Skip to content

SiteCheck Shop & Social

io.github.bck-stack/sitecheck-shop-socialbck-stackstreamable-httpv1.0.0Scanned

113 pay-per-call agent tools: e-commerce, product, price and social media data tools. x402

113 tools: 2 do something that can't be undone, 105 change things and 6 only read.

Tools: 0 delete, 2 irreversible, 105 write, 6 read.
  • Reads private data · 2
  • Reads text others write · 113
  • Can send data out · 12
  • 13 findings

Anlyon alternative

107 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

113 tools

Can't be undone 2Claude Code: ask
  • ecommerce_flixbusFlixBus and FlixTrain trips between two cities on a date: departure and arrival times and stations, duration, number of transfers, price in EUR (with and without platform fee), sea…Reads text others writeCan send data out1 finding

    Why it is in this group

    • The input addresses people (input.to): what it sends cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a destination (input.to): what the tool writes goes there.

    Findings

    • Warn

      The server marks "ecommerce_flixbus" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"openWorldHint":true}; The input addresses people (input.to): what it sends cannot be taken back.

      What this check looks for
    Description, as the server wrote it
    FlixBus and FlixTrain trips between two cities on a date: departure and arrival times and stations, duration, number of transfers, price in EUR (with and without platform fee), seats left and availability status, from FlixBus's public search API. One adult, one way. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • social_threads_repliesReplies to a Threads post: the post itself (text, likes, reply/repost/quote counts) and the replies the public post page shows (first page, typically 10-25, including short reply c…Reads text others writeCan send data out1 finding

    Why it is in this group

    • The name "social_threads_replies" says "reply": a word for sending, and what is sent cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "social_threads_replies" says "reply": it sends or publishes something to other people.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.

    Findings

    • Warn

      The server marks "social_threads_replies" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"openWorldHint":true}; The name "social_threads_replies" says "reply": a word for sending, and what is sent cannot be taken back.

      What this check looks for
    Description, as the server wrote it
    Replies to a Threads post: the post itself (text, likes, reply/repost/quote counts) and the replies the public post page shows (first page, typically 10-25, including short reply chains and the author's own thread continuations) with author, text, time, likes and who each reply answers. From threads.net through a residential proxy. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
Changes things 105Claude Code: ask
  • ecommerce_16881688.com (Alibaba's China wholesale market) offer search: offer id, product title, unit price in CNY, minimum order text, supplier company, supplier service scores (overall, return…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    1688.com (Alibaba's China wholesale market) offer search: offer id, product title, unit price in CNY, minimum order text, supplier company, supplier service scores (overall, returns, quality, logistics...), repeat-purchase/return rate text, ad flag and offer link, about 60 offers per page. From s.1688.com's public search through a rendering residential proxy (titles appear as 1688's machine translation). Price: $0.02 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • ecommerce_ace_hardwareAce Hardware (US) product search: total hits and up to 30 products per page with product code, name, brand, price, MSRP, on-sale flag, UPC, manufacturer part number, product type, …Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Ace Hardware (US) product search: total hits and up to 30 products per page with product code, name, brand, price, MSRP, on-sale flag, UPC, manufacturer part number, product type, online stock, rating, review count, image and product link. From acehardware.com via a residential proxy. Price: $0.02 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • ecommerce_aliexpressAliExpress product search from the public search page: product ID, title, sale price and original price with currency code, discount %, promo label (welcome-gift cards have no pric…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    AliExpress product search from the public search page: product ID, title, sale price and original price with currency code, discount %, promo label (welcome-gift cards have no price), star rating and units-sold text when shown, listing date, image and product URL; 60 products per page plus the total result count. Language and currency can follow the caller's region (the currency code is always returned). Unofficial page data, may change. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • ecommerce_amazon_bestsellersTop items on Amazon.com's Best Sellers page: rank, ASIN and product page link, read from the public HTML.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Top items on Amazon.com's Best Sellers page: rank, ASIN and product page link, read from the public HTML. Names are taken from the product URL, so they can be shortened. No prices or stock (not on this page). Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • ecommerce_avantor_vwr_internationalAvantor / VWR catalog search (US or Canada site): product code, name, short description, VWR catalog and article number, supplier/vendor, list prices per unit of measure (e.g.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Avantor / VWR catalog search (US or Canada site): product code, name, short description, VWR catalog and article number, supplier/vendor, list prices per unit of measure (e.g. pack of 6, case of 24) in USD or CAD, stock status, discontinued / restricted / chemical flags and product URL, plus total matches. Anonymous list prices from the API behind avantorsciences.com; contract prices need an account. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • ecommerce_backmarketBack Market refurbished-product search on a country site (en-us, en-gb, fr-fr, de-de, es-es, it-it, ...): total hits and the first page of products with listing id, title, brand, m…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Back Market refurbished-product search on a country site (en-us, en-gb, fr-fr, de-de, es-es, it-it, ...): total hits and the first page of products with listing id, title, brand, model, category, condition grade, price and currency, new-device price, stock, review average and count, warranty months, colours, sales bucket, image and product link. From backmarket.com via a residential proxy. Price: $0.02 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • ecommerce_chemist_warehouseChemist Warehouse (Australia) category products (first page, about 20): product id, name, price (AUD), saving off RRP (AUD), rating and review count, image and product link.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Chemist Warehouse (Australia) category products (first page, about 20): product id, name, price (AUD), saving off RRP (AUD), rating and review count, image and product link. Category as on the site, e.g. 81/vitamins-supplements, 1093/cold-flu, 109/foot-care. From chemistwarehouse.com.au via a rendering residential proxy. Price: $0.02 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • ecommerce_chewy_comChewy (US) item tracker: for 1-10 Chewy item IDs (the number after /dp/ in a chewy.com URL) returns name, brand, price, strike-through price, Autoship price and discount, per-unit …Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Chewy (US) item tracker: for 1-10 Chewy item IDs (the number after /dp/ in a chewy.com URL) returns name, brand, price, strike-through price, Autoship price and discount, per-unit price, in-stock / discontinued flags, shipping timeframe, GTIN, rating and rating count, active promotions, size/flavor variants with their prices and stock, and key attributes. From the GraphQL API chewy.com's product pages use; no keyword search. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • ecommerce_chrome_web_storeChrome Web Store search results: extension name, id and detail-page link, from the public results page (first page only).Reads text others write1 finding

    Why it is in this group

    • The name "ecommerce_chrome_web_store" says "store": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "ecommerce_chrome_web_store" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"openWorldHint":true}; The name "ecommerce_chrome_web_store" says "store": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Chrome Web Store search results: extension name, id and detail-page link, from the public results page (first page only). No ratings, user counts or prices: the results HTML does not include them. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • ecommerce_costcoCostco Canada (costco.ca) product tracker: for 1-5 product IDs (the number at the end of a costco.ca product URL) returns name, brand, item number (SKU), price in CAD, availability…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Costco Canada (costco.ca) product tracker: for 1-5 product IDs (the number at the end of a costco.ca product URL) returns name, brand, item number (SKU), price in CAD, availability (in stock / out of stock), shipping rate, rating and rating count, category path, description, image and URL, from each public product page's schema.org data. No keyword search; costco.com (US) is not reachable from the tool's network. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • ecommerce_costplusdrugsCost Plus Drugs mail-order cash prices from its official pricing API: search by drug name (optionally strength) or NDC; returns medication and brand name, generic/brand, form, stre…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Cost Plus Drugs mail-order cash prices from its official pricing API: search by drug name (optionally strength) or NDC; returns medication and brand name, generic/brand, form, strength, treatment categories, pack size, RxNorm ID, in-stock flag, price per unit (USD, incl. markup), cash dispensing fee, 30/60/90-count pack prices with and without fee, total with shipping, and product URL. Only drugs sold on the CPD mail-order channel. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • ecommerce_cpsc_recallsU.S.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    U.S. Consumer Product Safety Commission product recalls from SaferProducts.gov. Searches recall titles only (not all text). Returns recall number, date, hazard, remedy and the official CPSC page. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • ecommerce_dealstreamDealStream businesses for sale: listing title, asking price (USD), short description, industry, city and state, listing id and link, 25 per page (page 1 to 50), newest first, for t…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    DealStream businesses for sale: listing title, asking price (USD), short description, industry, city and state, listing id and link, 25 per page (page 1 to 50), newest first, for the whole US or one state. From dealstream.com's public listing pages via a residential proxy; financial details beyond the asking price are on the listing page. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • ecommerce_dealstream_listingsDealStream businesses for sale: listing title, asking price (USD), short description, industry, city and state, listing id and link, 25 per page (page 1 to 50), newest first, for t…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    DealStream businesses for sale: listing title, asking price (USD), short description, industry, city and state, listing id and link, 25 per page (page 1 to 50), newest first, for the whole US or one state. From dealstream.com's public listing pages via a residential proxy; financial details beyond the asking price are on the listing page. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • ecommerce_digikala_iranDigikala (Iran) product search: product ID, Persian and English title, brand, category, selling price and list price in Iranian rial (and toman), discount %, stock, rating (0-100) …Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Digikala (Iran) product search: product ID, Persian and English title, brand, category, selling price and list price in Iranian rial (and toman), discount %, stock, rating (0-100) and count, default seller (name, rating, trusted/official flags), warranty, colours, image and product URL, plus total items and pages. Sort by relevance, views, newest, best-selling, cheapest or most expensive. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • ecommerce_eu_safety_gate_rapexEU Safety Gate (RAPEX) weekly product-safety report index from the European Commission's public XML list: newest reports first, with reference, publication date, week and the link …Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    EU Safety Gate (RAPEX) weekly product-safety report index from the European Commission's public XML list: newest reports first, with reference, publication date, week and the link to each report's alerts. Product-level details are not included; open the returned link for them. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • ecommerce_faireFaire wholesale marketplace category listing (logged-out view): product token, name, brand name and token, suggested retail price (USD), case quantity, stock units, brand rating an…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Faire wholesale marketplace category listing (logged-out view): product token, name, brand name and token, suggested retail price (USD), case quantity, stock units, brand rating and review count, new / bestseller / promoted flags, brand's country, image and product link. Wholesale prices need a retailer login and are not included. From faire.com via a residential proxy. Price: $0.02 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • ecommerce_falabella_latamFalabella Chile product search: product ID, name, brand, seller, prices in CLP (Falabella CMR card price, internet/event price and crossed-out normal price) with discount badge, ra…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Falabella Chile product search: product ID, name, brand, seller, prices in CLP (Falabella CMR card price, internet/event price and crossed-out normal price) with discount badge, rating and review count, best-seller and sponsored flags, delivery stickers (e.g. arrives tomorrow), image and product URL; 48+ per page plus the total number of results. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • ecommerce_fisher_scientificFisher Scientific (US) lab product search: product family title, description, leaf category, starting list price (USD, as shown to logged-out visitors), catalog (part) numbers in t…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Fisher Scientific (US) lab product search: product family title, description, leaf category, starting list price (USD, as shown to logged-out visitors), catalog (part) numbers in the family, key specifications and link; 15 families per page (page 1 to 10). From fishersci.com's public search through a residential proxy; account-specific pricing is not included. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • ecommerce_gamenationGameNation.in (India) game, console and accessory search from the JSON API its website uses: product name, product ID, condition (new or pre-owned), selling price and MRP in INR, d…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    GameNation.in (India) game, console and accessory search from the JSON API its website uses: product name, product ID, condition (new or pre-owned), selling price and MRP in INR, discount %, trade-in cash and trade-in store-credit offers, availability and image. Returns the total match count and up to 200 products. Unofficial endpoint, may change. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • ecommerce_gmx_arbitrum_pricesGMX token prices on Arbitrum from the public api.gmx.io/prices feed.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    GMX token prices on Arbitrum from the public api.gmx.io/prices feed. Returns token contract addresses (the feed has no symbols) and USD price per token, scaled by 1e30 as GMX does. Use the address to match the token yourself. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • ecommerce_grubhubGrubhub restaurants delivering to a US ZIP code (or lat/lng), optionally matching a search such as pizza or sushi: restaurant id, name, cuisines, rating and rating count, price lev…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Grubhub restaurants delivering to a US ZIP code (or lat/lng), optionally matching a search such as pizza or sushi: restaurant id, name, cuisines, rating and rating count, price level (1-4), delivery fee and order minimum (USD), delivery time window (minutes), pickup/delivery, open now, phone, address, distance (miles) and Grubhub link. Up to 20 per page. From Grubhub's own diner API through a US proxy. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • ecommerce_hepsiburadaHepsiburada (Turkey) product search: product name, product ID (HB SKU), final price and crossed-out price in TRY, discount %, rating and number of reviews, campaign lines (e.g.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Hepsiburada (Turkey) product search: product name, product ID (HB SKU), final price and crossed-out price in TRY, discount %, rating and number of reviews, campaign lines (e.g. installments, lowest price in 30 days), image and product URL; 36 per page plus the total number of results. Sort by relevance, price, reviews, rating or newest. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • ecommerce_invaluable_auctionsAuction lots from Invaluable (thousands of auction houses worldwide) for a keyword: upcoming lots with current bid, bid count, estimate range, sale date and type (live/timed), or p…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Auction lots from Invaluable (thousands of auction houses worldwide) for a keyword: upcoming lots with current bid, bid count, estimate range, sale date and type (live/timed), or past lots with the hammer price result. Each lot: title, lot number, category path, artist, auction house, location and country, currency, image and lot URL; plus the total matching lots. Bidder identities are not returned. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • ecommerce_lazada_productsLazada product search for Singapore, Malaysia, Philippines, Thailand, Vietnam and Indonesia, from the JSON the Lazada catalog page itself loads: product name, item ID, price and or…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Lazada product search for Singapore, Malaysia, Philippines, Thailand, Vietnam and Indonesia, from the JSON the Lazada catalog page itself loads: product name, item ID, price and original price in local currency, discount, rating, review count, units sold, seller, brand, ship-from location, stock flag, sponsored flag, image and product URL. Up to 40 products per page. Unofficial endpoint, may change or rate-limit. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • ecommerce_made_in_chinaMade-in-China.com wholesale product search: product name, supplier company, price range (USD, as the page's structured data gives it) and stock state from the public results page.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Made-in-China.com wholesale product search: product name, supplier company, price range (USD, as the page's structured data gives it) and stock state from the public results page. Only the first page (about 20 products). Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • ecommerce_mediamarkt_euMediaMarkt / MediaWorld product search for Germany, Austria, Switzerland, Italy (MediaWorld) and Poland, read from the schema.org product list on the public search page: product na…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    MediaMarkt / MediaWorld product search for Germany, Austria, Switzerland, Italy (MediaWorld) and Poland, read from the schema.org product list on the public search page: product name, price and currency (EUR, CHF or PLN), average rating, review count, image and product URL for the top 12 results, plus the total number of matching products. A search that matches a category or brand returns that page's top products. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • ecommerce_metalprices_comLatest precious-metal prices from MetalpriceAPI (gold XAU, silver XAG, palladium XPD, platinum XPT): USD per troy ounce, plus the raw rate (ounces per 1 USD) and the time the price…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Latest precious-metal prices from MetalpriceAPI (gold XAU, silver XAG, palladium XPD, platinum XPT): USD per troy ounce, plus the raw rate (ounces per 1 USD) and the time the price is from (end of day on the free plan). Not a retail price list. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • ecommerce_mood_fabricsFabrics listed on Mood Fabrics' public product feed: title, type, variant prices and whether each variant is in stock.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Fabrics listed on Mood Fabrics' public product feed: title, type, variant prices and whether each variant is in stock. Only the feed's first page is read (newest products first). Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • ecommerce_neweggNewegg (US) product search: item number, title, model, price, list price, instant rebate, lowest price in 30 days, in-stock flag, rating, review count, seller count, category, best…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Newegg (US) product search: item number, title, model, price, list price, instant rebate, lowest price in 30 days, in-stock flag, rating, review count, seller count, category, best-selling rank, free-shipping flag and link, about 36-42 items per page (page 1 to 20), plus the total result count. From newegg.com's public search page via a residential proxy. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • ecommerce_nykaa_beautyNykaa (India) beauty product search: name, brand, price and MRP in INR, discount, rating, rating count, in-stock flag, shade/variant count, offer count, category path, tags (bestse…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Nykaa (India) beauty product search: name, brand, price and MRP in INR, discount, rating, rating count, in-stock flag, shade/variant count, offer count, category path, tags (bestseller, featured) and product link, about 20 per page (page 1 to 10), plus the total found and the Nykaa listing the search maps to. From nykaa.com through a residential proxy. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • ecommerce_openbeautyfacts_productsBeauty and personal-care products by brand from Open Beauty Facts (community open data, crowd-sourced).Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Beauty and personal-care products by brand from Open Beauty Facts (community open data, crowd-sourced). Gives name, barcode, size and product page. No prices or stock: this source does not have them. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • ecommerce_petcoPetco.com (US) product search read from the public search page: product name, brand, price, list price, Repeat Delivery (autoship) price in USD, average rating, review count, categ…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Petco.com (US) product search read from the public search page: product name, brand, price, list price, Repeat Delivery (autoship) price in USD, average rating, review count, category, same-day delivery / store pickup / in-store-only flags, number of variations, image and product URL, plus the total result count. 48 products per page. Prices are Petco's online prices at the time of the call. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • ecommerce_pricerunnerPrice comparison from PriceRunner (Klarna) in the UK, Sweden or Denmark: for a search, products with lowest price and currency, number of shops offering it, category, popularity ra…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Price comparison from PriceRunner (Klarna) in the UK, Sweden or Denmark: for a search, products with lowest price and currency, number of shops offering it, category, popularity rank, rating average and count, price-drop info, condition, stock flag, image and comparison URL, plus the total number of hits and the categories found. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • ecommerce_rakuten_japanRakuten Ichiba (Japan) product search from the official Rakuten Web Service API: item name, price in JPY, shop, review average and count, point rate, availability, shipping flags a…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Rakuten Ichiba (Japan) product search from the official Rakuten Web Service API: item name, price in JPY, shop, review average and count, point rate, availability, shipping flags and item link. Search results only, no stock history. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • ecommerce_rappiRappi restaurant menu and prices (Mexico, Brazil, Colombia, Argentina, Chile, Peru, Uruguay, Ecuador, Costa Rica): for a Rappi store ID returns store name, brand, address, open sta…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Rappi restaurant menu and prices (Mexico, Brazil, Colombia, Argentina, Chile, Peru, Uruguay, Ecuador, Costa Rica): for a Rappi store ID returns store name, brand, address, open status, ETA, delivery fee, rating and reviews, cuisine tags, weekly schedule, active offers, and the menu by section with each product's price, original price, discount %, availability and description. From the public restaurant page; no store search. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • ecommerce_restaurant_depot_sysco_us_foods_chef_storeRestaurant-supply prices from US Foods CHEF'STORE (cash-and-carry, open to the public): products with brand, description, category, pack and size, UPCs, item number and, at the cho…Reads text others write1 finding

    Why it is in this group

    • The name "ecommerce_restaurant_depot_sysco_us_foods_chef_store" says "store": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "ecommerce_restaurant_depot_sysco_us_foods_chef_store" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"openWorldHint":true}; The name "ecommerce_restaurant_depot_sysco_us_foods_chef_store" says "store": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Restaurant-supply prices from US Foods CHEF'STORE (cash-and-carry, open to the public): products with brand, description, category, pack and size, UPCs, item number and, at the chosen store, unit and case price, regular price, sale flag and end date, low-stock flag and aisle; plus store count and lowest/highest unit price across stores. Restaurant Depot and Sysco publish no prices without an account. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • ecommerce_revzillaRevZilla motorcycle gear and parts in a category (e.g.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    RevZilla motorcycle gear and parts in a category (e.g. motorcycle-helmets, motorcycle-jackets, motorcycle-tires): product name, brand, price (USD), in-stock flag, rating, review count, badge (top rated, new...), free-shipping flag, image and link; 96 per page (page 1 to 20), plus the category's product count. From revzilla.com's public category pages via a residential proxy. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • ecommerce_sephora_productsSephora (US) product search from Sephora's own catalog search: for a keyword up to 60 products per page with product ID, SKU ID, brand, name, price or price range (USD), sale price…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Sephora (US) product search from Sephora's own catalog search: for a keyword up to 60 products per page with product ID, SKU ID, brand, name, price or price range (USD), sale price, rating, review count, number of shades, flags (bestseller, new, Sephora exclusive, limited edition, online only, sale), product link and image, plus the total product count and Sephora's matching categories. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • ecommerce_shopify_storesProducts of a Shopify store from its public /products.json feed: title, type, vendor, variant prices and whether each variant is in stock.Reads text others write1 finding

    Why it is in this group

    • The name "ecommerce_shopify_stores" says "store": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "ecommerce_shopify_stores" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"openWorldHint":true}; The name "ecommerce_shopify_stores" says "store": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Products of a Shopify store from its public /products.json feed: title, type, vendor, variant prices and whether each variant is in stock. Works only for stores that keep the feed public; you give the store domain, e.g. allbirds.com. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • ecommerce_singlecareSingleCare prescription coupon prices for a drug: price at each nearby pharmacy (Kroger, CVS, Walgreens, Walmart...) with loyalty price and distance, the lowest price, form, streng…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    SingleCare prescription coupon prices for a drug: price at each nearby pharmacy (Kroger, CVS, Walgreens, Walmart...) with loyalty price and distance, the lowest price, form, strength and quantity priced, usual retail cash price, generic/brand flag and monthly price history. From singlecare.com's public drug pages via a residential proxy; the pharmacy list depends on the ZIP. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • ecommerce_takealot_south_africaTakealot.com (South Africa) product search from the JSON API the Takealot website uses: product ID (PLID), title, brand, price or price range in ZAR, list price, saving badge, star…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Takealot.com (South Africa) product search from the JSON API the Takealot website uses: product ID (PLID), title, brand, price or price range in ZAR, list price, saving badge, star rating, review count, stock status, delivery estimate, image and product URL, plus the total result count. Up to 36 products per call. Unofficial endpoint, may change without notice. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • ecommerce_target_reviewsReviews of a Target product by TCIN (the number after A- in a target.com product URL): rating statistics (average, count, 1-5 star distribution, % recommended, review and question …Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Reviews of a Target product by TCIN (the number after A- in a target.com product URL): rating statistics (average, count, 1-5 star distribution, % recommended, review and question counts) and reviews with rating, title, text, recommended and verified-purchase flags, helpful votes, photo count and date. Sort by most recent, most helpful, highest or lowest rating; optional verified-only. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • ecommerce_trendyol_turkeyTrendyol (Turkey) product search: total hits and 36 products per page with product id, name, brand, category, price (TRY), original price and discount, rating and review count, bes…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Trendyol (Turkey) product search: total hits and 36 products per page with product id, name, brand, category, price (TRY), original price and discount, rating and review count, best-seller rank, favourites and order counts (as shown, e.g. 55K / 200+), free-shipping flag, merchant id, variant, image and product link. From trendyol.com via a Turkish residential proxy. Price: $0.01 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • ecommerce_ulineUline industrial supply product by item number (e.g.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Uline industrial supply product by item number (e.g. S-4119): description, category, and the unit price the Uline page reports. Read from the public product page; no stock or shipping data. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • ecommerce_vestiaire_collectiveVestiaire Collective listing tracker (US site, USD): for 1-10 listing IDs (the number before .shtml in a listing URL) returns title, brand, category, condition, color, material, cu…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Vestiaire Collective listing tracker (US site, USD): for 1-10 listing IDs (the number before .shtml in a listing URL) returns title, brand, category, condition, color, material, current price, seller price and buyer fee, sold / reserved / available flags, likes, seller country, listed items and items sold, shipping origin and URL. Reads each public listing page; no catalog search. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • ecommerce_vestiairecollectiveVestiaire Collective listing tracker (US site, USD): for 1-10 listing IDs (the number before .shtml in a listing URL) returns title, brand, category, condition, color, material, cu…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Vestiaire Collective listing tracker (US site, USD): for 1-10 listing IDs (the number before .shtml in a listing URL) returns title, brand, category, condition, color, material, current price, seller price and buyer fee, sold / reserved / available flags, likes, seller country, listed items and items sold, shipping origin and URL. Reads each public listing page; no catalog search. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • ecommerce_vintage_photo_restorerRestores an old, scratched or faded photo with an AI image model (Cloudflare Workers AI, img2img).Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Restores an old, scratched or faded photo with an AI image model (Cloudflare Workers AI, img2img). Returns a new image; it does not recover lost detail or identify people. Send the photo as base64. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • ecommerce_webstaurantstoreWebstaurantStore search results for restaurant and foodservice supplies: item number, description, shown price per unit and product link, from the public results page (first page o…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    WebstaurantStore search results for restaurant and foodservice supplies: item number, description, shown price per unit and product link, from the public results page (first page only). Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • ecommerce_zazzleZazzle (US) product search from the public search page: product ID, title, product type, price and current sale price in USD, discount %, promo label, all-time order count, store n…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Zazzle (US) product search from the public search page: product ID, title, product type, price and current sale price in USD, discount %, promo label, all-time order count, store name and handle, image and product URL; 60 products per page plus the total number of matching products and pages. Prices are Zazzle's default-configuration prices at the time of the call. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • social_aemet_spain_weatherSpanish weather station observations from AEMET OpenData (official): latest hourly readings (temperature, humidity, wind, pressure, precipitation…) for all stations or one station …Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Spanish weather station observations from AEMET OpenData (official): latest hourly readings (temperature, humidity, wind, pressure, precipitation…) for all stations or one station ID (idema, e.g. 3195 Madrid Retiro), as published by AEMET. Requires the operator's free AEMET OpenData key. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • social_alltrailsHiking trails from OpenStreetMap (via the free Waymarked Trails API), not from AllTrails, which blocks automated access: search by trail name or list routes around a point.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Hiking trails from OpenStreetMap (via the free Waymarked Trails API), not from AllTrails, which blocks automated access: search by trail name or list routes around a point. Per trail: OSM ID, name, ref, network level, length in km, loop/linear, hardest OSM sac_scale difficulty, surfaces, operator, website, Wikidata, description and center point. No user ratings, reviews or photos (OSM has none). Coverage depends on OSM mapping. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • social_bea_national_accountsUS national accounts from the Bureau of Economic Analysis (official API): any NIPA table (e.g.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    US national accounts from the Bureau of Economic Analysis (official API): any NIPA table (e.g. T10101 real GDP percent change, T10105 GDP in dollars, T20100 personal income) at annual, quarterly or monthly frequency for chosen years, returned as BEA publishes the rows (line, description, period, value, unit). Requires the operator's free BEA API UserID. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • social_bilibili_commentsHot comments on one Bilibili video from Bilibili's public comment endpoint: comment id, author name, text, like count, reply count and time (up to 20, most-liked first).Reads text others write1 finding

    Why it is in this group

    • The name "social_bilibili_comments" says "comment": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "social_bilibili_comments" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"openWorldHint":true}; The name "social_bilibili_comments" says "comment": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Hot comments on one Bilibili video from Bilibili's public comment endpoint: comment id, author name, text, like count, reply count and time (up to 20, most-liked first). Needs the video's numeric aid (the number in the av<aid> URL); the tool does not convert BV ids. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • social_carparts_comCarParts.com product search: for a keyword (e.g.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    CarParts.com product search: for a keyword (e.g. 'brake pads', 'headlight', a part number) up to 20 products per page with SKU, manufacturer number, brand, private-label flag, category path (top level, category, sub-category, part), price, list price and saving, shipping cost, universal-fit flag, product attributes (warranty, notes …), image and product link, plus the total result count and page count. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • social_carsandbidsLive Cars & Bids auctions from the site's public RSS feed (about 250 current items, newest first): auction title, auction link and id, start date, short description and photo.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Live Cars & Bids auctions from the site's public RSS feed (about 250 current items, newest first): auction title, auction link and id, start date, short description and photo. The feed has no current bid, reserve or end-time data, so those are not returned. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • social_contact_infoContact details published on one public web page you name (https only): mailto and tel links, email addresses written in the page text, and links to social profiles, plus the page …Reads text others writeCan send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Contact details published on one public web page you name (https only): mailto and tel links, email addresses written in the page text, and links to social profiles, plus the page title. Reads the single page only, does not crawl, and returns nothing that the page does not show. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • social_facebook_commentsComments on a public Facebook post as a logged-out visitor sees them (the 'Most relevant' comments of the first page load, usually about 10): comment id, author, author link, text,…Reads text others writeCan send data out1 finding

    Why it is in this group

    • The name "social_facebook_comments" says "comment": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.

    Findings

    • Warn

      The server marks "social_facebook_comments" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"openWorldHint":true}; The name "social_facebook_comments" says "comment": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Comments on a public Facebook post as a logged-out visitor sees them (the 'Most relevant' comments of the first page load, usually about 10): comment id, author, author link, text, time, reaction count, reply count and link, plus the post's text and total reaction / comment / share counts. From facebook.com via a residential proxy. Price: $0.01 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • social_facebook_eventsEvents listed on a Facebook Page's Events tab (logged-out view): event id, name, date text, place, city, cancelled flag, organiser and event link, plus the Page name.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Events listed on a Facebook Page's Events tab (logged-out view): event id, name, date text, place, city, cancelled flag, organiser and event link, plus the Page name. From facebook.com via a residential proxy. Price: $0.01 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • social_facebook_followers_followingFacebook Page follower counts from Facebook's public Page Plugin: for up to 10 Pages (username, numeric ID or facebook.com URL) the Page name, numeric page ID, verified badge, prof…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Facebook Page follower counts from Facebook's public Page Plugin: for up to 10 Pages (username, numeric ID or facebook.com URL) the Page name, numeric page ID, verified badge, profile picture URL and exact follower count, sorted by followers. Counts only: the lists of individual followers or followed accounts require a logged-in Facebook session and are not returned. Unknown pages are listed under notFound. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • social_facebook_groupsFacebook group snapshot as a logged-out visitor sees it: group name, id, Public/Private, member count and the posts shown in the first page load (post id, link, author, text, time,…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Facebook group snapshot as a logged-out visitor sees it: group name, id, Public/Private, member count and the posts shown in the first page load (post id, link, author, text, time, reactions, comments, shares). Private groups return the header only. From facebook.com via a residential proxy. Price: $0.01 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • social_facebook_likesReaction, comment and share counts for up to 10 public Facebook post URLs, from Facebook's public Embedded Post plugin: counts as shown (e.g.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Reaction, comment and share counts for up to 10 public Facebook post URLs, from Facebook's public Embedded Post plugin: counts as shown (e.g. 1.2K) with a numeric estimate, page or author name, verified badge, publish time (UTC) and attached image. Totals only: who reacted is not available without login. Private, deleted or non-embeddable posts are listed under notFound. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • social_facebook_marketplaceFacebook Marketplace search for a city (logged-out view, the first ~15-25 listings): listing id, title, price, amount, city, state, seller name, sold / pending flags, delivery type…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Facebook Marketplace search for a city (logged-out view, the first ~15-25 listings): listing id, title, price, amount, city, state, seller name, sold / pending flags, delivery types, created time, photo and listing link. From facebook.com/marketplace via a residential proxy. Price: $0.01 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • social_facebook_page_contact_infoContact details from a Facebook Page's About tab (logged-out view): category, email, phone, website(s), address, other social links and the raw list of fields Facebook shows, plus …Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Contact details from a Facebook Page's About tab (logged-out view): category, email, phone, website(s), address, other social links and the raw list of fields Facebook shows, plus the Page name and follower count. From facebook.com via a residential proxy. Price: $0.01 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • social_facebook_pagesFacebook Page profile from Facebook's public Page Plugin: page name, follower count, verified flag and page link.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Facebook Page profile from Facebook's public Page Plugin: page name, follower count, verified flag and page link. Posts and discussions are not in the public plugin and are not returned. Facebook may block or rate-limit automated requests (503). Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • social_facebook_photosLatest photos on a Facebook Page's Photos tab (logged-out view, usually 8): photo id, alt-text caption, image URL, width, height and photo link, plus the Page name and follower cou…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Latest photos on a Facebook Page's Photos tab (logged-out view, usually 8): photo id, alt-text caption, image URL, width, height and photo link, plus the Page name and follower count. Image URLs are signed and expire. From facebook.com via a residential proxy. Price: $0.01 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • social_facebook_postsLatest public posts of a Facebook Page as a logged-out visitor sees them (Facebook shows the first 1-3 posts without login): post id, link, text, time, reaction / comment / share c…Reads text others writeCan send data out1 finding

    Why it is in this group

    • The name "social_facebook_posts" says "post": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "social_facebook_posts" says "post": it sends or publishes something to other people.

    Findings

    • Warn

      The server marks "social_facebook_posts" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"openWorldHint":true}; The name "social_facebook_posts" says "post": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Latest public posts of a Facebook Page as a logged-out visitor sees them (Facebook shows the first 1-3 posts without login): post id, link, text, time, reaction / comment / share counts and media type, plus the Page name and follower count. From facebook.com via a residential proxy. Price: $0.01 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • social_facebook_reelsFacebook Reel details from the public reel page (logged-out view): reel id, title, summary, caption, duration (seconds), thumbnail, owner name and id, post time, reaction, comment …Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Facebook Reel details from the public reel page (logged-out view): reel id, title, summary, caption, duration (seconds), thumbnail, owner name and id, post time, reaction, comment and share counts. Input a reel link or id. From facebook.com via a residential proxy. Price: $0.01 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • social_instagramEngagement snapshot of a public Instagram account from Instagram's web profile JSON: followers, total posts, and the 12 newest posts with likes, comments, video views and per-post …Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Engagement snapshot of a public Instagram account from Instagram's web profile JSON: followers, total posts, and the 12 newest posts with likes, comments, video views and per-post engagement rate ((likes+comments)/followers), plus averages, median likes, best post and posting frequency over those 12. Comment text is not served anonymously, only counts. Hidden like counts give null. Throttling gives 503 (not charged); unknown users 404. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • social_instagram_contactPublic contact details of an Instagram account from Instagram's web profile JSON: business email, phone and address (only when the account shows them as public contact buttons), co…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Public contact details of an Instagram account from Instagram's web profile JSON: business email, phone and address (only when the account shows them as public contact buttons), contact method, category, website and bio links, plus emails and phone-like numbers written in the bio. Nothing hidden is looked up. Anonymous access is throttled by Instagram (503, not charged). Unknown usernames return 404. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • social_instagram_highlightsStory highlights of a public Instagram profile (the highlights tray a logged-out visitor sees): highlight id, title, cover thumbnail and link, plus the profile's full name, followe…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Story highlights of a public Instagram profile (the highlights tray a logged-out visitor sees): highlight id, title, cover thumbnail and link, plus the profile's full name, followers, following, bio, verified and private flags. Highlight story items themselves need a login and are not returned. From instagram.com via a residential proxy. Price: $0.01 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • social_instagram_postsThe 12 most recent grid posts of a public Instagram account from Instagram's web profile JSON: shortcode, URL, type (image/carousel/video/reel), full caption, post time, likes, com…Reads text others writeCan send data out1 finding

    Why it is in this group

    • The name "social_instagram_posts" says "post": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "social_instagram_posts" says "post": it sends or publishes something to other people.

    Findings

    • Warn

      The server marks "social_instagram_posts" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"openWorldHint":true}; The name "social_instagram_posts" says "post": a word for a change.

      What this check looks for
    Description, as the server wrote it
    The 12 most recent grid posts of a public Instagram account from Instagram's web profile JSON: shortcode, URL, type (image/carousel/video/reel), full caption, post time, likes, comments, video views and duration, location and image URL, plus the account's total post count. Only the newest 12 are served anonymously (no paging, no comment text). Private accounts return an empty list. Throttling gives 503 (not charged); unknown users 404. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • social_instagram_profilePublic Instagram profile from Instagram's web profile JSON: ID, username, full name, bio, external link and bio links, verified/private/business flags, category, exact follower, fo…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Public Instagram profile from Instagram's web profile JSON: ID, username, full name, bio, external link and bio links, verified/private/business flags, category, exact follower, following and post counts, reel/highlight counts and profile picture. Anonymous access is throttled by Instagram, so a call can fail with 503 (not charged); a few business profiles hit an Instagram-side error (502). Unknown usernames return 404. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • social_instagram_reelRecent reels and videos of a public Instagram account from Instagram's web profile JSON: reels and videos among the 12 newest grid posts and the newest long-form (IGTV) videos, eac…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Recent reels and videos of a public Instagram account from Instagram's web profile JSON: reels and videos among the 12 newest grid posts and the newest long-form (IGTV) videos, each with URL, caption, post time, views, likes, comments and duration. Instagram does not serve the full reels tab or single-reel lookups anonymously, so only these recent items appear. Throttling gives 503 (not charged); unknown users 404. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • social_labx_comListings of one LabX seller (lab equipment marketplace) from the seller's public profile page: listing id, title, price range, currency, condition, category, source link and availa…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Listings of one LabX seller (lab equipment marketplace) from the seller's public profile page: listing id, title, price range, currency, condition, category, source link and availability date (about 20 per page), plus the seller's active-listing count. Prices are the seller's asking prices as listed; 'Request a Quote' listings have no price. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • social_olxOLX classified listings search (Poland, Romania, Portugal, Ukraine, Bulgaria, Kazakhstan, Uzbekistan) from OLX's public listing API: title, URL, price with currency and negotiable …Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    OLX classified listings search (Poland, Romania, Portugal, Ukraine, Bulgaria, Kazakhstan, Uzbekistan) from OLX's public listing API: title, URL, price with currency and negotiable flag, city/region, category ID, posted and refreshed dates, private vs business seller, photo URL, short description and promotion flags, plus the total number of matching ads. Newest first by default. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • social_pinterestLatest pins of a public Pinterest profile from Pinterest's own RSS feed: profile name and description, and for each of the newest 25 pins the pin URL and ID, text, image URL and pu…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Latest pins of a public Pinterest profile from Pinterest's own RSS feed: profile name and description, and for each of the newest 25 pins the pin URL and ID, text, image URL and publish date. Works for public profiles without login; boards, search and engagement counts are not part of the feed. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • social_reddit_postsPosts of one subreddit from Reddit's public feed, sorted hot, new, top or rising (about 25 items): id, title, author, date and link.Reads text others writeCan send data out1 finding

    Why it is in this group

    • The name "social_reddit_posts" says "post": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "social_reddit_posts" says "post": it sends or publishes something to other people.

    Findings

    • Warn

      The server marks "social_reddit_posts" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"openWorldHint":true}; The name "social_reddit_posts" says "post": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Posts of one subreddit from Reddit's public feed, sorted hot, new, top or rising (about 25 items): id, title, author, date and link. The feed has no scores or comment counts, so it cannot rank by votes. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • social_reddit_posts_commentsReddit community discussions from Reddit's public RSS feeds: top posts of a subreddit for hour/day/week/month/year/all, or one thread (post id) with its visible comments.Reads text others writeCan send data out1 finding

    Why it is in this group

    • The name "social_reddit_posts_comments" says "post": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "social_reddit_posts_comments" says "post": it sends or publishes something to other people.

    Findings

    • Warn

      The server marks "social_reddit_posts_comments" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"openWorldHint":true}; The name "social_reddit_posts_comments" says "post": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Reddit community discussions from Reddit's public RSS feeds: top posts of a subreddit for hour/day/week/month/year/all, or one thread (post id) with its visible comments. Feeds carry title, author, link, date and text only; no scores or comment counts. Reddit may rate-limit (503). Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • social_reddit_profilesReddit user profile from Reddit's public user feed: the user's name, the profile subtitle, and their latest submitted posts (title, subreddit, date, link; about 25 items).Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Reddit user profile from Reddit's public user feed: the user's name, the profile subtitle, and their latest submitted posts (title, subreddit, date, link; about 25 items). No karma, account age or hidden profile data; the feed does not show them. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • social_snapchatPublic Snapchat profile from its web profile page: username, display name, page title and description, snapcode image and canonical link.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Public Snapchat profile from its web profile page: username, display name, page title and description, snapcode image and canonical link. Stories, Spotlight posts and follower counts are not shown on the public page and are not returned. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • social_socialbladeSocial Blade creator statistics for a YouTube, Instagram, TikTok or Twitch account: followers/subscribers, views or likes, uploads, engagement rate and averages where Social Blade …Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Social Blade creator statistics for a YouTube, Instagram, TikTok or Twitch account: followers/subscribers, views or likes, uploads, engagement rate and averages where Social Blade has them, Social Blade grade and ranks, country and category, plus the daily history Social Blade shows publicly (about 15 days). From socialblade.com's public profile pages through a residential proxy. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • social_sosBusiness entity search in official Secretary of State open data for Colorado (all entities), New York (active corporations) and Oregon (active businesses): name contains-search, ne…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Business entity search in official Secretary of State open data for Colorado (all entities), New York (active corporations) and Oregon (active businesses): name contains-search, newest first, with entity ID, name, type, status, jurisdiction, formation date, principal or process address and registered agent. Only these three states; refresh follows each state's portal. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • social_telegram_channelPublic Telegram channel from its t.me/s preview page: title, description, subscriber/photo/video/link counts, and the latest ~20 posts with text, view count text and time.Reads text others writeCan send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a destination (input.channel): what the tool writes goes there.
    Description, as the server wrote it
    Public Telegram channel from its t.me/s preview page: title, description, subscriber/photo/video/link counts, and the latest ~20 posts with text, view count text and time. Only public channels that show a preview; private chats and groups are not returned. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • social_telegram_homepageLatest public posts of one Telegram channel as shown on its public web preview (t.me/s/<channel>): post id, text, view count text and date, about 20 per page.Reads text others writeCan send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a destination (input.channel): what the tool writes goes there.
    Description, as the server wrote it
    Latest public posts of one Telegram channel as shown on its public web preview (t.me/s/<channel>): post id, text, view count text and date, about 20 per page. Only public channels with a preview; the Telegram homepage itself has no data, so this tool reads a channel's public feed. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • social_threads_profileThreads (Meta) profile: name, verified flag, bio, follower count and bio links, plus the latest posts the public profile page shows (about 10, including the author's own thread con…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Threads (Meta) profile: name, verified flag, bio, follower count and bio links, plus the latest posts the public profile page shows (about 10, including the author's own thread continuations) with text, time, likes, replies, reposts, quotes, media URLs and link. From threads.net through a residential proxy; logged-out pages show a limited number of posts. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • social_tiktokOne public TikTok video by URL from the video page's embedded data: caption, hashtags, creation date, duration, size, cover image, region, language, ad flag, exact play, like, comm…Reads text others writeCan send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    One public TikTok video by URL from the video page's embedded data: caption, hashtags, creation date, duration, size, cover image, region, language, ad flag, exact play, like, comment, share, save and repost counts, the author (ID, username, nickname, verified, follower and like totals) and the sound. Keyword, hashtag and profile video lists are not available anonymously. Deleted or private videos return 404. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • social_tiktok_commentsTop-level comments of a public TikTok video from TikTok's web comment list JSON: comment ID, text, likes, reply count, time, language, pinned/liked-by-creator flags and the comment…Reads text others writeCan send data out1 finding

    Why it is in this group

    • The name "social_tiktok_comments" says "comment": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.

    Findings

    • Warn

      The server marks "social_tiktok_comments" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"openWorldHint":true}; The name "social_tiktok_comments" says "comment": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Top-level comments of a public TikTok video from TikTok's web comment list JSON: comment ID, text, likes, reply count, time, language, pinned/liked-by-creator flags and the commenter's ID, username and nickname, plus the video's total comment count. Up to 60 comments in TikTok's own ranking order (no reply threads). An unknown or deleted video ID returns an empty list with total 0. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • social_tiktok_creative_center_top_adsTikTok Creative Center Top Ads: the top-performing TikTok auction ads the public gallery shows first for a region and period (logged-out view: the first 4 cards): ad id, campaign o…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    TikTok Creative Center Top Ads: the top-performing TikTok auction ads the public gallery shows first for a region and period (logged-out view: the first 4 cards): ad id, campaign objective, industry, likes, CTR percentile band, budget band, thumbnail and the Creative Center analytics link. From ads.tiktok.com/business/creativecenter via a rendering residential proxy. Price: $0.02 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • social_tiktok_hashtag_analyticsTikTok hashtag stats from TikTok's public hashtag detail JSON: hashtag ID, title, description, exact video count and total view count, average views per video and commerce flag, fo…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    TikTok hashtag stats from TikTok's public hashtag detail JSON: hashtag ID, title, description, exact video count and total view count, average views per video and commerce flag, for up to 10 hashtags compared side by side (sorted by views). Lifetime totals only: no time series, no top-video list and no audience demographics. Unknown hashtags are listed under notFound. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • social_tiktok_profilePublic TikTok profile from the profile page's embedded data: user ID, secUid, nickname, bio, bio link, verified, private and organization flags, language, avatar, creation date, an…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Public TikTok profile from the profile page's embedded data: user ID, secUid, nickname, bio, bio link, verified, private and organization flags, language, avatar, creation date, and exact counts of followers, following, likes, videos and friends. The page carries no video list for anonymous visitors, so videos are not included. Unknown usernames return 404. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • social_tiktok_shopTikTok Shop (US) category products: the products the public category page shows first (about 10) with title, price, original price, rating, review count, units sold, shop name, bra…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    TikTok Shop (US) category products: the products the public category page shows first (about 10) with title, price, original price, rating, review count, units sold, shop name, brand and product link, plus a few recent buyer reviews and the category tree. Pass a category URL from shop.tiktok.com/us/c/... or its slug and id. Via a residential proxy. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • social_truthsocialTruth Social account and its latest posts: profile (name, followers, following, post count, verified, website, joined) and up to 20 newest posts with text, time, replies, reposts, …Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Truth Social account and its latest posts: profile (name, followers, following, post count, verified, website, joined) and up to 20 newest posts with text, time, replies, reposts, likes, media URLs, link card and repost/quote flags. From truthsocial.com's public Mastodon-style API through a residential proxy. Price: $0.003 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • social_upworkUpwork open jobs for one skill (e.g.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Upwork open jobs for one skill (e.g. python, shopify, video-editing): the newest 30 freelance jobs with title, description (first 600 characters), hourly or fixed budget, experience level, duration, weekly hours, skills, posted time and link, plus the total number of open jobs for that skill. From upwork.com's public freelance-jobs pages through a residential proxy. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • social_x_comOne public X (Twitter) post by URL or ID from the JSON behind X's official embed widget: text, language, date, like and reply counts, edit status, reply-to, links, hashtags, mentio…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    One public X (Twitter) post by URL or ID from the JSON behind X's official embed widget: text, language, date, like and reply counts, edit status, reply-to, links, hashtags, mentions, photos and video (poster, duration, MP4 variants), quoted post, and the author (name, handle, blue check, label). Retweet, view and bookmark counts are not in this source. Timelines and search need X's paid API. Deleted or protected posts return 404. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • social_x_com_profilesPublic X (Twitter) profiles for up to 10 usernames via the free FxTwitter API (open-source relay of X's public profile data; X's own API is paid): user ID, name, bio with expanded …Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Public X (Twitter) profiles for up to 10 usernames via the free FxTwitter API (open-source relay of X's public profile data; X's own API is paid): user ID, name, bio with expanded links, location, website, join date, protected flag, verification (verified + type: individual, business, government), followers, following, posts, likes, media count, avatar and banner. Unknown or suspended usernames go to notFound. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • social_youtubeLatest videos of a YouTube channel (first page, up to 30): video id, title, link, duration, view count text and age text, read from the channel's public Videos page.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Latest videos of a YouTube channel (first page, up to 30): video id, title, link, duration, view count text and age text, read from the channel's public Videos page. No comments, no subscriber counts and no full history; YouTube's page layout can change. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • social_youtube_channel_emailYouTube channel About page from YouTube's public page data: description, country, subscriber/view/video counts, external links, and any email addresses the creator wrote in the pub…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    YouTube channel About page from YouTube's public page data: description, country, subscriber/view/video counts, external links, and any email addresses the creator wrote in the public description. YouTube's hidden 'view email' address needs a CAPTCHA and is not returned. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • social_youtube_commentsFirst page of top comments (about 20) on one YouTube video: author, verified/creator flags, text, like count text, reply count text and age text.Reads text others write1 finding

    Why it is in this group

    • The name "social_youtube_comments" says "comment": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "social_youtube_comments" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"openWorldHint":true}; The name "social_youtube_comments" says "comment": a word for a change.

      What this check looks for
    Description, as the server wrote it
    First page of top comments (about 20) on one YouTube video: author, verified/creator flags, text, like count text, reply count text and age text. Comments turned off or empty return an empty list. Reply threads and later pages are not returned. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • social_youtube_edu_channelsEducation channels on YouTube: channels found by a topic search (default 'education', first page of about 20) with channel id, name, handle, subscriber count text, description snip…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Education channels on YouTube: channels found by a topic search (default 'education', first page of about 20) with channel id, name, handle, subscriber count text, description snippet and link, from YouTube's public channel-filtered search page. No video lists or exact subscriber counts. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • social_youtube_hashtagVideos on one YouTube hashtag page: video id, title, channel, view count text (exact for most videos), age text, duration and link, as shown on the first page (about 10-12 videos).Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Videos on one YouTube hashtag page: video id, title, channel, view count text (exact for most videos), age text, duration and link, as shown on the first page (about 10-12 videos). No comments and no full history; YouTube's page layout can change. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • social_youtube_shortsLatest Shorts of one YouTube channel from its public Shorts page (first ~48 items): video id, title, view count text (as YouTube shows it, e.g.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Latest Shorts of one YouTube channel from its public Shorts page (first ~48 items): video id, title, view count text (as YouTube shows it, e.g. '5 thousand views'), link and thumbnail. No durations, likes or comments. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • social_youtube_transcriptTranscript (captions) of a public YouTube video from YouTube caption tracks: title, channel, length, available caption languages, and the chosen track as timed segments (start and …Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Transcript (captions) of a public YouTube video from YouTube caption tracks: title, channel, length, available caption languages, and the chosen track as timed segments (start and duration in seconds, text) plus the joined full text. Prefers human captions over auto-generated ones. Videos without captions return an empty segment list; private or removed videos return 404. YouTube bot-checks some requests: those return 503 (not charged), retry. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • social_youtube_twitch_kick_creator_outreachOne outreach card for a creator across YouTube, Twitch and Kick (give any of the three usernames): bio, follower/subscriber counts, live status, verified flag, every public social …Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    One outreach card for a creator across YouTube, Twitch and Kick (give any of the three usernames): bio, follower/subscriber counts, live status, verified flag, every public social link (Instagram, X, YouTube, Discord, TikTok...) and email addresses written in public bios. Data is what each platform shows publicly; hidden business emails (YouTube 'view email') are not fetched. Unknown usernames are reported per platform. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
Only reads 6Show 6 read-only tools
  • ecommerce_smart_apify_actorSearches the public Apify Store for scraper actors by keyword: name, author, short description, and 30-day user count.Reads text others writeNo findings

    Why it is in this group

    • The description's first verb is "search": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Searches the public Apify Store for scraper actors by keyword: name, author, short description, and 30-day user count. Lists actors only; it does not run them or return product data. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

2712 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 2 private-data tools breaks every one.

Reads private data2
Reads files, mail, messages, databases, secrets, calendars or repositories.
deny to break every path
{
  "permissions": {
    "deny": [
      "mcp__sitecheck-shop-social__social_facebook_search",
      "mcp__sitecheck-shop-social__social_threads_search"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

13 warn
  • The server marks "ecommerce_flixbus" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"openWorldHint":true}; The input addresses people (input.to): what it sends cannot be taken back.

    What this check looks for
  • The server marks "ecommerce_shopify_stores" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"openWorldHint":true}; The name "ecommerce_shopify_stores" says "store": a word for a change.

    What this check looks for
  • The server marks "ecommerce_restaurant_depot_sysco_us_foods_chef_store" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"openWorldHint":true}; The name "ecommerce_restaurant_depot_sysco_us_foods_chef_store" says "store": a word for a change.

    What this check looks for
  • The server marks "ecommerce_chrome_web_store" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"openWorldHint":true}; The name "ecommerce_chrome_web_store" says "store": a word for a change.

    What this check looks for
  • The server marks "social_reddit_posts_comments" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"openWorldHint":true}; The name "social_reddit_posts_comments" says "post": a word for a change.

    What this check looks for
  • The server marks "social_instagram_posts" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"openWorldHint":true}; The name "social_instagram_posts" says "post": a word for a change.

    What this check looks for
Show 7 more findings
  • The server marks "social_youtube_comments" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"openWorldHint":true}; The name "social_youtube_comments" says "comment": a word for a change.

    What this check looks for
  • The server marks "social_reddit_posts" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"openWorldHint":true}; The name "social_reddit_posts" says "post": a word for a change.

    What this check looks for
  • The server marks "social_threads_replies" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"openWorldHint":true}; The name "social_threads_replies" says "reply": a word for sending, and what is sent cannot be taken back.

    What this check looks for
  • The server marks "social_facebook_posts" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"openWorldHint":true}; The name "social_facebook_posts" says "post": a word for a change.

    What this check looks for
  • The server marks "social_facebook_comments" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"openWorldHint":true}; The name "social_facebook_comments" says "comment": a word for a change.

    What this check looks for
  • The server marks "social_tiktok_comments" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"openWorldHint":true}; The name "social_tiktok_comments" says "comment": a word for a change.

    What this check looks for
  • The server marks "social_bilibili_comments" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"openWorldHint":true}; The name "social_bilibili_comments" says "comment": a word for a change.

    What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http sitecheck-shop-social https://api.shopsocial-api.workers.dev/mcp?ref=registry
claude mcp add --transport http sitecheck-shop-social https://api.shopsocial-api.workers.dev/mcp?ref=registry

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__sitecheck-shop-social__ecommerce_smart_apify_actor",
      "mcp__sitecheck-shop-social__social_facebook_search",
      "mcp__sitecheck-shop-social__social_threads_search",
      "mcp__sitecheck-shop-social__social_telegram_keyword_search",
      "mcp__sitecheck-shop-social__social_youtube_channel_search",
      "mcp__sitecheck-shop-social__social_copart_public_search"
    ],
    "ask": [
      "mcp__sitecheck-shop-social__ecommerce_1688",
      "mcp__sitecheck-shop-social__ecommerce_vestiairecollective",
      "mcp__sitecheck-shop-social__ecommerce_amazon_bestsellers",
      "mcp__sitecheck-shop-social__ecommerce_chewy_com",
      "mcp__sitecheck-shop-social__ecommerce_rakuten_japan",
      "mcp__sitecheck-shop-social__ecommerce_hepsiburada",
      "mcp__sitecheck-shop-social__ecommerce_grubhub",
      "mcp__sitecheck-shop-social__ecommerce_trendyol_turkey",
      "mcp__sitecheck-shop-social__ecommerce_chemist_warehouse",
      "mcp__sitecheck-shop-social__ecommerce_digikala_iran",
      "mcp__sitecheck-shop-social__ecommerce_backmarket",
      "mcp__sitecheck-shop-social__ecommerce_takealot_south_africa",
      "mcp__sitecheck-shop-social__ecommerce_aliexpress",
      "mcp__sitecheck-shop-social__ecommerce_flixbus",
      "mcp__sitecheck-shop-social__ecommerce_zazzle",
      "mcp__sitecheck-shop-social__ecommerce_costplusdrugs",
      "mcp__sitecheck-shop-social__ecommerce_nykaa_beauty",
      "mcp__sitecheck-shop-social__ecommerce_shopify_stores",
      "mcp__sitecheck-shop-social__ecommerce_faire",
      "mcp__sitecheck-shop-social__ecommerce_metalprices_com",
      "mcp__sitecheck-shop-social__ecommerce_petco",
      "mcp__sitecheck-shop-social__ecommerce_lazada_products",
      "mcp__sitecheck-shop-social__ecommerce_revzilla",
      "mcp__sitecheck-shop-social__ecommerce_avantor_vwr_international",
      "mcp__sitecheck-shop-social__ecommerce_vintage_photo_restorer",
      "mcp__sitecheck-shop-social__ecommerce_costco",
      "mcp__sitecheck-shop-social__ecommerce_rappi",
      "mcp__sitecheck-shop-social__ecommerce_singlecare",
      "mcp__sitecheck-shop-social__ecommerce_ace_hardware",
      "mcp__sitecheck-shop-social__ecommerce_gmx_arbitrum_prices",
      "mcp__sitecheck-shop-social__ecommerce_restaurant_depot_sysco_us_foods_chef_store",
      "mcp__sitecheck-shop-social__ecommerce_webstaurantstore",
      "mcp__sitecheck-shop-social__ecommerce_invaluable_auctions",
      "mcp__sitecheck-shop-social__ecommerce_newegg",
      "mcp__sitecheck-shop-social__ecommerce_dealstream_listings",
      "mcp__sitecheck-shop-social__ecommerce_target_reviews",
      "mcp__sitecheck-shop-social__ecommerce_uline",
      "mcp__sitecheck-shop-social__ecommerce_gamenation",
      "mcp__sitecheck-shop-social__ecommerce_fisher_scientific",
      "mcp__sitecheck-shop-social__ecommerce_mood_fabrics",
      "mcp__sitecheck-shop-social__ecommerce_made_in_china",
      "mcp__sitecheck-shop-social__ecommerce_dealstream",
      "mcp__sitecheck-shop-social__ecommerce_vestiaire_collective",
      "mcp__sitecheck-shop-social__ecommerce_cpsc_recalls",
      "mcp__sitecheck-shop-social__ecommerce_chrome_web_store",
      "mcp__sitecheck-shop-social__ecommerce_openbeautyfacts_products",
      "mcp__sitecheck-shop-social__ecommerce_sephora_products",
      "mcp__sitecheck-shop-social__ecommerce_mediamarkt_eu",
      "mcp__sitecheck-shop-social__ecommerce_eu_safety_gate_rapex",
      "mcp__sitecheck-shop-social__ecommerce_falabella_latam",
      "mcp__sitecheck-shop-social__ecommerce_pricerunner",
      "mcp__sitecheck-shop-social__social_reddit_posts_comments",
      "mcp__sitecheck-shop-social__social_tiktok_creative_center_top_ads",
      "mcp__sitecheck-shop-social__social_instagram_reel",
      "mcp__sitecheck-shop-social__social_x_com_profiles",
      "mcp__sitecheck-shop-social__social_instagram",
      "mcp__sitecheck-shop-social__social_facebook_pages",
      "mcp__sitecheck-shop-social__social_youtube",
      "mcp__sitecheck-shop-social__social_facebook_marketplace",
      "mcp__sitecheck-shop-social__social_tiktok_shop",
      "mcp__sitecheck-shop-social__social_tiktok_profile",
      "mcp__sitecheck-shop-social__social_facebook_groups",
      "mcp__sitecheck-shop-social__social_youtube_channel_email",
      "mcp__sitecheck-shop-social__social_youtube_transcript",
      "mcp__sitecheck-shop-social__social_socialblade",
      "mcp__sitecheck-shop-social__social_contact_info",
      "mcp__sitecheck-shop-social__social_telegram_channel",
      "mcp__sitecheck-shop-social__social_facebook_reels",
      "mcp__sitecheck-shop-social__social_reddit_profiles",
      "mcp__sitecheck-shop-social__social_youtube_hashtag",
      "mcp__sitecheck-shop-social__social_facebook_likes",
      "mcp__sitecheck-shop-social__social_instagram_contact",
      "mcp__sitecheck-shop-social__social_instagram_posts",
      "mcp__sitecheck-shop-social__social_instagram_profile",
      "mcp__sitecheck-shop-social__social_x_com",
      "mcp__sitecheck-shop-social__social_youtube_comments",
      "mcp__sitecheck-shop-social__social_reddit_posts",
      "mcp__sitecheck-shop-social__social_pinterest",
      "mcp__sitecheck-shop-social__social_tiktok",
      "mcp__sitecheck-shop-social__social_youtube_shorts",
      "mcp__sitecheck-shop-social__social_facebook_followers_following",
      "mcp__sitecheck-shop-social__social_threads_replies",
      "mcp__sitecheck-shop-social__social_labx_com",
      "mcp__sitecheck-shop-social__social_facebook_posts",
      "mcp__sitecheck-shop-social__social_facebook_comments",
      "mcp__sitecheck-shop-social__social_tiktok_hashtag_analytics",
      "mcp__sitecheck-shop-social__social_youtube_twitch_kick_creator_outreach",
      "mcp__sitecheck-shop-social__social_snapchat",
      "mcp__sitecheck-shop-social__social_facebook_events",
      "mcp__sitecheck-shop-social__social_facebook_photos",
      "mcp__sitecheck-shop-social__social_tiktok_comments",
      "mcp__sitecheck-shop-social__social_bilibili_comments",
      "mcp__sitecheck-shop-social__social_threads_profile",
      "mcp__sitecheck-shop-social__social_telegram_homepage",
      "mcp__sitecheck-shop-social__social_youtube_edu_channels",
      "mcp__sitecheck-shop-social__social_facebook_page_contact_info",
      "mcp__sitecheck-shop-social__social_truthsocial",
      "mcp__sitecheck-shop-social__social_instagram_related_profiles",
      "mcp__sitecheck-shop-social__social_instagram_highlights",
      "mcp__sitecheck-shop-social__social_aemet_spain_weather",
      "mcp__sitecheck-shop-social__social_bea_national_accounts",
      "mcp__sitecheck-shop-social__social_sos",
      "mcp__sitecheck-shop-social__social_olx",
      "mcp__sitecheck-shop-social__social_upwork",
      "mcp__sitecheck-shop-social__social_carparts_com",
      "mcp__sitecheck-shop-social__social_alltrails",
      "mcp__sitecheck-shop-social__social_carsandbids"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as sitecheck-shop-social. Review it before you use it.

Capability tags behind 113 rules
  • mcp__sitecheck-shop-social__ecommerce_1688 untrusted-input
  • mcp__sitecheck-shop-social__ecommerce_vestiairecollective untrusted-input
  • mcp__sitecheck-shop-social__ecommerce_amazon_bestsellers untrusted-input
  • mcp__sitecheck-shop-social__ecommerce_chewy_com untrusted-input
  • mcp__sitecheck-shop-social__ecommerce_rakuten_japan untrusted-input
  • mcp__sitecheck-shop-social__ecommerce_hepsiburada untrusted-input
  • mcp__sitecheck-shop-social__ecommerce_grubhub untrusted-input
  • mcp__sitecheck-shop-social__ecommerce_trendyol_turkey untrusted-input
  • mcp__sitecheck-shop-social__ecommerce_chemist_warehouse untrusted-input
  • mcp__sitecheck-shop-social__ecommerce_digikala_iran untrusted-input
  • mcp__sitecheck-shop-social__ecommerce_backmarket untrusted-input
  • mcp__sitecheck-shop-social__ecommerce_takealot_south_africa untrusted-input
  • mcp__sitecheck-shop-social__ecommerce_aliexpress untrusted-input
  • mcp__sitecheck-shop-social__ecommerce_flixbus untrusted-input, outbound
  • mcp__sitecheck-shop-social__ecommerce_zazzle untrusted-input
  • mcp__sitecheck-shop-social__ecommerce_costplusdrugs untrusted-input
  • mcp__sitecheck-shop-social__ecommerce_nykaa_beauty untrusted-input
  • mcp__sitecheck-shop-social__ecommerce_shopify_stores untrusted-input
  • mcp__sitecheck-shop-social__ecommerce_faire untrusted-input
  • mcp__sitecheck-shop-social__ecommerce_metalprices_com untrusted-input
  • mcp__sitecheck-shop-social__ecommerce_petco untrusted-input
  • mcp__sitecheck-shop-social__ecommerce_lazada_products untrusted-input
  • mcp__sitecheck-shop-social__ecommerce_revzilla untrusted-input
  • mcp__sitecheck-shop-social__ecommerce_avantor_vwr_international untrusted-input
  • mcp__sitecheck-shop-social__ecommerce_vintage_photo_restorer untrusted-input
  • mcp__sitecheck-shop-social__ecommerce_smart_apify_actor untrusted-input
  • mcp__sitecheck-shop-social__ecommerce_costco untrusted-input
  • mcp__sitecheck-shop-social__ecommerce_rappi untrusted-input
  • mcp__sitecheck-shop-social__ecommerce_singlecare untrusted-input
  • mcp__sitecheck-shop-social__ecommerce_ace_hardware untrusted-input
  • mcp__sitecheck-shop-social__ecommerce_gmx_arbitrum_prices untrusted-input
  • mcp__sitecheck-shop-social__ecommerce_restaurant_depot_sysco_us_foods_chef_store untrusted-input
  • mcp__sitecheck-shop-social__ecommerce_webstaurantstore untrusted-input
  • mcp__sitecheck-shop-social__ecommerce_invaluable_auctions untrusted-input
  • mcp__sitecheck-shop-social__ecommerce_newegg untrusted-input
  • mcp__sitecheck-shop-social__ecommerce_dealstream_listings untrusted-input
  • mcp__sitecheck-shop-social__ecommerce_target_reviews untrusted-input
  • mcp__sitecheck-shop-social__ecommerce_uline untrusted-input
  • mcp__sitecheck-shop-social__ecommerce_gamenation untrusted-input
  • mcp__sitecheck-shop-social__ecommerce_fisher_scientific untrusted-input
  • mcp__sitecheck-shop-social__ecommerce_mood_fabrics untrusted-input
  • mcp__sitecheck-shop-social__ecommerce_made_in_china untrusted-input
  • mcp__sitecheck-shop-social__ecommerce_dealstream untrusted-input
  • mcp__sitecheck-shop-social__ecommerce_vestiaire_collective untrusted-input
  • mcp__sitecheck-shop-social__ecommerce_cpsc_recalls untrusted-input
  • mcp__sitecheck-shop-social__ecommerce_chrome_web_store untrusted-input
  • mcp__sitecheck-shop-social__ecommerce_openbeautyfacts_products untrusted-input
  • mcp__sitecheck-shop-social__ecommerce_sephora_products untrusted-input
  • mcp__sitecheck-shop-social__ecommerce_mediamarkt_eu untrusted-input
  • mcp__sitecheck-shop-social__ecommerce_eu_safety_gate_rapex untrusted-input
  • mcp__sitecheck-shop-social__ecommerce_falabella_latam untrusted-input
  • mcp__sitecheck-shop-social__ecommerce_pricerunner untrusted-input
  • mcp__sitecheck-shop-social__social_reddit_posts_comments untrusted-input, outbound
  • mcp__sitecheck-shop-social__social_tiktok_creative_center_top_ads untrusted-input
  • mcp__sitecheck-shop-social__social_instagram_reel untrusted-input
  • mcp__sitecheck-shop-social__social_x_com_profiles untrusted-input
  • mcp__sitecheck-shop-social__social_instagram untrusted-input
  • mcp__sitecheck-shop-social__social_facebook_pages untrusted-input
  • mcp__sitecheck-shop-social__social_youtube untrusted-input
  • mcp__sitecheck-shop-social__social_facebook_search private-data, untrusted-input
  • mcp__sitecheck-shop-social__social_facebook_marketplace untrusted-input
  • mcp__sitecheck-shop-social__social_tiktok_shop untrusted-input
  • mcp__sitecheck-shop-social__social_tiktok_profile untrusted-input
  • mcp__sitecheck-shop-social__social_facebook_groups untrusted-input
  • mcp__sitecheck-shop-social__social_youtube_channel_email untrusted-input
  • mcp__sitecheck-shop-social__social_youtube_transcript untrusted-input
  • mcp__sitecheck-shop-social__social_socialblade untrusted-input
  • mcp__sitecheck-shop-social__social_contact_info untrusted-input, outbound
  • mcp__sitecheck-shop-social__social_telegram_channel untrusted-input, outbound
  • mcp__sitecheck-shop-social__social_facebook_reels untrusted-input
  • mcp__sitecheck-shop-social__social_reddit_profiles untrusted-input
  • mcp__sitecheck-shop-social__social_youtube_hashtag untrusted-input
  • mcp__sitecheck-shop-social__social_facebook_likes untrusted-input
  • mcp__sitecheck-shop-social__social_instagram_contact untrusted-input
  • mcp__sitecheck-shop-social__social_instagram_posts untrusted-input, outbound
  • mcp__sitecheck-shop-social__social_instagram_profile untrusted-input
  • mcp__sitecheck-shop-social__social_x_com untrusted-input
  • mcp__sitecheck-shop-social__social_youtube_comments untrusted-input
  • mcp__sitecheck-shop-social__social_reddit_posts untrusted-input, outbound
  • mcp__sitecheck-shop-social__social_threads_search private-data, untrusted-input
  • mcp__sitecheck-shop-social__social_pinterest untrusted-input
  • mcp__sitecheck-shop-social__social_tiktok untrusted-input, outbound
  • mcp__sitecheck-shop-social__social_youtube_shorts untrusted-input
  • mcp__sitecheck-shop-social__social_telegram_keyword_search untrusted-input
  • mcp__sitecheck-shop-social__social_facebook_followers_following untrusted-input
  • mcp__sitecheck-shop-social__social_threads_replies untrusted-input, outbound
  • mcp__sitecheck-shop-social__social_labx_com untrusted-input
  • mcp__sitecheck-shop-social__social_facebook_posts untrusted-input, outbound
  • mcp__sitecheck-shop-social__social_facebook_comments untrusted-input, outbound
  • mcp__sitecheck-shop-social__social_tiktok_hashtag_analytics untrusted-input
  • mcp__sitecheck-shop-social__social_youtube_twitch_kick_creator_outreach untrusted-input
  • mcp__sitecheck-shop-social__social_snapchat untrusted-input
  • mcp__sitecheck-shop-social__social_facebook_events untrusted-input
  • mcp__sitecheck-shop-social__social_facebook_photos untrusted-input
  • mcp__sitecheck-shop-social__social_tiktok_comments untrusted-input, outbound
  • mcp__sitecheck-shop-social__social_bilibili_comments untrusted-input
  • mcp__sitecheck-shop-social__social_threads_profile untrusted-input
  • mcp__sitecheck-shop-social__social_telegram_homepage untrusted-input, outbound
  • mcp__sitecheck-shop-social__social_youtube_edu_channels untrusted-input
  • mcp__sitecheck-shop-social__social_facebook_page_contact_info untrusted-input
  • mcp__sitecheck-shop-social__social_truthsocial untrusted-input
  • mcp__sitecheck-shop-social__social_instagram_related_profiles untrusted-input
  • mcp__sitecheck-shop-social__social_youtube_channel_search untrusted-input
  • mcp__sitecheck-shop-social__social_instagram_highlights untrusted-input
  • mcp__sitecheck-shop-social__social_aemet_spain_weather untrusted-input
  • mcp__sitecheck-shop-social__social_bea_national_accounts untrusted-input
  • mcp__sitecheck-shop-social__social_sos untrusted-input
  • mcp__sitecheck-shop-social__social_olx untrusted-input
  • mcp__sitecheck-shop-social__social_upwork untrusted-input
  • mcp__sitecheck-shop-social__social_carparts_com untrusted-input
  • mcp__sitecheck-shop-social__social_copart_public_search untrusted-input
  • mcp__sitecheck-shop-social__social_alltrails untrusted-input
  • mcp__sitecheck-shop-social__social_carsandbids untrusted-input

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/io.github.bck-stack/sitecheck-shop-social/verify?hash=214046ea530a3bfefbb8322d04dd64f1c774f1213ebd323d4e5628d8d7bc2bee" | jq -e '.changed == false'

Pinned hash 214046ea530a, from Oct 23, 2026, 18:19 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.github.bck-stack/sitecheck-shop-social/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for io.github.bck-stack/sitecheck-shop-social
[![anlyon.dev](https://anlyon.dev/badge/io.github.bck-stack/sitecheck-shop-social.svg)](https://anlyon.dev/servers/io.github.bck-stack/sitecheck-shop-social)

Source: MCP Registry. Synced Oct 23, 2026, 18:18 UTC.