Skip to content

call402 — x402 Agent Services

by lgs1520 · remote · no sign-in to list tools · v1.0.0 · published by GitHub user lgs1520

x402 pay-per-call APIs for agents: web search, wallet/token checks, text structuring.

Changes · 10
CompareRegistry entry

12 tools: 10 change things and 2 only read.

Scanned Oct 21, 2026

No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http call402 https://call402.com/mcp

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

12 tools

Changes things 10Claude Code: ask
  • email-verifyEmail address validation for signup screening, lead cleanup and form verification: syntax check, disposable/temporary-domain detection and a live MX-record lookup for the domain.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Email address validation for signup screening, lead cleanup and form verification: syntax check, disposable/temporary-domain detection and a live MX-record lookup for the domain. Returns a deliverability verdict (likely_deliverable, risky, undeliverable, invalid_format) with the MX hosts found. Does not probe individual mailboxes, so catch-all domains may still accept addresses that do not exist.

    Annotations the server declares

    • price_usd: 0.005
    • payment: [object Object]
  • fear-greed-indexCrypto Fear & Greed Index by alternative.me: current value (0-100) and classification (Extreme Fear, Fear, Neutral, Greed, Extreme Greed) plus optional daily history.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Crypto Fear & Greed Index by alternative.me: current value (0-100) and classification (Extreme Fear, Fear, Neutral, Greed, Extreme Greed) plus optional daily history. The most-cited single market-sentiment gauge for crypto trading agents: position sizing, risk checks and regime detection before trading. Data published by alternative.me for free commercial use with attribution; served from a 30-minute cache.

    Annotations the server declares

    • price_usd: 0.005
    • payment: [object Object]
  • fx-ratesDaily foreign-exchange reference rates for the major fiat currencies (USD, EUR, CNY, GBP, JPY, HKD and more) from the European Central Bank via Frankfurter: convert amounts, price …No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Daily foreign-exchange reference rates for the major fiat currencies (USD, EUR, CNY, GBP, JPY, HKD and more) from the European Central Bank via Frankfurter: convert amounts, price in a local currency, or sanity-check a rate before a payment. Give a base currency and optional symbols and amount. Reference rates are published once per working day; they are not live trading quotes. Source: ECB statistics via Frankfurter; the same reference rates are published free of charge by the European Central

    Annotations the server declares

    • price_usd: 0.005
    • payment: [object Object]
  • hash-toolsRun local cryptographic utilities: SHA-256 and SHA-512 hashes, Base64 encode/decode, or a random UUID v4.No findings

    Why it is in this group

    • The description's first verb is "run": a word for a change.
    Description, as the server wrote it
    Run local cryptographic utilities: SHA-256 and SHA-512 hashes, Base64 encode/decode, or a random UUID v4. No upstream service is called.

    Annotations the server declares

    • price_usd: 0.005
    • payment: [object Object]
  • language-detectDetect the most likely language of text entirely on this server, with ISO 639-1 language code, language name, confidence and alternatives.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Detect the most likely language of text entirely on this server, with ISO 639-1 language code, language name, confidence and alternatives. Supports English, Chinese, Japanese, Korean, Spanish, French, German, Russian, Portuguese and Italian; no upstream request.

    Annotations the server declares

    • price_usd: 0.005
    • payment: [object Object]
  • qr-codeGenerate a QR code image for any text, URL or payment address: returns SVG markup or a base64-encoded PNG rendered on our own servers (qrcode library, MIT).No findings

    Why it is in this group

    • The description's first verb is "generate": a word for a change.
    Description, as the server wrote it
    Generate a QR code image for any text, URL or payment address: returns SVG markup or a base64-encoded PNG rendered on our own servers (qrcode library, MIT). For agents that produce scannable payment requests, links, addresses or tickets but cannot render images themselves.

    Annotations the server declares

    • price_usd: 0.005
    • payment: [object Object]
  • ssl-checkTLS/SSL certificate check for any public host: issuer, subject, SAN list, validity window, days until expiry, SHA-256 fingerprint and whether the certificate chain verified.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    TLS/SSL certificate check for any public host: issuer, subject, SAN list, validity window, days until expiry, SHA-256 fingerprint and whether the certificate chain verified. Computed by a direct TLS handshake from our own servers. For uptime and security monitoring agents, vendor endpoint checks and integration pre-flight.

    Annotations the server declares

    • price_usd: 0.005
    • payment: [object Object]
  • text-extractExtract the readable main content of any public web page as clean text: send a URL, get the page title, excerpt and body text with navigation, ads and boilerplate stripped (Mozilla…Can send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Extract the readable main content of any public web page as clean text: send a URL, get the page title, excerpt and body text with navigation, ads and boilerplate stripped (Mozilla Readability, computed on our own servers). For RAG ingestion, summarization, research and page monitoring. First-party extraction: no third-party reader service is resold.

    Annotations the server declares

    • price_usd: 0.005
    • payment: [object Object]
  • text-to-structureTurn unstructured text into strict, machine-readable JSON for agent pipelines: a deterministic, reproducible alternative to an LLM extraction call.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Turn unstructured text into strict, machine-readable JSON for agent pipelines: a deterministic, reproducible alternative to an LLM extraction call. Extracts emails, URLs, EVM wallet addresses, transaction hashes, ISO-normalized dates, money amounts, percentages, phone numbers and key:value pairs from invoices, emails, messages, logs or documents. Pass fields or a JSON schema to receive exactly the fields you need. Same input, same output, in milliseconds.

    Annotations the server declares

    • price_usd: 0.005
    • payment: [object Object]
  • timestamp-convertConvert Unix seconds, Unix milliseconds or an ISO date to UTC and Asia/Shanghai timestamps.No findings

    Why it is in this group

    • The name "timestamp-convert" says "convert": a word for a change.
    Description, as the server wrote it
    Convert Unix seconds, Unix milliseconds or an ISO date to UTC and Asia/Shanghai timestamps. An empty object returns the current time.

    Annotations the server declares

    • price_usd: 0.005
    • payment: [object Object]
Only reads 2Claude Code: allow
  • domain-lookupDomain one-stop lookup: live DNS records (A, AAAA, CNAME, MX, NS, TXT via DNS-over-HTTPS) plus RDAP registration data (registrar, creation and expiry dates, status, nameservers) as…Reads text others writeNo findings

    Why it is in this group

    • The name "domain-lookup" says "lookup": a word for reading.

    What it can reach

    • untrusted-inputThe description's first sentence says "http": it reads web pages, which anyone can write.
    Description, as the server wrote it
    Domain one-stop lookup: live DNS records (A, AAAA, CNAME, MX, NS, TXT via DNS-over-HTTPS) plus RDAP registration data (registrar, creation and expiry dates, status, nameservers) assembled from public protocol endpoints on our servers. For domain due diligence, phishing-site checks, counterparty infrastructure review and integration pre-checks.

    Annotations the server declares

    • price_usd: 0.005
    • payment: [object Object]
  • sec-company-factsSummarize a US public company's latest SEC-reported Revenue, NetIncomeLoss and Assets from official EDGAR companyfacts.No findings

    Why it is in this group

    • The description's first verb is "summarize": a word for reading.
    Description, as the server wrote it
    Summarize a US public company's latest SEC-reported Revenue, NetIncomeLoss and Assets from official EDGAR companyfacts. Look up by ticker, CIK or company name; returns filing dates and fiscal periods. Uses SEC public-domain data with a declared User-Agent.

    Annotations the server declares

    • price_usd: 0.005
    • payment: [object Object]

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data.

Reads private data0
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write1
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out1
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http call402 https://call402.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__call402__domain-lookup",
      "mcp__call402__sec-company-facts"
    ],
    "ask": [
      "mcp__call402__text-to-structure",
      "mcp__call402__fx-rates",
      "mcp__call402__email-verify",
      "mcp__call402__fear-greed-index",
      "mcp__call402__text-extract",
      "mcp__call402__ssl-check",
      "mcp__call402__qr-code",
      "mcp__call402__language-detect",
      "mcp__call402__timestamp-convert",
      "mcp__call402__hash-tools"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as call402. Review it before you use it.

Capability tags behind 2 rules
  • mcp__call402__text-extract outbound
  • mcp__call402__domain-lookup untrusted-input