io.github.dario933/x402-paid-checks
NPM · X402-PAID-CHECKS-MCP
Domain, email, vendor and ransomware checks paid per call in USDC via x402 from your wallet.
Available components
Last scanned (21 hours ago)
Scores higher than 32% of npm servers
Category Security
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security99
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 30 of 111 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency19
- Repository check failed: no source repository is declared. See how to fix → View diagnostics → Fail
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 10 days ago).Pass
- Security-disclosure policy not yet verified: we couldn't inspect the source repository.Unverified
Schema Quality & AI Usability69
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 7733 tokens (~145/item across 53 items; 53 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
- Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 53 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 53 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Unverified: 1 category
A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 30 Oct 26 +3
- CVE-2023-54404 no longer affects this package ▲ security
- Known CVEs: fail → pass ▲ security
- 25 Oct 26 +15
- Malware scan: unverified → pass ▲ security
- 24 Oct 26 46
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 4 Nov 2026 · Analysed npm/x402-paid-checks-mcp@0.1.1
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 111 packages
| Packages resolved | 111 |
|---|---|
| Stale | 30 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
aeoinspector_domain_report AEO Inspector: GET /api/v1/domain-report ~131
Audit one domain for website security and AI search visibility (AEO) in one call. $2 USDC on Base per call. Returns a site security grade, an AEO grade and one priority-sorted fixes[] list with paste-ready DNS, robots.txt, llms.txt and JSON-LD fixes and verify commands. Don't use this for asking AI engines whether they mention the brand; use /report. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]
| Name | Type | Req | Description |
|---|---|---|---|
| url | string | yes | url |
No output schema declared.
No examples provided.
aeoinspector_report AEO Inspector: GET /api/v1/report ~145
Check if ChatGPT, Gemini, Claude, Perplexity and 12 other AI engines mention or cite a website, as JSON. $9 USDC on Base per call. Same as /report: per-engine answers (240 total), mention rate, citation rate, visibility score and competitor share of mentions. Don't use this for a one-off crawl check; /api/v1/scan costs less. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]
| Name | Type | Req | Description |
|---|---|---|---|
| brand | string | – | brand |
| topic | string | – | topic |
| url | string | yes | url |
No output schema declared.
No examples provided.
aeoinspector_report_page AEO Inspector: GET /report ~146
Check if ChatGPT, Gemini, Claude, Perplexity and 12 other AI engines mention or cite a website. $9 USDC on Base per call. Returns per-engine answers to 5 category questions asked 3 times (240 answers), mention rate, citation rate, a visibility score and competitor share of mentions. Don't use this for technical crawl fixes; use /api/v1/scan. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]
| Name | Type | Req | Description |
|---|---|---|---|
| brand | string | – | brand |
| topic | string | – | topic |
| url | string | yes | url |
No output schema declared.
No examples provided.
aeoinspector_scan AEO Inspector: GET /api/v1/scan ~136
Find why AI crawlers can't read a website, with paste-ready fixes. $0.05 USDC on Base per call. Crawls the homepage and up to 9 sitemap pages. Returns a score, grade and fixes covering robots.txt for 21 AI crawlers, AI bot blocks, browser vs crawler fetch gaps and JSON-LD checks. Don't use this for measuring brand mentions in AI answers; use /api/v1/report. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]
| Name | Type | Req | Description |
|---|---|---|---|
| url | string | yes | url |
No output schema declared.
No examples provided.
aeoinspector_track AEO Inspector: POST /api/v1/track ~143
Track a website's AI search visibility every week for 4 weeks. $19 USDC on Base per call. Runs the 16-engine report now, then each Monday until 4 successful runs. Returns a private tracking_url with a trend chart and competitor shifts, plus emails. Settles only if the first run succeeds (12+ of 16 engines). Don't use this for a single snapshot; use /api/v1/report. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]
| Name | Type | Req | Description |
|---|---|---|---|
| string | yes | ||
| url | string | yes | url |
No output schema declared.
No examples provided.
dragonseye_batch Dragons Eye Lookup: GET /v1/batch ~109
Check up to 25 vendor domains for ransomware leak-site claims in one call. $0.05 USDC on Base per call. Returns any matching claims per domain. found:false is not proof of absence. Don't use this for company names or more than 25; use /v1/bulk-check. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]
| Name | Type | Req | Description |
|---|---|---|---|
| domains | string | yes | domains |
No output schema declared.
No examples provided.
dragonseye_bulk_check Dragons Eye Lookup: GET /v1/bulk-check ~105
Check up to 100 vendors (domains or company names) for ransomware leak-site claims. $0.5 USDC on Base per call. Returns matching claims per vendor with group, dates and sources. Don't use this for risk levels and actions; use /v1/vendor-report. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]
| Name | Type | Req | Description |
|---|---|---|---|
| vendors | string | yes | vendors |
No output schema declared.
No examples provided.
dragonseye_cve Dragons Eye Lookup: GET /v1/cve ~156
Is this CVE exploited? CVE lookup with KEV, ransomware use, EPSS and public exploits. $0.03 USDC on Base per call. Returns CVSS, affected products, advisories, CISA KEV and ransomware use, EPSS, public exploit repos, an AI-generated ATT&CK attack flow (flagged) and D3FEND countermeasures. Uncached CVEs return 404, not charged. Don't use this for CVEs not yet cached; they return 404 and are queued. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | id |
No output schema declared.
No examples provided.
dragonseye_cve_batch Dragons Eye Lookup: GET /v1/cve-batch ~132
Look up up to 50 CVEs in one call: KEV, EPSS, exploits and ATT&CK. $0.5 USDC on Base per call. Returns the /v1/cve record for each. Charged only if every CVE is covered; otherwise 404 before payment listing uncovered and covered ids. Don't use this for one CVE; /v1/cve costs less. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]
| Name | Type | Req | Description |
|---|---|---|---|
| ids | string | yes | ids |
No output schema declared.
No examples provided.
dragonseye_group Dragons Eye Lookup: GET /v1/group ~118
Look up a ransomware group profile: aliases, first seen and newest claims. $0.02 USDC on Base per call. Returns aliases, first observation by RansomLook and a sample of newest claims. Unknown groups return 404, not charged. Don't use this for tools, TTPs or momentum; use /v1/group-intel. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | name |
No output schema declared.
No examples provided.
dragonseye_group_intel Dragons Eye Lookup: GET /v1/group-intel ~137
Get intel on a ransomware group: activity trend, tools, malware, ATT&CK and CVEs. $0.05 USDC on Base per call. Returns leak-site listing counts with a momentum status (30-day vs lifetime), reported tools, co-mentioned malware, campaigns, ATT&CK techniques and CVEs (not attribution), headlines and D3FEND defenses. Don't use this for attribution; co-mentions are not proof. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | name |
No output schema declared.
No examples provided.
dragonseye_indicator_batch Dragons Eye Lookup: GET /v1/indicator-batch ~118
Check up to 100 domains or IPv4 addresses against a threat IOC feed in one call. $0.25 USDC on Base per call. Same check as /v1/indicator-check at one flat price. Stale feed returns 503, not charged. Don't use this for one indicator; /v1/indicator-check costs less. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]
| Name | Type | Req | Description |
|---|---|---|---|
| q | string | yes | q |
No output schema declared.
No examples provided.
dragonseye_indicator_check Dragons Eye Lookup: GET /v1/indicator-check ~135
Is this domain or IP malicious? Check against a 30-day high-confidence IOC feed. $0.01 USDC on Base per call. Returns listed or not_listed, match type, stated reason, linked reports, ThreatCluster clusters and feed freshness. If the feed is older than 3 hours it returns 503, not charged. Don't use this as proof a domain is safe; no match is not proof of absence. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]
| Name | Type | Req | Description |
|---|---|---|---|
| q | string | yes | q |
No output schema declared.
No examples provided.
dragonseye_lookup Dragons Eye Lookup: GET /v1/lookup ~110
Was this company hit by ransomware? Leak-site claim lookup by company name or domain. $0.01 USDC on Base per call. Returns matching ransomware-group claims with group, dates, country, sector and sources. Don't use this as proof of a breach; these are unverified claims from criminal leak sites. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]
| Name | Type | Req | Description |
|---|---|---|---|
| q | string | yes | q |
No output schema declared.
No examples provided.
dragonseye_recent Dragons Eye Lookup: GET /v1/recent ~119
Get the newest ransomware leak-site victim claims, optionally for one group. $0.01 USDC on Base per call. Returns up to 10 of the newest claims. Country and sector are often null. Commercially reusable sources only. Don't use this for checking a specific company; use /v1/lookup. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]
| Name | Type | Req | Description |
|---|---|---|---|
| group | string | – | group |
| limit | string | – | limit |
No output schema declared.
No examples provided.
dragonseye_vendor_report Dragons Eye Lookup: GET /v1/vendor-report ~133
Build a third-party ransomware risk report for up to 100 vendors. $3 USDC on Base per call. Returns matching leak-site claims, a risk level per vendor (high = claim in last 90 days, elevated = last 12 months, historical, none_found, unknown), groups involved, a portfolio summary and follow-up actions. Don't use this for claims only; /v1/bulk-check costs less. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]
| Name | Type | Req | Description |
|---|---|---|---|
| vendors | string | yes | vendors |
No output schema declared.
No examples provided.
dragonseye_watch Dragons Eye Lookup: POST /v1/watch ~138
Watch a list of company or vendor domains (items) for new ransomware leak-site claims, sent to your webhook_url. POST /v1/watch. $0.30 USDC on Base per call. Covers up to 25 vendors for 30 days, each re-checked about once a day. For a one-time lookup, use dragonseye lookup ($0.01) instead. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]
| Name | Type | Req | Description |
|---|---|---|---|
| items | – | yes | JSON body field items |
| webhook_url | – | yes | JSON body field webhook_url |
No output schema declared.
No examples provided.
freesmallbiztools_late_fee_notice Free Small Biz Tools API: GET /v1/late-fee-notice ~204
Write a late-fee reminder email for an overdue invoice. $0.01 USDC on Base per call. Calculates the late fee and returns a ready-to-send subject and body in a polite, firm or final tone. Bad input returns 400 and is not charged. Don't use this for sending email; it only returns text. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]
| Name | Type | Req | Description |
|---|---|---|---|
| amount | string | yes | amount |
| business_name | string | – | business_name |
| client_name | string | – | client_name |
| due_date | string | yes | due_date |
| grace_days | string | – | grace_days |
| invoice_number | string | – | invoice_number |
| paid_date | string | – | paid_date |
| rate | string | – | rate |
| rate_type | string | – | rate_type |
| tone | string | – | tone |
No output schema declared.
No examples provided.
freesmallbiztools_quote_pack Free Small Biz Tools API: POST /v1/quote-pack ~204
Turn a list of line items into a priced customer quote, with optional tax, discount, deposit, valid-days, currency, business name and better/best markup tiers. POST /v1/quote-pack. $0.05 USDC on Base per call. For plain totals only, use the free quote tool. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]
| Name | Type | Req | Description |
|---|---|---|---|
| best_markup_percent | – | – | JSON body field best_markup_percent |
| better_markup_percent | – | – | JSON body field better_markup_percent |
| business_name | – | – | JSON body field business_name |
| currency | – | – | JSON body field currency |
| deposit_percent | – | – | JSON body field deposit_percent |
| discount_percent | – | – | JSON body field discount_percent |
| items | – | yes | JSON body field items |
| tax_percent | – | – | JSON body field tax_percent |
| valid_days | – | – | JSON body field valid_days |
No output schema declared.
No examples provided.
freesmallbiztools_stack_report Free Small Biz Tools API: GET /v1/stack-report ~157
Pick free or freemium software for a small business by business type. $1 USDC on Base per call. Returns one tool per need from freesmallbiztools.com's checked listings (vendor quote and check date), with alternatives and caveats. Types: service, trades, retail, online_store, creator, consultant, agency, nonprofit. Don't use this for paid enterprise software comparisons. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]
| Name | Type | Req | Description |
|---|---|---|---|
| business_type | string | yes | business_type |
| free_only | string | – | free_only |
| needs | string | – | needs |
| team_size | string | – | team_size |
No output schema declared.
No examples provided.
inboxguards_email_check InboxGuards Email Test: GET /v1/email-check ~128
Validate an email address before sending: syntax, MX, disposable and role account. $0.005 USDC on Base per call. Returns a verdict of ok, risky or undeliverable with syntax, MX, disposable (CC0 list), role account and free provider flags. Bad syntax returns 400, not charged. Don't use this for confirming a mailbox exists; no SMTP probe is made. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]
| Name | Type | Req | Description |
|---|---|---|---|
| string | yes |
No output schema declared.
No examples provided.
inboxguards_fix_plan InboxGuards Email Test: GET /v1/fix-plan ~135
Get the exact SPF, DKIM and DMARC DNS records to publish for a domain. $1 USDC on Base per call. Reads live MX, NS, SPF, DKIM and DMARC, detects the mail provider and DNS host, and returns records in order (create, replace or keep) with one merged SPF and a staged DMARC policy. Don't use this for testing a real sent message; use /v1/report. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | domain |
No output schema declared.
No examples provided.
inboxguards_report InboxGuards Email Test: GET /v1/report ~182
Test why a real sent email lands in spam: SPF, DKIM, DMARC and deliverability report. $0.05 USDC on Base per call. Get a free test address via POST /v1/tests, send one email to it, then call this with test_id and X-Read-Token. Returns SPF, DKIM, DMARC, ARC, BIMI, rDNS, SpamCop, unsubscribe and content checks, a 0-100 score and top fixes. Don't use this for checking a domain without sending mail; use /v1/fix-plan. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]
| Name | Type | Req | Description |
|---|---|---|---|
| X-Read-Token | string | yes | X-Read-Token |
| test_id | string | yes | test_id |
No output schema declared.
No examples provided.
isitdownapi_incidents 60SecMonitor Status API: GET /v1/incidents ~120
List recent outages and incidents for one SaaS vendor. $0.01 USDC on Base per call. Returns up to 10 most recent incidents (title, status, severity, start and resolve times) from 60SecMonitor. Unknown vendors return 404, not charged. Don't use this for live up/down status; use /v1/status. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]
| Name | Type | Req | Description |
|---|---|---|---|
| vendor | string | yes | vendor |
No output schema declared.
No examples provided.
isitdownapi_status 60SecMonitor Status API: GET /v1/status ~124
Is a vendor down right now? Current outage status for one SaaS vendor. $0.01 USDC on Base per call. Returns status, active-incident summary, last-checked time, source URL and freshness fields, read live from 60SecMonitor. Unknown vendors return 404, not charged. Don't use this for past incidents; use /v1/incidents. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]
| Name | Type | Req | Description |
|---|---|---|---|
| vendor | string | yes | vendor |
No output schema declared.
No examples provided.
isitdownapi_status_batch 60SecMonitor Status API: GET /v1/status/batch ~126
Check whether up to 25 SaaS vendors are down in one call. $0.05 USDC on Base per call. Returns current status per vendor (comma-separated input) at one flat price, plus a list of vendors that are not operational. Not charged if no vendor is tracked or every lookup fails. Don't use this for a single vendor; /v1/status costs less. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]
| Name | Type | Req | Description |
|---|---|---|---|
| vendors | string | yes | vendors |
No output schema declared.
No examples provided.
mailsecuritytools_bulk_score Mail Security Tools API: GET /v1/bulk-score ~138
Score email security (SPF, DMARC, DKIM, MX) for up to 100 domains in one call. $0.5 USDC on Base per call. Returns per-domain score, grade and issues plus a summary: grade counts, missing DMARC/SPF and worst 10. Bad input 400 and widespread DNS failure 502, not charged. Don't use this for one domain; /v1/score costs less. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]
| Name | Type | Req | Description |
|---|---|---|---|
| domains | string | yes | domains |
No output schema declared.
No examples provided.
mailsecuritytools_email_check Mail Security Tools API: GET /v1/email-check ~113
Validate an email address: syntax, MX, disposable and role account. $0.01 USDC on Base per call. Returns a verdict of ok, risky or undeliverable without sending mail. Bad syntax returns 400, not charged. Don't use this for confirming a mailbox exists; no SMTP probe is made. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]
| Name | Type | Req | Description |
|---|---|---|---|
| string | yes |
No output schema declared.
No examples provided.
mailsecuritytools_fix_plan Mail Security Tools API: GET /v1/fix-plan ~150
Get the exact SPF, DKIM and DMARC records to publish, with steps for your DNS host. $1 USDC on Base per call. Reads live MX, NS, SPF, DKIM and DMARC, detects the mail provider and DNS host, and returns records in order with a staged DMARC rollout. Non-sending domains get a lock-down set. Bad input 400, unknown domain 404, not charged. Don't use this for a quick grade; use /v1/score. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | domain |
No output schema declared.
No examples provided.
mailsecuritytools_score Mail Security Tools API: GET /v1/score ~151
Grade a domain's email security: SPF, DMARC, DKIM and MX score. $0.01 USDC on Base per call. Returns a 0-100 score and A-F grade (SPF 30, DMARC 40, DKIM 25, MX 5) from live DNS, with findings and the top 3 fixes. Bad input 400, unknown domain 404, not charged. Don't use this for the exact records to publish; use /v1/fix-plan. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | domain |
No output schema declared.
No examples provided.
mailsecuritytools_watch Mail Security Tools API: POST /v1/watch ~145
Monitor the email security setup of a list of domains (items) and send updates to your webhook_url. POST /v1/watch. $0.30 USDC on Base per call. Covers up to 25 domains for 30 days; SPF, DMARC, DKIM, MX and score are re-checked about once a day. For a one-time score, use /v1/score ($0.01). [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]
| Name | Type | Req | Description |
|---|---|---|---|
| items | – | yes | JSON body field items |
| webhook_url | – | yes | JSON body field webhook_url |
No output schema declared.
No examples provided.
orioncmd_audit_report OrionCMD Checks: GET /v1/audit-report ~130
Run a full website security audit with a prioritized fix list for a client or vendor review. $2 USDC on Base per call. Runs every OrionCMD check plus HTTPS redirect, www/apex, security.txt, robots.txt and sitemap. Returns the A-F grade, score and an action plan sorted critical to low. Don't use this for one quick check; single checks start at $0.01. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | domain |
No output schema declared.
No examples provided.
orioncmd_bulk_threat_check OrionCMD Checks: GET /v1/bulk-threat-check ~131
Check up to 100 domains or IPv4 addresses against a threat IOC feed in one call. $0.5 USDC on Base per call. Resolves each domain and matches names, parent domains and IPv4 against ThreatCluster's high-confidence 30-day IOC feed. Stale feed answers 503 before payment. Don't use this for ransomware claim lookups; use /v1/threat-check. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]
| Name | Type | Req | Description |
|---|---|---|---|
| q | string | yes | q |
No output schema declared.
No examples provided.
orioncmd_cert OrionCMD Checks: GET /v1/cert ~125
Check a domain's SSL/TLS certificate expiry and renewal from CT logs. $0.01 USDC on Base per call. Returns issuer, validity, days left, % of lifetime used, renewal cadence and a renewal-stall heuristic from Certificate Transparency logs, plus a live HTTPS pass/fail probe. Don't use this for inspecting the exact certificate served live; details come from CT logs. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | domain |
No output schema declared.
No examples provided.
orioncmd_dns OrionCMD Checks: GET /v1/dns ~138
Check a domain's DNS records, DNSSEC, CAA, SPF and DMARC. $0.01 USDC on Base per call. Returns NS, A/AAAA/CNAME, MX, SPF, DMARC, CAA and DNSSEC via Cloudflare DoH, with plain-English findings and paste-ready fixes with dig verify commands. Don't use this for DKIM, MTA-STS or BIMI; use /v1/email-auth. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | domain |
No output schema declared.
No examples provided.
orioncmd_domain_grade OrionCMD Checks: GET /v1/domain-grade ~137
Get a domain security grade A-F with a per-category breakdown. $0.03 USDC on Base per call. Returns one A-F grade, a 0-100 score, points per category (TLS 25, email auth 25, headers 20, DNS 15, expiry 15) and the top fixes. Don't use this for raw cert, DNS and expiry data without a grade; use /v1/site-health. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | domain |
No output schema declared.
No examples provided.
orioncmd_email_auth OrionCMD Checks: GET /v1/email-auth ~153
Check a domain's email authentication: SPF, DMARC, DKIM, MTA-STS, TLS-RPT and BIMI. $0.01 USDC on Base per call. Returns SPF validity and lookup count (limit 10), DMARC policy/pct/rua, DKIM on common selectors, MTA-STS mode, TLS-RPT, BIMI, a rough 0-100 score and plain-English findings. Don't use this for DKIM on custom selectors; only common selectors are checked. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | domain |
No output schema declared.
No examples provided.
orioncmd_expiry OrionCMD Checks: GET /v1/expiry ~124
When does a domain expire? Registration expiry and registrar via RDAP. $0.01 USDC on Base per call. Returns registrar, registration and expiry dates, days left, EPP status and nameservers. Within 60 days of expiry, fixes[] gives auto-renew steps for the registrar. Don't use this for SSL certificate expiry; use /v1/cert. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | domain |
No output schema declared.
No examples provided.
orioncmd_headers OrionCMD Checks: GET /v1/headers ~122
Check a website's HTTP security headers and redirect chain. $0.01 USDC on Base per call. One HTTPS GET returns the redirect chain, final status, HSTS, CSP, X-Frame-Options and other headers, a simple A-F grade and plain-English findings. Don't use this for a full site security audit; use /v1/audit-report. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | domain |
No output schema declared.
No examples provided.
orioncmd_site_health OrionCMD Checks: GET /v1/site-health ~141
Check a domain's certificate, DNS and expiry together in one call. $0.03 USDC on Base per call. Returns a summary, the renewal-stall heuristic, the Let's Encrypt 64-day (2027-02-10) note and fixes[] with paste-ready DNS records and auto-renew steps, each with a verify command. Partial results if one source fails. Don't use this for an A-F grade; use /v1/domain-grade. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | domain |
No output schema declared.
No examples provided.
orioncmd_threat_check OrionCMD Checks: GET /v1/threat-check ~136
Is this domain malicious or named by ransomware? Domain threat check. $0.02 USDC on Base per call. Matches the hostname, parent domains and resolved IPv4 against ThreatCluster's high-confidence 30-day IOC feed and looks up ransomware leak-site claims. Returns one verdict: listed, claimed, listed_and_claimed or no_known_threat. Don't use this for many domains; use /v1/bulk-threat-check. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | domain |
No output schema declared.
No examples provided.
orioncmd_watch OrionCMD Checks: POST /v1/watch ~146
Set up monitoring for a list of domains (items) and get updates sent to your webhook_url. POST /v1/watch. $0.30 USDC on Base per call. Covers up to 25 domains for 30 days, each re-checked about once a day, with HMAC-signed webhook alerts. Use it when you want ongoing alerts; for a one-time check, call the matching single-check tool instead. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]
| Name | Type | Req | Description |
|---|---|---|---|
| items | – | yes | JSON body field items |
| webhook_url | – | yes | JSON body field webhook_url |
No output schema declared.
No examples provided.
paidpilot_invoice_from_timesheet PaidPilot Invoice API: POST /v1/invoice-from-timesheet ~270
Turn timesheet entries into invoice JSON. $0.02 USDC on Base per call. Hours x rate, optional rounding, grouping, expenses, tax and terms become a validated invoice JSON with totals, ready for /v1/invoice.pdf. Don't use this for the PDF itself; send the result to /v1/invoice.pdf. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]
| Name | Type | Req | Description |
|---|---|---|---|
| buyer | – | yes | JSON body field buyer |
| currency | – | – | JSON body field currency |
| default_rate | – | – | JSON body field default_rate |
| discount | – | – | JSON body field discount |
| due_date | – | – | JSON body field due_date |
| entries | – | yes | JSON body field entries |
| expenses | – | – | JSON body field expenses |
| group_by | – | – | JSON body field group_by |
| invoice_number | – | yes | JSON body field invoice_number |
| issue_date | – | yes | JSON body field issue_date |
| notes | – | – | JSON body field notes |
| payment_instructions | – | – | JSON body field payment_instructions |
| rounding | – | – | JSON body field rounding |
| seller | – | yes | JSON body field seller |
| tax_rate | – | – | JSON body field tax_rate |
| terms | – | – | JSON body field terms |
No output schema declared.
No examples provided.
paidpilot_invoice_pdf PaidPilot Invoice API: POST /v1/invoice.pdf ~216
Generate an invoice PDF from JSON. $0.02 USDC on Base per call. Computes line items, tax, discount and totals server-side; 12 currencies; multi-page. Validate free first at POST /v1/invoice/validate. Don't use this for sending the invoice; it only returns the PDF. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]
| Name | Type | Req | Description |
|---|---|---|---|
| buyer | – | yes | JSON body field buyer |
| currency | – | – | JSON body field currency |
| discount | – | – | JSON body field discount |
| due_date | – | – | JSON body field due_date |
| invoice_number | – | yes | JSON body field invoice_number |
| issue_date | – | yes | JSON body field issue_date |
| line_items | – | yes | JSON body field line_items |
| notes | – | – | JSON body field notes |
| payment_instructions | – | – | JSON body field payment_instructions |
| seller | – | yes | JSON body field seller |
| tax_rate | – | – | JSON body field tax_rate |
No output schema declared.
No examples provided.
paidpilot_late_fee PaidPilot Invoice API: POST /v1/late-fee ~209
Calculate a late fee on an overdue invoice. $0.01 USDC on Base per call. Flat, monthly % or annual %, simple or compounding, with grace days. Returns days late, fee, new total and a paste-ready invoice line. Don't use this for legal advice; state caps are not looked up. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]
| Name | Type | Req | Description |
|---|---|---|---|
| amount | – | yes | JSON body field amount |
| as_of | – | – | JSON body field as_of |
| compounding | – | – | JSON body field compounding |
| currency | – | – | JSON body field currency |
| due_date | – | yes | JSON body field due_date |
| fee_type | – | yes | JSON body field fee_type |
| flat_fee | – | – | JSON body field flat_fee |
| grace_days | – | – | JSON body field grace_days |
| rate_percent | – | – | JSON body field rate_percent |
| state | – | – | JSON body field state |
No output schema declared.
No examples provided.
paidpilot_payment_terms PaidPilot Invoice API: POST /v1/payment-terms ~186
Work out an invoice due date and early-pay discount from terms like Net 30 or 2/10 Net 30. $0.01 USDC on Base per call. Parses Net N, D/N Net M, Due on receipt, EOM and Net N EOM. Returns due date, days until due or overdue, discount and deadline, the annualized cost of skipping it and reminder dates. Don't use this for late fees; use /v1/late-fee. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]
| Name | Type | Req | Description |
|---|---|---|---|
| amount | – | – | JSON body field amount |
| as_of | – | – | JSON body field as_of |
| currency | – | – | JSON body field currency |
| invoice_date | – | yes | JSON body field invoice_date |
| terms | – | yes | JSON body field terms |
No output schema declared.
No examples provided.
paidpilot_receivables_report PaidPilot Invoice API: POST /v1/receivables-report ~200
Analyze accounts receivable aging from an invoice CSV or JSON export. $1 USDC on Base per call. Takes up to 1000 open invoices (QuickBooks, Xero, FreshBooks, Wave, Stripe or custom). Returns an A-F health grade, 0-100 score, aging buckets, overdue %, DSO and a collection priority list. Don't use this for a single invoice; use /v1/reminder-draft or /v1/late-fee. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]
| Name | Type | Req | Description |
|---|---|---|---|
| as_of | – | – | JSON body field as_of |
| csv | – | – | JSON body field csv |
| currency | – | – | JSON body field currency |
| default_terms | – | – | JSON body field default_terms |
| invoices | – | – | JSON body field invoices |
| revenue_window_days | – | – | JSON body field revenue_window_days |
No output schema declared.
No examples provided.
paidpilot_reminder_draft PaidPilot Invoice API: POST /v1/reminder-draft ~224
Write a payment reminder email for an unpaid invoice (friendly, firm or final notice). $0.01 USDC on Base per call. Returns subject and plain-text body, days overdue, the recommended tone and the next step. Template-based and deterministic. Don't use this for sending email; it only drafts. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]
| Name | Type | Req | Description |
|---|---|---|---|
| amount | – | – | JSON body field amount |
| as_of | – | – | JSON body field as_of |
| client_name | – | – | JSON body field client_name |
| currency | – | – | JSON body field currency |
| due_date | – | – | JSON body field due_date |
| final_deadline_days | – | – | JSON body field final_deadline_days |
| from_name | – | yes | JSON body field from_name |
| invoice_number | – | – | JSON body field invoice_number |
| late_fee_terms | – | – | JSON body field late_fee_terms |
| payment_link | – | – | JSON body field payment_link |
| tone | – | yes | JSON body field tone |
No output schema declared.
No examples provided.
pulsewatch_incidents PulseWatch Status API: GET /v1/incidents ~117
List recent outages and incidents for one SaaS vendor. $0.01 USDC on Base per call. Returns up to 10 most recent incidents (title, status, severity, start and resolve times) from PulseWatch. Unknown vendors return 404, not charged. Don't use this for live up/down status; use /v1/status. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]
| Name | Type | Req | Description |
|---|---|---|---|
| vendor | string | yes | vendor |
No output schema declared.
No examples provided.
pulsewatch_status PulseWatch Status API: GET /v1/status ~121
Is a vendor down right now? Current outage status for one SaaS vendor. $0.01 USDC on Base per call. Returns status, active-incident summary, last-checked time, source URL and freshness fields, read live from PulseWatch. Unknown vendors return 404, not charged. Don't use this for past incidents; use /v1/incidents. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]
| Name | Type | Req | Description |
|---|---|---|---|
| vendor | string | yes | vendor |
No output schema declared.
No examples provided.
How do I install the io.github.dario933/x402-paid-checks MCP server?
io.github.dario933/x402-paid-checks runs locally as an npm package, launched with npx -y x402-paid-checks-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · x402-paid-checks-mcp
claude mcp add dario933-x402-paid-checks -- npx -y x402-paid-checks-mcp
What is the io.github.dario933/x402-paid-checks MCP server?
io.github.dario933/x402-paid-checks is an MCP server listed in the public MCP registry as io.github.dario933/x402-paid-checks. Domain, email, vendor and ransomware checks paid per call in USDC via x402 from your wallet. This page covers its npm package (x402-paid-checks-mcp).
Is the io.github.dario933/x402-paid-checks MCP server safe to use?
io.github.dario933/x402-paid-checks scores 64 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 4 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.dario933/x402-paid-checks MCP server expose?
io.github.dario933/x402-paid-checks exposes 53 tools: orioncmd_cert, orioncmd_dns, orioncmd_expiry, orioncmd_email_auth, orioncmd_headers, and 48 more. Their descriptions and schemas cost roughly 7,733 tokens of context every time the server is loaded.
Is the io.github.dario933/x402-paid-checks MCP server still maintained?
io.github.dario933/x402-paid-checks is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.dario933/x402-paid-checks MCP server under?
io.github.dario933/x402-paid-checks declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.