Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

Stormap

REMOTE · STORMAP.AI

Find the best paid API for a task, package safety checks, stock catalysts, x402 market data.

Available components

+5 this week 76 Trust /100

Last scanned (1 hour ago)

Scores higher than 71% of remote servers

Reachable. Last reached 18 Oct 2026.

Category Search and Retrieval

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →

Endpoint Security80
Transport & Reachability100
Schema Quality & AI Usability67
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 3448 tokens (~181/item across 19 items; 19 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management43
  • Stability observed for 13 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage93
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 79% of tool parameters carry a description.Partial
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • We read all 19 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
  • An AI judge read all 20 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities60
  • Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28. See how to fix → Fail
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 18 Oct 26 +7
    • Authorization: unverified → partial ▲ security
    • The server rewrote its instructions, which are the text every model session reads security
    • Tool “search_guides” rewrote its description, which is the text the model reads security
    • Tool “x402_market_report” rewrote its description, which is the text the model reads security
    • New tool “brainstorm_ideas” functional
  • 17 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 37 to 40. That category is still filling its 30-day observation window: 11 days of observed history at the previous scan, 12 at this one. The score rises as the window fills, whether or not the server changes.

  • 15 Oct 26 0
    • Tool “why_is_it_moving” rewrote its description, which is the text the model reads security
    • Schema quality: 2856 → 3196 ▼ functional
    • New tool “find_best_api” functional
  • 14 Oct 26 +1
    • Tool “company_profile” rewrote its description, which is the text the model reads security
    • Schema quality: 2161 → 2856 ▼ functional
    • Schema quality: 2161 → 2724 ▼ functional
    • Tool coverage: 66% → 74% ▲ functional
    • Tool coverage: 66% → 71% ▲ functional
    • New tool “package_check” functional
    • New tool “trading_halts” functional
    • New tool “why_is_it_moving” functional
    • New tool “x402_market_report” functional
  • 13 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.

  • 12 Oct 26 −5
    • Authorization: partial → unverified ▼ security
    • The server rewrote its instructions, which are the text every model session reads security
    • Tool “ai_visibility_score” rewrote its description, which is the text the model reads security
    • Schema quality: 143 → 166 ▼ functional
    • Tool coverage: 47% → 66% ▲ functional
    • Schema quality: good → excellent functional
    • New tool “agentic_commerce_readiness” functional
    • New tool “check_before_paying” functional
    • New tool “company_changes” functional
    • New tool “company_profile” functional
    • New tool “email_domain_check” functional
    • New tool “read_url” functional
    • New tool “vendor_trust_profile” functional
  • 7 Oct 26 71

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 18 Oct 2026 · Probed https://stormap.ai/mcp

TLS valid

Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .

Subject Issuer Valid from Valid until Key Signature Serial
CN=stormap.ai CN=YR1,O=Let's Encrypt,C=US 4 Sept 2026 3 Dec 2026 RSA 2048 SHA256-RSA 5882a3eef80ed386492461656f88e58c887
SANs: stormap.ai
CN=YR1,O=Let's Encrypt,C=US (CA) CN=Root YR,O=ISRG,C=US 3 Sept 2025 2 Sept 2028 RSA 2048 SHA256-RSA a20253f15f2691c05dc1ce13b9bcca4e
CN=Root YR,O=ISRG,C=US (CA) CN=ISRG Root X1,O=Internet Security Research Group,C=US 13 May 2026 2 Sept 2032 RSA 4096 SHA256-RSA f24b6d17f9d9ad7cb1c9fea78782699f

Background: What to check on a remote MCP endpoint →

DNSSEC insecure

Validation of stormap.ai. — Not signed

Zone DS Keys Algorithms Outcome
. trust_anchor 20326, 38696 8, 8 Verified
ai. present 3799 8 Verified
stormap.ai. absent Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation
Authentication No authorisation required

The endpoint answered without asking for a token. Anyone who knows the URL can reach it.

Result No authorisation required
HTTP status 200
Header Value
strict-transport-security max-age=31536000; includeSubDomains
content-security-policy default-src 'self';script-src 'self' 'unsafe-inline' https://d3js.org https://cdn.jsdelivr.net https://cdnjs.cloudflare.com https://js.stripe.com https://www.googletagmanager.com https://vercel.live https://unpkg.com https://pagead2.googlesyndication.com https://*.googlesyndication.com https://*.adtrafficquality.google blob:;worker-src 'self' blob:;style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com https://cdn.jsdelivr.net https://vercel.live;font-src 'self' https://fonts.gstatic.com https://cdnjs.cloudflare.com;img-src 'self' data: https: *.googleusercontent.com blob:;connect-src 'self' https://api.openai.com https://api.stripe.com https://www.google-analytics.com https://region1.google-analytics.com https://stats.g.doubleclick.net https://www.google.com https://vercel.live wss://vercel.live https://cdn.jsdelivr.net https://fonts.googleapis.com https://fonts.gstatic.com https://pagead2.googlesyndication.com https://*.googlesyndication.com https://*.adtrafficquality.goo
x-content-type-options nosniff
x-frame-options SAMEORIGIN
referrer-policy no-referrer
permissions-policy payment=(self)

Background: How OAuth 2.1 works in the 2026 MCP spec →

Transports 2 probes
Transport URL Outcome Status Location
streamable-http https://stormap.ai/mcp Verified 200
http (plaintext) http://stormap.ai/mcp HTTPS enforced 308 https://stormap.ai/mcp
MCP tools · 19 exposed · ~3,250 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
agentic_commerce_readiness ~175

Is this store ready for ChatGPT shopping? Audit whether an online store is ready for AI shopping agents (ChatGPT shopping and Instant Checkout via ACP, Google AI Mode via UCP, Perplexity, Claude): AI bot access to product pages, Product structured data (price, currency, availability, GTIN/MPN, brand, ratings), return policy and shipping details, policy pages, product sitemap/feed, platform and Stripe detection, and agent protocol discovery files (/.well-known/ucp, /.well-known/acp.json, MCP server card). Returns a 0-100 score, readiness level and a prioritized fix list.

NameTypeReqDescription
urlstringyesStore domain or a product page URL, e.g. "allbirds.com" or "https://shop.example.com/products/blue-mug".

No output schema declared.

No examples provided.

ai_visibility_score ~141

AI search / GEO / AEO audit: score how well AI assistants (ChatGPT, Claude, Perplexity, Gemini) can find, read and cite a public web page: 0-100 score, letter grade, pass/fail checks (AI answer-bot access in robots.txt, server-rendered content, title/meta, JSON-LD, canonical, llms.txt, sitemap) and a prioritized fix list. Blocking bulk training crawlers is treated as a policy choice and does not lower the score.

NameTypeReqDescription
urlstringyesPublic page URL or domain, e.g. "example.com" or "https://example.com/pricing".

No output schema declared.

No examples provided.

brainstorm_ideas ~265

Brainstorm ideas for a topic, goal, problem or question, each scored 1-10 on three criteria that fit the kind of brainstorm (for business ideas: market size, ease to start, profit potential; for problem solving: impact, feasibility, cost to implement) with an overall score, sorted best first. depth 2 also grows 3 sub-ideas under each of the top 3. Returns a map_url that opens the result as an interactive bubble map on stormap.ai, where a person can keep growing, re-scoring and sharing it. Scores are quick model estimates for sorting, not research.

NameTypeReqDescription
countinteger–Ideas at the top level (default 5).
depthinteger–1 (default) or 2 to also grow sub-ideas under the top 3.
modestring–Kind of brainstorm; sets the scoring criteria (default general). breakdown splits the topic into exhaustive, non-overlapping parts with no scores.
steerstring–Optional constraint, e.g. "cheap, no hardware", "for beginners".
topicstringyesWhat to brainstorm, e.g. "side hustles for engineers", "reduce factory scrap rate", "YouTube channel about home cooking".

No output schema declared.

No examples provided.

check_ai_crawler_access ~124

Check whether AI crawlers (GPTBot, ChatGPT-User, OAI-SearchBot, ClaudeBot, Claude-User, PerplexityBot, Google-Extended, CCBot) may access a public URL according to its robots.txt, and score the page's machine readability (status, title, meta description, canonical, JSON-LD, server-rendered text). Returns a 0-100 score and a list of findings.

NameTypeReqDescription
urlstringyesPublic page URL or domain, e.g. "https://example.com/pricing".

No output schema declared.

No examples provided.

check_before_paying ~215

Should your agent pay this? Run before paying an x402 / pay-per-call endpoint, an unfamiliar seller or a wallet address. Returns a verdict (ok_to_pay, caution, dont_pay, no_payment_needed) with reasons, from: the endpoint's live payment terms (price, token, payment address), its listing in Coinbase's x402 marketplace (how many different wallets paid it in 30 days, listed payment address), whether the live payment address matches the listing, whether the token is real USDC, the price compared with typical prices for similar tools, and the seller domain's age, website and mail security. Read-only: never pays or signs anything.

NameTypeReqDescription
amount_usdnumber–Optional: the amount in USD you are about to pay, to check it against what the endpoint asks for.
targetstringyesPaid endpoint URL (e.g. "https://api.example.com/v1/search"), seller domain (e.g. "example.com") or wallet address (0x...).

No output schema declared.

No examples provided.

company_changes ~141

Did they raise prices or change their terms? What changed on a company's pricing, terms of service, privacy policy and subprocessor pages, and when. Returns the change history (prices added/removed, free plan or trial added/removed, subprocessors added/removed, text added/removed) and the current prices. Stormap checks tracked pages about once a day; asking about a new company starts tracking it, so history builds from that day. Useful for competitor monitoring, vendor renewals and compliance.

NameTypeReqDescription
domainstringyesCompany domain, e.g. "linear.app".
since_daysinteger–Only return changes from the last N days.

No output schema declared.

No examples provided.

company_profile ~129

Company profile from a domain: a one-line summary, what the company does, founded, headquarters, industry, employee count, founders, parent company, public listing (ticker, exchange, SEC business address and industry), key pages (pricing, docs, contact, careers, status), social profiles, current prices with the date seen, tech stack, role contact emails, domain age and mail provider, and AI-readiness. From the company's own website plus Wikidata, SEC EDGAR, RDAP and DNS.

NameTypeReqDescription
domainstringyesCompany domain or homepage URL, e.g. "stripe.com".

No output schema declared.

No examples provided.

email_domain_check ~158

Is this email address or domain real and legitimate? For lead research, signup / fraud screening, outreach list cleaning and vendor checks. Returns a verdict (looks_legitimate, risky, invalid) with reasons, plus: email syntax, role address (sales@, info@), free provider or disposable/throwaway service, whether the domain accepts mail (MX, null MX), mail provider (Google Workspace, Microsoft 365...), SPF and DMARC policy, whether the website loads, and domain age from RDAP. Does not contact the mail server, so it cannot confirm a specific mailbox exists.

NameTypeReqDescription
emailstringyesEmail address (e.g. "sales@stripe.com") or a bare domain (e.g. "stripe.com").

No output schema declared.

No examples provided.

find_best_api ~266

Describe what you need ("web search", "weather forecast", "verify an email", "pdf to text", "people enrichment") and get the top 1-5 pay-per-call (x402) APIs to use, from an hourly index of Coinbase's x402 marketplace (~38,000 endpoints). Ranked by evidence that other agents keep paying for them: calls per paying wallet over 30 days (so one-off sampling bots count little), how recently each was paid, relevance and price vs. typical. Top candidates are checked live (still asking for payment, at the listed price). Each result: endpoint URL, method, price, network, why it ranks there, and flags (mostly one-time payers, above typical price, not called recently, did not answer). Read-only; never pays.

NameTypeReqDescription
check_liveboolean–Check the top candidates live (default true). False is faster.
limitinteger–How many APIs to return (default 3).
max_price_usdnumber–Optional price cap per call in USD, e.g. 0.05.
taskstringyesWhat you need the API for, in a few words, e.g. "web search", "transcribe audio", "company enrichment".

No output schema declared.

No examples provided.

generate_ai_robots_txt ~145

Generate robots.txt rules for AI crawlers from a policy: "open" (allow all), "balanced" (allow search and user-triggered fetchers, block bulk training crawlers) or "block" (block all). Optional per-bot overrides, allowed/blocked paths, sitemap and crawl delay. No network access.

NameTypeReqDescription
allow_pathsarray––
crawl_delayinteger––
disallow_pathsarray––
overridesobject–e.g. {"GPTBot":"allow","CCBot":"block"}
policystring––
site_urlstring––
sitemap_urlstring––

No output schema declared.

No examples provided.

generate_llms_txt ~144

Generate an llms.txt file (llmstxt.org format) for a public website. Uses the site name, summary and pages you pass; anything missing is filled from the homepage and sitemap.xml. Returns the file text plus notes on how to improve it.

NameTypeReqDescription
max_pagesinteger––
pagesarray–Optional list of the most important page URLs. If omitted, sitemap.xml is used.
site_namestring––
site_urlstringyesSite root, e.g. "https://example.com".
summarystring–One paragraph: what the site is, who it is for, what is most useful.

No output schema declared.

No examples provided.

get_guide ~77

Return one Stormap guide as clean Markdown with front matter (title, URL, dates, tags). Accepts a slug ("how-to-install-hermes-desktop") or a stormap.ai post URL.

NameTypeReqDescription
max_charsinteger––
slugstringyesGuide slug or full https://stormap.ai/post/... URL.

No output schema declared.

No examples provided.

package_check ~193

Before installing an npm or PyPI package: does it exist (AI-suggested names are sometimes made up, and attackers register them), has it been reported as malicious, which known vulnerabilities affect this version (with the fixed version), is it deprecated or yanked, how old is it, does it run code on install, how many downloads, and does its name imitate a popular package (typosquat). Verdict: ok_to_install, caution, dont_install or does_not_exist, with reasons. From OSV.dev, deps.dev, the npm registry and PyPI.

NameTypeReqDescription
ecosystemstring–npm (default) or pypi.
namestringyesPackage name, optionally with a version: "lodash", "lodash@4.17.15", "@scope/pkg", "requests==2.31.0".
versionstring–Optional version to check (default: latest).

No output schema declared.

No examples provided.

read_url ~116

Read a web page for an AI: fetch a public page and return its main content as clean, LLM-ready Markdown (navigation, footers, scripts and cookie banners removed) plus metadata: title, description, author, published/modified dates, canonical URL, language and word count. Reads server-rendered HTML (no JavaScript execution) and respects robots.txt.

NameTypeReqDescription
max_charsinteger–Maximum Markdown length to return.
urlstringyesPublic page URL, e.g. "https://example.com/blog/post".

No output schema declared.

No examples provided.

search_guides ~120

Search Stormap's practical guides on building with AI agents (OpenClaw, Hermes, Claude, coding agents, browser automation, RAG, MCP, AI news). Returns titles, URLs, Markdown URLs and short descriptions.

NameTypeReqDescription
categorystring–Optional category filter, e.g. "OpenClaw Tutorials", "AI News", "AI Tools", "Automation".
limitinteger––
querystringyesWhat to look for, e.g. "install hermes desktop" or "stop coding agents overwriting files".

No output schema declared.

No examples provided.

trading_halts ~141

US stock trading halts right now and earlier today (Nasdaq, NYSE, NYSE American and other US markets), from Nasdaq's halt feed refreshed every minute. For each: symbol, market, the reason in plain English (news pending, volatility pause, additional information requested, regulatory concern...), halt time, and when quoting and trading resume, with a status (halted, resuming_soon, resumed). Filter by one or more tickers, or omit for all.

NameTypeReqDescription
symbolsstring–Optional: one or more tickers separated by commas, e.g. "FFAI, AAPL". Omit for all current halts.

No output schema declared.

No examples provided.

vendor_trust_profile ~204

Vendor security review / third-party risk check: a first-pass security and privacy profile of a software vendor from its own public website, given a domain. Answers "is this vendor SOC 2 certified?" and "do they train AI on our data?": certifications it claims (SOC 2 Type I/II, ISO 27001/27701/42001, HIPAA, PCI DSS, FedRAMP…), whether it trains AI models on customer data (with the exact quote and page), subprocessor list, DPA, data residency, security features (SSO/SAML, SCIM, MFA, encryption, pen tests, bug bounty), security.txt contact, status page, links to trust center, privacy policy and terms, plus a 0-100 transparency score. Use for vendor risk assessments, procurement and security questionnaires. Certifications are vendor claims, not verified audits.

NameTypeReqDescription
domainstringyesVendor domain, e.g. "notion.com".

No output schema declared.

No examples provided.

why_is_it_moving ~280

For a US stock ticker: the likely catalysts behind a move, from primary sources, in seconds. Ranks the last 48 hours (adjustable) of SEC filings: 8-K events decoded into plain English (deals, earnings, new debt, unregistered share sales, delisting notices, management changes), the press-release headline from Exhibit 99.1, offerings and shelf registrations (dilution), insider open-market buys and sells from Form 4 (who, shares, price, value), 5%+ stakes (13D/13G); plus whether the stock is halted or was halted today and why. Each item has its time, a link to the filing and why it ranks where it does; filing bursts say which filing to read first. An explicit answer status (filing_found, news_halt_no_filing_yet, unexplained_by_primary_sources) and a coverage block (window searched, when each source was last checked, latest filing date) let an agent tell "nothing filed" apart from "a source failed". Facts only: no price data and no buy/sell opinions.

NameTypeReqDescription
hoursinteger–How far back to look, in hours (default 48).
tickerstringyesUS stock ticker, e.g. "AAPL" or "BRK.B".

No output schema declared.

No examples provided.

x402_market_report ~216

What paid AI-agent tools cost and who sells the most, from an hourly index of Coinbase's x402 marketplace (about 38,000 pay-per-call endpoints). For a category or a search phrase: the typical price that paying wallets actually accept (median, middle range, top 10%), a price distribution, the top sellers by distinct paying wallets in the last 30 days, new listings this week that are already being paid, and how concentrated the market is. Use it to price your own x402 endpoint, or to pick which paid tool to call.

NameTypeReqDescription
categorystring–Optional category, e.g. "scraping", "web_search", "llm", "market_data", "onchain". Omit for the whole marketplace plus a per-category table.
limitinteger–How many top sellers and new listings to return (default 10).
querystring–Optional search phrase matched against listing names, descriptions and URLs, e.g. "transcription" or "weather".

No output schema declared.

No examples provided.

Install

How do I install the Stormap MCP server?

Stormap is a hosted endpoint at https://stormap.ai/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

remote · stormap.ai

# add to Claude Code
claude mcp add --transport http boriskendev-stormap 'https://stormap.ai/mcp'
Common questions

What is the Stormap MCP server?

Stormap is an MCP server listed in the public MCP registry as io.github.boriskendev/stormap. Find the best paid API for a task, package safety checks, stock catalysts, x402 market data. This page covers its hosted endpoint (https://stormap.ai/mcp).

Is the Stormap MCP server safe to use?

Stormap scores 76 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the Stormap MCP server expose?

Stormap exposes 19 tools: vendor_trust_profile, company_changes, agentic_commerce_readiness, company_profile, check_before_paying, and 14 more. Their descriptions and schemas cost roughly 3,250 tokens of context every time the server is loaded.

Does the Stormap MCP server require authentication?

No. We connected to Stormap without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

Is the Stormap MCP server still maintained?

Stormap is still listed as active in the MCP registry. We last reached this channel on 18 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.