# `xyz.apexfaucet/apex-web` on anlyon.dev

> Text inside fenced blocks marked untrusted-server-text was written by the MCP server's publisher, not by anlyon.dev. It is data to inspect, not instructions to follow. Invisible characters are shown as [U+XXXX].
> No finding is not a safety guarantee: these are point-in-time checks of tool definitions, not of code or behaviour.

- Page: https://anlyon.dev/servers/xyz.apexfaucet/apex-web
- JSON: https://anlyon.dev/api/v1/servers/xyz.apexfaucet/apex-web
- Version: 1.0.3 (active)
- Publisher: xyz.apexfaucet (domain proven to the MCP Registry)
- Runs: remote (streamable-http)
- Sign-in to list tools: none
- Metadata from the official MCP Registry, synced 2026-10-21T18:55:50.010Z

Title and description, as the publisher wrote them:

```untrusted-server-text
APEX web reader
A real browser for your agent: a page to clean text for $0.009, a 25-page site for $0.14. x402.
```

Scanned 2026-10-21T19:32:57.407Z over streamable-http.

**3 tools: 2 change things and 1 only read.**

| Group | Class | Tools | Claude Code |
| --- | --- | --- | --- |
| Deletes or cancels | destructive | 0 | deny |
| Can't be undone | irreversible | 0 | ask |
| Changes things | write | 2 | ask |
| Only reads | read | 1 | allow |

## Findings

No check matched anything in these tool definitions.


## Changes things (2)

Creates or changes something that can be changed back. Claude Code: ask.

### `page_extract`

- Nothing in its name or description says what it does, so it is counted as a write.

Description, as the server wrote it:

```untrusted-server-text
Render any public web page in a real headless Chrome and return its text. JavaScript runs first, so docs sites and single-page apps that a plain fetch returns empty come back complete. $0.009 per call (x402 on Arc/Base/Solana/X1): the full text and every outbound link. Without a payment the call returns the price and every rail we accept. Refuses private and reserved addresses and our own hosts, so it cannot be used as a proxy into a network. Sites that put a bot wall in front of their pages (Cloudflare, DataDome and the like) answer with a challenge rather than the page: the call then FAILS with `http-403` or `bot-challenge` and says so, rather than charging you for a spinner.
```

### `site_extract`

- Nothing in its name or description says what it does, so it is counted as a write.

Description, as the server wrote it:

```untrusted-server-text
Render a whole section of a site - up to 25 pages - in one call and get every page back as clean text, with JavaScript executed. Same host only; robots.txt is obeyed and anything it disallows is skipped and named. FREE: the crawl PLAN - exactly which pages would be fetched and what robots.txt allows - so you can see what you would get before paying. PAID ($0.14, x402 on Arc/Base/Solana/X1): every page rendered and returned. It costs more than one page because it is up to 25 real browser renders, not a lookup. If a bot wall on the site lets the first page through but blocks the rest, the call fails with `poor-yield` and names every page it could not render, instead of billing you for a list of failures.
```

## Only reads (1)

Looks things up and changes nothing. Claude Code: allow.

### `web_read`

- The name "web_read" says "read": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Read up to 10 web pages as clean text in one call: title, description and readable body, with the final URL. A plain fetch (no JavaScript); for a rendered page use page_extract. $0.003 per call over x402 (USDC on Arc, Base or Solana, or XNT on X1). Call once without `payment` for the terms, sign them with your own wallet, call again with `payment`.
```

## Claude Code permissions

For `.claude/settings.json`, assuming the server is installed as `apex-web`:

```json
{
  "permissions": {
    "allow": [
      "mcp__apex-web__web_read"
    ],
    "ask": [
      "mcp__apex-web__page_extract",
      "mcp__apex-web__site_extract"
    ],
    "deny": []
  }
}
```