Stormap
REMOTE · STORMAP.AI
Find the best paid API for a task, package safety checks, stock catalysts, x402 market data.
Available components
Last scanned (1 hour ago)
Scores higher than 71% of remote servers
Reachable. Last reached 18 Oct 2026.
Category Search and Retrieval
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security80
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one. See how to fix → View diagnostics → Partial
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability67
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 3448 tokens (~181/item across 19 items; 19 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management43
- Stability observed for 13 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage93
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 79% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 19 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 20 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities60
- Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28. See how to fix → Fail
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 18 Oct 26 +7
- Authorization: unverified → partial ▲ security
- The server rewrote its instructions, which are the text every model session reads security
- Tool “search_guides” rewrote its description, which is the text the model reads security
- Tool “x402_market_report” rewrote its description, which is the text the model reads security
- New tool “brainstorm_ideas” functional
- 17 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 37 to 40. That category is still filling its 30-day observation window: 11 days of observed history at the previous scan, 12 at this one. The score rises as the window fills, whether or not the server changes.
- 15 Oct 26 0
- Tool “why_is_it_moving” rewrote its description, which is the text the model reads security
- Schema quality: 2856 → 3196 ▼ functional
- New tool “find_best_api” functional
- 14 Oct 26 +1
- Tool “company_profile” rewrote its description, which is the text the model reads security
- Schema quality: 2161 → 2856 ▼ functional
- Schema quality: 2161 → 2724 ▼ functional
- Tool coverage: 66% → 74% ▲ functional
- Tool coverage: 66% → 71% ▲ functional
- New tool “package_check” functional
- New tool “trading_halts” functional
- New tool “why_is_it_moving” functional
- New tool “x402_market_report” functional
- 13 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.
- 12 Oct 26 −5
- Authorization: partial → unverified ▼ security
- The server rewrote its instructions, which are the text every model session reads security
- Tool “ai_visibility_score” rewrote its description, which is the text the model reads security
- Schema quality: 143 → 166 ▼ functional
- Tool coverage: 47% → 66% ▲ functional
- Schema quality: good → excellent functional
- New tool “agentic_commerce_readiness” functional
- New tool “check_before_paying” functional
- New tool “company_changes” functional
- New tool “company_profile” functional
- New tool “email_domain_check” functional
- New tool “read_url” functional
- New tool “vendor_trust_profile” functional
- 7 Oct 26 71
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 18 Oct 2026 · Probed https://stormap.ai/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=stormap.ai | CN=YR1,O=Let's Encrypt,C=US | 4 Sept 2026 | 3 Dec 2026 | RSA 2048 | SHA256-RSA | 5882a3eef80ed386492461656f88e58c887 |
| SANs: stormap.ai | ||||||
| CN=YR1,O=Let's Encrypt,C=US (CA) | CN=Root YR,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | RSA 2048 | SHA256-RSA | a20253f15f2691c05dc1ce13b9bcca4e |
| CN=Root YR,O=ISRG,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | RSA 4096 | SHA256-RSA | f24b6d17f9d9ad7cb1c9fea78782699f |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of stormap.ai. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| ai. | present | 3799 | 8 | Verified |
| stormap.ai. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
| Header | Value |
|---|---|
| strict-transport-security | max-age=31536000; includeSubDomains |
| content-security-policy | default-src 'self';script-src 'self' 'unsafe-inline' https://d3js.org https://cdn.jsdelivr.net https://cdnjs.cloudflare.com https://js.stripe.com https://www.googletagmanager.com https://vercel.live https://unpkg.com https://pagead2.googlesyndication.com https://*.googlesyndication.com https://*.adtrafficquality.google blob:;worker-src 'self' blob:;style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com https://cdn.jsdelivr.net https://vercel.live;font-src 'self' https://fonts.gstatic.com https://cdnjs.cloudflare.com;img-src 'self' data: https: *.googleusercontent.com blob:;connect-src 'self' https://api.openai.com https://api.stripe.com https://www.google-analytics.com https://region1.google-analytics.com https://stats.g.doubleclick.net https://www.google.com https://vercel.live wss://vercel.live https://cdn.jsdelivr.net https://fonts.googleapis.com https://fonts.gstatic.com https://pagead2.googlesyndication.com https://*.googlesyndication.com https://*.adtrafficquality.goo |
| x-content-type-options | nosniff |
| x-frame-options | SAMEORIGIN |
| referrer-policy | no-referrer |
| permissions-policy | payment=(self) |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://stormap.ai/mcp | Verified | 200 | |
| http (plaintext) | http://stormap.ai/mcp | HTTPS enforced | 308 | https://stormap.ai/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
agentic_commerce_readiness Agentic commerce readiness (AI shopping agents) ~175
Is this store ready for ChatGPT shopping? Audit whether an online store is ready for AI shopping agents (ChatGPT shopping and Instant Checkout via ACP, Google AI Mode via UCP, Perplexity, Claude): AI bot access to product pages, Product structured data (price, currency, availability, GTIN/MPN, brand, ratings), return policy and shipping details, policy pages, product sitemap/feed, platform and Stripe detection, and agent protocol discovery files (/.well-known/ucp, /.well-known/acp.json, MCP server card). Returns a 0-100 score, readiness level and a prioritized fix list.
| Name | Type | Req | Description |
|---|---|---|---|
| url | string | yes | Store domain or a product page URL, e.g. "allbirds.com" or "https://shop.example.com/products/blue-mug". |
No output schema declared.
No examples provided.
ai_visibility_score AI visibility score ~141
AI search / GEO / AEO audit: score how well AI assistants (ChatGPT, Claude, Perplexity, Gemini) can find, read and cite a public web page: 0-100 score, letter grade, pass/fail checks (AI answer-bot access in robots.txt, server-rendered content, title/meta, JSON-LD, canonical, llms.txt, sitemap) and a prioritized fix list. Blocking bulk training crawlers is treated as a policy choice and does not lower the score.
| Name | Type | Req | Description |
|---|---|---|---|
| url | string | yes | Public page URL or domain, e.g. "example.com" or "https://example.com/pricing". |
No output schema declared.
No examples provided.
brainstorm_ideas Brainstorm scored ideas for a topic ~265
Brainstorm ideas for a topic, goal, problem or question, each scored 1-10 on three criteria that fit the kind of brainstorm (for business ideas: market size, ease to start, profit potential; for problem solving: impact, feasibility, cost to implement) with an overall score, sorted best first. depth 2 also grows 3 sub-ideas under each of the top 3. Returns a map_url that opens the result as an interactive bubble map on stormap.ai, where a person can keep growing, re-scoring and sharing it. Scores are quick model estimates for sorting, not research.
| Name | Type | Req | Description |
|---|---|---|---|
| count | integer | – | Ideas at the top level (default 5). |
| depth | integer | – | 1 (default) or 2 to also grow sub-ideas under the top 3. |
| mode | string | – | Kind of brainstorm; sets the scoring criteria (default general). breakdown splits the topic into exhaustive, non-overlapping parts with no scores. |
| steer | string | – | Optional constraint, e.g. "cheap, no hardware", "for beginners". |
| topic | string | yes | What to brainstorm, e.g. "side hustles for engineers", "reduce factory scrap rate", "YouTube channel about home cooking". |
No output schema declared.
No examples provided.
check_ai_crawler_access Check AI crawler access ~124
Check whether AI crawlers (GPTBot, ChatGPT-User, OAI-SearchBot, ClaudeBot, Claude-User, PerplexityBot, Google-Extended, CCBot) may access a public URL according to its robots.txt, and score the page's machine readability (status, title, meta description, canonical, JSON-LD, server-rendered text). Returns a 0-100 score and a list of findings.
| Name | Type | Req | Description |
|---|---|---|---|
| url | string | yes | Public page URL or domain, e.g. "https://example.com/pricing". |
No output schema declared.
No examples provided.
check_before_paying Check before paying ~215
Should your agent pay this? Run before paying an x402 / pay-per-call endpoint, an unfamiliar seller or a wallet address. Returns a verdict (ok_to_pay, caution, dont_pay, no_payment_needed) with reasons, from: the endpoint's live payment terms (price, token, payment address), its listing in Coinbase's x402 marketplace (how many different wallets paid it in 30 days, listed payment address), whether the live payment address matches the listing, whether the token is real USDC, the price compared with typical prices for similar tools, and the seller domain's age, website and mail security. Read-only: never pays or signs anything.
| Name | Type | Req | Description |
|---|---|---|---|
| amount_usd | number | – | Optional: the amount in USD you are about to pay, to check it against what the endpoint asks for. |
| target | string | yes | Paid endpoint URL (e.g. "https://api.example.com/v1/search"), seller domain (e.g. "example.com") or wallet address (0x...). |
No output schema declared.
No examples provided.
company_changes Company change history (pricing, terms, privacy, subprocessors) ~141
Did they raise prices or change their terms? What changed on a company's pricing, terms of service, privacy policy and subprocessor pages, and when. Returns the change history (prices added/removed, free plan or trial added/removed, subprocessors added/removed, text added/removed) and the current prices. Stormap checks tracked pages about once a day; asking about a new company starts tracking it, so history builds from that day. Useful for competitor monitoring, vendor renewals and compliance.
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | Company domain, e.g. "linear.app". |
| since_days | integer | – | Only return changes from the last N days. |
No output schema declared.
No examples provided.
company_profile Company profile from a domain ~129
Company profile from a domain: a one-line summary, what the company does, founded, headquarters, industry, employee count, founders, parent company, public listing (ticker, exchange, SEC business address and industry), key pages (pricing, docs, contact, careers, status), social profiles, current prices with the date seen, tech stack, role contact emails, domain age and mail provider, and AI-readiness. From the company's own website plus Wikidata, SEC EDGAR, RDAP and DNS.
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | Company domain or homepage URL, e.g. "stripe.com". |
No output schema declared.
No examples provided.
email_domain_check Check an email address or domain ~158
Is this email address or domain real and legitimate? For lead research, signup / fraud screening, outreach list cleaning and vendor checks. Returns a verdict (looks_legitimate, risky, invalid) with reasons, plus: email syntax, role address (sales@, info@), free provider or disposable/throwaway service, whether the domain accepts mail (MX, null MX), mail provider (Google Workspace, Microsoft 365...), SPF and DMARC policy, whether the website loads, and domain age from RDAP. Does not contact the mail server, so it cannot confirm a specific mailbox exists.
| Name | Type | Req | Description |
|---|---|---|---|
| string | yes | Email address (e.g. "sales@stripe.com") or a bare domain (e.g. "stripe.com"). |
No output schema declared.
No examples provided.
find_best_api Which paid API should I call? ~266
Describe what you need ("web search", "weather forecast", "verify an email", "pdf to text", "people enrichment") and get the top 1-5 pay-per-call (x402) APIs to use, from an hourly index of Coinbase's x402 marketplace (~38,000 endpoints). Ranked by evidence that other agents keep paying for them: calls per paying wallet over 30 days (so one-off sampling bots count little), how recently each was paid, relevance and price vs. typical. Top candidates are checked live (still asking for payment, at the listed price). Each result: endpoint URL, method, price, network, why it ranks there, and flags (mostly one-time payers, above typical price, not called recently, did not answer). Read-only; never pays.
| Name | Type | Req | Description |
|---|---|---|---|
| check_live | boolean | – | Check the top candidates live (default true). False is faster. |
| limit | integer | – | How many APIs to return (default 3). |
| max_price_usd | number | – | Optional price cap per call in USD, e.g. 0.05. |
| task | string | yes | What you need the API for, in a few words, e.g. "web search", "transcribe audio", "company enrichment". |
No output schema declared.
No examples provided.
generate_ai_robots_txt Generate robots.txt rules for AI crawlers ~145
Generate robots.txt rules for AI crawlers from a policy: "open" (allow all), "balanced" (allow search and user-triggered fetchers, block bulk training crawlers) or "block" (block all). Optional per-bot overrides, allowed/blocked paths, sitemap and crawl delay. No network access.
| Name | Type | Req | Description |
|---|---|---|---|
| allow_paths | array | – | – |
| crawl_delay | integer | – | – |
| disallow_paths | array | – | – |
| overrides | object | – | e.g. {"GPTBot":"allow","CCBot":"block"} |
| policy | string | – | – |
| site_url | string | – | – |
| sitemap_url | string | – | – |
No output schema declared.
No examples provided.
generate_llms_txt Generate llms.txt ~144
Generate an llms.txt file (llmstxt.org format) for a public website. Uses the site name, summary and pages you pass; anything missing is filled from the homepage and sitemap.xml. Returns the file text plus notes on how to improve it.
| Name | Type | Req | Description |
|---|---|---|---|
| max_pages | integer | – | – |
| pages | array | – | Optional list of the most important page URLs. If omitted, sitemap.xml is used. |
| site_name | string | – | – |
| site_url | string | yes | Site root, e.g. "https://example.com". |
| summary | string | – | One paragraph: what the site is, who it is for, what is most useful. |
No output schema declared.
No examples provided.
get_guide Read a Stormap guide ~77
Return one Stormap guide as clean Markdown with front matter (title, URL, dates, tags). Accepts a slug ("how-to-install-hermes-desktop") or a stormap.ai post URL.
| Name | Type | Req | Description |
|---|---|---|---|
| max_chars | integer | – | – |
| slug | string | yes | Guide slug or full https://stormap.ai/post/... URL. |
No output schema declared.
No examples provided.
package_check Is this package safe to install? ~193
Before installing an npm or PyPI package: does it exist (AI-suggested names are sometimes made up, and attackers register them), has it been reported as malicious, which known vulnerabilities affect this version (with the fixed version), is it deprecated or yanked, how old is it, does it run code on install, how many downloads, and does its name imitate a popular package (typosquat). Verdict: ok_to_install, caution, dont_install or does_not_exist, with reasons. From OSV.dev, deps.dev, the npm registry and PyPI.
| Name | Type | Req | Description |
|---|---|---|---|
| ecosystem | string | – | npm (default) or pypi. |
| name | string | yes | Package name, optionally with a version: "lodash", "lodash@4.17.15", "@scope/pkg", "requests==2.31.0". |
| version | string | – | Optional version to check (default: latest). |
No output schema declared.
No examples provided.
read_url Read a web page as Markdown ~116
Read a web page for an AI: fetch a public page and return its main content as clean, LLM-ready Markdown (navigation, footers, scripts and cookie banners removed) plus metadata: title, description, author, published/modified dates, canonical URL, language and word count. Reads server-rendered HTML (no JavaScript execution) and respects robots.txt.
| Name | Type | Req | Description |
|---|---|---|---|
| max_chars | integer | – | Maximum Markdown length to return. |
| url | string | yes | Public page URL, e.g. "https://example.com/blog/post". |
No output schema declared.
No examples provided.
search_guides Search Stormap guides ~120
Search Stormap's practical guides on building with AI agents (OpenClaw, Hermes, Claude, coding agents, browser automation, RAG, MCP, AI news). Returns titles, URLs, Markdown URLs and short descriptions.
| Name | Type | Req | Description |
|---|---|---|---|
| category | string | – | Optional category filter, e.g. "OpenClaw Tutorials", "AI News", "AI Tools", "Automation". |
| limit | integer | – | – |
| query | string | yes | What to look for, e.g. "install hermes desktop" or "stop coding agents overwriting files". |
No output schema declared.
No examples provided.
trading_halts Trading halts ~141
US stock trading halts right now and earlier today (Nasdaq, NYSE, NYSE American and other US markets), from Nasdaq's halt feed refreshed every minute. For each: symbol, market, the reason in plain English (news pending, volatility pause, additional information requested, regulatory concern...), halt time, and when quoting and trading resume, with a status (halted, resuming_soon, resumed). Filter by one or more tickers, or omit for all.
| Name | Type | Req | Description |
|---|---|---|---|
| symbols | string | – | Optional: one or more tickers separated by commas, e.g. "FFAI, AAPL". Omit for all current halts. |
No output schema declared.
No examples provided.
vendor_trust_profile Vendor security & privacy profile ~204
Vendor security review / third-party risk check: a first-pass security and privacy profile of a software vendor from its own public website, given a domain. Answers "is this vendor SOC 2 certified?" and "do they train AI on our data?": certifications it claims (SOC 2 Type I/II, ISO 27001/27701/42001, HIPAA, PCI DSS, FedRAMP…), whether it trains AI models on customer data (with the exact quote and page), subprocessor list, DPA, data residency, security features (SSO/SAML, SCIM, MFA, encryption, pen tests, bug bounty), security.txt contact, status page, links to trust center, privacy policy and terms, plus a 0-100 transparency score. Use for vendor risk assessments, procurement and security questionnaires. Certifications are vendor claims, not verified audits.
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | Vendor domain, e.g. "notion.com". |
No output schema declared.
No examples provided.
why_is_it_moving Why is this stock moving? ~280
For a US stock ticker: the likely catalysts behind a move, from primary sources, in seconds. Ranks the last 48 hours (adjustable) of SEC filings: 8-K events decoded into plain English (deals, earnings, new debt, unregistered share sales, delisting notices, management changes), the press-release headline from Exhibit 99.1, offerings and shelf registrations (dilution), insider open-market buys and sells from Form 4 (who, shares, price, value), 5%+ stakes (13D/13G); plus whether the stock is halted or was halted today and why. Each item has its time, a link to the filing and why it ranks where it does; filing bursts say which filing to read first. An explicit answer status (filing_found, news_halt_no_filing_yet, unexplained_by_primary_sources) and a coverage block (window searched, when each source was last checked, latest filing date) let an agent tell "nothing filed" apart from "a source failed". Facts only: no price data and no buy/sell opinions.
| Name | Type | Req | Description |
|---|---|---|---|
| hours | integer | – | How far back to look, in hours (default 48). |
| ticker | string | yes | US stock ticker, e.g. "AAPL" or "BRK.B". |
No output schema declared.
No examples provided.
x402_market_report x402 marketplace report ~216
What paid AI-agent tools cost and who sells the most, from an hourly index of Coinbase's x402 marketplace (about 38,000 pay-per-call endpoints). For a category or a search phrase: the typical price that paying wallets actually accept (median, middle range, top 10%), a price distribution, the top sellers by distinct paying wallets in the last 30 days, new listings this week that are already being paid, and how concentrated the market is. Use it to price your own x402 endpoint, or to pick which paid tool to call.
| Name | Type | Req | Description |
|---|---|---|---|
| category | string | – | Optional category, e.g. "scraping", "web_search", "llm", "market_data", "onchain". Omit for the whole marketplace plus a per-category table. |
| limit | integer | – | How many top sellers and new listings to return (default 10). |
| query | string | – | Optional search phrase matched against listing names, descriptions and URLs, e.g. "transcription" or "weather". |
No output schema declared.
No examples provided.
How do I install the Stormap MCP server?
Stormap is a hosted endpoint at https://stormap.ai/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · stormap.ai
claude mcp add --transport http boriskendev-stormap 'https://stormap.ai/mcp'
What is the Stormap MCP server?
Stormap is an MCP server listed in the public MCP registry as io.github.boriskendev/stormap. Find the best paid API for a task, package safety checks, stock catalysts, x402 market data. This page covers its hosted endpoint (https://stormap.ai/mcp).
Is the Stormap MCP server safe to use?
Stormap scores 76 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Stormap MCP server expose?
Stormap exposes 19 tools: vendor_trust_profile, company_changes, agentic_commerce_readiness, company_profile, check_before_paying, and 14 more. Their descriptions and schemas cost roughly 3,250 tokens of context every time the server is loaded.
Does the Stormap MCP server require authentication?
No. We connected to Stormap without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the Stormap MCP server still maintained?
Stormap is still listed as active in the MCP registry. We last reached this channel on 18 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.