Skip to content

io.github.drain54/verify-api

by drain54 · remote · no sign-in to list tools · v1.0.0 · published by GitHub user drain54

AI claim verification MCP endpoint with x402 payments and stealth web fetch

Changes · 5
CompareRegistry entry

8 tools: 5 change things and 3 only read.

Scanned Oct 21, 2026

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http verify-api https://verify.drain54.my.id

Findings

Matches of fixed checks, with the text they matched.

1 warn
  • Warnsearch_web

    The server marks "search_web" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true}; The name "search_web" says "search": a word for reading.

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

8 tools

Changes things 5Claude Code: ask
  • check_endpoint_healthProbe and verify the reachability, HTTP status code, latency, and operational health of an AI API endpoint or web service.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Probe and verify the reachability, HTTP status code, latency, and operational health of an AI API endpoint or web service. Follows redirects with a 15-second timeout. Requires x402 micropayment (0.01 USDC on Base). When to use: Check if a specific API URL or model endpoint is online, responding, or returning 5xx/402 errors. When NOT to use: Do NOT use for general domain WHOIS or DNS record lookups. Parameters: - `url` (string, required): Target HTTP/HTTPS endpoint URL to probe (8-1000 chars), e.g. 'https://api.openai.com/v1/models'.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
  • extract_json_from_webExtract structured JSON data matching a custom schema directly from any webpage.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Extract structured JSON data matching a custom schema directly from any webpage. Extracts clean content and processes schema mapping via fast LLM parsing. Requires x402 micropayment (0.015 USDC on Base). When to use: Scraping structured data (product specs, prices, jobs, articles) into clean JSON. When NOT to use: Do NOT use for general open-ended chat without a defined schema. Parameters: - `url` (string, required): Target webpage URL. - `schema` (object, required): JSON object describing fields or schema to extract. - `instructions` (string, optional): Specific guidance for extraction.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
  • search_webExecute live web searches using multi-engine chain (TinyFish, DuckDuckGo, Jina) without monthly API subscriptions.1 finding

    Why it is in this group

    • The name "search_web" says "search": a word for reading.
    • The description's first verb is "execute": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "search_web" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true}; The name "search_web" says "search": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Execute live web searches using multi-engine chain (TinyFish, DuckDuckGo, Jina) without monthly API subscriptions. Returns fresh source URLs, titles, and snippets. Requires x402 micropayment (0.005 USDC on Base). When to use: Real-time web browsing and information retrieval for AI agents. When NOT to use: Do NOT use for deep recursive crawling of entire sites. Parameters: - `query` (string, required): Search query (3-300 chars). - `limit` (integer, optional, default 5): Maximum number of search results to return (1-10).

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
  • solve_captchaSolve web CAPTCHA challenges (Turnstile, hCaptcha, reCAPTCHA v2, Arkose, Cloudflare) and return a valid solution token.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Solve web CAPTCHA challenges (Turnstile, hCaptcha, reCAPTCHA v2, Arkose, Cloudflare) and return a valid solution token. Automatically retries once on failure without double charging. Requires x402 payment on Base. When to use: Use when an agent encounters a bot wall or CAPTCHA challenge during automated web workflows. When NOT to use: Do NOT use for non-CAPTCHA auth, 2FA/OTP codes, or general login forms. Parameters: - `type` (string, required): CAPTCHA type ('turnstile', 'hcaptcha', 'recaptcha', 'arkose', 'cloudflare'). - `sitekey` (string, required): Public sitekey extracted from the target page DOM. - `url` (string, required): Full target webpage URL hosting the challenge.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
  • verify_ai_claimVerify whether an AI model, API provider, pricing claim, or infrastructure assertion is true today using live web evidence.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Verify whether an AI model, API provider, pricing claim, or infrastructure assertion is true today using live web evidence. Returns deterministic verdicts (TRUE, FALSE, PARTIALLY_TRUE, UNREACHABLE, UNVERIFIED) with cited sources and confidence scores. Requires x402 micropayment (0.01 USDC on Base). When to use: Fact-checking an AI provider's claims, pricing, or model availability. When NOT to use: Do NOT use for general open-ended web search, coding assistance, or non-AI claim verification. Parameters: - `query` (string, required): The exact claim or assertion to verify (5-500 chars), e.g. 'Is GLM-5.3 Flash free on ZenMux?'. - `depth` (string, optional, default 'standard'): Verification depth. 'standard' executes fast single-pass search (0.01 USDC); 'deep' conducts multi-source cross-examination (0.03 USDC).

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
Only reads 3Claude Code: allow
  • fetch_stealth_webFetch webpage HTML with modern browser TLS and header impersonation (Sec-Ch-Ua, realistic headers) to bypass bot protection and detect anti-bot challenges.No findings

    Why it is in this group

    • The name "fetch_stealth_web" says "fetch": a word for reading.
    Description, as the server wrote it
    Fetch webpage HTML with modern browser TLS and header impersonation (Sec-Ch-Ua, realistic headers) to bypass bot protection and detect anti-bot challenges. Requires x402 micropayment (0.01 USDC on Base). When to use: Fetching websites that block standard cURL or basic HTTP libraries with 403 Forbidden. When NOT to use: Do NOT use for downloading giant binary files (videos, zip archives). Parameters: - `url` (string, required): Target webpage URL. - `custom_headers` (object, optional): Additional HTTP headers to pass along.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
  • get_captcha_pricingRetrieve current x402 pricing per 1,000 CAPTCHA solves across all supported types (Turnstile, hCaptcha, reCAPTCHA v2, Arkose, Cloudflare).No findings

    Why it is in this group

    • The name "get_captcha_pricing" says "get": a word for reading.
    Description, as the server wrote it
    Retrieve current x402 pricing per 1,000 CAPTCHA solves across all supported types (Turnstile, hCaptcha, reCAPTCHA v2, Arkose, Cloudflare). Free endpoint with zero parameters. When to use: Check current rates and atomic USDC requirements before calling solve_captcha. When NOT to use: Do NOT use to submit or solve CAPTCHA challenges.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
  • read_web_pageExtract clean, readable Markdown and metadata from any public webpage for LLM ingestion, stripping ads, popups, and navigational clutter.No findings

    Why it is in this group

    • The name "read_web_page" says "read": a word for reading.
    Description, as the server wrote it
    Extract clean, readable Markdown and metadata from any public webpage for LLM ingestion, stripping ads, popups, and navigational clutter. Returns clean markdown, title, description, character count, and estimated tokens. Requires x402 micropayment (0.005 USDC on Base). When to use: Ingesting articles, blog posts, documentation, or news pages into LLM context. When NOT to use: Do NOT use for raw binary files (PDF/images), authenticated pages behind a login, or single-page apps that require heavy JavaScript rendering. Parameters: - `url` (string, required): Full target webpage URL (e.g. 'https://news.ycombinator.com'). - `include_links` (boolean, optional, default true): Whether to preserve markdown hyperlinks. - `include_images` (boolean, optional, default false): Whether to preserve image markdown links.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http verify-api https://verify.drain54.my.id

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__verify-api__get_captcha_pricing",
      "mcp__verify-api__read_web_page",
      "mcp__verify-api__fetch_stealth_web"
    ],
    "ask": [
      "mcp__verify-api__verify_ai_claim",
      "mcp__verify-api__check_endpoint_health",
      "mcp__verify-api__solve_captcha",
      "mcp__verify-api__search_web",
      "mcp__verify-api__extract_json_from_web"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as verify-api. Review it before you use it.