Ontario Protocol

by ontarioprotocol.com · remote · no sign-in to list tools · v1.0.12 · published by com.ontarioprotocol

Find live x402 APIs for any task (0.005 USDC, no match no charge); free x402 readiness checks.

Final · 3Changes · 12

Compare Registry entry

17 tools: 3 do something that can't be undone, 12 change things and 2 only read.

Scanned Oct 21, 2026

Deletes or cancels0Claude Code: deny
Can't be undone3Claude Code: ask: see these tools
Changes things12Claude Code: ask: see these tools
Only reads2Claude Code: allow: see these tools

23 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http ontario-protocol https://ontarioprotocol.com/mcp

Findings

Matches of fixed checks, with the text they matched.

12 warn11 info

Warnontario_purchase_router
The server marks "ontario_purchase_router" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
Matched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "ontario_purchase_router" says "purchase": a word that usually means money moves, which cannot be taken back.
What this check looks for
Warnagent_can_pay
The server marks "agent_can_pay" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
Matched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "agent_can_pay" says "pay": a word that usually means money moves, which cannot be taken back.
What this check looks for
Warnontario_find-api
The description contains a 42-character base64 string.
Matched text
description: "...policy allows base 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913 and 0.005 USDC is i..."
What this check looks for
Warnontario_find-api
The server marks "ontario_find-api" as not read-only (readOnlyHint: false), and its words say it reads.
Matched text
annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The name "ontario_find-api" says "find": a word for reading.
What this check looks for
Warnx402_launch_kit
The server marks "x402_launch_kit" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
Matched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The description's first verb is "generate": a word for a change.
What this check looks for
Warnontario_validate-service
The server marks "ontario_validate-service" as not read-only (readOnlyHint: false), and its words say it reads.
Matched text
annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The name "ontario_validate-service" says "validate": a word for reading.
What this check looks for

Show 17 more findings

Warnontario_list-service
The description contains a 42-character base64 string.
Matched text
description: "...policy allows base 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913 and 0.50 USDC is in..."
What this check looks for
Warnontario_refresh-listing
The description contains a 42-character base64 string.
Matched text
description: "...policy allows base 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913 and 0.10 USDC is in..."
What this check looks for
Warnontario_list-agent
The description contains a 42-character base64 string.
Matched text
description: "...policy allows base 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913 and 0.10 USDC is in..."
What this check looks for
Warnontario_list-agent
The server marks "ontario_list-agent" as not read-only (readOnlyHint: false), and its words say it reads.
Matched text
annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The name "ontario_list-agent" says "list": a word for reading.
What this check looks for
Warnontario_validate-agent
The server marks "ontario_validate-agent" as not read-only (readOnlyHint: false), and its words say it reads.
Matched text
annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The name "ontario_validate-agent" says "validate": a word for reading.
What this check looks for
Warnontario_validate-refresh
The server marks "ontario_validate-refresh" as not read-only (readOnlyHint: false), and its words say it reads.
Matched text
annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The name "ontario_validate-refresh" says "validate": a word for reading.
What this check looks for
Infoontario_purchase_router
The input schema at properties.task.description mentions "credentials".
Matched text
inputSchema.properties.task.description: "...ic task description only; never include credentials or private customer data."
What this check looks for
Infoagent_can_pay
The input schema at properties.endpoint.description mentions "credentials".
Matched text
inputSchema.properties.endpoint.description: "...evaluate before payment; never include credentials or private query parameters."
What this check looks for
Infox402_readiness_verify
The input schema at properties.target_url.description mentions "credentials".
Matched text
inputSchema.properties.target_url.description: "...inspect without payment. Do not submit credentials, private hosts, or sensitive query para..."
What this check looks for
Infobazaar_buyer_intent_gap
The input schema at properties.buyer_query.description mentions "credentials".
Matched text
inputSchema.properties.buyer_query.description: "...use in CDP Bazaar search; never include credentials or private customer text."
What this check looks for
Infofind_x402_tool
The description mentions "credential".
Matched text
description: "..., and Coinbase CDP Bazaar. Rank public, credential-free endpoint candidates by task releva..."
What this check looks for
Infofind_x402_tool
The input schema at properties.query.description mentions "credentials".
Matched text
inputSchema.properties.query.description: "Public task text only; never include credentials or private customer data."
What this check looks for
Infoontario_find-api
The input schema at properties.task.description mentions "credentials".
Matched text
inputSchema.properties.task.description: "...search for an AI agent'. Never include credentials or private data."
What this check looks for
Infox402_launch_kit
The input schema at properties.owner_contact.description mentions "credentials".
Matched text
inputSchema.properties.owner_contact.description: "...s. Omit private addresses; never supply credentials."
What this check looks for
Infoontario_validate-service
The input schema at properties.owner_contact.description mentions "credentials".
Matched text
inputSchema.properties.owner_contact.description: "...mit when unnecessary; never send wallet credentials."
What this check looks for
Infoontario_list-service
The input schema at properties.owner_contact.description mentions "credentials".
Matched text
inputSchema.properties.owner_contact.description: "...mit when unnecessary; never send wallet credentials."
What this check looks for
Infoagent_trust_preview
The input schema at properties.target_url.description mentions "credentials".
Matched text
inputSchema.properties.target_url.description: "...payment; never include private hosts or credentials."
What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

17 tools

Can't be undone 3Sends, pays, publishes or merges: once done, it cannot be taken back.Claude Code: ask

agent_can_payFree pre-payment policy decision.2 findings
Why it is in this group
- The name "agent_can_pay" says "pay": a word that usually means money moves, which cannot be taken back.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Info
  The input schema at properties.endpoint.description mentions "credentials".
  Matched text
  inputSchema.properties.endpoint.description: "...evaluate before payment; never include credentials or private query parameters."
  What this check looks for
- Warn
  The server marks "agent_can_pay" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
  Matched text
  annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "agent_can_pay" says "pay": a word that usually means money moves, which cannot be taken back.
  What this check looks for
Description, as the server wrote it
Free pre-payment policy decision. Agents ask whether an x402 endpoint should be paid under strict, standard, or permissive policy. The free result is sufficient by default; set require_audit_receipt only when a settlement-backed receipt is required.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
- title: Agent Payment Preflight
ontario_list-servicePublish a provider-owned x402 API so AI agents can discover and buy it.2 findings
Why it is in this group
- The name "ontario_list-service" says "list": a word for reading.
- The description's first verb is "publish": a word for a change that another call does not undo.
Findings
- Info
  The input schema at properties.owner_contact.description mentions "credentials".
  Matched text
  inputSchema.properties.owner_contact.description: "...mit when unnecessary; never send wallet credentials."
  What this check looks for
- Warn
  The description contains a 42-character base64 string.
  Matched text
  description: "...policy allows base 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913 and 0.50 USDC is in..."
  What this check looks for
Description, as the server wrote it
Publish a provider-owned x402 API so AI agents can discover and buy it. After free validation and a Bazaar buyer-intent audit, the 0.50 USDC Launch Passport creates a signed public HTML/JSON profile, readiness and Coinbase indexing evidence, a five-query retrieval snapshot, badge, copy-ready MCP/catalog records, and 30 days of freshness maintenance. It can become eligible for strict Ontario discovery when evidence is ready and fresh. It does not guarantee Coinbase placement, ranking, traffic, purchases, a ready grade, or safety. Agent payment guidance: run free can-pay and readiness checks first; pay only when policy allows base 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913 and 0.50 USDC is inside the agent budget. [PAID: 0.50 USDC via x402 on Base. Two-step flow: call without payment to receive MCP PaymentRequired, then retry with params._meta['x402/payment'] containing the signed PaymentPayload. The legacy _x402_payment base64 argument is also supported. Sign only after explicit budget and policy approval.]
Annotations the server declares
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
- readOnlyHint: false
- title: Publish your x402 API for agent discovery
ontario_purchase_routerFree deterministic pre-purchase routing across Ontario tools.2 findings
Why it is in this group
- The name "ontario_purchase_router" says "purchase": a word that usually means money moves, which cannot be taken back.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Info
  The input schema at properties.task.description mentions "credentials".
  Matched text
  inputSchema.properties.task.description: "...ic task description only; never include credentials or private customer data."
  What this check looks for
- Warn
  The server marks "ontario_purchase_router" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
  Matched text
  annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "ontario_purchase_router" says "purchase": a word that usually means money moves, which cannot be taken back.
  What this check looks for
Description, as the server wrote it
Free deterministic pre-purchase routing across Ontario tools. Use this before any paid Ontario tool to decide whether the task is free-only, needs free preflight, or is eligible for a paid result after wallet, Base network, and explicit budget gates. Natural endpoint-verification tasks route to the free readiness verifier and disclose the optional 0.002 USDC settlement-backed receipt only when extra audit evidence is needed. Provider jobs such as publishing, registering, or making an x402 endpoint discoverable can route to the self-serve 0.50 USDC publication product after preflight. Existing paid profiles can route to the 0.10 USDC evidence refresh only after the free refresh validator. Empty calls return safe free discovery guidance instead of guessing a purchase. This tool never invokes another tool, signs a payload, or spends funds.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
- title: Ontario Free/Paid Purchase Router

Changes things 12Creates or changes something that can be changed back.Claude Code: ask

bazaar_buyer_intent_gapFree read-only provider audit that runs Coinbase's indexing preflight and measures one public x402 endpoint across five live CDP Bazaar buyer-search variations.1 finding
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Info
  The input schema at properties.buyer_query.description mentions "credentials".
  Matched text
  inputSchema.properties.buyer_query.description: "...use in CDP Bazaar search; never include credentials or private customer text."
  What this check looks for
Description, as the server wrote it
Free read-only provider audit that runs Coinbase's indexing preflight and measures one public x402 endpoint across five live CDP Bazaar buyer-search variations. Returns retrieval coverage, observed sample ranks, alternatives, public 30-day call and unique-payer observations, Base USDC price bands, HTTP 402 and metadata readiness, and the activation boundary. Public quality counts may include owner-funded calls and are not revenue. It never signs or settles.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
- title: Bazaar Buyer Intent Gap
github_x402_repo_scanFree pre-deployment scan of one public GitHub repository for x402 implementation, HTTP 402 tests, payment configuration, buyer documentation, discovery metadata, CI gates, and sens…No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Free pre-deployment scan of one public GitHub repository for x402 implementation, HTTP 402 tests, payment configuration, buyer documentation, discovery metadata, CI gates, and sensitive filenames. Returns paths and remediation, never source contents.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
- title: GitHub x402 Repo Scan
ontario_find-apiWhich x402 API should I call for this task?3 findings
Why it is in this group
- The name "ontario_find-api" says "find": a word for reading.
- The server marks it as not read-only (readOnlyHint: false).
Findings
- Info
  The input schema at properties.task.description mentions "credentials".
  Matched text
  inputSchema.properties.task.description: "...search for an AI agent'. Never include credentials or private data."
  What this check looks for
- Warn
  The description contains a 42-character base64 string.
  Matched text
  description: "...policy allows base 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913 and 0.005 USDC is i..."
  What this check looks for
- Warn
  The server marks "ontario_find-api" as not read-only (readOnlyHint: false), and its words say it reads.
  Matched text
  annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The name "ontario_find-api" says "find": a word for reading.
  What this check looks for
Description, as the server wrote it
Which x402 API should I call for this task? Returns up to 5 paid APIs from Coinbase Bazaar and Agentic Market that answered a fresh unpaid probe with a valid Base USDC payment challenge at their listed price, ranked by repeat buyers rather than one-off probe payments, each with a ready-to-call request. The search runs before settlement: if no live match is found the payment is not settled. Agent payment guidance: run free can-pay and readiness checks first; pay only when policy allows base 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913 and 0.005 USDC is inside the agent budget. [PAID: 0.005 USDC via x402 on Base. Two-step flow: call without payment to receive MCP PaymentRequired, then retry with params._meta['x402/payment'] containing the signed PaymentPayload. The legacy _x402_payment base64 argument is also supported. Sign only after explicit budget and policy approval.]
Annotations the server declares
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
- readOnlyHint: false
- title: Find a Live x402 API for a Task
ontario_list-agentUse only when the caller owns the agent and wants to submit a public directory listing.2 findings
Why it is in this group
- The name "ontario_list-agent" says "list": a word for reading.
- The server marks it as not read-only (readOnlyHint: false).
Findings
- Warn
  The description contains a 42-character base64 string.
  Matched text
  description: "...policy allows base 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913 and 0.10 USDC is in..."
  What this check looks for
- Warn
  The server marks "ontario_list-agent" as not read-only (readOnlyHint: false), and its words say it reads.
  Matched text
  annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The name "ontario_list-agent" says "list": a word for reading.
  What this check looks for
Description, as the server wrote it
Use only when the caller owns the agent and wants to submit a public directory listing. Validate the payload for free first; payment does not guarantee approval, traffic, ranking, or safety. Agent payment guidance: run free can-pay and readiness checks first; pay only when policy allows base 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913 and 0.10 USDC is inside the agent budget. [PAID: 0.10 USDC via x402 on Base. Two-step flow: call without payment to receive MCP PaymentRequired, then retry with params._meta['x402/payment'] containing the signed PaymentPayload. The legacy _x402_payment base64 argument is also supported. Sign only after explicit budget and policy approval.]
Annotations the server declares
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
- readOnlyHint: false
- title: List an Agent
ontario_refresh-listingUse only for an existing paid Ontario provider profile when the caller wants a fresh live readiness observation attached to its canonical HTML, JSON twin, and badge.1 finding
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Findings
- Warn
  The description contains a 42-character base64 string.
  Matched text
  description: "...policy allows base 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913 and 0.10 USDC is in..."
  What this check looks for
Description, as the server wrote it
Use only for an existing paid Ontario provider profile when the caller wants a fresh live readiness observation attached to its canonical HTML, JSON twin, and badge. This tool cannot edit provider metadata, improve a grade by payment, or buy ranking or traffic. Do not pay while the launch passport's 30-day included maintenance is active. Agent payment guidance: run free can-pay and readiness checks first; pay only when policy allows base 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913 and 0.10 USDC is inside the agent budget. [PAID: 0.10 USDC via x402 on Base. Two-step flow: call without payment to receive MCP PaymentRequired, then retry with params._meta['x402/payment'] containing the signed PaymentPayload. The legacy _x402_payment base64 argument is also supported. Sign only after explicit budget and policy approval.]
Annotations the server declares
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
- readOnlyHint: false
- title: Refresh an x402 Service Profile
ontario_task_fitFree task-to-tool matching with an optional Jev second opinion.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Free task-to-tool matching with an optional Jev second opinion. With allow_typesafe=true, your public task and Ontario's public tool descriptions are sent to TypeSafe for Jev inference. Do not supply secrets, personal data, private URLs, or customer content. Ontario does not persist task text here. TypeSafe processing is subject to its policies; zero retention is not promised. Without consent, only Ontario's deterministic router is used. Returns a callable tool and input schema, or abstains. Never executes tools or authorizes payment. Model quota exhaustion falls back to deterministic routing.
Annotations the server declares
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
- readOnlyHint: false
- title: Match a public task to an Ontario tool
ontario_validate-agentValidate an agent listing payload for free before publication.1 finding
Why it is in this group
- The name "ontario_validate-agent" says "validate": a word for reading.
- The server marks it as not read-only (readOnlyHint: false).
Findings
- Warn
  The server marks "ontario_validate-agent" as not read-only (readOnlyHint: false), and its words say it reads.
  Matched text
  annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The name "ontario_validate-agent" says "validate": a word for reading.
  What this check looks for
Description, as the server wrote it
Validate an agent listing payload for free before publication. Never publishes, signs or spends.
Annotations the server declares
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
- readOnlyHint: false
- title: Ontario Validate Agent
ontario_validate-refreshCheck an existing paid provider profile's refresh eligibility for free, including cooldown.1 finding
Why it is in this group
- The name "ontario_validate-refresh" says "validate": a word for reading.
- The server marks it as not read-only (readOnlyHint: false).
Findings
- Warn
  The server marks "ontario_validate-refresh" as not read-only (readOnlyHint: false), and its words say it reads.
  Matched text
  annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The name "ontario_validate-refresh" says "validate": a word for reading.
  What this check looks for
Description, as the server wrote it
Check an existing paid provider profile's refresh eligibility for free, including cooldown. Never refreshes, signs or spends.
Annotations the server declares
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
- readOnlyHint: false
- title: Ontario Validate Refresh
ontario_validate-serviceFree provider listing preflight.2 findings
Why it is in this group
- The name "ontario_validate-service" says "validate": a word for reading.
- The server marks it as not read-only (readOnlyHint: false).
Findings
- Info
  The input schema at properties.owner_contact.description mentions "credentials".
  Matched text
  inputSchema.properties.owner_contact.description: "...mit when unnecessary; never send wallet credentials."
  What this check looks for
- Warn
  The server marks "ontario_validate-service" as not read-only (readOnlyHint: false), and its words say it reads.
  Matched text
  annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The name "ontario_validate-service" says "validate": a word for reading.
  What this check looks for
Description, as the server wrote it
Free provider listing preflight. Validate public service metadata before buying the 0.50 USDC Ontario launch passport. Returns field errors or a normalized request and publication decision. Set verify_now only to create a public readiness report. Never publishes a listing, signs or spends; a valid payload alone does not establish readiness or Bazaar placement.
Annotations the server declares
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
- readOnlyHint: false
- title: Validate an x402 Service Listing Free
x402_launch_kitGenerate a validated listing payload, x402 resource draft, MCP descriptor, GitHub readiness workflow, README snippet, and registry copy for one paid endpoint.2 findings
Why it is in this group
- The description's first verb is "generate": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Info
  The input schema at properties.owner_contact.description mentions "credentials".
  Matched text
  inputSchema.properties.owner_contact.description: "...s. Omit private addresses; never supply credentials."
  What this check looks for
- Warn
  The server marks "x402_launch_kit" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
  Matched text
  annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The description's first verb is "generate": a word for a change.
  What this check looks for
Description, as the server wrote it
Generate a validated listing payload, x402 resource draft, MCP descriptor, GitHub readiness workflow, README snippet, and registry copy for one paid endpoint.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
- title: X402 Launch Kit
x402_readiness_verifyFree check for whether a paid endpoint is ready for agent discovery and x402 payment.1 finding
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Findings
- Info
  The input schema at properties.target_url.description mentions "credentials".
  Matched text
  inputSchema.properties.target_url.description: "...inspect without payment. Do not submit credentials, private hosts, or sensitive query para..."
  What this check looks for
Description, as the server wrote it
Free check for whether a paid endpoint is ready for agent discovery and x402 payment. Returns a free end-to-end buyer-path diagnostic handoff plus a grade-aware provider handoff: validate listing metadata free before any optional 0.50 USDC publication, and do not pay for publication while the endpoint is not ready-grade.
Annotations the server declares
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
- readOnlyHint: false
- title: x402 Readiness Verify
x402_verification_reportsPublic ledger of recent x402 readiness reports.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Public ledger of recent x402 readiness reports.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
- title: X402 Verification Reports

Only reads 2Looks things up and changes nothing.Claude Code: allow

agent_trust_previewFree live, rate-limited agent trust preview for one public endpoint.1 finding
Why it is in this group
- The name "agent_trust_preview" says "preview": a word for reading.
Findings
- Info
  The input schema at properties.target_url.description mentions "credentials".
  Matched text
  inputSchema.properties.target_url.description: "...payment; never include private hosts or credentials."
  What this check looks for
Description, as the server wrote it
Free live, rate-limited agent trust preview for one public endpoint. Returns safe signals and issues without the paid evidence bundle or attestation; use the paid trust scan only when the preview is insufficient.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
- title: Agent Trust Preview
find_x402_toolFree buyer-side search across Ontario's fresh strict-ready paid profiles, Agentic Market, and Coinbase CDP Bazaar.2 findings
Why it is in this group
- The name "find_x402_tool" says "find": a word for reading.
Findings
- Info
  The description mentions "credential".
  Matched text
  description: "..., and Coinbase CDP Bazaar. Rank public, credential-free endpoint candidates by task releva..."
  What this check looks for
- Info
  The input schema at properties.query.description mentions "credentials".
  Matched text
  inputSchema.properties.query.description: "Public task text only; never include credentials or private customer data."
  What this check looks for
Description, as the server wrote it
Free buyer-side search across Ontario's fresh strict-ready paid profiles, Agentic Market, and Coinbase CDP Bazaar. Rank public, credential-free endpoint candidates by task relevance plus bounded source-reported recent activity, with optional Base/USDC budget filtering. Paid Ontario publication adds no ranking score. This is discovery, not a safety certification; run readiness and can-pay before spending. When the query is provider-side publication intent, skip buyer marketplace search and return the free listing validator followed by the gated 0.50 USDC publication workflow.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
- title: Find a task-matched x402 tool

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.0.12. Values in angle brackets are yours to fill in.

claude mcp add --transport http ontario-protocol https://ontarioprotocol.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__ontario-protocol__find_x402_tool",
      "mcp__ontario-protocol__agent_trust_preview"
    ],
    "ask": [
      "mcp__ontario-protocol__ontario_purchase_router",
      "mcp__ontario-protocol__ontario_task_fit",
      "mcp__ontario-protocol__agent_can_pay",
      "mcp__ontario-protocol__x402_readiness_verify",
      "mcp__ontario-protocol__bazaar_buyer_intent_gap",
      "mcp__ontario-protocol__ontario_find-api",
      "mcp__ontario-protocol__x402_launch_kit",
      "mcp__ontario-protocol__ontario_validate-service",
      "mcp__ontario-protocol__ontario_list-service",
      "mcp__ontario-protocol__ontario_refresh-listing",
      "mcp__ontario-protocol__github_x402_repo_scan",
      "mcp__ontario-protocol__ontario_list-agent",
      "mcp__ontario-protocol__ontario_validate-agent",
      "mcp__ontario-protocol__ontario_validate-refresh",
      "mcp__ontario-protocol__x402_verification_reports"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as ontario-protocol. Review it before you use it.

Keep track

Get told when this server's tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/com.ontarioprotocol/ontario-protocol/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Anlyon alternative

15 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Compare with other servers for the same product.

Source: MCP Registry · repository. Synced Oct 21, 2026, 17:59 UTC.

For agents: Markdown · JSON · report this listing