ca.tonbot.tolca/tolca
REMOTE · TOLCA.TONBOT.CA
Verify a company before paying it: OFAC sanctions, UK/Canada registries, contractor licences (x402)
Available components
Last scanned (19 hours ago)
Scores higher than 69% of remote servers
Reachable. Last reached 4 Nov 2026.
Category Security
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security74
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one. See how to fix → View diagnostics → Partial
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability57
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 3020 tokens (~201/item across 15 items; 15 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management77
- Stability observed for 23 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage84
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 53% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 15 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 15 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 4 Nov 26 0
- Tool “qc_contractor_check” rewrote its description, which is the text the model reads security
- Tool “verify_business” rewrote its description, which is the text the model reads security
- Schema quality: 2573 → 3020 ▼ functional
- Tool coverage: 48% → 53% ▲ functional
- New tool “payment_check” functional
- New tool “sanctions_check” functional
- 3 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 70 to 73. That category is still filling its 30-day observation window: 21 days of observed history at the previous scan, 22 at this one. The score rises as the window fills, whether or not the server changes.
- 1 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 63 to 67. That category is still filling its 30-day observation window: 19 days of observed history at the previous scan, 20 at this one. The score rises as the window fills, whether or not the server changes.
- 31 Oct 26 0
- Tool “company_enrich” rewrote its description, which is the text the model reads security
- Tool “verify_business” rewrote its description, which is the text the model reads security
- 30 Oct 26 0
- Tool “company_enrich” rewrote its description, which is the text the model reads security
- Tool “qc_contractor_check” rewrote its description, which is the text the model reads security
- Tool “verify_business” rewrote its description, which is the text the model reads security
- 29 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 53 to 57. That category is still filling its 30-day observation window: 16 days of observed history at the previous scan, 17 at this one. The score rises as the window fills, whether or not the server changes.
- 28 Oct 26 0
- Tool coverage: 54% → 48% ▼ functional
- Schema quality: 1882 → 2347 ▼ functional
- New tool “company_enrich” functional
- New tool “company_fit” functional
- 26 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 43 to 47. That category is still filling its 30-day observation window: 13 days of observed history at the previous scan, 14 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 4 Nov 2026 · Probed https://tolca.tonbot.ca/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=tolca.tonbot.ca | CN=YE2,O=Let's Encrypt,C=US | 11 Oct 2026 | 9 Jan 2027 | ECDSA 256 | ECDSA-SHA384 | 556d32617caf3bf48e6fa85b64e8f84e99b |
| SANs: tolca.tonbot.ca | ||||||
| CN=YE2,O=Let's Encrypt,C=US (CA) | CN=Root YE,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | ECDSA 384 | ECDSA-SHA384 | 4df3b15dd6c0784c507cd37b58e6f115 |
| CN=Root YE,O=ISRG,C=US (CA) | CN=ISRG Root X2,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | ECDSA-SHA384 | 872165fc34b6e5fba8add5b3705fb53a |
| CN=ISRG Root X2,O=Internet Security Research Group,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | SHA256-RSA | 6c8f1dc727c7117f7baf853ac980f9cd |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of tolca.tonbot.ca. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| ca. | present | 26384 | 13 | Verified |
| tonbot.ca. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://tolca.tonbot.ca/mcp | Verified | 200 | |
| http (plaintext) | http://tolca.tonbot.ca/mcp | HTTPS enforced | 308 | https://tolca.tonbot.ca/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
company_enrich company-enrich ~247
Company profile from a domain or name in ONE call, for sales and research agents: what the company does, industry, services, service area, address, phones and emails published by the company (each with the page it came from), social links, plus official screening (registries, US, UK, EU and Canadian sanctions lists). Read live from the company's own website, no third-party database. No website found = HTTP 404 = no charge. Input: domain or name, optional city, country, lang (en|fr). Businesses only. Costs $0.02 USDC per call (x402 v2, Base). Send the HTTP header PAYMENT-SIGNATURE with your x402 payment, or call POST https://tolca.tonbot.ca/v1/company-enrich with an x402 client.
| Name | Type | Req | Description |
|---|---|---|---|
| city | string | – | – |
| country | string | – | ISO 3166 alpha-2 |
| domain | string | – | Company website or domain, e.g. acme.com |
| lang | string | – | – |
| name | string | – | Company name, used to find the website when no domain is given |
| official_checks | boolean | – | – |
No output schema declared.
No examples provided.
company_fit company-fit ~223
Is this company worth contacting FOR YOU? Everything in company-enrich, plus a fit verdict for your offer and goal: good / maybe / poor, a 0-100 score, reasons grounded in facts from the company's website, and an opening line that references one of those facts. Input: domain or name, plus for: { seller (who you are and what you sell), goal (sales | partnership | supplier | hiring | investment | other), optional ideal_customer }. No website found = no charge. Costs $0.03 USDC per call (x402 v2, Base). Send the HTTP header PAYMENT-SIGNATURE with your x402 payment, or call POST https://tolca.tonbot.ca/v1/company-fit with an x402 client.
| Name | Type | Req | Description |
|---|---|---|---|
| city | string | – | – |
| country | string | – | – |
| domain | string | – | Company website or domain, e.g. acme.com |
| for | object | yes | – |
| lang | string | – | – |
| name | string | – | – |
| official_checks | boolean | – | – |
No output schema declared.
No examples provided.
extract ~131
Turn messy text into clean JSON matching the schema you provide (field names and types). Pay-per-call over x402 in USDC on Base; payment challenge answered in ~5 ms, 7-day average processing ~1.5 s across Tolca services. Costs $0.02 USDC per call (x402 v2, Base). Send the HTTP header PAYMENT-SIGNATURE with your x402 payment, or call POST https://tolca.tonbot.ca/v1/extract with an x402 client.
| Name | Type | Req | Description |
|---|---|---|---|
| schema | object | yes | Field name -> type or description |
| text | string | yes | – |
No output schema declared.
No examples provided.
extract_url extract-url ~138
Fetch a public URL (HTML article, PDF, or JSON) and return JSON matching your schema in one call, with page title and source. Pay-per-call over x402 in USDC on Base; payment challenge answered in ~8 ms. Costs $0.03 USDC per call (x402 v2, Base). Send the HTTP header PAYMENT-SIGNATURE with your x402 payment, or call POST https://tolca.tonbot.ca/v1/extract-url with an x402 client.
| Name | Type | Req | Description |
|---|---|---|---|
| max_chars | integer | – | – |
| schema | object | yes | Field name -> type or description |
| url | string | yes | – |
No output schema declared.
No examples provided.
homework_check homework-check ~218
Can this homework be done by an AI? For teachers and schools: paste an assignment (or a public PDF URL) and get an overall AI-completion risk 0-100, a per-question breakdown (risk, why, concrete fix to make it AI-resistant) and general tips. No student data. Input: text or url, optional grade, subject, lang fr|en. / Ce devoir peut-il être fait par une IA? Score par question et corrections concrètes pour l'enseignant. Costs $0.25 USDC per call (x402 v2, Base). Send the HTTP header PAYMENT-SIGNATURE with your x402 payment, or call POST https://tolca.tonbot.ca/v1/homework-check with an x402 client.
| Name | Type | Req | Description |
|---|---|---|---|
| grade | string | – | Grade level, e.g. secondaire 3 |
| lang | string | – | – |
| subject | string | – | – |
| text | string | – | Assignment text |
| url | string | – | Public URL of the assignment (PDF or page) |
No output schema declared.
No examples provided.
payment_check payment-check ~281
Check an x402 payment request before your agent pays it. One call screens the payTo address against official sanctions lists (OFAC SDN digital currency addresses), checks that the asset is the official USDC contract and the network is Base, compares the price with the seller's Bazaar catalogue listing and, with seller_name, screens the company against US, UK, EU and Canadian sanctions lists. Returns allow / review / block with reasons, the hash of the exact invoice checked and an Ed25519-signed receipt valid 10 minutes. Keep it as proof of the check if a payment is ever disputed. Input: requirements (one entry of the 402 accepts array) or payment_required (the full 402 body), optional seller_name and seller_country. Costs $0.01 USDC per call (x402 v2, Base). Send the HTTP header PAYMENT-SIGNATURE with your x402 payment, or call POST https://tolca.tonbot.ca/v1/payment-check with an x402 client.
| Name | Type | Req | Description |
|---|---|---|---|
| payment_required | object | – | Or the full 402 response body |
| requirements | object | – | One entry of the accepts array from the seller's 402 response |
| seller_country | string | – | Optional ISO-2 country code of the seller |
| seller_name | string | – | Optional: seller company name, screened against sanctions lists |
No output schema declared.
No examples provided.
pkg_check Package safety check (npm / PyPI) ~137
Is this package safe to install? One call, one verdict: safe / caution / avoid, with a score, concrete reasons (known vulnerabilities from OSV, deprecation, abandonment, adoption, install scripts, typosquat signals) and a one-line recommendation. Input: name, ecosystem (npm | PyPI), optional version. Free over MCP (100/day shared quota); unlimited via x402 at https://tolca.tonbot.ca/v1/pkg-check ($0.02).
| Name | Type | Req | Description |
|---|---|---|---|
| ecosystem | string | yes | – |
| name | string | yes | Package name as published |
| version | string | – | Exact version; defaults to latest |
No output schema declared.
No examples provided.
pkg_meta pkg-meta ~153
Package metadata in one call, cheapest tier: latest and resolved version, license, first/last publish dates, weekly downloads, deprecation flag, install scripts, maintainers count. npm or PyPI. No vulnerability scan (see pkg-check for the full safe/caution/avoid verdict). Input: name, ecosystem (npm | PyPI), optional version. Costs $0.005 USDC per call (x402 v2, Base). Send the HTTP header PAYMENT-SIGNATURE with your x402 payment, or call POST https://tolca.tonbot.ca/v1/pkg-meta with an x402 client.
| Name | Type | Req | Description |
|---|---|---|---|
| ecosystem | string | yes | – |
| name | string | yes | – |
| version | string | – | – |
No output schema declared.
No examples provided.
qc_contractor_check Québec contractor check (RBQ + RENA + environmental penalties + SEAO public contracts) ~236
Call before hiring, paying or subcontracting a Québec (Canada) contractor. One call checks: active RBQ licence (status, categories, restrictions), RENA listing (banned from public contracts), environmental penalties, public contracts awarded on SEAO (count, total, buyers). Verdict ok / review / blocking with reasons and source dates. Every response includes an Ed25519-signed receipt you can verify offline (public key: https://tolca.tonbot.ca/.well-known/tolca-receipt-key.json) or online at /receipts/verify. Keep it as proof of the check if a payment is ever disputed. Input: name, NEQ or RBQ licence number. Official open data. Free over MCP (10/day shared quota); unlimited via x402 at https://tolca.tonbot.ca/v1/qc-contractor-check ($0.1).
| Name | Type | Req | Description |
|---|---|---|---|
| lang | string | – | – |
| licence | string | – | RBQ licence number |
| name | string | – | Business name, exact or partial |
| neq | string | – | Numéro d'entreprise du Québec (10 digits) |
No output schema declared.
No examples provided.
qc_licence qc-licence ~174
Cheapest check: does this Québec contractor hold an ACTIVE RBQ licence right now? Returns active true/false, licence number, name, NEQ, city, restriction flag and authorized work categories. Use to vet many contractors fast; use qc-contractor-check for RENA and penalties. Input: name, NEQ or RBQ licence number. Costs $0.01 USDC per call (x402 v2, Base). Send the HTTP header PAYMENT-SIGNATURE with your x402 payment, or call POST https://tolca.tonbot.ca/v1/qc-licence with an x402 client.
| Name | Type | Req | Description |
|---|---|---|---|
| licence | string | – | RBQ licence number |
| name | string | – | Business name, exact or partial |
| neq | string | – | Numéro d'entreprise du Québec (10 digits) |
No output schema declared.
No examples provided.
sanctions_check sanctions-check ~248
Sanctions screening only, cheapest tier: is this company on an official sanctions list? One call checks the US Consolidated Screening List (incl. OFAC SDN), the UK Sanctions List, the EU consolidated financial sanctions list and the Consolidated Canadian Autonomous Sanctions List (UN designations included as implemented by the UK and the EU), each refreshed daily. Returns a clear action (allow / review / block), a 0-100 risk score, matches with the official list references and the date of each list copy. Companies only. Every response includes an Ed25519-signed receipt, verifiable with the public key at /.well-known/tolca-receipt-key.json. Keep it as proof of the check if a payment is ever disputed. Input: name, optional country. Costs $0.01 USDC per call (x402 v2, Base). Send the HTTP header PAYMENT-SIGNATURE with your x402 payment, or call POST https://tolca.tonbot.ca/v1/sanctions-check with an x402 client.
| Name | Type | Req | Description |
|---|---|---|---|
| country | string | – | Optional ISO-2 country code |
| name | string | yes | Person or company name to screen |
No output schema declared.
No examples provided.
summarize ~144
Summarize text (up to 40k chars) into a faithful, tight summary, with optional max_words and target language. Pay-per-call over x402 in USDC on Base; payment challenge answered in ~10 ms, 7-day average processing ~1.5 s across Tolca services. Costs $0.03 USDC per call (x402 v2, Base). Send the HTTP header PAYMENT-SIGNATURE with your x402 payment, or call POST https://tolca.tonbot.ca/v1/summarize with an x402 client.
| Name | Type | Req | Description |
|---|---|---|---|
| language | string | – | – |
| max_words | integer | – | – |
| text | string | yes | – |
No output schema declared.
No examples provided.
translate ~131
Translate text between French (including Quebec French) and English, with optional tone. Pay-per-call over x402 in USDC on Base; payment challenge answered in ~25 ms, 7-day average processing ~1.5 s across Tolca services. Costs $0.04 USDC per call (x402 v2, Base). Send the HTTP header PAYMENT-SIGNATURE with your x402 payment, or call POST https://tolca.tonbot.ca/v1/translate with an x402 client.
| Name | Type | Req | Description |
|---|---|---|---|
| target | string | yes | – |
| text | string | yes | – |
| tone | string | – | – |
No output schema declared.
No examples provided.
verify_business verify-business ~294
Call before paying, onboarding or contracting a company (KYB). One call checks the US, UK, EU and Canadian sanctions lists (CSL incl. OFAC SDN), company registries (UK Companies House, Canada federal), legal entity status (GLEIF, worldwide) and contractor licences (Quebec, Washington, Oregon). Returns a clear action (allow / review / block), a 0-100 risk score, reasons with dated sources, and an Ed25519-signed receipt you can verify offline (public key: https://tolca.tonbot.ca/.well-known/tolca-receipt-key.json) or online at /receipts/verify. Keep it as proof of the check if a payment is ever disputed. Input: name, optional country (ISO-2) and region (WA, OR, QC). Businesses only. Costs $0.05 USDC per call (x402 v2, Base). Send the HTTP header PAYMENT-SIGNATURE with your x402 payment, or call POST https://tolca.tonbot.ca/v1/verify-business with an x402 client.
| Name | Type | Req | Description |
|---|---|---|---|
| country | string | – | ISO 3166 alpha-2 country code, e.g. US, CA, GB |
| name | string | yes | Business legal or trade name |
| region | string | – | State/province code: WA, OR or QC enables contractor-licence checks |
No output schema declared.
No examples provided.
web_search web-search ~265
Search the web and read the top pages in ONE call: 10 results (title, url, snippet, date) plus the clean text of the best pages, with fetch time and sha256. French and Canada by default when the query is French; official-sources mode (governments, registries, courts, laws); freshness filter; site: restriction. No results = HTTP 404 = you are not charged. Input: query, optional read (0-5), official, lang, country, freshness, site. Costs $0.008 USDC per call (x402 v2, Base). Send the HTTP header PAYMENT-SIGNATURE with your x402 payment, or call POST https://tolca.tonbot.ca/v1/web-search with an x402 client.
| Name | Type | Req | Description |
|---|---|---|---|
| country | string | – | ISO country to prioritize (default CA) |
| freshness | string | – | – |
| lang | string | – | – |
| official | boolean | – | Only governments, registries, courts, laws |
| query | string | yes | Question or keywords; Brave operators allowed (site:, "exact", -word) |
| read | integer | – | Top pages to fetch and return as clean text (default 3) |
| site | string | – | Restrict to one domain |
No output schema declared.
No examples provided.
How do I install the ca.tonbot.tolca/tolca MCP server?
ca.tonbot.tolca/tolca is a hosted endpoint at https://tolca.tonbot.ca/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · tolca.tonbot.ca
claude mcp add --transport http ca-tonbot-tolca-tolca 'https://tolca.tonbot.ca/mcp'
What is the ca.tonbot.tolca/tolca MCP server?
ca.tonbot.tolca/tolca is an MCP server listed in the public MCP registry as ca.tonbot.tolca/tolca. Verify a company before paying it: OFAC sanctions, UK/Canada registries, contractor licences (x402). This page covers its hosted endpoint (https://tolca.tonbot.ca/mcp).
Is the ca.tonbot.tolca/tolca MCP server safe to use?
ca.tonbot.tolca/tolca scores 77 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the ca.tonbot.tolca/tolca MCP server expose?
ca.tonbot.tolca/tolca exposes 15 tools: pkg_check, qc_contractor_check, summarize, translate, extract, and 10 more. Their descriptions and schemas cost roughly 3,020 tokens of context every time the server is loaded.
Does the ca.tonbot.tolca/tolca MCP server require authentication?
No. We connected to ca.tonbot.tolca/tolca without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the ca.tonbot.tolca/tolca MCP server still maintained?
ca.tonbot.tolca/tolca is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.