Toolcall
REMOTE · TOOLCALL.CLICK · SCANNED SEP 20
30 pay-per-call APIs for AI agents: compliance, trade, safety, web, data. USDC on Base via x402.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security46
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation not fully verified: no authorisation is required to call this server, and 22 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe. See how to fix → View diagnostics → Unverified
- HTTPS enforcement could not be verified: the plaintext port answered with HTTP 405, which proves neither a plaintext path nor enforcement. View diagnostics → Unverified
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability77
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 2748 tokens (~124/item across 22 items; 22 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage99
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 98% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 22 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 23 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the Toolcall MCP server?
Toolcall is a hosted endpoint at https://toolcall.click/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · toolcall.click
claude mcp add --transport http click-toolcall-toolcall 'https://toolcall.click/mcp'
{
"mcpServers": {
"click-toolcall-toolcall": {
"url": "https://toolcall.click/mcp"
}
}
} {
"servers": {
"click-toolcall-toolcall": {
"type": "http",
"url": "https://toolcall.click/mcp"
}
}
} [mcp_servers.click-toolcall-toolcall] url = "https://toolcall.click/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"click-toolcall-toolcall": {
"type": "remote",
"url": "https://toolcall.click/mcp",
"enabled": true
}
}
} openclaw mcp add click-toolcall-toolcall --url 'https://toolcall.click/mcp' --transport streamable-http
mcp_servers:
click-toolcall-toolcall:
url: "https://toolcall.click/mcp" {
"McpServers": {
"click-toolcall-toolcall": {
"Transport": "http",
"Url": "https://toolcall.click/mcp"
}
}
} assistant mcp add click-toolcall-toolcall -t streamable-http -u 'https://toolcall.click/mcp'
{
"mcpServers": {
"click-toolcall-toolcall": {
"type": "http",
"url": "https://toolcall.click/mcp"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 10 Sept 26 +4
- Stability: fail → pass ▲ security
- 7 Sept 26 0
- Tool “tech-stack” rewrote its description, which is the text the model reads security
- Tool “web-history” rewrote its description, which is the text the model reads security
- 26 Aug 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 25 Aug 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 70 to 73.
- 23 Aug 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 63 to 66.
- 11 Aug 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 31 Jul 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 28 Jul 26 0
- Tool “company-verify” rewrote its description, which is the text the model reads security
- Tool “crypto-spot” rewrote its description, which is the text the model reads security
- Tool “legal-cases” rewrote its description, which is the text the model reads security
- Tool “med-device” rewrote its description, which is the text the model reads security
- Tool “med-drug” rewrote its description, which is the text the model reads security
- Tool “pdf-extract” rewrote its description, which is the text the model reads security
- Tool “recall-check” rewrote its description, which is the text the model reads security
- Tool “sanctions-screen” rewrote its description, which is the text the model reads security
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Probed https://toolcall.click/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=toolcall.click | CN=WE1,O=Google Trust Services,C=US | 13 Sept 2026 | 12 Dec 2026 | ECDSA 256 | ECDSA-SHA256 | da5891f5d4876b34139e920499fd55d3 |
| SANs: toolcall.click, *.toolcall.click | ||||||
| CN=WE1,O=Google Trust Services,C=US (CA) | CN=GTS Root R4,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | ECDSA 256 | ECDSA-SHA384 | 7ff31977972c224a76155d13b6d685e3 |
| CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 15 Nov 2023 | 28 Jan 2028 | ECDSA 384 | SHA256-RSA | 7fe530bf331343bedd821610493d8a1b |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of toolcall.click. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| click. | present | 65517 | 13 | Verified |
| toolcall.click. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://toolcall.click/mcp | Verified | 200 | |
| http (plaintext) | http://toolcall.click/mcp | Inconclusive | 405 |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
brand-visibility ~127
See what AI models say about a brand right now. Runs category and reputation prompts across multiple AI engines (one web-grounded), then reports whether the brand is mentioned, its position vs competitors, sentiment, the exact descriptors used, gaps, and concrete recommendations. JSON report. [Paid: $0.25 USDC per call via x402 on Base; the calling client pays automatically.]
| Name | Type | Req | Description |
|---|---|---|---|
| brand | string | yes | Brand or product name |
| category | string | – | Market category for best-of prompts, optional |
| domain | string | – | Brand website, optional, improves accuracy |
No output schema declared.
No examples provided.
chem-compat ~133
Can chemical A be safely mixed or stored with chemical B? Pass two CAS numbers or names. Returns a verdict (incompatible / caution / no_known_hazard), the reason, expected effects (gas evolution, heat, fire, toxic fumes) and confidence, from expert reasoning over PubChem GHS data and CAMEO-derived reactivity profiles. JSON response. [Paid: $0.03 USDC per call via x402 on Base; the calling client pays automatically.]
| Name | Type | Req | Description |
|---|---|---|---|
| a | string | yes | First chemical: CAS number or name |
| b | string | yes | Second chemical: CAS number or name |
No output schema declared.
No examples provided.
chem-safety ~147
Full safety profile for any chemical by CAS number or name: GHS hazard classification (signal word, pictograms, H-statements, P-codes), first-aid measures for inhalation/skin/eye/ingestion, fire-fighting guidance, UN transport number, PPE, and CAMEO reactivity profile. Sourced live from PubChem (NIH) authoritative annotations. JSON response. [Paid: $0.03 USDC per call via x402 on Base; the calling client pays automatically.]
| Name | Type | Req | Description |
|---|---|---|---|
| cas | string | – | CAS registry number, e.g. 7681-52-9 |
| name | string | – | Chemical name, alternative to cas |
No output schema declared.
No examples provided.
crypto-gas ~69
Current gas price and latest block for Base or Ethereum mainnet, straight from public RPC. Fresh within 15 seconds. JSON response. [Paid: $0.002 USDC per call via x402 on Base; the calling client pays automatically.]
| Name | Type | Req | Description |
|---|---|---|---|
| chain | string | yes | Chain to query |
No output schema declared.
No examples provided.
domain-check ~103
Due-diligence check on any domain: registration age via RDAP, registrar, DNS posture (A/MX/NS), SPF and DMARC presence, SSL certificate history, and risk flags like newly-registered or no-mail-setup. One call, one JSON verdict. [Paid: $0.008 USDC per call via x402 on Base; the calling client pays automatically.]
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | Domain to check, e.g. example.com |
No output schema declared.
No examples provided.
email-validate ~100
Email verification and deliverability check without sending anything: syntax, MX records, disposable-domain detection (121k+ known domains), role-account and free-provider flags. JSON verdict with a bounce/deliverability risk level. Validate emails for signup fraud prevention, list hygiene and lead qualification. [Paid: $0.004 USDC per call via x402 on Base; the calling client pays automatically.]
| Name | Type | Req | Description |
|---|---|---|---|
| string | yes | Email address to validate |
No output schema declared.
No examples provided.
fx-rates ~86
Foreign exchange reference rates from the European Central Bank. Base currency plus optional symbols filter. Updated daily on ECB schedule. JSON response. [Paid: $0.002 USDC per call via x402 on Base; the calling client pays automatically.]
| Name | Type | Req | Description |
|---|---|---|---|
| base | string | – | Base currency code, default USD |
| symbols | string | – | Comma-separated target currency codes, optional |
No output schema declared.
No examples provided.
holidays ~152
Public holidays for any country and year, plus optional business-day checking. Pass country= (ISO alpha-2) and year=; add date= to learn whether that day is a business day, whether it is a weekend or public holiday, the holiday name, and the next business day. Covers 100+ countries. JSON response. [Paid: $0.01 USDC per call via x402 on Base; the calling client pays automatically.]
| Name | Type | Req | Description |
|---|---|---|---|
| country | string | yes | ISO 3166 alpha-2 country code, e.g. US, GB, DE |
| date | string | – | YYYY-MM-DD to run a business-day check, optional |
| year | integer | – | Year, default current |
No output schema declared.
No examples provided.
hs-classify ~142
Classify any product to its HS / HTS customs code from a plain-English description. Expert LLM classification grounded in the live official USITC Harmonized Tariff Schedule: returns the 10-digit HTS code, international HS6, official description path, US duty rate (general + special programs), confidence, reasoning and alternates. JSON response. [Paid: $0.04 USDC per call via x402 on Base; the calling client pays automatically.]
| Name | Type | Req | Description |
|---|---|---|---|
| desc | string | yes | Plain-English product description, max 500 chars |
| dest | string | – | Destination country ISO code, default US (duty shown is US MFN) |
No output schema declared.
No examples provided.
job-search ~152
Live job postings without scraping: company= returns an employer's current openings straight from their official ATS board (Greenhouse, Lever, Ashby, SmartRecruiters) with title, location, department, type and apply URL; query= searches remote-heavy job APIs (Remotive, Arbeitnow) by keyword. Optional location= filter. JSON response. [Paid: $0.02 USDC per call via x402 on Base; the calling client pays automatically.]
| Name | Type | Req | Description |
|---|---|---|---|
| company | string | – | Employer name; reads their public ATS job board |
| limit | integer | – | – |
| location | string | – | Location filter substring, optional |
| query | string | – | Keyword search across job APIs, alternative to company |
No output schema declared.
No examples provided.
local-search ~184
Find local businesses and places by category and location: pharmacies, restaurants, hotels, plumbers, lawyers, gyms and 40+ more categories, or any name keyword. Pass what= plus city= (geocoded automatically) or lat=&lon= with a radius. Returns name, category, address, phone, website, opening hours and coordinates from OpenStreetMap. JSON response. [Paid: $0.02 USDC per call via x402 on Base; the calling client pays automatically.]
| Name | Type | Req | Description |
|---|---|---|---|
| city | string | – | City or place name, geocoded automatically |
| lat | number | – | Latitude, alternative to city |
| lon | number | – | Longitude, alternative to city |
| radius | integer | – | Search radius in meters, default 5000 |
| what | string | yes | Business category (pharmacy, plumber, hotel...) or name keyword |
No output schema declared.
No examples provided.
news-search ~99
Recent news headlines for any company, topic or query: deduplicated titles with source, link and publish date from a broad news index. Window configurable 1-30 days. JSON response. [Paid: $0.01 USDC per call via x402 on Base; the calling client pays automatically.]
| Name | Type | Req | Description |
|---|---|---|---|
| days | integer | – | Lookback window in days, default 7 |
| q | string | yes | Search query, company or topic |
No output schema declared.
No examples provided.
package-check ~157
Is this dependency safe to use? Pass a package name (npm, PyPI, Go, Maven, crates.io, RubyGems, NuGet) and optional version: returns known vulnerabilities (OSV/CVE with CVSS and fixed-in version), deprecation status, license, latest version, repo health (stars, OpenSSF Scorecard) and an overall ok/caution/avoid verdict. JSON response. [Paid: $0.01 USDC per call via x402 on Base; the calling client pays automatically.]
| Name | Type | Req | Description |
|---|---|---|---|
| eco | string | – | Ecosystem, default npm |
| name | string | yes | Package name, e.g. express or @scope/pkg |
| version | string | – | Version to check, default latest |
No output schema declared.
No examples provided.
part-lookup ~141
Everything about an electronic component from its manufacturer part number: live distributor stock and price breaks across DigiKey, Mouser, Farnell, RS, Arrow and more, lifecycle status, MOQ, packaging, lead times, datasheet link, key specs and drop-in alternates. Optional country= for regional pricing. One call instead of checking each distributor. JSON response. [Paid: $0.04 USDC per call via x402 on Base; the calling client pays automatically.]
| Name | Type | Req | Description |
|---|---|---|---|
| country | string | – | ISO country for regional pricing, default US |
| mpn | string | yes | Manufacturer part number, e.g. LM358MX/NOPB |
No output schema declared.
No examples provided.
product-barcode ~133
Full product truth from an EAN/UPC barcode: name, brand, quantity, categories, complete ingredients, allergens, additives, nutrition per 100g, Nutri-Score / NOVA / Eco-Score, packaging materials with recycling info, plus any linked CPSC or FDA recall for the same barcode. Covers food, general products and cosmetics (Open Food/Products/Beauty Facts). JSON response. [Paid: $0.02 USDC per call via x402 on Base; the calling client pays automatically.]
| Name | Type | Req | Description |
|---|---|---|---|
| ean | string | yes | EAN/UPC barcode, 8-14 digits |
No output schema declared.
No examples provided.
reader ~104
Turn any public web page, including JavaScript-heavy ones, into clean readable markdown (or text/html) with title and byline. Rendered by a real browser then stripped to the main content. Ideal for feeding pages to LLMs. JSON response. [Paid: $0.006 USDC per call via x402 on Base; the calling client pays automatically.]
| Name | Type | Req | Description |
|---|---|---|---|
| format | string | – | Output format, default markdown |
| url | string | yes | Public page URL |
No output schema declared.
No examples provided.
screenshot ~110
Full-fidelity screenshot of any public web page, captured by a real Chrome browser. Viewport or full-page, configurable width. Returns a base64 PNG. JSON response. [Paid: $0.015 USDC per call via x402 on Base; the calling client pays automatically.]
| Name | Type | Req | Description |
|---|---|---|---|
| full | string | – | 1 for full-page, else viewport |
| url | string | yes | Public page URL |
| width | integer | – | Viewport width 320-2000, default 1280 |
No output schema declared.
No examples provided.
sec-financials ~123
Key financials for any US-listed company by ticker, straight from SEC EDGAR XBRL filings: latest annual revenue, gross profit, operating and net income, total assets, liabilities, stockholders equity, cash and diluted EPS, plus up to 5 years of history for each. Official as-reported 10-K figures. Pass ticker=. JSON response. [Paid: $0.03 USDC per call via x402 on Base; the calling client pays automatically.]
| Name | Type | Req | Description |
|---|---|---|---|
| ticker | string | yes | US-listed ticker symbol, e.g. AAPL |
No output schema declared.
No examples provided.
tech-stack ~119
Detect the technologies a website runs: CMS (WordPress, Shopify, Webflow...), JS framework (Next.js, React, Vue, Angular...), analytics and marketing tools, payments, CDN, hosting, server, language, UI libraries and fonts. Plus server header, generator meta and security-header posture. Pass url= or domain=. Signature-based from the live homepage. JSON response. [Paid: $0.01 USDC per call via x402 on Base; the calling client pays automatically.]
| Name | Type | Req | Description |
|---|---|---|---|
| url | string | yes | URL or domain to fingerprint |
No output schema declared.
No examples provided.
web-history ~121
The archived history of any website from the Internet Archive Wayback Machine: first-seen date, last-seen date, total snapshots, how many distinct versions the page went through, and a timeline of snapshot links (one per month). Great for domain due-diligence, brand history and change tracking. JSON response. [Paid: $0.01 USDC per call via x402 on Base; the calling client pays automatically.]
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Max snapshots, default 25 |
| url | string | yes | URL or domain to look up |
No output schema declared.
No examples provided.
web-search ~90
Keyless web search for agents: pass a query, get a concise web-grounded answer plus the top source results (title, URL, snippet). Live web access, no API key or account needed. JSON response. [Paid: $0.008 USDC per call via x402 on Base; the calling client pays automatically.]
| Name | Type | Req | Description |
|---|---|---|---|
| q | string | yes | Search query, 1-300 chars |
No output schema declared.
No examples provided.
youtube-transcript ~87
Full plain-text transcript of a YouTube video, de-duplicated and cleaned from the captions. Accepts a video id or URL. Ideal for feeding video content to LLMs. JSON response. [Paid: $0.01 USDC per call via x402 on Base; the calling client pays automatically.]
| Name | Type | Req | Description |
|---|---|---|---|
| v | string | yes | YouTube video id or full URL |
No output schema declared.
No examples provided.
What is the Toolcall MCP server?
Toolcall is an MCP server listed in the public MCP registry as click.toolcall/toolcall. 30 pay-per-call APIs for AI agents: compliance, trade, safety, web, data. USDC on Base via x402. This page covers its hosted endpoint (https://toolcall.click/mcp).
Is the Toolcall MCP server safe to use?
Toolcall scores 74 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Toolcall MCP server expose?
Toolcall exposes 22 tools: crypto-gas, fx-rates, domain-check, email-validate, news-search, and 17 more. Their descriptions and schemas cost roughly 2,679 tokens of context every time the server is loaded.
Does the Toolcall MCP server require authentication?
No. We connected to Toolcall without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the Toolcall MCP server still maintained?
Toolcall is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.