight from XBRL filings: revenue, net_income, operating_income, assets, cash, rnd, eps, stockholders_equity, long_term_…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Rank every SEC filer by one reported metric for a period, straight from XBRL filings: revenue, net_income, operating_income, assets, cash, rnd, eps, stockholders_equity, long_term_debt, shares_outstanding or any us-gaap tag, for a year (CY2024) or quarter (CY2025Q2). Use for market-wide screens and league tables.
  • solana_balanceSOL and SPL token balances of a Solana wallet (Token and Token-2022), with USD values and total where a price is known.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    SOL and SPL token balances of a Solana wallet (Token and Token-2022), with USD values and total where a price is known. Use to check a Solana wallet or confirm a payment arrived.
  • ssl_certificateTLS certificate of a domain: whether it is valid, issuer, subject, valid-from and expiry dates, days left, all SAN hostnames, TLS version and cipher.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    TLS certificate of a domain: whether it is valid, issuer, subject, valid-from and expiry dates, days left, all SAN hostnames, TLS version and cipher. Use for uptime/expiry monitoring or security checks.
  • stablecoins_supplyStablecoins ranked by circulating supply (USDT, USDC, USDe, DAI...) with 1-day, 7-day and 30-day supply change, peg price, mechanism and main chains, plus total USD stablecoin supp…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Stablecoins ranked by circulating supply (USDT, USDC, USDe, DAI...) with 1-day, 7-day and 30-day supply change, peg price, mechanism and main chains, plus total USD stablecoin supply. Use to track liquidity flowing into crypto.
  • subdomain_finderSubdomains of a domain found in public Certificate Transparency logs (crt.sh), with first certificate and current validity date.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Subdomains of a domain found in public Certificate Transparency logs (crt.sh), with first certificate and current validity date. Use for attack-surface mapping, asset inventory or competitor research.
  • sun_moon_timesSunrise, sunset, solar noon, day length, sun elevation, moonrise, moonset, moon phase and illumination for any place (name or coordinates) and date.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Sunrise, sunset, solar noon, day length, sun elevation, moonrise, moonset, moon phase and illumination for any place (name or coordinates) and date. Use for photography, prayer and event planning, solar or outdoor work.
  • tech_stackDetect the technologies a website uses from its headers and HTML: CMS (WordPress, Shopify, Webflow), frameworks (Next.js, React, Vue), CDN and hosting (Cloudflare, Vercel), analyti…Can send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Detect the technologies a website uses from its headers and HTML: CMS (WordPress, Shopify, Webflow), frameworks (Next.js, React, Vue), CDN and hosting (Cloudflare, Vercel), analytics, chat, payments. Use for lead qualification, sales prospecting or competitor research.
  • text_statsStatistics for a text: words, sentences, characters, paragraphs, reading and speaking time, Flesch reading ease, Flesch-Kincaid grade, Gunning fog, complex-word share, lexical dive…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Statistics for a text: words, sentences, characters, paragraphs, reading and speaking time, Flesch reading ease, Flesch-Kincaid grade, Gunning fog, complex-word share, lexical diversity and top keywords. Use to check copy, essays or SEO content.
  • uk_grid_carbonGreat Britain electricity carbon intensity (gCO2/kWh) now, nationally or for a postcode region, with the generation mix (wind, gas, nuclear, solar, imports) and a half-hourly forec…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Great Britain electricity carbon intensity (gCO2/kWh) now, nationally or for a postcode region, with the generation mix (wind, gas, nuclear, solar, imports) and a half-hourly forecast up to 48h including the lowest-carbon slot. Use to schedule EV charging, heat pumps or compute jobs.
  • url_metadataLink-preview metadata of a web page: title, description, Open Graph and Twitter card image, site name, author, publish date, language, canonical URL, favicon and RSS feeds.Can send data outNo findings

    Why it is in this group

    • The description's first verb is "link": a word for a change.

    What it can reach

    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Link-preview metadata of a web page: title, description, Open Graph and Twitter card image, site name, author, publish date, language, canonical URL, favicon and RSS feeds. Use to build link previews, enrich bookmarks or classify a URL without reading the full page.
  • us_company_filingsLatest SEC EDGAR filings of a US-listed company by ticker with links, optionally filtered by form (10-K, 10-Q, 8-K, 4 for insider trades, 13F-HR, S-1).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Latest SEC EDGAR filings of a US-listed company by ticker with links, optionally filtered by form (10-K, 10-Q, 8-K, 4 for insider trades, 13F-HR, S-1). Use for recent disclosures or insider filings.
  • us_company_fundamentalsReported financials of a US-listed company from SEC 10-K/10-Q filings by ticker: revenue, profit, EPS, cash flow, free cash flow, assets, debt, equity and margins, annual or quarte…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Reported financials of a US-listed company from SEC 10-K/10-Q filings by ticker: revenue, profit, EPS, cash flow, free cash flow, assets, debt, equity and margins, annual or quarterly. Use when analysing or comparing US stocks and you need filed numbers, not estimates.
  • us_company_profileSEC profile of a US-listed company: legal name, tickers and exchanges, industry (SIC), state of incorporation, fiscal year end, business address and phone, website, former names, f…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    SEC profile of a US-listed company: legal name, tickers and exchanges, industry (SIC), state of incorporation, fiscal year end, business address and phone, website, former names, filer category and links to the latest 10-K and 10-Q. Use for due diligence and company research.
  • us_treasury_yieldsUS Treasury par yield curve from 1 month to 30 years (percent) for the latest day or any date since 1990, with 10y-2y and 10y-3m spreads, inversion flag and up to 60 days of histor…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    US Treasury par yield curve from 1 month to 30 years (percent) for the latest day or any date since 1990, with 10y-2y and 10y-3m spreads, inversion flag and up to 60 days of history. Use for risk-free rates, discounting, macro analysis or answering where 10-year yields are.
  • weather_forecastCurrent weather and a daily forecast (up to 9 days) for any city, address or coordinates: temperature, min/max, humidity, wind, clouds, pressure, sky and precipitation, from the No…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Current weather and a daily forecast (up to 9 days) for any city, address or coordinates: temperature, min/max, humidity, wind, clouds, pressure, sky and precipitation, from the Norwegian Meteorological Institute. Use for travel, events, logistics or energy planning.
  • website_contact_detailsContact details of a company website: emails, phones, social profiles, name and address, from its home, contact, about and imprint pages.Can send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Contact details of a company website: emails, phones, social profiles, name and address, from its home, contact, about and imprint pages. Use to find how to reach a business or enrich a lead.
  • wikipedia_summaryLead summary of the Wikipedia article that best matches a topic, in any language edition: title, short description, summary paragraph, image, coordinates, Wikidata id and link.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Lead summary of the Wikipedia article that best matches a topic, in any language edition: title, short description, summary paragraph, image, coordinates, Wikidata id and link. Use for quick factual background on a person, place, company or concept.
  • worldbank_indicatorWorld Bank development data for any country: GDP, GDP per capita, growth, population, inflation, unemployment, life expectancy, CO2, exports, debt, internet use, FDI or any indicat…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    World Bank development data for any country: GDP, GDP per capita, growth, population, inflation, unemployment, life expectancy, CO2, exports, debt, internet use, FDI or any indicator code, by year. Use for country comparisons and market sizing.
Only reads 26Claude Code: allow, ask for 4 outbound
  • bitcoin_transactionStatus of a Bitcoin transaction: confirmed or pending, confirmations, block, time, fee and fee rate, RBF flag, inputs and outputs.No findings

    Why it is in this group

    • The description's first verb is "status": a word for reading.
    Description, as the server wrote it
    Status of a Bitcoin transaction: confirmed or pending, confirmations, block, time, fee and fee rate, RBF flag, inputs and outputs. Use to confirm a BTC payment or decide whether to bump a fee.
  • dns_lookupDNS records of a domain: A, AAAA, MX, TXT, NS, CNAME, SOA and CAA, plus SPF and DNSSEC status, via Cloudflare/Google DNS-over-HTTPS.Reads text others writeNo findings

    Why it is in this group

    • The name "dns_lookup" says "lookup": a word for reading.

    What it can reach

    • untrusted-inputThe description's first sentence says "http": it reads web pages, which anyone can write.
    Description, as the server wrote it
    DNS records of a domain: A, AAAA, MX, TXT, NS, CNAME, SOA and CAA, plus SPF and DNSSEC status, via Cloudflare/Google DNS-over-HTTPS. Use to check where a domain points, its mail servers, verification TXT records or why email or a website is failing.
  • email_validateCheck an email address before sending: syntax, whether the domain exists and has mail servers (MX), disposable/temporary provider, role address (info@, sales@), free provider and t…No findings

    Why it is in this group

    • The name "email_validate" says "validate": a word for reading.
    Description, as the server wrote it
    Check an email address before sending: syntax, whether the domain exists and has mail servers (MX), disposable/temporary provider, role address (info@, sales@), free provider and typo suggestion (gmial.com -> gmail.com), with a verdict. No mail is sent and the mailbox is not probed.
  • ens_resolveResolve an ENS name (vitalik.eth) or Basename (jesse.base.eth) to its address and profile records (avatar, url, twitter, github, email, description), or an address to its verified …Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "ens_resolve" says "resolve": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "resolve" and "email": it reads mail.
    • untrusted-inputThe description's first sentence says "resolve" and "url": it reads web pages, which anyone can write.
    Description, as the server wrote it
    Resolve an ENS name (vitalik.eth) or Basename (jesse.base.eth) to its address and profile records (avatar, url, twitter, github, email, description), or an address to its verified primary name. Use before sending funds to a name or to show who owns a wallet.
  • eu_vat_checkValidate an EU VAT number live against the official EU VIES service, returning valid/invalid and the registered company name and address where the member state shares them.No findings

    Why it is in this group

    • The description's first verb is "validate": a word for reading.
    Description, as the server wrote it
    Validate an EU VAT number live against the official EU VIES service, returning valid/invalid and the registered company name and address where the member state shares them. Use for B2B invoicing, reverse charge checks and KYC. Unavailable member states return an error and are not charged.
  • evm_chain_lookupLook up any EVM chain by chain ID or name (8453, base, arbitrum): chain ID in decimal and hex, native currency, public RPC URLs, block explorers and testnet flag.No findings

    Why it is in this group

    • The name "evm_chain_lookup" says "lookup": a word for reading.
    Description, as the server wrote it
    Look up any EVM chain by chain ID or name (8453, base, arbitrum): chain ID in decimal and hex, native currency, public RPC URLs, block explorers and testnet flag. Use to configure wallets, RPCs or cross-chain apps.
  • evm_transaction_statusStatus of an EVM transaction by hash: pending, success or failed, block, confirmations, timestamp, from/to, value, gas used, fee (plus L1 fee on Base/Optimism) and ERC-20 token tra…No findings

    Why it is in this group

    • The name "evm_transaction_status" says "status": a word for reading.
    Description, as the server wrote it
    Status of an EVM transaction by hash: pending, success or failed, block, confirmations, timestamp, from/to, value, gas used, fee (plus L1 fee on Base/Optimism) and ERC-20 token transfers. Searches Ethereum, Base, Arbitrum, Optimism and Polygon if no chain is given. Use to confirm a payment settled.
  • http_headersFetch a URL's HTTP response headers with the full redirect chain, status, server, caching and a security grade (A-F) based on HSTS, CSP, X-Frame-Options and other headers, listing …Reads text others writeCan send data outNo findings

    Why it is in this group

    • The description's first verb is "fetch": a word for reading.

    What it can reach

    • untrusted-inputThe name "http_headers" says "http": it reads web pages, which anyone can write.
    • untrusted-inputThe description's first sentence says "fetch" and "url": it reads web pages, which anyone can write.
    • untrusted-inputThe input takes a URL (input.url), and the tool reads it: it reads web pages, which anyone can write.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.

    Claude Code: ask, because it is tagged outbound.

    Description, as the server wrote it
    Fetch a URL's HTTP response headers with the full redirect chain, status, server, caching and a security grade (A-F) based on HSTS, CSP, X-Frame-Options and other headers, listing what is missing. Use for security reviews, redirect debugging or SEO checks.
  • iban_validateValidate an IBAN: country, correct length, ISO 13616 checksum, bank code and BBAN, with a reason when invalid (likely typo, wrong length).No findings

    Why it is in this group

    • The name "iban_validate" says "validate": a word for reading.
    Description, as the server wrote it
    Validate an IBAN: country, correct length, ISO 13616 checksum, bank code and BBAN, with a reason when invalid (likely typo, wrong length). Works offline for about 80 countries. Use before sending a bank transfer or saving payout details.
  • ip_lookupWho owns an IP address (or a hostname's IP): ASN, network holder, announced prefix, regional registry, country, approximate city and coordinates, reverse DNS.No findings

    Why it is in this group

    • The name "ip_lookup" says "lookup": a word for reading.
    Description, as the server wrote it
    Who owns an IP address (or a hostname's IP): ASN, network holder, announced prefix, regional registry, country, approximate city and coordinates, reverse DNS. Use for fraud checks, log analysis or finding a site's host.
  • lei_lookupLook up legal entities in the global LEI register (GLEIF) by company name or 20-character LEI: exact legal name, status, legal form, jurisdiction, registration number, address and …No findings

    Why it is in this group

    • The name "lei_lookup" says "lookup": a word for reading.
    Description, as the server wrote it
    Look up legal entities in the global LEI register (GLEIF) by company name or 20-character LEI: exact legal name, status, legal form, jurisdiction, registration number, address and LEI renewal date. Use for KYC, counterparty checks and company identification.
  • read_rss_feedRead any RSS or Atom feed (or a website that links one) and get clean JSON items: title, link, date, author, summary text, categories and image, plus feed title and language.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "read_rss_feed" says "read": a word for reading.

    What it can reach

    • untrusted-inputThe name "read_rss_feed" says "read" and "rss": it reads web pages, which anyone can write.
    • untrusted-inputThe description's first sentence says "read" and "rss": it reads web pages, which anyone can write.
    • untrusted-inputThe input takes a URL (input.url), and the tool reads it: it reads web pages, which anyone can write.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.

    Claude Code: ask, because it is tagged outbound.

    Description, as the server wrote it
    Read any RSS or Atom feed (or a website that links one) and get clean JSON items: title, link, date, author, summary text, categories and image, plus feed title and language. Use to monitor blogs, news sites, podcasts or release notes without parsing XML.
  • read_web_pageRead a public web page and return its main content as clean Markdown with title, author, publish date and language.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "read_web_page" says "read": a word for reading.

    What it can reach

    • untrusted-inputThe name "read_web_page" says "read" and "web": it reads web pages, which anyone can write.
    • untrusted-inputThe description's first sentence says "read" and "web": it reads web pages, which anyone can write.
    • untrusted-inputThe input takes a URL (input.url), and the tool reads it: it reads web pages, which anyone can write.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.

    Claude Code: ask, because it is tagged outbound.

    Description, as the server wrote it
    Read a public web page and return its main content as clean Markdown with title, author, publish date and language. Use when you need to read, quote or summarise an article or docs page from a URL.
  • research_papersSearch published research papers and articles across all publishers (Crossref): title, authors, journal, year, DOI, citation count and abstract, by relevance, date or citations.No findings

    Why it is in this group

    • The description's first verb is "search": a word for reading.
    Description, as the server wrote it
    Search published research papers and articles across all publishers (Crossref): title, authors, journal, year, DOI, citation count and abstract, by relevance, date or citations. Use to find and cite sources.
  • sec_full_text_searchSearch the full text of all SEC filings since 2001 for any word or exact phrase (in quotes), filtered by form type (10-K, 8-K, S-1...) and date: company, form, filing date, period …Reads private dataNo findings

    Why it is in this group

    • The name "sec_full_text_search" says "search": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "search" and "document": it reads documents.
    Description, as the server wrote it
    Search the full text of all SEC filings since 2001 for any word or exact phrase (in quotes), filtered by form type (10-K, 8-K, S-1...) and date: company, form, filing date, period and document link. Use to find every filing mentioning a risk, product, customer or event.
  • university_lookupUniversities worldwide by name and/or country, with official websites and email domains.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "university_lookup" says "lookup": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "email": it reads mail.
    • untrusted-inputThe description's first sentence says "website": it reads web pages, which anyone can write.
    Description, as the server wrote it
    Universities worldwide by name and/or country, with official websites and email domains. Use to verify academic email addresses, fill forms or build education lists.
  • wayback_snapshotsInternet Archive Wayback Machine snapshots of a URL: the capture closest to a date, plus the first and latest captures, with direct archive links.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "wayback_snapshots" says "snapshot": a word for reading.

    What it can reach

    • untrusted-inputThe description's first sentence says "internet": it reads web pages, which anyone can write.
    • untrusted-inputThe input takes a URL (input.url), and the tool reads it: it reads web pages, which anyone can write.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.

    Claude Code: ask, because it is tagged outbound.

    Description, as the server wrote it
    Internet Archive Wayback Machine snapshots of a URL: the capture closest to a date, plus the first and latest captures, with direct archive links. Use to see how a page looked before or recover deleted content.
  • word_finderFind words by relation: synonyms, antonyms, rhymes, near rhymes, sound-alikes, spelling patterns with * and ?No findings

    Why it is in this group

    • The description's first verb is "find": a word for reading.
    Description, as the server wrote it
    Find words by relation: synonyms, antonyms, rhymes, near rhymes, sound-alikes, spelling patterns with * and ? wildcards, words that mean something, adjectives describing a noun and more, ranked with definitions. Use for copywriting, naming, poetry and puzzles.

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

240 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 3 private-data tools breaks every one.

Reads private data3
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write8
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out10
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
deny to break every path
{
  "permissions": {
    "deny": [
      "mcp__data-tools__ens_resolve",
      "mcp__data-tools__sec_full_text_search",
      "mcp__data-tools__university_lookup"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Tool changes

Every rescan that found different tool definitions, newest first.

  1. Oct 22, 2026

    e8667476fbb6

    +74 added

  2. Oct 22, 2026

    fb6d05f6cebd

    +16 added

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Looked at Oct 22, 2026, 14:37 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable
no
HTTP status of an anonymous initialize
none
tools/list served without credentials
no
Tools that change things, listed without credentials
0
Protocol version
none
WWW-Authenticate on 401
not observed
resource_metadata in WWW-Authenticate
none
RFC 9728 protected resource metadata
none
Authorization servers
none
Legacy HTTP+SSE transport
no
Dynamic client registration
not observed
Client ID metadata documents
not observed

The probe stopped: bess-x402.onrender.com does not resolve.

Install

Pinned to version 1.7.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http data-tools https://bess-x402.onrender.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__data-tools__evm_transaction_status",
      "mcp__data-tools__ens_resolve",
      "mcp__data-tools__dns_lookup",
      "mcp__data-tools__email_validate",
      "mcp__data-tools__polymarket_search",
      "mcp__data-tools__kalshi_search",
      "mcp__data-tools__manifold_search",
      "mcp__data-tools__prediction_markets_search",
      "mcp__data-tools__bitcoin_transaction",
      "mcp__data-tools__arxiv_search",
      "mcp__data-tools__research_papers",
      "mcp__data-tools__book_search",
      "mcp__data-tools__ip_lookup",
      "mcp__data-tools__lei_lookup",
      "mcp__data-tools__eu_vat_check",
      "mcp__data-tools__iban_validate",
      "mcp__data-tools__us_company_search",
      "mcp__data-tools__sec_full_text_search",
      "mcp__data-tools__evm_chain_lookup",
      "mcp__data-tools__word_finder",
      "mcp__data-tools__free_image_search",
      "mcp__data-tools__university_lookup"
    ],
    "ask": [
      "mcp__data-tools__read_web_page",
      "mcp__data-tools__eu_power_prices",
      "mcp__data-tools__us_company_fundamentals",
      "mcp__data-tools__us_company_filings",
      "mcp__data-tools__evm_gas_fees",
      "mcp__data-tools__app_store_reviews",
      "mcp__data-tools__website_contact_details",
      "mcp__data-tools__app_store_details",
      "mcp__data-tools__app_store_search",
      "mcp__data-tools__bess_arbitrage_revenue",
      "mcp__data-tools__crypto_token_prices",
      "mcp__data-tools__evm_wallet_balance",
      "mcp__data-tools__defi_yields",
      "mcp__data-tools__crypto_news",
      "mcp__data-tools__domain_whois",
      "mcp__data-tools__url_metadata",
      "mcp__data-tools__qr_code",
      "mcp__data-tools__fx_rates",
      "mcp__data-tools__us_treasury_yields",
      "mcp__data-tools__public_holidays",
      "mcp__data-tools__read_rss_feed",
      "mcp__data-tools__wikipedia_summary",
      "mcp__data-tools__polymarket_top_markets",
      "mcp__data-tools__polymarket_market",
      "mcp__data-tools__crypto_fear_greed",
      "mcp__data-tools__crypto_trending",
      "mcp__data-tools__crypto_coin_info",
      "mcp__data-tools__crypto_top_coins",
      "mcp__data-tools__crypto_price_history",
      "mcp__data-tools__defi_protocols_tvl",
      "mcp__data-tools__chains_tvl",
      "mcp__data-tools__stablecoins_supply",
      "mcp__data-tools__dex_volumes",
      "mcp__data-tools__protocol_fees",
      "mcp__data-tools__dex_pairs",
      "mcp__data-tools__perp_funding_rates",
      "mcp__data-tools__exchange_ticker",
      "mcp__data-tools__crypto_candles",
      "mcp__data-tools__bitcoin_fees",
      "mcp__data-tools__bitcoin_address",
      "mcp__data-tools__solana_balance",
      "mcp__data-tools__erc20_token_info",
      "mcp__data-tools__npm_package",
      "mcp__data-tools__pypi_package",
      "mcp__data-tools__rust_crate",
      "mcp__data-tools__package_vulnerabilities",
      "mcp__data-tools__cve_details",
      "mcp__data-tools__hacker_news",
      "mcp__data-tools__ssl_certificate",
      "mcp__data-tools__subdomain_finder",
      "mcp__data-tools__http_headers",
      "mcp__data-tools__tech_stack",
      "mcp__data-tools__robots_sitemap",
      "mcp__data-tools__wayback_snapshots",
      "mcp__data-tools__fred_series",
      "mcp__data-tools__worldbank_indicator",
      "mcp__data-tools__geocode",
      "mcp__data-tools__weather_forecast",
      "mcp__data-tools__earthquakes",
      "mcp__data-tools__postal_code",
      "mcp__data-tools__time_zone_convert",
      "mcp__data-tools__us_company_profile",
      "mcp__data-tools__insider_trades",
      "mcp__data-tools__sec_metric_screen",
      "mcp__data-tools__crypto_market_overview",
      "mcp__data-tools__crypto_exchanges",
      "mcp__data-tools__defi_lending_rates",
      "mcp__data-tools__crypto_convert",
      "mcp__data-tools__uk_grid_carbon",
      "mcp__data-tools__eu_power_mix",
      "mcp__data-tools__define_word",
      "mcp__data-tools__text_stats",
      "mcp__data-tools__detect_language",
      "mcp__data-tools__food_product",
      "mcp__data-tools__sun_moon_times",
      "mcp__data-tools__country_info",
      "mcp__data-tools__domain_availability",
      "mcp__data-tools__extract_links"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as data-tools. Review it before you use it.

Capability tags behind 15 rules
  • mcp__data-tools__read_web_page untrusted-input, outbound
  • mcp__data-tools__website_contact_details outbound
  • mcp__data-tools__ens_resolve private-data, untrusted-input
  • mcp__data-tools__dns_lookup untrusted-input
  • mcp__data-tools__url_metadata outbound
  • mcp__data-tools__read_rss_feed untrusted-input, outbound
  • mcp__data-tools__http_headers untrusted-input, outbound
  • mcp__data-tools__tech_stack outbound
  • mcp__data-tools__wayback_snapshots untrusted-input, outbound
  • mcp__data-tools__time_zone_convert outbound
  • mcp__data-tools__sec_full_text_search private-data
  • mcp__data-tools__crypto_convert outbound
  • mcp__data-tools__free_image_search untrusted-input
  • mcp__data-tools__university_lookup private-data, untrusted-input
  • mcp__data-tools__extract_links outbound