# app.surewhynot.quartermaster/quartermaster (remote · quartermaster.surewhynot.app)

x402 toolkit for AI agents: paid web, AI, and Base chain tools per call in USDC. Free tools too.

- Trust score: 66/100 (medium)
- Change this week: +6
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- remote · `quartermaster.surewhynot.app`: 66/100 (this document), [markdown](https://verifymcp.io/servers/app-surewhynot-quartermaster-quartermaster/quartermaster.md), [page](https://verifymcp.io/servers/app-surewhynot-quartermaster-quartermaster/quartermaster)

## Channel facts

- Endpoint: `https://quartermaster.surewhynot.app/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `1.6.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Endpoint Security**: 63/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation not fully verified: no authorisation is required to call this server, and 49 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe.
  - HTTPS is enforced; there's no plaintext access path.
  - The HSTS (Strict-Transport-Security) header is present.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 71/100
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 3115 tokens (~63/item across 49 items; 49 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 73/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 20% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add --transport http app-surewhynot-quartermaster-quartermaster https://quartermaster.surewhynot.app/mcp
```

### Codex

```toml
[mcp_servers.app-surewhynot-quartermaster-quartermaster]
url = "https://quartermaster.surewhynot.app/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "app-surewhynot-quartermaster-quartermaster": {
      "type": "remote",
      "url": "https://quartermaster.surewhynot.app/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add app-surewhynot-quartermaster-quartermaster --url https://quartermaster.surewhynot.app/mcp --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  app-surewhynot-quartermaster-quartermaster:
    url: "https://quartermaster.surewhynot.app/mcp"
```

### Other

```json
{
  "mcpServers": {
    "app-surewhynot-quartermaster-quartermaster": {
      "type": "http",
      "url": "https://quartermaster.surewhynot.app/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 66, +1)

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-01 (score 65, +1)

No change was recorded against any check on this day. Stability & Change Management went from 17 to 20. That category is still filling its 30-day observation window: 5 days of observed history at the previous scan, 6 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-31 (score 64, +2)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 62, +1)

No change was recorded against any check on this day. Stability & Change Management went from 10 to 13. That category is still filling its 30-day observation window: 3 days of observed history at the previous scan, 4 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-28 (score 61, +1)

No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-27 (score 60, +1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-26 (score 59)

First indexed and scored.

## MCP tools (49)

### `x402_router` (~136 tokens)

START HERE. One tool for anything x402, Base chain, or web/AI: describe your goal in plain English (q) and Quartermaster picks and runs the right underlying tool, returning the answer plus which tool it used. Examples: 'audit https://api.example.com/paid', 'price of eth', 'is 0x… a contract', 'verify settlement 0x…', 'search the bazaar for weather'. Use this when you don't want to choose among the individual tools below. Costs $0.03 (USDC via x402).

Input parameters:

- `q` (string, required): Your goal in plain English

### `web_extract` (~47 tokens)

[Web] Extract clean readable text and metadata from a public webpage as structured JSON. Costs $0.005 (USDC via x402).

Input parameters:

- `url` (string, required): Public webpage URL

### `page_meta` (~42 tokens)

[Web] Get page metadata: title, description, Open Graph, canonical URL, favicon, language. Costs $0.002.

Input parameters:

- `url` (string, required)

### `qr_generate` (~52 tokens)

[Web] Generate a QR code as SVG (or terminal text with format=text). Costs $0.002.

Input parameters:

- `data` (string, required)
- `ecc` (string)
- `format` (string)

### `dns_lookup` (~57 tokens)

[Web] Resolve DNS records over DNS-over-HTTPS (A, AAAA, CNAME, MX, NS, TXT, and more). Costs $0.001.

Input parameters:

- `name` (string, required)
- `type` (string)

### `http_error_explain` (~42 tokens)

[Web] Explain an HTTP status code: meaning, common causes, fixes, retry guidance. Costs $0.001.

Input parameters:

- `code` (integer, required)

### `tx_status` (~78 tokens)

[Crypto/Base] Check a Base transaction: success/reverted/pending, confirmations, gas, explorer link. Costs $0.002. Choose this for a quick raw status; use payment_receipt for decoded transfers, or settlement_assurance to PROVE an x402 payment settled to the right wallet/amount.

Input parameters:

- `hash` (string, required)

### `wallet_balance` (~50 tokens)

[Crypto/Base] ETH and USDC (or any ERC-20) balance for an address on Base. Costs $0.001.

Input parameters:

- `address` (string, required)
- `token` (string)

### `gas_prices` (~29 tokens)

[Crypto/Base] Current Base gas prices with a simple-transfer cost estimate. Costs $0.001.

### `summarize_url` (~52 tokens)

[AI] AI summary of a public webpage (fetch + extract + summarize). length: short|medium|long. Costs $0.01.

Input parameters:

- `length` (string)
- `url` (string, required)

### `translate_text` (~43 tokens)

[AI] AI translation into any target language; source auto-detected. Costs $0.005.

Input parameters:

- `text` (string, required)
- `to` (string, required)

### `tldr_text` (~64 tokens)

[AI] Summarize raw text you pass in directly (not a URL). length: short|medium|long. Costs $0.005. Use summarize_url when you have a URL instead.

Input parameters:

- `length` (string)
- `text` (string, required)

### `classify_text` (~68 tokens)

[AI] Zero-shot classification of text into caller-supplied labels; the result is validated back into your label set so you can route on it. Costs $0.002.

Input parameters:

- `labels` (string, required): Comma-separated candidate labels (2-20)
- `text` (string, required)

### `unshorten_url` (~66 tokens)

[Web] Expand a shortened/redirecting URL: follow the redirect chain and return every hop plus the final destination. Each hop is SSRF-validated. Costs $0.002. Safe way to see where an untrusted link goes.

Input parameters:

- `url` (string, required)

### `regex_test` (~59 tokens)

[Dev] Test a regular expression against text; returns every match with numbered and named capture groups. Deterministic. Costs $0.001.

Input parameters:

- `flags` (string)
- `pattern` (string, required)
- `text` (string, required)

### `random_numbers` (~64 tokens)

[Dev] Cryptographically-secure random integers in a range (CSPRNG, unbiased) — real entropy an LLM cannot produce itself. Costs $0.001.

Input parameters:

- `count` (integer)
- `max` (integer)
- `min` (integer)

### `random_pick` (~65 tokens)

[Dev] Pick one or several options at random from a caller-supplied list (CSPRNG), optionally without replacement. Costs $0.001.

Input parameters:

- `count` (integer)
- `options` (string, required): Comma-separated options
- `unique` (boolean)

### `http_check` (~67 tokens)

[Web] Liveness/latency pre-flight for a URL: is it up, HTTP status and class, response latency in ms, whether it redirects and where, content-type and server. Costs $0.001. Use before relying on a dependency.

Input parameters:

- `url` (string, required)

### `public_holiday` (~72 tokens)

[Dev] Is a date a public holiday in a country (2-letter ISO code)? Returns the holiday name, its types, and the next upcoming holiday. Costs $0.001. Useful for scheduling.

Input parameters:

- `country` (string, required)
- `date` (string): YYYY-MM-DD (defaults to today)

### `x402_inspect` (~89 tokens)

[x402] Inspect and lint any x402 paid endpoint: decode the 402 challenge, identify network/asset, flag misconfigurations and Bazaar-readiness. Costs $0.002. Choose this for a quick one-shot decode+lint; use x402_audit for a full 0-100 scored report with origin discovery probes and recommended fixes.

Input parameters:

- `url` (string, required)

### `x402_simulate` (~123 tokens)

[x402] Pre-flight a payment BEFORE you spend: decode an endpoint's 402 challenge, report the cost on every rail (Base and Solana) and the cheapest, and — with an optional payer address — verify the wallet can afford the call on Base. Costs $0.003. Use this before paying an unfamiliar endpoint; use x402_inspect to lint an endpoint you own.

Input parameters:

- `address` (string): Optional payer wallet (0x…) for a Base affordability check
- `url` (string, required): The x402 endpoint to pre-flight

### `tx_decode` (~91 tokens)

[Crypto/Base] Decode a Base transaction's calldata into the function it called and its arguments — ERC-20 transfer/approve and the EIP-3009 transferWithAuthorization used by x402 settlements. Recognizes x402 settlement transactions and formats USDC amounts. Costs $0.003. Use tx_status for pass/fail; use this to see WHAT a transaction did.

Input parameters:

- `hash` (string, required)

### `embed_text` (~40 tokens)

[AI] Text embeddings (1024-dim vector) for semantic search and RAG. Costs $0.002.

Input parameters:

- `text` (string, required)

### `extract_structured` (~59 tokens)

Structured extraction: JSON Schema plus a URL or raw text in, matching JSON out. Costs $0.005.

Input parameters:

- `schema` (string, required): JSON Schema as a JSON string
- `text` (string)
- `url` (string)

### `moderate_text` (~39 tokens)

[AI] Content-safety classification (Llama Guard): safe flag plus category codes. Costs $0.002.

Input parameters:

- `text` (string, required)

### `describe_image` (~44 tokens)

[AI] AI vision: describe a public image URL, including visible text. Costs $0.005.

Input parameters:

- `prompt` (string)
- `url` (string, required)

### `token_price` (~41 tokens)

[Crypto/Base] USD price for major tokens by symbol or any Base ERC-20 by address. Costs $0.001.

Input parameters:

- `token` (string, required)

### `payment_receipt` (~99 tokens)

[x402] Formatted settlement receipt for a Base transaction (0x hash) or Solana settlement (base58 signature): timestamp, decoded transfers, explorer link. Costs $0.002. Choose this for a human-readable record; use payment_proof to ASSERT a specific payTo/amount, or settlement_assurance for a full scored verdict.

Input parameters:

- `hash` (string, required): 0x Base tx hash or base58 Solana signature

### `resolve_basename` (~37 tokens)

Resolve a Basename (.base.eth) to a wallet address on Base. Costs $0.001.

Input parameters:

- `name` (string, required)

### `x402_audit` (~124 tokens)

[x402] WORKFLOW: full scored audit of an x402 SELLER endpoint (a URL) in one call - verifies the 402 challenge, payment fields, Bazaar discovery metadata, and the origin's discovery surfaces; returns a 0-100 score, checks with evidence, and recommended fixes. Costs $0.01. Use this to grade an endpoint before trusting/publishing it; use settlement_assurance instead when you already have a transaction hash and want to prove a completed PAYMENT settled correctly.

Input parameters:

- `url` (string, required): x402 paid endpoint to audit

### `payment_proof` (~147 tokens)

[x402] Verify an x402 settlement on Base OR Solana from a tx id (0x hash or base58 signature): confirm it succeeded, decode its USDC transfers, optionally assert payTo/amount - returns a single verdict. Costs $0.003. Choose this when you only need the yes/no did-it-land answer; use settlement_assurance for the full scored report (proof + receipt + optional endpoint audit).

Input parameters:

- `amount` (string)
- `hash` (string, required): 0x Base tx hash or base58 Solana signature
- `payTo` (string): expected recipient: 0x address (Base) or base58 wallet (Solana)

### `settlement_assurance` (~195 tokens)

[x402] FLAGSHIP: from a tx id on Base (0x hash) or Solana (base58 signature), prove a completed x402 payment is real and sound - onchain success, USDC transfer match to an expected wallet/amount, a receipt, and an optional audit of the issuing endpoint - as one 0-100 scored report with a verdict. Costs $0.03. This is the most complete post-payment check; use payment_proof if you only need a plain pass/fail, tx_status for raw status, or x402_audit to grade a seller endpoint by URL (no payment yet).

Input parameters:

- `amount` (string)
- `hash` (string, required): 0x Base tx hash or base58 Solana signature
- `payTo` (string): expected recipient: 0x address (Base) or base58 wallet (Solana)
- `resource` (string)

### `x402_discover` (~48 tokens)

[x402] Search the Coinbase x402 Bazaar for paid resources by natural-language query. Costs $0.001.

Input parameters:

- `limit` (integer)
- `query` (string, required)

### `x402_merchant` (~48 tokens)

[x402] List all x402 Bazaar resources under a merchant payTo wallet. Costs $0.001.

Input parameters:

- `limit` (integer)
- `payTo` (string, required)

### `usdc_normalize` (~48 tokens)

Convert USDC amounts between atomic units and human decimals. Costs $0.001.

Input parameters:

- `amount` (string, required)
- `decimals` (integer)
- `direction` (string)

### `base_token_info` (~39 tokens)

ERC-20 name, symbol, decimals, total supply for a token on Base. Costs $0.001.

Input parameters:

- `address` (string, required)

### `base_allowance` (~50 tokens)

Check an ERC-20 spending allowance on Base; flags unlimited approvals. Costs $0.001.

Input parameters:

- `owner` (string, required)
- `spender` (string, required)
- `token` (string)

### `base_contract` (~34 tokens)

Determine whether a Base address is a contract or an EOA. Costs $0.001.

Input parameters:

- `address` (string, required)

### `base_usdc_transfers` (~46 tokens)

Recent USDC transfers (in and out) for an address on Base. Costs $0.002.

Input parameters:

- `address` (string, required)
- `limit` (integer)

### `jwt_decode` (~35 tokens)

[Dev] Decode a JWT header and payload (signature NOT verified). Costs $0.001.

Input parameters:

- `token` (string, required)

### `base64` (~39 tokens)

[Dev] Base64 encode or decode a string. Costs $0.001.

Input parameters:

- `data` (string, required)
- `op` (string)

### `text_stats` (~38 tokens)

[Dev] Word/sentence counts, reading time, and readability score for text. Costs $0.001.

Input parameters:

- `text` (string, required)

### `text_diff` (~39 tokens)

[Dev] Compact line-level diff between two texts. Costs $0.001.

Input parameters:

- `after` (string, required)
- `before` (string, required)

### `x402_test_vector` (~28 tokens)

[x402] Free: example x402 payment-requirement objects with field explanations.

### `current_time` (~51 tokens)

FREE (no wallet needed): current time as ISO, unix, UTC, and optional local time for an IANA timezone.

Input parameters:

- `tz` (string): Optional IANA timezone, e.g. America/Chicago

### `generate_uuid` (~41 tokens)

FREE (no wallet needed): generate UUID v4 values, up to 100 at once.

Input parameters:

- `count` (integer): How many, 1-100

### `hash_string` (~43 tokens)

FREE (no wallet needed): SHA-1/256/384/512 hex digest of a string.

Input parameters:

- `algo` (string)
- `data` (string, required)

### `http_errors_list` (~33 tokens)

FREE (no wallet needed): index of documented HTTP status codes (use http_error_explain for a paid detailed explanation).

### `quartermaster_info` (~22 tokens)

Free: catalog, prices, and payment instructions for this server.

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/app-surewhynot-quartermaster-quartermaster/quartermaster#diagnostics

## Score history

- 2026-08-03: 66
- 2026-08-02: 65
- 2026-08-01: 65
- 2026-07-31: 64
- 2026-07-30: 62
- 2026-07-29: 61
- 2026-07-28: 61
- 2026-07-27: 60
- 2026-07-26: 59

## Links

- Remote endpoint: https://quartermaster.surewhynot.app/mcp
- Website: https://quartermaster.surewhynot.app/
- Changelog RSS feed: https://verifymcp.io/servers/app-surewhynot-quartermaster-quartermaster/quartermaster/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/app-surewhynot-quartermaster-quartermaster/quartermaster/changelog.json
- HTML version of this page: https://verifymcp.io/servers/app-surewhynot-quartermaster-quartermaster/quartermaster