Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

Johto Data

REMOTE · JOHTO-X402-API.JOHTODATA.WORKERS.DEV

Johto Data: pay-per-call company, compliance and filings data via x402. Free sample on every tool.

65 Trust /100

Last scanned (5 hours ago)

Scores higher than 43% of remote servers

Reachable. Last reached 26 Oct 2026.

Category Security

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →

Endpoint Security63
Transport & Reachability100
Schema Quality & AI Usability63
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 4410 tokens (~315/item across 14 items; 14 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management13
  • Stability observed for 4 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • We read all 14 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
  • An AI judge read all 15 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities60
  • Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28. See how to fix → Fail
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 26 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 10 to 13. That category is still filling its 30-day observation window: 3 days of observed history at the previous scan, 4 at this one. The score rises as the window fills, whether or not the server changes.

  • 24 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.

  • 23 Oct 26 0
    • The server rewrote its instructions, which are the text every model session reads security
    • Tool “crawl” rewrote its description, which is the text the model reads security
    • Tool “jobs” rewrote its description, which is the text the model reads security
    • Tool “jp-invoice-check” rewrote its description, which is the text the model reads security
    • Tool “kyb” rewrote its description, which is the text the model reads security
    • Tool “read” rewrote its description, which is the text the model reads security
    • Tool “sanctions-screen” rewrote its description, which is the text the model reads security
    • Tool “sec-13f” rewrote its description, which is the text the model reads security
    • Tool “sec-8k” rewrote its description, which is the text the model reads security
    • Tool “wallet-risk” rewrote its description, which is the text the model reads security
    • Schema quality: 3093 → 4410 ▼ functional
    • Stability: unverified → 0.03 ▲ functional
    • New tool “au-contracts” functional
    • New tool “domain-profile” functional
    • New tool “fr-tenders” functional
    • New tool “tenders” functional
    • New tool “uk-tenders” functional
    • “crawl” reworded the description of “sample” cosmetic
    • “jobs” reworded the description of “sample” cosmetic
    • “jp-invoice-check” reworded the description of “sample” cosmetic
    • “kyb” reworded the description of “sample” cosmetic
    • “read” reworded the description of “sample” cosmetic
    • “sanctions-screen” reworded the description of “sample” cosmetic
    • “sec-13f” reworded the description of “sample” cosmetic
    • “sec-8k” reworded the description of “sample” cosmetic
    • “wallet-risk” reworded the description of “sample” cosmetic
  • 22 Oct 26 63

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 26 Oct 2026 · Probed https://johto-x402-api.johtodata.workers.dev/mcp

TLS valid

Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .

Subject Issuer Valid from Valid until Key Signature Serial
CN=johtodata.workers.dev CN=YE2,O=Let's Encrypt,C=US 22 Oct 2026 20 Jan 2027 ECDSA 256 ECDSA-SHA384 537a113c8214f1a1d632bec23b4e50616e2
SANs: *.johtodata.workers.dev, johtodata.workers.dev
CN=YE2,O=Let's Encrypt,C=US (CA) CN=Root YE,O=ISRG,C=US 3 Sept 2025 2 Sept 2028 ECDSA 384 ECDSA-SHA384 4df3b15dd6c0784c507cd37b58e6f115
CN=Root YE,O=ISRG,C=US (CA) CN=ISRG Root X2,O=Internet Security Research Group,C=US 13 May 2026 2 Sept 2032 ECDSA 384 ECDSA-SHA384 872165fc34b6e5fba8add5b3705fb53a
CN=ISRG Root X2,O=Internet Security Research Group,C=US (CA) CN=ISRG Root X1,O=Internet Security Research Group,C=US 13 May 2026 2 Sept 2032 ECDSA 384 SHA256-RSA 6c8f1dc727c7117f7baf853ac980f9cd

Background: What to check on a remote MCP endpoint →

DNSSEC insecure

Validation of johto-x402-api.johtodata.workers.dev. — Not signed

Zone DS Keys Algorithms Outcome
. trust_anchor 20326, 38696 8, 8 Verified
dev. present 60074 8 Verified
workers.dev. absent Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation
Authentication No authorisation required

The endpoint answered without asking for a token. Anyone who knows the URL can reach it.

Result No authorisation required
HTTP status 200

Background: How OAuth 2.1 works in the 2026 MCP spec →

Transports 2 probes
Transport URL Outcome Status Location
streamable-http https://johto-x402-api.johtodata.workers.dev/mcp Verified 200
http (plaintext) http://johto-x402-api.johtodata.workers.dev/mcp Inconclusive 405
MCP tools · 14 exposed · ~4,331 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
au-contracts ~248

$0.035 per call. Up to 25 Australian federal contract notices (awarded contracts) from AusTender, read live for each call, by publish date range. Returns title, buying agency, published date, contract value in AUD, UNSPSC code, procurement method, notice URL and next_cursor. Supplier names are not included. No charge when nothing matches or the source fails. Use when: you need recent Australian federal contract awards by agency, value and UNSPSC category for market sizing or account research. Don't use when: you need open tenders you can still bid on, supplier names, contact people, or state and local government contracts. Price: $0.035 per call over x402 (USDC on Base). Set sample:true for a sample at no charge.

NameTypeReqDescription
cursorstring–next_cursor from a previous response
limitstring–Notices 1-25 (default 25)
sampleboolean–true: return the sample at no charge (no payment, other arguments ignored)
sincestring–Published on or after, YYYY-MM-DD
untilstring–Published on or before, YYYY-MM-DD

No output schema declared.

No examples provided.

crawl ~249

Crawl up to 20 pages under a start URL into Markdown: url, HTTP status, title, description, markdown, token estimate, content hash, truncated flag, depth and load time per page. Not charged if no page is read. ?url=https://docs.example.com&pages=20&max_chars=20000 Use when: you need a docs site or one section of a site (up to 20 pages under a start URL) as Markdown. Don't use when: you need a single page (use /v1/read), more than 20 pages, pages outside the start URL path, or content behind a login or paywall. Price: $0.05 per call over x402 (USDC on Base). Set sample:true for a sample at no charge.

NameTypeReqDescription
max_charsstring–Max Markdown characters per page, 500-20000 (default 20000)
pagesstring–Max pages, 1-20 (default 20)
sampleboolean–true: return the sample at no charge (no payment, other arguments ignored)
urlstringyesStart URL, http(s). Only pages under it are crawled.

No output schema declared.

No examples provided.

domain-profile ~315

$0.03 per call. Profile of one domain in one call: A, AAAA, MX, NS and CAA records, parsed SPF and DMARC, DKIM selector hints, mail provider, DNS provider, hosting or CDN, services verified in TXT records, homepage status and title, tech stack from homepage headers and HTML, TLS certificate issuer and expiry, and posture flags. Domains that do not exist, or DNS failures, return an error and are not charged. Invalid, IP or private names return 400, not charged. robots.txt is respected for the homepage. Sample at no charge: ?sample=1. DNS lookups via Cloudflare 1.1.1.1. Homepage and TLS certificate read directly from the domain. ?domain=example.com Use when: you want one call that profiles a company or vendor domain: mail provider and SPF/DMARC posture, DNS and hosting providers, tech stack and TLS expiry, for lead enrichment, vendor checks or deliverability triage. Don't use when: you need raw DNS records of arbitrary types, WHOIS or registrar data, subdomain enumeration, full certificate chains, many pages of a site, or a security audit. Price: $0.03 per call over x402 (USDC on Base). Set sample:true for a sample at no charge.

NameTypeReqDescription
domainstringyesOne domain name, e.g. example.com
sampleboolean–true: return the sample at no charge (no payment, other arguments ignored)

No output schema declared.

No examples provided.

fr-tenders ~253

$0.06 per call. Up to 25 newest French tender notices from BOAMP, read live for each call, filterable by département and keyword. Returns title, buyer organisation, published and deadline dates, descriptors, procedure, notice type and notice URL (value is not included). No charge when nothing matches or the source fails. Use when: you need fresh French tender notices (marchés publics) by département or keyword to find bid opportunities. Don't use when: you need contract values, contact people, award winners, full tender documents, or notices from outside France. Price: $0.06 per call over x402 (USDC on Base). Set sample:true for a sample at no charge.

NameTypeReqDescription
deptstring–Département code, e.g. 75
limitstring–Notices 1-25 (default 25)
offsetstring–Rows to skip, 0-9900
qstring–Keyword in the title, 2-60 characters
sampleboolean–true: return the sample at no charge (no payment, other arguments ignored)
sincestring–Published on or after, YYYY-MM-DD

No output schema declared.

No examples provided.

jobs ~276

Open jobs from named Lever boards, up to 25 per call: title, location, remote flag, published salary range, employment type, posted date, apply URL. Not charged if no job matches. ?companies=lever:zoox&title=engineer&days=7&remote=1&limit=25 Use when: you need current open roles at named companies that hire through Lever, with salary ranges where the employer publishes them. Don't use when: you need a keyword search across all employers, boards on other hiring systems, or candidate profiles. Price: $0.10 per call over x402 (USDC on Base). Set sample:true for a sample at no charge.

NameTypeReqDescription
companiesstringyes1-20 Lever boards, comma-separated: lever:slug or https://jobs.lever.co/slug
daysstring–Posted within N days, 1-365 (optional)
limitstring–Jobs 1-25 (default 25)
locationstring–Comma list; location contains any (optional)
remotestring–1 = remote only
sampleboolean–true: return the sample at no charge (no payment, other arguments ignored)
titlestring–Comma list; title contains any (optional)

No output schema declared.

No examples provided.

jp-invoice-check ~467

$0.02 per call. Status of one Japanese qualified-invoice issuer registration number (適格請求書発行事業者 登録番号, T + 13 digits) for corporations (法人): registration_number, status (registered, cancelled, expired, not_found), name, registration_date, update_date, cancel_date and expire_date when set, prefecture of the head office, data_as_of and source. Batch: POST {"numbers":[...]} with up to 1000 numbers at $0.012 per unique number; the price is set from the count before payment. Data as of 2026-10-21, from the National Tax Agency bulk download files (full monthly file plus daily diff files). Sole-proprietor registrations are not covered and return not_found. Sample at no charge: ?sample=1 (25 rows). Invalid numbers (format or check digit) return 400, not charged. Data not loaded returns 503, not charged. 出典:国税庁適格請求書発行事業者公表サイト(国税庁)(https://www.invoice-kohyo.nta.go.jp/)。国税庁適格請求書発行事業者公表サイト(国税庁)(https://www.invoice-kohyo.nta.go.jp/)を加工して作成。Johto Data作成。国が作成したものではありません。 ?t=T1180301018771 Use when: you need to confirm that a Japanese corporate supplier's invoice registration number (T-number) is valid, cancelled or expired before paying an invoice or claiming input tax credit, one at a time or in batches of up to 1,000. Don't use when: you need sole-proprietor (個人事業者) registrations, the full address, the 法人番号 register itself, credit or financial data, or tax advice. Price: $0.02 per call over x402 (USDC on Base). Set sample:true for a sample at no charge.

NameTypeReqDescription
sampleboolean–true: return the sample at no charge (no payment, other arguments ignored)
tstringyesRegistration number, T + 13 digits

No output schema declared.

No examples provided.

kyb ~262

Company verification from GLEIF LEI and SEC EDGAR: LEI status, registration number, jurisdiction, direct/ultimate parent, CIK, ticker, EIN, SIC, last filing. Up to 10 rows. Pass one of name, lei, ticker or cik. Not charged if nothing matches. ?name=Tesla, Inc. Use when: you need to confirm a company's legal identity (LEI, registration number, jurisdiction, parents, SEC CIK and ticker) before onboarding or a deal. Don't use when: you need data on people, credit scores, financial statements or sanctions screening. Price: $0.03 per call over x402 (USDC on Base). Set sample:true for a sample at no charge.

NameTypeReqDescription
cikstring–SEC CIK, digits
countrystring–ISO-2 filter for GLEIF matches, e.g. US
leistring–20-character LEI
namestring–Company legal name; top 3 GLEIF matches plus SEC listed-company match
sampleboolean–true: return the sample at no charge (no payment, other arguments ignored)
tickerstring–US ticker, e.g. TSLA

No output schema declared.

No examples provided.

read ~215

Read one web page as Markdown: url, HTTP status, title, markdown, token estimate and content hash. One http(s) URL per call. Not charged if the page fails. Caller is responsible for the target site's terms. robots.txt is respected. ?url=https://...&max_chars=20000 Use when: you need one web page as clean Markdown for an LLM or RAG pipeline. Don't use when: you need many pages from one site (use /v1/crawl), or the page needs a login or sits behind a paywall. Price: $0.02 per call over x402 (USDC on Base). Set sample:true for a sample at no charge.

NameTypeReqDescription
max_charsstring–Max characters of Markdown to return, 1-100000 (default 20000)
sampleboolean–true: return the sample at no charge (no payment, other arguments ignored)
urlstring–One http(s) page URL (required). No commas or lists.

No output schema declared.

No examples provided.

sanctions-screen ~495

$0.025 per call. Screen one person or entity name against the OFAC SDN and UK Sanctions List. Returns verdict (MATCH, POSSIBLE_MATCH, CLEAR), query, and up to 20 matches with name matched, primaryName, list, listId, entityType, programs or regimes, score 0-1, matchType (exact, alias, fuzzy), dob and nationality where listed (OFAC SDN entries; UK Sanctions List entries are names-only), plus listsChecked, listsAsOf and fetchedAt. Fuzzy matching handles typos, word order, diacritics and company suffixes. Optional filters: type, dob, country, threshold, limit. Snapshots: OFAC SDN list 2026-10-21, UK Sanctions List 2026-10-16. A CLEAR verdict is a full answer and is charged. Sample at no charge: ?sample=1. Invalid input returns 400, not charged. A screening aid, not legal advice. Contains public sector information licensed under the Open Government Licence v3.0. ?name=Bank Rossiya&type=any&threshold=0.85&limit=10 Use when: you need to check a counterparty, customer or supplier name against the OFAC SDN and UK Sanctions List before onboarding, paying or shipping. Don't use when: you need any list other than the OFAC SDN and UK Sanctions List, wallet addresses (use /v1/wallet-risk), adverse media, politically exposed persons, ownership data, or a legal determination. Price: $0.025 per call over x402 (USDC on Base). Set sample:true for a sample at no charge.

NameTypeReqDescription
countrystring–ISO-2 country code, e.g. RU
dobstring–Date of birth, YYYY or YYYY-MM-DD
limitstring–Matches 1-20, best first (default 10)
namestringyesPerson or entity name, 2-200 characters
sampleboolean–true: return the sample at no charge (no payment, other arguments ignored)
thresholdstring–Minimum score to return, 0.70-1.00 (default 0.85)
typestring–person, entity (organizations, vessels, aircraft) or any (default any)

No output schema declared.

No examples provided.

sec-13f ~469

$0.03 per call. 13F-HR holdings for one institutional filer (fund or manager), top positions by value, up to 100 per call (offset pages through the rest): filerName, filerCik, reportDate, filedAt, accessionNumber, and per holding issuer, cusip, titleOfClass, valueUsd, shares, sharesType, putCall, investmentDiscretion, votingSole, votingShared, votingNone and pctOfPortfolio, plus portfolio total and fetchedAt. Newest report period by default; pick any 13F-HR or 13F-HR/A with accession. Pass exactly one of cik or ticker. Sample at no charge: ?sample=1. Not charged if nothing matches or SEC EDGAR is unavailable. Invalid input returns 400, not charged. The largest filers are served from a stored snapshot (snapshotAsOf gives its time); other very large filers may return 503 (not charged). ?cik=1067983&limit=25 Use when: you need what a fund or investment manager reported holding at quarter end: positions by CUSIP with value, shares, put/call and voting authority, ranked by value. Don't use when: you need intra-quarter trades, insider Form 4 trades, short positions, holdings not reported on 13F (non-US listings, most bonds, cash), or ticker symbols for each position (13F reports CUSIPs). Price: $0.03 per call over x402 (USDC on Base). Set sample:true for a sample at no charge.

NameTypeReqDescription
accessionstring–13F-HR or 13F-HR/A accession number of this filer
cikstring–Filer SEC CIK, 1-10 digits (pass cik or ticker, not both)
limitstring–Holdings 1-100, largest by value first (default 25)
offsetstring–Holdings to skip, for paging (default 0)
sampleboolean–true: return the sample at no charge (no payment, other arguments ignored)
tickerstring–Filer ticker, e.g. BRK-B (pass cik or ticker, not both)

No output schema declared.

No examples provided.

sec-8k ~354

$0.03 per call. Recent 8-K and 8-K/A filings for one SEC filer, up to 20 per call, newest first: companyName, cik, ticker, formType, filedDate, filedAt, reportDate, accessionNumber, items with item names, fileNumber, documentUrl and filingIndexUrl, plus fetchedAt. Pass exactly one of ticker or cik. Sample at no charge: ?sample=1. Not charged if no filing matches or SEC EDGAR is unavailable. Invalid input returns 400, not charged. ?ticker=AAPL&limit=10&since=2026-01-01 Use when: you need a company's recent 8-K current reports (earnings, executive changes, deals, other material events) with item codes and links to each filing. Don't use when: you need the full filing text, other forms (10-K, 10-Q, Form 4, 13F), a feed across all companies, or filers outside SEC EDGAR. Price: $0.03 per call over x402 (USDC on Base). Set sample:true for a sample at no charge.

NameTypeReqDescription
cikstring–SEC CIK, 1-10 digits (pass ticker or cik, not both)
limitstring–Filings 1-20 (default 10)
sampleboolean–true: return the sample at no charge (no payment, other arguments ignored)
sincestring–Only filings filed on or after this date, YYYY-MM-DD
tickerstring–Ticker, e.g. AAPL or BRK-B (pass ticker or cik, not both)

No output schema declared.

No examples provided.

tenders ~212

$0.11 per call. One fixed bundle of the newest notices from 4 markets, 10 rows each, read live for each call: EU (TED), UK (Find a Tender), France (BOAMP) and Australia (AusTender Contract Notices, awarded contracts). Every row carries market, source and licence. A market whose feed fails is marked unavailable; you are charged only when at least one market returns rows. No parameters. Use when: you want one call that returns fresh tender and contract notices across the EU, UK, France and Australia, with per-row licence fields. Don't use when: you need filters (country, keyword, CPV), more than 10 rows per market, contact people, full tender documents, or Australian open tenders. Price: $0.11 per call over x402 (USDC on Base). Set sample:true for a sample at no charge.

NameTypeReqDescription
sampleboolean–true: return the sample at no charge (no payment, other arguments ignored)

No output schema declared.

No examples provided.

uk-tenders ~249

$0.03 per call. Up to 25 newest UK tender notices from Find a Tender (feed=fts, default) or Contracts Finder (feed=cf), read live for each call. Returns title, buyer organisation, published and deadline dates, value and currency when stated, CPV codes, procedure, notice URL and next_cursor. No charge when nothing matches or the source fails. Use when: you need fresh UK tender notices to find bid opportunities or track buyers, with CPV codes and deadlines. Don't use when: you need contact people, award winners, full tender documents, or notices from outside the UK. Price: $0.03 per call over x402 (USDC on Base). Set sample:true for a sample at no charge.

NameTypeReqDescription
cursorstring–next_cursor from a previous response
feedstring–fts (Find a Tender, default) or cf (Contracts Finder)
limitstring–Notices 1-25 (default 25)
sampleboolean–true: return the sample at no charge (no payment, other arguments ignored)
sincestring–Published on or after, YYYY-MM-DD

No output schema declared.

No examples provided.

wallet-risk ~267

$0.025 per call. Screen one EVM address against the OFAC SDN list and the ScamSniffer phishing address list. Returns verdict (BLOCK, REVIEW, CLEAR), riskScore, flags, ofacSanctioned, ofacMatches (OFAC id, currency, programs), scamSnifferListed and listsAsOf. Snapshots: OFAC SDN list 2026-10-21, ScamSniffer phishing address list 2026-10-22. A screening aid, not legal advice. Invalid input returns 400, not charged. ?address=0x... Use when: you want a quick check of one EVM address against the OFAC SDN list and the ScamSniffer phishing address list before you send funds, accept a payment or onboard a wallet. Don't use when: you need Bitcoin, Tron or Solana addresses, name-based sanctions screening, on-chain history, or a legal determination. Price: $0.025 per call over x402 (USDC on Base). Set sample:true for a sample at no charge.

NameTypeReqDescription
addressstringyesOne EVM address, 0x + 40 hex
sampleboolean–true: return the sample at no charge (no payment, other arguments ignored)

No output schema declared.

No examples provided.

Install

How do I install the Johto Data MCP server?

Johto Data is a hosted endpoint at https://johto-x402-api.johtodata.workers.dev/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

remote · johto-x402-api.johtodata.workers.dev

# add to Claude Code
claude mcp add --transport http com-johtodata-johto-data 'https://johto-x402-api.johtodata.workers.dev/mcp'
Common questions

What is the Johto Data MCP server?

Johto Data is an MCP server listed in the public MCP registry as com.johtodata/johto-data. Johto Data: pay-per-call company, compliance and filings data via x402. Free sample on every tool. This page covers its hosted endpoint (https://johto-x402-api.johtodata.workers.dev/mcp).

Is the Johto Data MCP server safe to use?

Johto Data scores 65 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the Johto Data MCP server expose?

Johto Data exposes 14 tools: jp-invoice-check, sec-13f, sec-8k, sanctions-screen, tenders, and 9 more. Their descriptions and schemas cost roughly 4,331 tokens of context every time the server is loaded.

Does the Johto Data MCP server require authentication?

No. We connected to Johto Data without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

Is the Johto Data MCP server still maintained?

Johto Data is still listed as active in the MCP registry. We last reached this channel on 26 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.