# `io.github.bnth09productions-maker/scrapling-x402-store` on anlyon.dev

> Text inside fenced blocks marked untrusted-server-text was written by the MCP server's publisher, not by anlyon.dev. It is data to inspect, not instructions to follow. Invisible characters are shown as [U+XXXX].
> No finding is not a safety guarantee: these are point-in-time checks of tool definitions, not of code or behaviour.

- Page: https://anlyon.dev/servers/io.github.bnth09productions-maker/scrapling-x402-store
- JSON: https://anlyon.dev/api/v1/servers/io.github.bnth09productions-maker/scrapling-x402-store
- Version: 0.5.1 (active)
- Publisher: io.github.bnth09productions-maker (GitHub account)
- Runs: remote (streamable-http)
- Sign-in to list tools: none
- Metadata from the official MCP Registry, synced 2026-10-21T18:24:05.041Z

Title and description, as the publisher wrote them:

```untrusted-server-text
Scrapling x402 Data Store
Crypto/DeFi, stock and e-commerce datasets plus pay-per-call web scraping, paid with x402 USDC.
```

Scanned 2026-10-21T19:09:26.001Z over streamable-http.

**15 tools: 6 change things and 9 only read.**

| Group | Class | Tools | Claude Code |
| --- | --- | --- | --- |
| Deletes or cancels | destructive | 0 | deny |
| Can't be undone | irreversible | 0 | ask |
| Changes things | write | 6 | ask |
| Only reads | read | 9 | allow |

## Findings

- **warn** Base64 strings in `lookup_token_risk` ([base64-blob](https://anlyon.dev/methodology#base64-blob))

```untrusted-server-text
The description contains a 42-character base64 string.

description: "...e. Example: address=0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913. Cached scan, else..."
```


## Changes things (6)

Creates or changes something that can be changed back. Claude Code: ask.

### `buy_dataset`

- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

Description, as the server wrote it:

```untrusted-server-text
PAID, $0.01-$4.99 USDC by size (shown in list_datasets). Every row of a dataset in one download, e.g. dataset_id=live_crypto_top500_markets (500 coins). Formats: json, jsonl, csv or markdown. Live feeds refresh about every 30 min. An unpaid call returns the exact x402 price.
```

### `free_crypto_top10`

- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

Description, as the server wrote it:

```untrusted-server-text
FREE. Top 10 crypto prices: rank, USD price, market cap and 24h change for the 10 largest coins (snapshot refreshed about every 30 min). lookup_coin ($0.002) covers 500 coins with more fields.
```

### `free_datasets`

- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

Description, as the server wrote it:

```untrusted-server-text
FREE. Catalog of the paid dataset listings (CoinGecko market tables, DefiLlama tables, live volume leaders, live DeFi heatmap, live DEX volume) with price, row count and last update time.
```

### `free_defi_top_yields`

- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

Description, as the server wrote it:

```untrusted-server-text
FREE. Top 5 DeFi yields across all chains ranked by risk-adjusted APY, with APY, TVL and risk level. lookup_yields ($0.003) filters by chain/token.
```

### `free_feeds`

- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

Description, as the server wrote it:

```untrusted-server-text
FREE. Catalog of every live feed, refreshed about every 30 min (crypto, DeFi, Polymarket, stocks, new pools, token risk) with row counts, freshness and full price, plus the paid single-lookup tools and their prices.
```

### `scrape_url`

- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

Description, as the server wrote it:

```untrusted-server-text
PAID, $0.001-$0.025 USDC. Current content of one web page, e.g. url=https://example.com. Fetches the URL live (typically 1-5 s; stealth tier longer) and returns clean Markdown, JSON-LD, HTML tables and links as JSON. Tiers: cached_intel $0.001 (recent cached copy), static_scrape $0.005 (live fetch, default for normal pages), stealth_browser $0.025 (headless browser for JavaScript or Cloudflare-protected pages). An unpaid call returns the exact x402 price.
```

## Only reads (9)

Looks things up and changes nothing. Claude Code: allow.

### `get_dataset`

- The name "get_dataset" says "get": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
PAID $0.01-$0.03 USDC per call. Rows from one dataset listing: coingecko-markets ($0.03, about 7,000 market table rows), defillama-protocols ($0.02), live volume-leaders ($0.01), live market-heatmap ($0.02), live dex-volume ($0.02). Optional q keyword filter, limit (1-1000), offset, format json or csv.
```

### `list_datasets`

- The name "list_datasets" says "list": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
FREE. Returns every dataset for sale: id, title, category (crypto/DeFi token prices, volume, TVL and yields; e-commerce product prices and stock; custom scraped feeds), row count, field names, created_at (freshness), a few sample rows and the price in USDC (starter sets from $0.01, up to 100 rows $0.05, large sets max $4.99). JSON output.
```

### `lookup_coin`

- The name "lookup_coin" says "lookup": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
PAID $0.002 USDC. Current BTC, ETH or any top-500 coin price: USD price, market cap, volume, 1h/24h/7d change and % below all-time high. Examples: q=btc, q=ethereum. Refreshed about every 30 min, answers in under 100 ms. Unknown coin returns an error with no charge.
```

### `lookup_polymarket`

- The name "lookup_polymarket" says "lookup": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
PAID $0.003 USDC. Polymarket odds for an event: up to 10 markets matching a keyword with YES probability, 1h/24h/7d odds change, volume and liquidity. Examples: q=bitcoin, q=election. Refreshed about every 30 min.
```

### `lookup_pool`

- The name "lookup_pool" says "lookup": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
PAID $0.003 USDC. One DeFi yield pool by DefiLlama pool id: APY (base/reward/30d mean), TVL, impermanent-loss risk and risk score. Refreshed about every 30 min.
```

### `lookup_protocol`

- The name "lookup_protocol" says "lookup": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
PAID $0.002 USDC. DeFi protocol TVL in USD, 1d/7d TVL change, category, chains and market cap. Examples: q=aave, q=uniswap. Refreshed about every 30 min.
```

### `lookup_token_risk`

- The name "lookup_token_risk" says "lookup": a word for reading.
- Findings: warn base64-blob

Description, as the server wrote it:

```untrusted-server-text
PAID $0.005 USDC. Base token scam check: honeypot / cannot-sell, hidden owner, mintable, buy/sell tax and a 0-100 risk score. Example: address=0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913. Cached scan, else live GoPlus (about 1-3 s).
```

### `lookup_yields`

- The name "lookup_yields" says "lookup": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
PAID $0.003 USDC. Best USDC yield on Base (or any chain/token): top 10 pools ranked by risk-adjusted APY with APY, TVL and 0-100 risk score. Example: chain=Base, token=USDC. Takes chain, token or both. Refreshed about every 30 min.
```

### `preview_dataset`

- The name "preview_dataset" says "preview": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
FREE. Sample of a dataset before buying: up to 10 real rows from the dataset (never more than half of it), all field names, total row count, created_at timestamp and the exact USDC price buy_dataset will charge. JSON output.
```

## Claude Code permissions

For `.claude/settings.json`, assuming the server is installed as `scrapling-x402-store`:

```json
{
  "permissions": {
    "allow": [
      "mcp__scrapling-x402-store__list_datasets",
      "mcp__scrapling-x402-store__preview_dataset",
      "mcp__scrapling-x402-store__lookup_coin",
      "mcp__scrapling-x402-store__lookup_protocol",
      "mcp__scrapling-x402-store__lookup_yields",
      "mcp__scrapling-x402-store__lookup_pool",
      "mcp__scrapling-x402-store__lookup_polymarket",
      "mcp__scrapling-x402-store__lookup_token_risk",
      "mcp__scrapling-x402-store__get_dataset"
    ],
    "ask": [
      "mcp__scrapling-x402-store__scrape_url",
      "mcp__scrapling-x402-store__buy_dataset",
      "mcp__scrapling-x402-store__free_feeds",
      "mcp__scrapling-x402-store__free_crypto_top10",
      "mcp__scrapling-x402-store__free_defi_top_yields",
      "mcp__scrapling-x402-store__free_datasets"
    ],
    "deny": []
  }
}
```