# ca.tonbot.tolca/tolca (remote · tolca.tonbot.ca)

Verify a company before paying it: OFAC sanctions, UK/Canada registries, contractor licences (x402)

- Trust score: 78/100 (medium)
- Change this week: +3
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- remote · `tolca.tonbot.ca`: 78/100 (this document), [markdown](https://verifymcp.io/servers/ca-tonbot-tolca-tolca/tolca.md), [page](https://verifymcp.io/servers/ca-tonbot-tolca-tolca/tolca)

## Channel facts

- Endpoint: `https://tolca.tonbot.ca/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `1.0.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Endpoint Security**: 74/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one.
  - HTTPS is enforced; there's no plaintext access path.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 57/100
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 3020 tokens (~201/item across 15 items; 15 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 80/100
  - Stability observed for 24 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 84/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 53% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 15 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 15 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### How do I install the ca.tonbot.tolca/tolca MCP server?

ca.tonbot.tolca/tolca is a hosted endpoint at https://tolca.tonbot.ca/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http ca-tonbot-tolca-tolca 'https://tolca.tonbot.ca/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "ca-tonbot-tolca-tolca": {
      "url": "https://tolca.tonbot.ca/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "ca-tonbot-tolca-tolca": {
      "type": "http",
      "url": "https://tolca.tonbot.ca/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.ca-tonbot-tolca-tolca]
url = "https://tolca.tonbot.ca/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "ca-tonbot-tolca-tolca": {
      "type": "remote",
      "url": "https://tolca.tonbot.ca/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add ca-tonbot-tolca-tolca --url 'https://tolca.tonbot.ca/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  ca-tonbot-tolca-tolca:
    url: "https://tolca.tonbot.ca/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "ca-tonbot-tolca-tolca": {
      "Transport": "http",
      "Url": "https://tolca.tonbot.ca/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add ca-tonbot-tolca-tolca -t streamable-http -u 'https://tolca.tonbot.ca/mcp'
```

### Other

```json
{
  "mcpServers": {
    "ca-tonbot-tolca-tolca": {
      "type": "http",
      "url": "https://tolca.tonbot.ca/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-05 (score 78, +1)

No change was recorded against any check on this day. Stability & Change Management went from 77 to 80. That category is still filling its 30-day observation window: 23 days of observed history at the previous scan, 24 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-11-04 (score 77, 0)

- [security] Tool “qc_contractor_check” rewrote its description, which is the text the model reads
- [security] Tool “verify_business” rewrote its description, which is the text the model reads
- [functional regression] Schema quality: 2573 → 3020
- [functional improvement] Tool coverage: 48% → 53%
- [functional] New tool “payment_check”
- [functional] New tool “sanctions_check”

### 2026-11-03 (score 77, +1)

No change was recorded against any check on this day. Stability & Change Management went from 70 to 73. That category is still filling its 30-day observation window: 21 days of observed history at the previous scan, 22 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-11-01 (score 76, +1)

No change was recorded against any check on this day. Stability & Change Management went from 63 to 67. That category is still filling its 30-day observation window: 19 days of observed history at the previous scan, 20 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-31 (score 75, 0)

- [security] Tool “company_enrich” rewrote its description, which is the text the model reads
- [security] Tool “verify_business” rewrote its description, which is the text the model reads

### 2026-10-30 (score 75, 0)

- [security] Tool “company_enrich” rewrote its description, which is the text the model reads
- [security] Tool “qc_contractor_check” rewrote its description, which is the text the model reads
- [security] Tool “verify_business” rewrote its description, which is the text the model reads

### 2026-10-29 (score 75, +1)

No change was recorded against any check on this day. Stability & Change Management went from 53 to 57. That category is still filling its 30-day observation window: 16 days of observed history at the previous scan, 17 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-28 (score 74, 0)

- [functional regression] Tool coverage: 54% → 48%
- [functional regression] Schema quality: 1882 → 2347
- [functional] New tool “company_enrich”
- [functional] New tool “company_fit”

## MCP tools (15)

### `pkg_check` (~137 tokens)

Package safety check (npm / PyPI)

Is this package safe to install? One call, one verdict: safe / caution / avoid, with a score, concrete reasons (known vulnerabilities from OSV, deprecation, abandonment, adoption, install scripts, typosquat signals) and a one-line recommendation. Input: name, ecosystem (npm | PyPI), optional version. Free over MCP (100/day shared quota); unlimited via x402 at https://tolca.tonbot.ca/v1/pkg-check ($0.02).

Input parameters:

- `ecosystem` (string, required)
- `name` (string, required): Package name as published
- `version` (string): Exact version; defaults to latest

### `qc_contractor_check` (~236 tokens)

Québec contractor check (RBQ + RENA + environmental penalties + SEAO public contracts)

Call before hiring, paying or subcontracting a Québec (Canada) contractor. One call checks: active RBQ licence (status, categories, restrictions), RENA listing (banned from public contracts), environmental penalties, public contracts awarded on SEAO (count, total, buyers). Verdict ok / review / blocking with reasons and source dates. Every response includes an Ed25519-signed receipt you can verify offline (public key: https://tolca.tonbot.ca/.well-known/tolca-receipt-key.json) or online at /receipts/verify. Keep it as proof of the check if a payment is ever disputed. Input: name, NEQ or RBQ licence number. Official open data. Free over MCP (10/day shared quota); unlimited via x402 at https://tolca.tonbot.ca/v1/qc-contractor-check ($0.1).

Input parameters:

- `lang` (string)
- `licence` (string): RBQ licence number
- `name` (string): Business name, exact or partial
- `neq` (string): Numéro d'entreprise du Québec (10 digits)

### `summarize` (~144 tokens)

Summarize text (up to 40k chars) into a faithful, tight summary, with optional max_words and target language. Pay-per-call over x402 in USDC on Base; payment challenge answered in ~10 ms, 7-day average processing ~1.5 s across Tolca services. Costs $0.03 USDC per call (x402 v2, Base). Send the HTTP header PAYMENT-SIGNATURE with your x402 payment, or call POST https://tolca.tonbot.ca/v1/summarize with an x402 client.

Input parameters:

- `language` (string)
- `max_words` (integer)
- `text` (string, required)

### `translate` (~131 tokens)

Translate text between French (including Quebec French) and English, with optional tone. Pay-per-call over x402 in USDC on Base; payment challenge answered in ~25 ms, 7-day average processing ~1.5 s across Tolca services. Costs $0.04 USDC per call (x402 v2, Base). Send the HTTP header PAYMENT-SIGNATURE with your x402 payment, or call POST https://tolca.tonbot.ca/v1/translate with an x402 client.

Input parameters:

- `target` (string, required)
- `text` (string, required)
- `tone` (string)

### `extract` (~131 tokens)

Turn messy text into clean JSON matching the schema you provide (field names and types). Pay-per-call over x402 in USDC on Base; payment challenge answered in ~5 ms, 7-day average processing ~1.5 s across Tolca services. Costs $0.02 USDC per call (x402 v2, Base). Send the HTTP header PAYMENT-SIGNATURE with your x402 payment, or call POST https://tolca.tonbot.ca/v1/extract with an x402 client.

Input parameters:

- `schema` (object, required): Field name -> type or description
- `text` (string, required)

### `extract_url` (~138 tokens)

extract-url

Fetch a public URL (HTML article, PDF, or JSON) and return JSON matching your schema in one call, with page title and source. Pay-per-call over x402 in USDC on Base; payment challenge answered in ~8 ms. Costs $0.03 USDC per call (x402 v2, Base). Send the HTTP header PAYMENT-SIGNATURE with your x402 payment, or call POST https://tolca.tonbot.ca/v1/extract-url with an x402 client.

Input parameters:

- `max_chars` (integer)
- `schema` (object, required): Field name -> type or description
- `url` (string, required)

### `qc_licence` (~174 tokens)

qc-licence

Cheapest check: does this Québec contractor hold an ACTIVE RBQ licence right now? Returns active true/false, licence number, name, NEQ, city, restriction flag and authorized work categories. Use to vet many contractors fast; use qc-contractor-check for RENA and penalties. Input: name, NEQ or RBQ licence number. Costs $0.01 USDC per call (x402 v2, Base). Send the HTTP header PAYMENT-SIGNATURE with your x402 payment, or call POST https://tolca.tonbot.ca/v1/qc-licence with an x402 client.

Input parameters:

- `licence` (string): RBQ licence number
- `name` (string): Business name, exact or partial
- `neq` (string): Numéro d'entreprise du Québec (10 digits)

### `pkg_meta` (~153 tokens)

pkg-meta

Package metadata in one call, cheapest tier: latest and resolved version, license, first/last publish dates, weekly downloads, deprecation flag, install scripts, maintainers count. npm or PyPI. No vulnerability scan (see pkg-check for the full safe/caution/avoid verdict). Input: name, ecosystem (npm | PyPI), optional version. Costs $0.005 USDC per call (x402 v2, Base). Send the HTTP header PAYMENT-SIGNATURE with your x402 payment, or call POST https://tolca.tonbot.ca/v1/pkg-meta with an x402 client.

Input parameters:

- `ecosystem` (string, required)
- `name` (string, required)
- `version` (string)

### `homework_check` (~218 tokens)

homework-check

Can this homework be done by an AI? For teachers and schools: paste an assignment (or a public PDF URL) and get an overall AI-completion risk 0-100, a per-question breakdown (risk, why, concrete fix to make it AI-resistant) and general tips. No student data. Input: text or url, optional grade, subject, lang fr|en. / Ce devoir peut-il être fait par une IA? Score par question et corrections concrètes pour l'enseignant. Costs $0.25 USDC per call (x402 v2, Base). Send the HTTP header PAYMENT-SIGNATURE with your x402 payment, or call POST https://tolca.tonbot.ca/v1/homework-check with an x402 client.

Input parameters:

- `grade` (string): Grade level, e.g. secondaire 3
- `lang` (string)
- `subject` (string)
- `text` (string): Assignment text
- `url` (string): Public URL of the assignment (PDF or page)

### `verify_business` (~294 tokens)

verify-business

Call before paying, onboarding or contracting a company (KYB). One call checks the US, UK, EU and Canadian sanctions lists (CSL incl. OFAC SDN), company registries (UK Companies House, Canada federal), legal entity status (GLEIF, worldwide) and contractor licences (Quebec, Washington, Oregon). Returns a clear action (allow / review / block), a 0-100 risk score, reasons with dated sources, and an Ed25519-signed receipt you can verify offline (public key: https://tolca.tonbot.ca/.well-known/tolca-receipt-key.json) or online at /receipts/verify. Keep it as proof of the check if a payment is ever disputed. Input: name, optional country (ISO-2) and region (WA, OR, QC). Businesses only. Costs $0.05 USDC per call (x402 v2, Base). Send the HTTP header PAYMENT-SIGNATURE with your x402 payment, or call POST https://tolca.tonbot.ca/v1/verify-business with an x402 client.

Input parameters:

- `country` (string): ISO 3166 alpha-2 country code, e.g. US, CA, GB
- `name` (string, required): Business legal or trade name
- `region` (string): State/province code: WA, OR or QC enables contractor-licence checks

### `web_search` (~265 tokens)

web-search

Search the web and read the top pages in ONE call: 10 results (title, url, snippet, date) plus the clean text of the best pages, with fetch time and sha256. French and Canada by default when the query is French; official-sources mode (governments, registries, courts, laws); freshness filter; site: restriction. No results = HTTP 404 = you are not charged. Input: query, optional read (0-5), official, lang, country, freshness, site. Costs $0.008 USDC per call (x402 v2, Base). Send the HTTP header PAYMENT-SIGNATURE with your x402 payment, or call POST https://tolca.tonbot.ca/v1/web-search with an x402 client.

Input parameters:

- `country` (string): ISO country to prioritize (default CA)
- `freshness` (string)
- `lang` (string)
- `official` (boolean): Only governments, registries, courts, laws
- `query` (string, required): Question or keywords; Brave operators allowed (site:, "exact", -word)
- `read` (integer): Top pages to fetch and return as clean text (default 3)
- `site` (string): Restrict to one domain

### `company_enrich` (~247 tokens)

company-enrich

Company profile from a domain or name in ONE call, for sales and research agents: what the company does, industry, services, service area, address, phones and emails published by the company (each with the page it came from), social links, plus official screening (registries, US, UK, EU and Canadian sanctions lists). Read live from the company's own website, no third-party database. No website found = HTTP 404 = no charge. Input: domain or name, optional city, country, lang (en|fr). Businesses only. Costs $0.02 USDC per call (x402 v2, Base). Send the HTTP header PAYMENT-SIGNATURE with your x402 payment, or call POST https://tolca.tonbot.ca/v1/company-enrich with an x402 client.

Input parameters:

- `city` (string)
- `country` (string): ISO 3166 alpha-2
- `domain` (string): Company website or domain, e.g. acme.com
- `lang` (string)
- `name` (string): Company name, used to find the website when no domain is given
- `official_checks` (boolean)

### `company_fit` (~223 tokens)

company-fit

Is this company worth contacting FOR YOU? Everything in company-enrich, plus a fit verdict for your offer and goal: good / maybe / poor, a 0-100 score, reasons grounded in facts from the company's website, and an opening line that references one of those facts. Input: domain or name, plus for: { seller (who you are and what you sell), goal (sales | partnership | supplier | hiring | investment | other), optional ideal_customer }. No website found = no charge. Costs $0.03 USDC per call (x402 v2, Base). Send the HTTP header PAYMENT-SIGNATURE with your x402 payment, or call POST https://tolca.tonbot.ca/v1/company-fit with an x402 client.

Input parameters:

- `city` (string)
- `country` (string)
- `domain` (string): Company website or domain, e.g. acme.com
- `for` (object, required)
- `lang` (string)
- `name` (string)
- `official_checks` (boolean)

### `payment_check` (~281 tokens)

payment-check

Check an x402 payment request before your agent pays it. One call screens the payTo address against official sanctions lists (OFAC SDN digital currency addresses), checks that the asset is the official USDC contract and the network is Base, compares the price with the seller's Bazaar catalogue listing and, with seller_name, screens the company against US, UK, EU and Canadian sanctions lists. Returns allow / review / block with reasons, the hash of the exact invoice checked and an Ed25519-signed receipt valid 10 minutes. Keep it as proof of the check if a payment is ever disputed. Input: requirements (one entry of the 402 accepts array) or payment_required (the full 402 body), optional seller_name and seller_country. Costs $0.01 USDC per call (x402 v2, Base). Send the HTTP header PAYMENT-SIGNATURE with your x402 payment, or call POST https://tolca.tonbot.ca/v1/payment-check with an x402 client.

Input parameters:

- `payment_required` (object): Or the full 402 response body
- `requirements` (object): One entry of the accepts array from the seller's 402 response
- `seller_country` (string): Optional ISO-2 country code of the seller
- `seller_name` (string): Optional: seller company name, screened against sanctions lists

### `sanctions_check` (~248 tokens)

sanctions-check

Sanctions screening only, cheapest tier: is this company on an official sanctions list? One call checks the US Consolidated Screening List (incl. OFAC SDN), the UK Sanctions List, the EU consolidated financial sanctions list and the Consolidated Canadian Autonomous Sanctions List (UN designations included as implemented by the UK and the EU), each refreshed daily. Returns a clear action (allow / review / block), a 0-100 risk score, matches with the official list references and the date of each list copy. Companies only. Every response includes an Ed25519-signed receipt, verifiable with the public key at /.well-known/tolca-receipt-key.json. Keep it as proof of the check if a payment is ever disputed. Input: name, optional country. Costs $0.01 USDC per call (x402 v2, Base). Send the HTTP header PAYMENT-SIGNATURE with your x402 payment, or call POST https://tolca.tonbot.ca/v1/sanctions-check with an x402 client.

Input parameters:

- `country` (string): Optional ISO-2 country code
- `name` (string, required): Person or company name to screen

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/ca-tonbot-tolca-tolca/tolca#diagnostics

## Score history

- 2026-11-05: 78
- 2026-11-04: 77
- 2026-11-03: 77
- 2026-11-02: 76
- 2026-11-01: 76
- 2026-10-31: 75
- 2026-10-30: 75
- 2026-10-29: 75
- 2026-10-28: 74
- 2026-10-27: 74
- 2026-10-26: 74
- 2026-10-25: 73
- 2026-10-24: 73
- 2026-10-23: 72
- 2026-10-22: 72
- 2026-10-21: 71
- 2026-10-20: 71
- 2026-10-19: 70
- 2026-10-18: 70
- 2026-10-17: 70
- 2026-10-16: 69
- 2026-10-15: 68
- 2026-10-14: 61
- 2026-10-13: 60
- 2026-10-12: 60

## Common questions

### What is the ca.tonbot.tolca/tolca MCP server?

ca.tonbot.tolca/tolca is an MCP server listed in the public MCP registry as ca.tonbot.tolca/tolca. Verify a company before paying it: OFAC sanctions, UK/Canada registries, contractor licences (x402). This page covers its hosted endpoint (https://tolca.tonbot.ca/mcp).

### Is the ca.tonbot.tolca/tolca MCP server safe to use?

ca.tonbot.tolca/tolca scores 78 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the ca.tonbot.tolca/tolca MCP server expose?

ca.tonbot.tolca/tolca exposes 15 tools: pkg_check, qc_contractor_check, summarize, translate, extract, and 10 more. Their descriptions and schemas cost roughly 3,020 tokens of context every time the server is loaded.

### Does the ca.tonbot.tolca/tolca MCP server require authentication?

No. We connected to ca.tonbot.tolca/tolca without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

### Is the ca.tonbot.tolca/tolca MCP server still maintained?

ca.tonbot.tolca/tolca is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Remote endpoint: https://tolca.tonbot.ca/mcp
- Website: https://tolca.tonbot.ca/
- Changelog RSS feed: https://verifymcp.io/servers/ca-tonbot-tolca-tolca/tolca.xml
- Changelog JSON feed: https://verifymcp.io/servers/ca-tonbot-tolca-tolca/tolca.json
- HTML version of this page: https://verifymcp.io/servers/ca-tonbot-tolca-tolca/tolca