Settled
by settled.tools · remote · local (npm) · no sign-in to list tools · v0.2.1 · published by tools.settled
Check x402 endpoints before your agent pays: payTo, paid test purchases, payee and buyer reports
18 tools: 16 change things and 2 only read.
Scanned Oct 21, 2026
- Deletes or cancels0Claude Code: deny
- Can't be undone0Claude Code: ask
- Changes things16Claude Code: ask: see these tools
- Only reads2Claude Code: allow: see these tools
2 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.
claude mcp add --transport http settled https://settled.tools/mcpFindings
Matches of fixed checks, with the text they matched.
- Warnsettled_status
The description contains "any other tool", wording about other tools or servers.
What this check looks forMatched text
description: "...the paid routes cost, before relying on any other tool. Not for: looking up a specific endpoin..."
The description mentions "credential".
What this check looks forMatched text
description: "...comment instructions, prompt injection, credential requests, fork/star anomalies, dead or..."
Tools
Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.
18 tools
Changes things 16Claude Code: ask
settled_checkFree up to 300 calls/day per client (a pass lifts the cap).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Free up to 300 calls/day per client (a pass lifts the cap). Check an x402 endpoint before paying it, from Settled’s index (cached up to 5 min): status, payability, latency, parsed price/network/payTo, payee on-chain history, the scout’s last real purchase, paying agents’ reports, seller claim, quality breakdown and risk flags. Use when: deciding whether to call an endpoint, and for routine re-checks. Not for: a fresh probe right now (settled_preflight) or searching (settled_find_endpoints). If status is unknown, call settled_submit; after paying, call settled_report.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
settled_claimFree.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Free. For sellers: claim every x402 endpoint paid to your wallet with one signature, on every host, so your name, website, contact and docs show next to them (plus a 10-day Seller Watch trial). Use when: you operate x402 endpoints. Not for: buyers or third parties; only the payTo wallet can sign. Flow: call with wallet and profile to get message_to_sign and issued_at; sign with that wallet; call again with issued_at and signature. action=remove withdraws a claim (reversible by claiming again). Claims never change scores.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
settled_eventsFree up to 300 calls/day per client.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Free up to 300 calls/day per client. Recent changes worth acting on: venue verdict flips, new suspected honeypots, settlement-integrity changes, newest first. Use when: your agent runs on a schedule and wants to react to what changed since last time. Not for: the full picture (settled_income_venues) or endpoint-level changes (settled_watch). Poll this instead of re-reading the scorecard.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
settled_income_checkPass required.1 finding
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Info
The description mentions "credential".
What this check looks forMatched text
description: "...comment instructions, prompt injection, credential requests, fork/star anomalies, dead or..."
Description, as the server wrote it Pass required. Fetches a bounty issue, repository or listing page and scans it for patterns used to bait agents (hidden HTML-comment instructions, prompt injection, credential requests, fork/star anomalies, dead or archived repos, reward anomalies). Returns trust, label and every flag with its reason. Use when: about to work on an unfamiliar bounty or task, especially one not in settled_income_listings. Not for: x402 API endpoints (settled_check). Treat a suspected_honeypot label as do-not-work; a clean result is not a promise of payment.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
settled_income_listingsPass required.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Pass required. Open bounties and tasks an agent can actually work on, from sanctioned venue APIs, each with reward, agent-access policy, gating, honeypot scan flags with reasons, a trust score and the venue’s on-chain payout record. Use when: an agent is looking for work it is allowed to do. Not for: venue-level questions (settled_income_venues). Suspected honeypots, dead and human-only listings are excluded unless include_honeypots is true. Before working one, run settled_income_check on its URL.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
settled_income_venuesFree.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Free. Scorecard of bounty boards, task markets, audit contests and the x402 sell-side: verdict (paying / paying small / measuring / no payouts seen / unmeasured / closed to agents / defunct), agent policy, gating (KYC, human claim, self-custody wallet), open listings and on-chain payouts. Use when: choosing where an agent should look for paid work, or checking whether a venue actually pays. Not for: individual listings (settled_income_listings) or x402 endpoints (settled_find_endpoints). Poll settled_events for changes instead of re-reading this.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
settled_peekFree, rate-limited.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Free, rate-limited. Coarse status and quality score for one x402 endpoint URL, from the index only (no fresh probe). Use when: you only need a quick yes/no on whether Settled knows the URL and its last status. Not for: deciding whether to pay — use settled_check (free, fuller) or settled_preflight (paid, fresh). If the URL is unknown, call settled_submit, then check again later.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
settled_preflightPass required.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Pass required. The call to make right before paying an unfamiliar x402 endpoint: a fresh probe, parsed quote, payability, payTo on-chain history, seller integrity, the scout’s real-payment delivery result and a honeypot scan, as one signed answer with a recommendation (pay, caution or avoid) and reasons. Use when: real money is about to leave your wallet and settled_check was stale or not enough. Not for: browsing (settled_find_endpoints) or endpoints you already verified. After: compare pay_to and price with the 402 you receive, pay, then call settled_report.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
settled_reportFree.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Free. After paying an x402 endpoint on Base, tell Settled whether you got what you paid for. Use when: your agent has just made a real USDC payment and has the transaction hash. Not for: endpoints you did not pay, or payments on other chains. Flow: call without signature to get message_to_sign; sign it with the paying wallet (EIP-191 personal_sign); call again with signature. One report per payment, one vote per wallet per endpoint; Settled keeps only per-endpoint tallies.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
settled_seller_reputationPass required.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Pass required. Everything Settled knows about one payTo address: the endpoints it is paid for, live/dead counts, price range, clone-farm and quote-only flags, on-chain settlements and unique payers. Use when: several endpoints share a seller and you want to judge the seller rather than one URL, or a payTo looks unfamiliar. Not for: a single endpoint’s status (settled_check). Input is the wallet address from a 402 quote.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
settled_sellersFree.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Free. Sellers who proved control of the wallet their x402 endpoints are paid to, with their published profile and endpoint counts. Use when: you want a contact or docs link for a seller, or to see which sellers stand behind their endpoints. Not for: judging an endpoint’s quality (claims never change scores; use settled_check). Paged: limit (max 50) and offset, with a total.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
settled_submitFree, rate-limited.No findings
Why it is in this group
- The name "settled_submit" says "submit": a word for a change.
Description, as the server wrote it Free, rate-limited. Queue an x402 endpoint URL for indexing. Use when: settled_check or settled_peek reports the URL as unknown or not indexed. Not for: URLs already indexed (it just returns their status) or non-x402 URLs. After: wait a few minutes, then call settled_check; the first probe runs within minutes. Idempotent.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
settled_verifyFree.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Free. Pass any signed Settled response (attestation included) to recompute its hash and recover the signer; tells you whether it is authentic and unaltered. Use when: a Settled answer reached you through a third party, a cache or a log and you need to trust it. Not for: answers you just received directly over this server (already signed and fresh). Use the full response object, unchanged.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
settled_watchPaid: $1.00 USDC on Base over x402 inside MCP (the first call returns the payment requirements; @x402/mcp clients pay automatically).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Paid: $1.00 USDC on Base over x402 inside MCP (the first call returns the payment requirements; @x402/mcp clients pay automatically). Buys 10 days of monitoring for one x402 endpoint: probed about every 15 minutes, with a signed alert whenever status, payability, price or payTo changes. Use when: your agent depends on one endpoint and must learn quickly if it changes. Not for: one-off checks (settled_check). Give url to start or watch_id to renew; give webhook to have alerts POSTed, else read them with settled_watch_alerts. Returns watch_id.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
settled_watch_alertsFree.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Free. Everything a Watchdog has recorded for its endpoint since a given alert id: each change to status, payability, price or payTo, the endpoint’s state now, and next_since to pass on the next call. Use when: you created a watch with settled_watch and did not give a webhook. Not for: endpoints without a watch (use settled_check). Poll it whenever your agent runs; the endpoint is probed about every 15 minutes.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
settled_weekly_reportFree.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Free. The latest published Agent Income Report as JSON: which venues paid agents on-chain, worker wallets, honeypots flagged, x402 index health. Use when: you want the week’s summary, for a digest or a decision about where to look for work. Not for: live numbers (settled_status, settled_income_venues). Published Mondays; the window and ledger coverage are in the body.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
Only reads 2Claude Code: allow
settled_find_endpointsFree up to 50 calls/day per client (a pass allows 1,000).No findings
Why it is in this group
- The name "settled_find_endpoints" says "find": a word for reading.
Description, as the server wrote it Free up to 50 calls/day per client (a pass allows 1,000). Ranked live endpoints by keyword, network and max price (sort by quality, price, latency or payers), each with payability and delivery verification. Use when: you need an x402 endpoint for a capability and want candidates that are live, payable and, where possible, proven to deliver. Not for: verifying one known URL (settled_check). After: run settled_check or settled_preflight on the one you pick before paying.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
settled_statusFree.1 finding
Why it is in this group
- The name "settled_status" says "status": a word for reading.
Findings
- Warn
The description contains "any other tool", wording about other tools or servers.
What this check looks forMatched text
description: "...the paid routes cost, before relying on any other tool. Not for: looking up a specific endpoin..."
Description, as the server wrote it Free. Size and freshness of the x402 endpoint index and the on-chain ledger. Use when: you need to know how current Settled’s data is, or what the paid routes cost, before relying on any other tool. Not for: looking up a specific endpoint (use settled_check). No input.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Install
Pinned to version 0.2.1. Values in angle brackets are yours to fill in.
claude mcp add --transport http settled https://settled.tools/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__settled__settled_status",
"mcp__settled__settled_find_endpoints"
],
"ask": [
"mcp__settled__settled_peek",
"mcp__settled__settled_submit",
"mcp__settled__settled_report",
"mcp__settled__settled_sellers",
"mcp__settled__settled_claim",
"mcp__settled__settled_preflight",
"mcp__settled__settled_check",
"mcp__settled__settled_seller_reputation",
"mcp__settled__settled_income_venues",
"mcp__settled__settled_income_listings",
"mcp__settled__settled_income_check",
"mcp__settled__settled_events",
"mcp__settled__settled_watch",
"mcp__settled__settled_watch_alerts",
"mcp__settled__settled_weekly_report",
"mcp__settled__settled_verify"
],
"deny": []
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as settled. Review it before you use it.