# Stormap (remote · stormap.ai)

Find the best paid API for a task, package safety checks, stock catalysts, x402 market data.

- Trust score: 76/100 (medium)
- Change this week: +5
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-10-18

## Components

- remote · `stormap.ai`: 76/100 (this document), [markdown](https://verifymcp.io/servers/boriskendev-stormap/stormap.md), [page](https://verifymcp.io/servers/boriskendev-stormap/stormap)

## Channel facts

- Endpoint: `https://stormap.ai/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `1.7.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-10-18.

- **Endpoint Security**: 80/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one.
  - HTTPS is enforced; there's no plaintext access path.
  - The HSTS (Strict-Transport-Security) header is present.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 67/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 3448 tokens (~181/item across 19 items; 19 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 43/100
  - Stability observed for 13 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 93/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 79% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 19 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 20 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 60/100
  - Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28.

## Install

### How do I install the Stormap MCP server?

Stormap is a hosted endpoint at https://stormap.ai/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http boriskendev-stormap 'https://stormap.ai/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "boriskendev-stormap": {
      "url": "https://stormap.ai/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "boriskendev-stormap": {
      "type": "http",
      "url": "https://stormap.ai/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.boriskendev-stormap]
url = "https://stormap.ai/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "boriskendev-stormap": {
      "type": "remote",
      "url": "https://stormap.ai/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add boriskendev-stormap --url 'https://stormap.ai/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  boriskendev-stormap:
    url: "https://stormap.ai/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "boriskendev-stormap": {
      "Transport": "http",
      "Url": "https://stormap.ai/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add boriskendev-stormap -t streamable-http -u 'https://stormap.ai/mcp'
```

### Other

```json
{
  "mcpServers": {
    "boriskendev-stormap": {
      "type": "http",
      "url": "https://stormap.ai/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-10-18 (score 76, +7)

- [security improvement] Authorization: unverified → partial
- [security] The server rewrote its instructions, which are the text every model session reads
- [security] Tool “search_guides” rewrote its description, which is the text the model reads
- [security] Tool “x402_market_report” rewrote its description, which is the text the model reads
- [functional] New tool “brainstorm_ideas”

### 2026-10-17 (score 69, +1)

No change was recorded against any check on this day. Stability & Change Management went from 37 to 40. That category is still filling its 30-day observation window: 11 days of observed history at the previous scan, 12 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-15 (score 68, 0)

- [security] Tool “why_is_it_moving” rewrote its description, which is the text the model reads
- [functional regression] Schema quality: 2856 → 3196
- [functional] New tool “find_best_api”

### 2026-10-14 (score 68, +1)

- [security] Tool “company_profile” rewrote its description, which is the text the model reads
- [functional regression] Schema quality: 2161 → 2856
- [functional regression] Schema quality: 2161 → 2724
- [functional improvement] Tool coverage: 66% → 74%
- [functional improvement] Tool coverage: 66% → 71%
- [functional] New tool “package_check”
- [functional] New tool “trading_halts”
- [functional] New tool “why_is_it_moving”
- [functional] New tool “x402_market_report”

### 2026-10-13 (score 67, +1)

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-12 (score 66, −5)

- [security regression] Authorization: partial → unverified
- [security] The server rewrote its instructions, which are the text every model session reads
- [security] Tool “ai_visibility_score” rewrote its description, which is the text the model reads
- [functional regression] Schema quality: 143 → 166
- [functional improvement] Tool coverage: 47% → 66%
- [functional] Schema quality: good → excellent
- [functional] New tool “agentic_commerce_readiness”
- [functional] New tool “check_before_paying”
- [functional] New tool “company_changes”
- [functional] New tool “company_profile”
- [functional] New tool “email_domain_check”
- [functional] New tool “read_url”
- [functional] New tool “vendor_trust_profile”

### 2026-10-07 (score 71)

First indexed and scored.

## MCP tools (19)

### `vendor_trust_profile` (~204 tokens)

Vendor security & privacy profile

Vendor security review / third-party risk check: a first-pass security and privacy profile of a software vendor from its own public website, given a domain. Answers "is this vendor SOC 2 certified?" and "do they train AI on our data?": certifications it claims (SOC 2 Type I/II, ISO 27001/27701/42001, HIPAA, PCI DSS, FedRAMP…), whether it trains AI models on customer data (with the exact quote and page), subprocessor list, DPA, data residency, security features (SSO/SAML, SCIM, MFA, encryption, pen tests, bug bounty), security.txt contact, status page, links to trust center, privacy policy and terms, plus a 0-100 transparency score. Use for vendor risk assessments, procurement and security questionnaires. Certifications are vendor claims, not verified audits.

Input parameters:

- `domain` (string, required): Vendor domain, e.g. "notion.com".

### `company_changes` (~141 tokens)

Company change history (pricing, terms, privacy, subprocessors)

Did they raise prices or change their terms? What changed on a company's pricing, terms of service, privacy policy and subprocessor pages, and when. Returns the change history (prices added/removed, free plan or trial added/removed, subprocessors added/removed, text added/removed) and the current prices. Stormap checks tracked pages about once a day; asking about a new company starts tracking it, so history builds from that day. Useful for competitor monitoring, vendor renewals and compliance.

Input parameters:

- `domain` (string, required): Company domain, e.g. "linear.app".
- `since_days` (integer): Only return changes from the last N days.

### `agentic_commerce_readiness` (~175 tokens)

Agentic commerce readiness (AI shopping agents)

Is this store ready for ChatGPT shopping? Audit whether an online store is ready for AI shopping agents (ChatGPT shopping and Instant Checkout via ACP, Google AI Mode via UCP, Perplexity, Claude): AI bot access to product pages, Product structured data (price, currency, availability, GTIN/MPN, brand, ratings), return policy and shipping details, policy pages, product sitemap/feed, platform and Stripe detection, and agent protocol discovery files (/.well-known/ucp, /.well-known/acp.json, MCP server card). Returns a 0-100 score, readiness level and a prioritized fix list.

Input parameters:

- `url` (string, required): Store domain or a product page URL, e.g. "allbirds.com" or "https://shop.example.com/products/blue-mug".

### `company_profile` (~129 tokens)

Company profile from a domain

Company profile from a domain: a one-line summary, what the company does, founded, headquarters, industry, employee count, founders, parent company, public listing (ticker, exchange, SEC business address and industry), key pages (pricing, docs, contact, careers, status), social profiles, current prices with the date seen, tech stack, role contact emails, domain age and mail provider, and AI-readiness. From the company's own website plus Wikidata, SEC EDGAR, RDAP and DNS.

Input parameters:

- `domain` (string, required): Company domain or homepage URL, e.g. "stripe.com".

### `check_before_paying` (~215 tokens)

Check before paying

Should your agent pay this? Run before paying an x402 / pay-per-call endpoint, an unfamiliar seller or a wallet address. Returns a verdict (ok_to_pay, caution, dont_pay, no_payment_needed) with reasons, from: the endpoint's live payment terms (price, token, payment address), its listing in Coinbase's x402 marketplace (how many different wallets paid it in 30 days, listed payment address), whether the live payment address matches the listing, whether the token is real USDC, the price compared with typical prices for similar tools, and the seller domain's age, website and mail security. Read-only: never pays or signs anything.

Input parameters:

- `amount_usd` (number): Optional: the amount in USD you are about to pay, to check it against what the endpoint asks for.
- `target` (string, required): Paid endpoint URL (e.g. "https://api.example.com/v1/search"), seller domain (e.g. "example.com") or wallet address (0x...).

### `package_check` (~193 tokens)

Is this package safe to install?

Before installing an npm or PyPI package: does it exist (AI-suggested names are sometimes made up, and attackers register them), has it been reported as malicious, which known vulnerabilities affect this version (with the fixed version), is it deprecated or yanked, how old is it, does it run code on install, how many downloads, and does its name imitate a popular package (typosquat). Verdict: ok_to_install, caution, dont_install or does_not_exist, with reasons. From OSV.dev, deps.dev, the npm registry and PyPI.

Input parameters:

- `ecosystem` (string): npm (default) or pypi.
- `name` (string, required): Package name, optionally with a version: "lodash", "lodash@4.17.15", "@scope/pkg", "requests==2.31.0".
- `version` (string): Optional version to check (default: latest).

### `why_is_it_moving` (~280 tokens)

Why is this stock moving?

For a US stock ticker: the likely catalysts behind a move, from primary sources, in seconds. Ranks the last 48 hours (adjustable) of SEC filings: 8-K events decoded into plain English (deals, earnings, new debt, unregistered share sales, delisting notices, management changes), the press-release headline from Exhibit 99.1, offerings and shelf registrations (dilution), insider open-market buys and sells from Form 4 (who, shares, price, value), 5%+ stakes (13D/13G); plus whether the stock is halted or was halted today and why. Each item has its time, a link to the filing and why it ranks where it does; filing bursts say which filing to read first. An explicit answer status (filing_found, news_halt_no_filing_yet, unexplained_by_primary_sources) and a coverage block (window searched, when each source was last checked, latest filing date) let an agent tell "nothing filed" apart from "a source failed". Facts only: no price data and no buy/sell opinions.

Input parameters:

- `hours` (integer): How far back to look, in hours (default 48).
- `ticker` (string, required): US stock ticker, e.g. "AAPL" or "BRK.B".

### `trading_halts` (~141 tokens)

Trading halts

US stock trading halts right now and earlier today (Nasdaq, NYSE, NYSE American and other US markets), from Nasdaq's halt feed refreshed every minute. For each: symbol, market, the reason in plain English (news pending, volatility pause, additional information requested, regulatory concern...), halt time, and when quoting and trading resume, with a status (halted, resuming_soon, resumed). Filter by one or more tickers, or omit for all.

Input parameters:

- `symbols` (string): Optional: one or more tickers separated by commas, e.g. "FFAI, AAPL". Omit for all current halts.

### `x402_market_report` (~216 tokens)

x402 marketplace report

What paid AI-agent tools cost and who sells the most, from an hourly index of Coinbase's x402 marketplace (about 38,000 pay-per-call endpoints). For a category or a search phrase: the typical price that paying wallets actually accept (median, middle range, top 10%), a price distribution, the top sellers by distinct paying wallets in the last 30 days, new listings this week that are already being paid, and how concentrated the market is. Use it to price your own x402 endpoint, or to pick which paid tool to call.

Input parameters:

- `category` (string): Optional category, e.g. "scraping", "web_search", "llm", "market_data", "onchain". Omit for the whole marketplace plus a per-category table.
- `limit` (integer): How many top sellers and new listings to return (default 10).
- `query` (string): Optional search phrase matched against listing names, descriptions and URLs, e.g. "transcription" or "weather".

### `find_best_api` (~266 tokens)

Which paid API should I call?

Describe what you need ("web search", "weather forecast", "verify an email", "pdf to text", "people enrichment") and get the top 1-5 pay-per-call (x402) APIs to use, from an hourly index of Coinbase's x402 marketplace (~38,000 endpoints). Ranked by evidence that other agents keep paying for them: calls per paying wallet over 30 days (so one-off sampling bots count little), how recently each was paid, relevance and price vs. typical. Top candidates are checked live (still asking for payment, at the listed price). Each result: endpoint URL, method, price, network, why it ranks there, and flags (mostly one-time payers, above typical price, not called recently, did not answer). Read-only; never pays.

Input parameters:

- `check_live` (boolean): Check the top candidates live (default true). False is faster.
- `limit` (integer): How many APIs to return (default 3).
- `max_price_usd` (number): Optional price cap per call in USD, e.g. 0.05.
- `task` (string, required): What you need the API for, in a few words, e.g. "web search", "transcribe audio", "company enrichment".

### `brainstorm_ideas` (~265 tokens)

Brainstorm scored ideas for a topic

Brainstorm ideas for a topic, goal, problem or question, each scored 1-10 on three criteria that fit the kind of brainstorm (for business ideas: market size, ease to start, profit potential; for problem solving: impact, feasibility, cost to implement) with an overall score, sorted best first. depth 2 also grows 3 sub-ideas under each of the top 3. Returns a map_url that opens the result as an interactive bubble map on stormap.ai, where a person can keep growing, re-scoring and sharing it. Scores are quick model estimates for sorting, not research.

Input parameters:

- `count` (integer): Ideas at the top level (default 5).
- `depth` (integer): 1 (default) or 2 to also grow sub-ideas under the top 3.
- `mode` (string): Kind of brainstorm; sets the scoring criteria (default general). breakdown splits the topic into exhaustive, non-overlapping parts with no scores.
- `steer` (string): Optional constraint, e.g. "cheap, no hardware", "for beginners".
- `topic` (string, required): What to brainstorm, e.g. "side hustles for engineers", "reduce factory scrap rate", "YouTube channel about home cooking".

### `email_domain_check` (~158 tokens)

Check an email address or domain

Is this email address or domain real and legitimate? For lead research, signup / fraud screening, outreach list cleaning and vendor checks. Returns a verdict (looks_legitimate, risky, invalid) with reasons, plus: email syntax, role address (sales@, info@), free provider or disposable/throwaway service, whether the domain accepts mail (MX, null MX), mail provider (Google Workspace, Microsoft 365...), SPF and DMARC policy, whether the website loads, and domain age from RDAP. Does not contact the mail server, so it cannot confirm a specific mailbox exists.

Input parameters:

- `email` (string, required): Email address (e.g. "sales@stripe.com") or a bare domain (e.g. "stripe.com").

### `read_url` (~116 tokens)

Read a web page as Markdown

Read a web page for an AI: fetch a public page and return its main content as clean, LLM-ready Markdown (navigation, footers, scripts and cookie banners removed) plus metadata: title, description, author, published/modified dates, canonical URL, language and word count. Reads server-rendered HTML (no JavaScript execution) and respects robots.txt.

Input parameters:

- `max_chars` (integer): Maximum Markdown length to return.
- `url` (string, required): Public page URL, e.g. "https://example.com/blog/post".

### `search_guides` (~120 tokens)

Search Stormap guides

Search Stormap's practical guides on building with AI agents (OpenClaw, Hermes, Claude, coding agents, browser automation, RAG, MCP, AI news). Returns titles, URLs, Markdown URLs and short descriptions.

Input parameters:

- `category` (string): Optional category filter, e.g. "OpenClaw Tutorials", "AI News", "AI Tools", "Automation".
- `limit` (integer)
- `query` (string, required): What to look for, e.g. "install hermes desktop" or "stop coding agents overwriting files".

### `get_guide` (~77 tokens)

Read a Stormap guide

Return one Stormap guide as clean Markdown with front matter (title, URL, dates, tags). Accepts a slug ("how-to-install-hermes-desktop") or a stormap.ai post URL.

Input parameters:

- `max_chars` (integer)
- `slug` (string, required): Guide slug or full https://stormap.ai/post/... URL.

### `ai_visibility_score` (~141 tokens)

AI visibility score

AI search / GEO / AEO audit: score how well AI assistants (ChatGPT, Claude, Perplexity, Gemini) can find, read and cite a public web page: 0-100 score, letter grade, pass/fail checks (AI answer-bot access in robots.txt, server-rendered content, title/meta, JSON-LD, canonical, llms.txt, sitemap) and a prioritized fix list. Blocking bulk training crawlers is treated as a policy choice and does not lower the score.

Input parameters:

- `url` (string, required): Public page URL or domain, e.g. "example.com" or "https://example.com/pricing".

### `check_ai_crawler_access` (~124 tokens)

Check AI crawler access

Check whether AI crawlers (GPTBot, ChatGPT-User, OAI-SearchBot, ClaudeBot, Claude-User, PerplexityBot, Google-Extended, CCBot) may access a public URL according to its robots.txt, and score the page's machine readability (status, title, meta description, canonical, JSON-LD, server-rendered text). Returns a 0-100 score and a list of findings.

Input parameters:

- `url` (string, required): Public page URL or domain, e.g. "https://example.com/pricing".

### `generate_llms_txt` (~144 tokens)

Generate llms.txt

Generate an llms.txt file (llmstxt.org format) for a public website. Uses the site name, summary and pages you pass; anything missing is filled from the homepage and sitemap.xml. Returns the file text plus notes on how to improve it.

Input parameters:

- `max_pages` (integer)
- `pages` (array): Optional list of the most important page URLs. If omitted, sitemap.xml is used.
- `site_name` (string)
- `site_url` (string, required): Site root, e.g. "https://example.com".
- `summary` (string): One paragraph: what the site is, who it is for, what is most useful.

### `generate_ai_robots_txt` (~145 tokens)

Generate robots.txt rules for AI crawlers

Generate robots.txt rules for AI crawlers from a policy: "open" (allow all), "balanced" (allow search and user-triggered fetchers, block bulk training crawlers) or "block" (block all). Optional per-bot overrides, allowed/blocked paths, sitemap and crawl delay. No network access.

Input parameters:

- `allow_paths` (array)
- `crawl_delay` (integer)
- `disallow_paths` (array)
- `overrides` (object): e.g. {"GPTBot":"allow","CCBot":"block"}
- `policy` (string)
- `site_url` (string)
- `sitemap_url` (string)

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/boriskendev-stormap/stormap#diagnostics

## Score history

- 2026-10-18: 76
- 2026-10-17: 69
- 2026-10-16: 68
- 2026-10-15: 68
- 2026-10-14: 68
- 2026-10-13: 67
- 2026-10-12: 66
- 2026-10-08: 71
- 2026-10-07: 71

## Common questions

### What is the Stormap MCP server?

Stormap is an MCP server listed in the public MCP registry as io.github.boriskendev/stormap. Find the best paid API for a task, package safety checks, stock catalysts, x402 market data. This page covers its hosted endpoint (https://stormap.ai/mcp).

### Is the Stormap MCP server safe to use?

Stormap scores 76 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Stormap MCP server expose?

Stormap exposes 19 tools: vendor_trust_profile, company_changes, agentic_commerce_readiness, company_profile, check_before_paying, and 14 more. Their descriptions and schemas cost roughly 3,250 tokens of context every time the server is loaded.

### Does the Stormap MCP server require authentication?

No. We connected to Stormap without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

### Is the Stormap MCP server still maintained?

Stormap is still listed as active in the MCP registry. We last reached this channel on 18 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Remote endpoint: https://stormap.ai/mcp
- Website: https://stormap.ai/developers
- Changelog RSS feed: https://verifymcp.io/servers/boriskendev-stormap/stormap.xml
- Changelog JSON feed: https://verifymcp.io/servers/boriskendev-stormap/stormap.json
- HTML version of this page: https://verifymcp.io/servers/boriskendev-stormap/stormap