agent-tools (x402 + MCP + A2A directory)
REMOTE · AGENT-TOOLS.CLOUD · 2 COMPONENTS · SCANNED SEP 21
Discover x402 services, MCP servers and A2A agents by intent — agent-tools.cloud directory.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security57
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation not fully verified: no authorisation is required to call this server, and 11 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe. See how to fix → View diagnostics → Unverified
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability62
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 2701 tokens (~245/item across 11 items; 11 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage71
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 0% of tool parameters carry a description.Fail
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 11 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 12 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the agent-tools (x402 + MCP + A2A directory) server?
agent-tools (x402 + MCP + A2A directory) is a hosted endpoint at https://agent-tools.cloud/mcp-discovery/, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · agent-tools.cloud
claude mcp add --transport http agenttools-cloud-agent-tools-mcp 'https://agent-tools.cloud/mcp-discovery/'
{
"mcpServers": {
"agenttools-cloud-agent-tools-mcp": {
"url": "https://agent-tools.cloud/mcp-discovery/"
}
}
} {
"servers": {
"agenttools-cloud-agent-tools-mcp": {
"type": "http",
"url": "https://agent-tools.cloud/mcp-discovery/"
}
}
} [mcp_servers.agenttools-cloud-agent-tools-mcp] url = "https://agent-tools.cloud/mcp-discovery/"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"agenttools-cloud-agent-tools-mcp": {
"type": "remote",
"url": "https://agent-tools.cloud/mcp-discovery/",
"enabled": true
}
}
} openclaw mcp add agenttools-cloud-agent-tools-mcp --url 'https://agent-tools.cloud/mcp-discovery/' --transport streamable-http
mcp_servers:
agenttools-cloud-agent-tools-mcp:
url: "https://agent-tools.cloud/mcp-discovery/" {
"McpServers": {
"agenttools-cloud-agent-tools-mcp": {
"Transport": "http",
"Url": "https://agent-tools.cloud/mcp-discovery/"
}
}
} assistant mcp add agenttools-cloud-agent-tools-mcp -t streamable-http -u 'https://agent-tools.cloud/mcp-discovery/'
{
"mcpServers": {
"agenttools-cloud-agent-tools-mcp": {
"type": "http",
"url": "https://agent-tools.cloud/mcp-discovery/"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 6 Sept 26 +41
- Injection markers: unverified → pass ▲ security
- Stability: unverified → pass ▲ security
- Authorization: Authorisation not fully verified: no authorisation is required to call this server, and 11 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe. security
- Endpoint reachability: not serving MCP → reachable ▲ functional
- Tool coverage: unverified → 100 ▲ functional
- MCP protocol: unverified → pass ▲ functional
- 5 Sept 26 −41
- Endpoint reachability: reachable → not serving MCP ▼ security
- Stability: pass → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Authorization: Authorisation not fully verified: no authorisation is required to connect, but we couldn't read the tool list to see what that exposes. security
- Tool coverage: 100 → unverified ▼ functional
- Capabilities: pass → unverified ▼ functional
- 4 Sept 26 +41
- Stability: unverified → pass ▲ security
- Injection markers: unverified → pass ▲ security
- Authorization: Authorisation not fully verified: no authorisation is required to call this server, and 11 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe. security
- Endpoint reachability: not serving MCP → reachable ▲ functional
- MCP protocol: unverified → pass ▲ functional
- Tool coverage: unverified → 100 ▲ functional
- 3 Sept 26 −41
- Endpoint reachability: reachable → not serving MCP ▼ security
- Stability: pass → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Authorization: Authorisation not fully verified: no authorisation is required to connect, but we couldn't read the tool list to see what that exposes. security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- First check of Schema quality: unverified functional
- 26 Aug 26 +2
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 25 Aug 26 0
- Stability: 0.97 → pass security
- 24 Aug 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 11 Aug 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 21 Sept 2026 · Probed https://agent-tools.cloud/mcp-discovery/
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=agent-tools.cloud | CN=YE2,O=Let's Encrypt,C=US | 15 Sept 2026 | 14 Dec 2026 | ECDSA 256 | ECDSA-SHA384 | 57a6ce49858e8cda500ed19edacd79140e5 |
| SANs: *.agent-tools.cloud, agent-tools.cloud | ||||||
| CN=YE2,O=Let's Encrypt,C=US (CA) | CN=Root YE,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | ECDSA 384 | ECDSA-SHA384 | 4df3b15dd6c0784c507cd37b58e6f115 |
| CN=Root YE,O=ISRG,C=US (CA) | CN=ISRG Root X2,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | ECDSA-SHA384 | 872165fc34b6e5fba8add5b3705fb53a |
| CN=ISRG Root X2,O=Internet Security Research Group,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | SHA256-RSA | 6c8f1dc727c7117f7baf853ac980f9cd |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of agent-tools.cloud. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| cloud. | present | 7041 | 13 | Verified |
| agent-tools.cloud. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
| Header | Value |
|---|---|
| x-content-type-options | nosniff |
| x-frame-options | SAMEORIGIN |
| referrer-policy | strict-origin-when-cross-origin |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://agent-tools.cloud/mcp-discovery/ | Verified | 200 | |
| http (plaintext) | http://agent-tools.cloud/mcp-discovery/ | HTTPS enforced | 301 | https://agent-tools.cloud/mcp-discovery/ |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
ask_services ~279
Ask for the best x402/MCP services for an agent intent. This is the high-level discovery tool: it retrieves candidates from the directory, asks the configured backend LLM to rank only those candidates, and returns service cards for the selected recommendations. If the LLM is unavailable, it falls back to the directory ranker. Args: intent: Natural-language job the agent wants to accomplish. top_k: Max recommendations to return (1-10). max_price_usd: Optional per-call budget cap. category: Optional directory category filter. chain: Optional payment network filter, e.g. "base" or "solana". require_healthy: When true, only consider services marked health=ok. min_confidence: Optional x402scan quality floor (0.0-1.0). has_mcp: When true, only consider services with MCP endpoints. use_llm: Set false for deterministic retrieval-only fallback.
| Name | Type | Req | Description |
|---|---|---|---|
| category | – | – | – |
| chain | – | – | – |
| has_mcp | boolean | – | – |
| intent | string | yes | – |
| max_price_usd | – | – | – |
| min_confidence | – | – | – |
| require_healthy | boolean | – | – |
| top_k | integer | – | – |
| use_llm | boolean | – | – |
Structured output declared, but exposes no named fields.
No examples provided.
get ~92
Get full details + ready-to-paste call template for a service. Returns the service card with payment, call, quality, resource samples, and ready-to-use MCP/x402 call hints. Use this after `search` or `ask_services` before paying/calling an external service. Args: slug: Service slug as returned by `search` items.
| Name | Type | Req | Description |
|---|---|---|---|
| slug | string | yes | – |
Structured output declared, but exposes no named fields.
No examples provided.
get_mcp_server ~28
Get the full card for one MCP server by slug.
| Name | Type | Req | Description |
|---|---|---|---|
| slug | string | yes | – |
Structured output declared, but exposes no named fields.
No examples provided.
list_categories ~17
List all available service categories in the directory.
Input schema present but exposes no named parameters.
Structured output declared, but exposes no named fields.
No examples provided.
register ~418
Self-register an x402 / MCP service in the agent-tools directory. Service owners and agents may submit new services here. Submissions are auto-reviewed instantly by x402 verification (no human gate): if the URL proves x402 payment support it is listed immediately and shows up in `search`; otherwise it is rejected or retried automatically. Listing is FREE. Dedup: if a service with the same canonical origin (scheme://host) already exists in the directory we return its slug instead of creating a duplicate submission. Same goes for a still-pending submission with the same origin. Rate limit: at most 5 pending submissions per client IP per 24h. Hits beyond that get `{error: rate_limited}` — try again later or email contact@agent-tools.cloud for bulk imports. Args: url: Public HTTPS URL of the service (the x402-payable endpoint or its homepage). Required. name: Human-friendly name. Defaults to the URL hostname. description: One-paragraph description (max ~2000 chars). mcp_url: If the service speaks MCP, its streamable-http endpoint. category: Free-form (e.g. "defi", "search", "social"). Use `list_categories` to align with existing taxonomy. chains: Networks the service accepts payment on (e.g. ["base", "solana"]). price_min_usdc: Lower bound of per-call price in USDC. price_max_usdc: Upper bound of per-call price in USDC. contact: Optional email / handle the directory team can reach you on for clarifications.
| Name | Type | Req | Description |
|---|---|---|---|
| category | – | – | – |
| chains | – | – | – |
| contact | – | – | – |
| description | – | – | – |
| mcp_url | – | – | – |
| name | – | – | – |
| price_max_usdc | – | – | – |
| price_min_usdc | – | – | – |
| url | string | yes | – |
Structured output declared, but exposes no named fields.
No examples provided.
scan_mcp_safety ~742
Check an MCP server for malware / prompt-injection lures by its endpoint URL. Give the server's streamable-http endpoint URL. Two paths: * **Already in the agent-tools directory** → returns our LATEST stored rule verdict. Every indexed server is re-scanned hourly, so you get a consistent, continuously-refreshed answer without re-probing. * **Not yet indexed** → we probe the endpoint live, statically scan its advertised tools + metadata, ADD it to the directory, and return the fresh verdict (so the next caller gets the rule verdict instantly from cache). Two dimensions are reported. `verdict` is authoritative and comes from deterministic static rules — pure pattern-matching over the *advertised* text only, NO code execution. It flags the social-engineering / RCE tricks listing-spam servers use: * `curl … | bash` and `base64 -d | sh` install lures * `eval "$(curl …)"` / PowerShell `IEX(...DownloadString)` cradles * base64 blobs that decode to a shell command * bare-IP payload hosts and cheap throwaway TLDs * prompt-injection / credential-exfiltration phrasing ("ignore previous instructions", "send your .env / api key") * MCP tool-poisoning coercion — descriptions that hijack an agent's tool-calling ("always call this tool first", "before using any other tool you must…"), hidden `<IMPORTANT>` instructions, "list all API keys / include secrets in your response", and coercion to read & forward `.key`/`.pem`/`.ssh`/`.env` files Source-code-oriented rules (SQL / command / code injection) are deliberately not applied to natural-language descriptions, to avoid false positives. `llm_reference` is an advisory frontier-LLM second opinion over the same text. Because the LLM is slow it is computed LIVE on this call only and is never stored (the hourly job never runs it), so it may be null on timeout. It…
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | – | – |
| endpoint_url | string | yes | – |
| name | string | – | – |
| tools_text | string | – | – |
Structured output declared, but exposes no named fields.
No examples provided.
search ~547
Find x402 / MCP services matching an intent or filter set. Two usage modes (agents pick whichever fits): A. Natural-language: `search(intent="fetch tweets for @user")` B. Pure browse: `search(has_mcp=True, category="defi", top_k=10)` At least one of `intent`, `category`, `chain`, `has_mcp`, `min_confidence` must be supplied — otherwise the call is rejected (we won't dump 2300+ rows). Results are ranked by: (health=ok AND tx_30d>0) → health=ok → has-quality-signal → confidence → tx_30d → recency. So the highest-quality real-traffic services appear first. Each item includes (when available): - confidence : 0.0–1.0 x402scan quality score. - tx_30d : 30-day x402 payment count (proxy for real usage). - match_snippet : FTS snippet showing where `intent` hit ([[token]]). - match_reason : list[str] of human-readable ranking signals. - mcp_url : populated when the service exposes an MCP endpoint (you can call it directly via streamable-http). Agents should prefer items with non-null confidence and tx_30d > 0 unless the user explicitly wants experimental endpoints. Args: intent: What the agent wants to do (English or Chinese). Optional when at least one structured filter is set. Synonym expansion covers twitter↔X↔推特, whale↔巨鲸, price↔价格 etc. top_k: Max services to return (default 5, hard cap 25). max_price_usd: Upper bound on per-call price in USD. category: Filter (see `list_categories`). chain: "base", "polygon", "solana", "arbitrum", ... min_confidence: Minimum confidence (0.0–1.0). 0.8+ keeps only services x402scan rates as high-quality. has_mcp: When true, return only services with a callable MCP endpoint. Use this when the agent wants to chain another MCP server rather than perform raw HTTP+x402.…
| Name | Type | Req | Description |
|---|---|---|---|
| category | – | – | – |
| chain | – | – | – |
| has_mcp | boolean | – | – |
| intent | – | – | – |
| max_price_usd | – | – | – |
| min_confidence | – | – | – |
| top_k | integer | – | – |
Structured output declared, but exposes no named fields.
No examples provided.
search_a2a_agents ~91
Find A2A agents you can delegate a task to. Args: intent: Natural-language description of the task to delegate. top_k: Max agents to return (1-20). x402_only: When true, only return agents that advertise x402 payment.
| Name | Type | Req | Description |
|---|---|---|---|
| intent | – | – | – |
| top_k | integer | – | – |
| x402_only | boolean | – | – |
Structured output declared, but exposes no named fields.
No examples provided.
search_mcp_servers ~156
Find MCP servers in the directory. Searches the standalone MCP directory (PulseMCP / official MCP registry import) unioned with x402 services that also expose an MCP endpoint. Returns normalised entries with a ready-to-use streamable-http `call_hint.mcp.url`. Args: intent: Natural-language description of the tool/capability needed. top_k: Max servers to return (1-20). chain: Optional payment-network filter for paid MCP servers. require_healthy: When true, only return servers marked health=ok.
| Name | Type | Req | Description |
|---|---|---|---|
| chain | – | – | – |
| intent | – | – | – |
| require_healthy | boolean | – | – |
| top_k | integer | – | – |
Structured output declared, but exposes no named fields.
No examples provided.
search_resources ~85
Unified search across x402 services, MCP servers and A2A agents. Args: intent: Natural-language query. protocol: Optional filter: "x402", "mcp" or "a2a". top_k: Max resources to return (1-50).
| Name | Type | Req | Description |
|---|---|---|---|
| intent | – | – | – |
| protocol | – | – | – |
| top_k | integer | – | – |
Structured output declared, but exposes no named fields.
No examples provided.
stats ~22
High-level stats about the directory: total services, healthy count, sources.
Input schema present but exposes no named parameters.
Structured output declared, but exposes no named fields.
No examples provided.
What is the agent-tools (x402 + MCP + A2A directory) server?
agent-tools (x402 + MCP + A2A directory) is listed in the public MCP registry as io.github.AgentTools-Cloud/agent-tools-mcp. Discover x402 services, MCP servers and A2A agents by intent, agent-tools.cloud directory. This page covers its hosted endpoint (https://agent-tools.cloud/mcp-discovery/).
Is the agent-tools (x402 + MCP + A2A directory) server safe to use?
agent-tools (x402 + MCP + A2A directory) scores 74 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the agent-tools (x402 + MCP + A2A directory) server expose?
agent-tools (x402 + MCP + A2A directory) exposes 11 tools: search, ask_services, get, list_categories, stats, and 6 more. Their descriptions and schemas cost roughly 2,477 tokens of context every time the server is loaded.
Does the agent-tools (x402 + MCP + A2A directory) server require authentication?
No. We connected to agent-tools (x402 + MCP + A2A directory) without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the agent-tools (x402 + MCP + A2A directory) server still maintained?
agent-tools (x402 + MCP + A2A directory) is still listed as active in the MCP registry. We last reached this channel on 21 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.