# io.github.dario933/x402-paid-checks (npm · x402-paid-checks-mcp)

Domain, email, vendor and ransomware checks paid per call in USDC via x402 from your wallet.

- Trust score: 64/100 (medium)
- Change this week: +3
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- npm · `x402-paid-checks-mcp`: 64/100 (this document), [markdown](https://verifymcp.io/servers/dario933-x402-paid-checks/x402-paid-checks-mcp.md), [page](https://verifymcp.io/servers/dario933-x402-paid-checks/x402-paid-checks-mcp)

## Channel facts

- Registry: `npm`
- Package: `x402-paid-checks-mcp`
- Version: `0.1.1`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Supply Chain Security**: 99/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - 30 of 111 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 19/100
  - Repository check failed: no source repository is declared.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 11 days ago).
  - Security-disclosure policy not yet verified: we couldn't inspect the source repository.
- **Schema Quality & AI Usability**: 69/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 7733 tokens (~145/item across 53 items; 53 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 53 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 53 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### How do I install the io.github.dario933/x402-paid-checks MCP server?

io.github.dario933/x402-paid-checks runs locally as an npm package, launched with npx -y x402-paid-checks-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add dario933-x402-paid-checks -- npx -y x402-paid-checks-mcp
```

### Cursor

```json
{
  "mcpServers": {
    "dario933-x402-paid-checks": {
      "command": "npx",
      "args": [
        "-y",
        "x402-paid-checks-mcp"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "dario933-x402-paid-checks": {
      "command": "npx",
      "args": [
        "-y",
        "x402-paid-checks-mcp"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add dario933-x402-paid-checks -- npx -y x402-paid-checks-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "dario933-x402-paid-checks": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "x402-paid-checks-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add dario933-x402-paid-checks --command npx --arg -y --arg x402-paid-checks-mcp
```

### Hermes

```yaml
mcp_servers:
  dario933-x402-paid-checks:
    command: "npx"
    args: ["-y", "x402-paid-checks-mcp"]
```

### Netclaw

```json
{
  "McpServers": {
    "dario933-x402-paid-checks": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "x402-paid-checks-mcp"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add dario933-x402-paid-checks -t stdio -c npx -a -y x402-paid-checks-mcp
```

### Other

```json
{
  "mcpServers": {
    "dario933-x402-paid-checks": {
      "command": "npx",
      "args": [
        "-y",
        "x402-paid-checks-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-10-30 (score 64, +3)

- [security improvement] CVE-2023-54404 no longer affects this package
- [security improvement] Known CVEs: fail → pass

### 2026-10-25 (score 61, +15)

- [security improvement] Malware scan: unverified → pass

### 2026-10-24 (score 46)

First indexed and scored.

## MCP tools (53)

### `orioncmd_cert` (~125 tokens)

OrionCMD Checks: GET /v1/cert

Check a domain's SSL/TLS certificate expiry and renewal from CT logs. $0.01 USDC on Base per call. Returns issuer, validity, days left, % of lifetime used, renewal cadence and a renewal-stall heuristic from Certificate Transparency logs, plus a live HTTPS pass/fail probe. Don't use this for inspecting the exact certificate served live; details come from CT logs. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Input parameters:

- `domain` (string, required): domain

### `orioncmd_dns` (~138 tokens)

OrionCMD Checks: GET /v1/dns

Check a domain's DNS records, DNSSEC, CAA, SPF and DMARC. $0.01 USDC on Base per call. Returns NS, A/AAAA/CNAME, MX, SPF, DMARC, CAA and DNSSEC via Cloudflare DoH, with plain-English findings and paste-ready fixes with dig verify commands. Don't use this for DKIM, MTA-STS or BIMI; use /v1/email-auth. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Input parameters:

- `domain` (string, required): domain

### `orioncmd_expiry` (~124 tokens)

OrionCMD Checks: GET /v1/expiry

When does a domain expire? Registration expiry and registrar via RDAP. $0.01 USDC on Base per call. Returns registrar, registration and expiry dates, days left, EPP status and nameservers. Within 60 days of expiry, fixes[] gives auto-renew steps for the registrar. Don't use this for SSL certificate expiry; use /v1/cert. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Input parameters:

- `domain` (string, required): domain

### `orioncmd_email_auth` (~153 tokens)

OrionCMD Checks: GET /v1/email-auth

Check a domain's email authentication: SPF, DMARC, DKIM, MTA-STS, TLS-RPT and BIMI. $0.01 USDC on Base per call. Returns SPF validity and lookup count (limit 10), DMARC policy/pct/rua, DKIM on common selectors, MTA-STS mode, TLS-RPT, BIMI, a rough 0-100 score and plain-English findings. Don't use this for DKIM on custom selectors; only common selectors are checked. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Input parameters:

- `domain` (string, required): domain

### `orioncmd_headers` (~122 tokens)

OrionCMD Checks: GET /v1/headers

Check a website's HTTP security headers and redirect chain. $0.01 USDC on Base per call. One HTTPS GET returns the redirect chain, final status, HSTS, CSP, X-Frame-Options and other headers, a simple A-F grade and plain-English findings. Don't use this for a full site security audit; use /v1/audit-report. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Input parameters:

- `domain` (string, required): domain

### `orioncmd_domain_grade` (~137 tokens)

OrionCMD Checks: GET /v1/domain-grade

Get a domain security grade A-F with a per-category breakdown. $0.03 USDC on Base per call. Returns one A-F grade, a 0-100 score, points per category (TLS 25, email auth 25, headers 20, DNS 15, expiry 15) and the top fixes. Don't use this for raw cert, DNS and expiry data without a grade; use /v1/site-health. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Input parameters:

- `domain` (string, required): domain

### `orioncmd_audit_report` (~130 tokens)

OrionCMD Checks: GET /v1/audit-report

Run a full website security audit with a prioritized fix list for a client or vendor review. $2 USDC on Base per call. Runs every OrionCMD check plus HTTPS redirect, www/apex, security.txt, robots.txt and sitemap. Returns the A-F grade, score and an action plan sorted critical to low. Don't use this for one quick check; single checks start at $0.01. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Input parameters:

- `domain` (string, required): domain

### `orioncmd_site_health` (~141 tokens)

OrionCMD Checks: GET /v1/site-health

Check a domain's certificate, DNS and expiry together in one call. $0.03 USDC on Base per call. Returns a summary, the renewal-stall heuristic, the Let's Encrypt 64-day (2027-02-10) note and fixes[] with paste-ready DNS records and auto-renew steps, each with a verify command. Partial results if one source fails. Don't use this for an A-F grade; use /v1/domain-grade. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Input parameters:

- `domain` (string, required): domain

### `orioncmd_threat_check` (~136 tokens)

OrionCMD Checks: GET /v1/threat-check

Is this domain malicious or named by ransomware? Domain threat check. $0.02 USDC on Base per call. Matches the hostname, parent domains and resolved IPv4 against ThreatCluster's high-confidence 30-day IOC feed and looks up ransomware leak-site claims. Returns one verdict: listed, claimed, listed_and_claimed or no_known_threat. Don't use this for many domains; use /v1/bulk-threat-check. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Input parameters:

- `domain` (string, required): domain

### `orioncmd_bulk_threat_check` (~131 tokens)

OrionCMD Checks: GET /v1/bulk-threat-check

Check up to 100 domains or IPv4 addresses against a threat IOC feed in one call. $0.5 USDC on Base per call. Resolves each domain and matches names, parent domains and IPv4 against ThreatCluster's high-confidence 30-day IOC feed. Stale feed answers 503 before payment. Don't use this for ransomware claim lookups; use /v1/threat-check. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Input parameters:

- `q` (string, required): q

### `orioncmd_watch` (~146 tokens)

OrionCMD Checks: POST /v1/watch

Set up monitoring for a list of domains (items) and get updates sent to your webhook_url. POST /v1/watch. $0.30 USDC on Base per call. Covers up to 25 domains for 30 days, each re-checked about once a day, with HMAC-signed webhook alerts. Use it when you want ongoing alerts; for a one-time check, call the matching single-check tool instead. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Input parameters:

- `items` (required): JSON body field items
- `webhook_url` (required): JSON body field webhook_url

### `isitdownapi_status` (~124 tokens)

60SecMonitor Status API: GET /v1/status

Is a vendor down right now? Current outage status for one SaaS vendor. $0.01 USDC on Base per call. Returns status, active-incident summary, last-checked time, source URL and freshness fields, read live from 60SecMonitor. Unknown vendors return 404, not charged. Don't use this for past incidents; use /v1/incidents. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Input parameters:

- `vendor` (string, required): vendor

### `isitdownapi_incidents` (~120 tokens)

60SecMonitor Status API: GET /v1/incidents

List recent outages and incidents for one SaaS vendor. $0.01 USDC on Base per call. Returns up to 10 most recent incidents (title, status, severity, start and resolve times) from 60SecMonitor. Unknown vendors return 404, not charged. Don't use this for live up/down status; use /v1/status. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Input parameters:

- `vendor` (string, required): vendor

### `isitdownapi_status_batch` (~126 tokens)

60SecMonitor Status API: GET /v1/status/batch

Check whether up to 25 SaaS vendors are down in one call. $0.05 USDC on Base per call. Returns current status per vendor (comma-separated input) at one flat price, plus a list of vendors that are not operational. Not charged if no vendor is tracked or every lookup fails. Don't use this for a single vendor; /v1/status costs less. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Input parameters:

- `vendors` (string, required): vendors

### `dragonseye_lookup` (~110 tokens)

Dragons Eye Lookup: GET /v1/lookup

Was this company hit by ransomware? Leak-site claim lookup by company name or domain. $0.01 USDC on Base per call. Returns matching ransomware-group claims with group, dates, country, sector and sources. Don't use this as proof of a breach; these are unverified claims from criminal leak sites. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Input parameters:

- `q` (string, required): q

### `dragonseye_recent` (~119 tokens)

Dragons Eye Lookup: GET /v1/recent

Get the newest ransomware leak-site victim claims, optionally for one group. $0.01 USDC on Base per call. Returns up to 10 of the newest claims. Country and sector are often null. Commercially reusable sources only. Don't use this for checking a specific company; use /v1/lookup. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Input parameters:

- `group` (string): group
- `limit` (string): limit

### `dragonseye_group` (~118 tokens)

Dragons Eye Lookup: GET /v1/group

Look up a ransomware group profile: aliases, first seen and newest claims. $0.02 USDC on Base per call. Returns aliases, first observation by RansomLook and a sample of newest claims. Unknown groups return 404, not charged. Don't use this for tools, TTPs or momentum; use /v1/group-intel. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Input parameters:

- `name` (string, required): name

### `dragonseye_batch` (~109 tokens)

Dragons Eye Lookup: GET /v1/batch

Check up to 25 vendor domains for ransomware leak-site claims in one call. $0.05 USDC on Base per call. Returns any matching claims per domain. found:false is not proof of absence. Don't use this for company names or more than 25; use /v1/bulk-check. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Input parameters:

- `domains` (string, required): domains

### `dragonseye_vendor_report` (~133 tokens)

Dragons Eye Lookup: GET /v1/vendor-report

Build a third-party ransomware risk report for up to 100 vendors. $3 USDC on Base per call. Returns matching leak-site claims, a risk level per vendor (high = claim in last 90 days, elevated = last 12 months, historical, none_found, unknown), groups involved, a portfolio summary and follow-up actions. Don't use this for claims only; /v1/bulk-check costs less. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Input parameters:

- `vendors` (string, required): vendors

### `dragonseye_bulk_check` (~105 tokens)

Dragons Eye Lookup: GET /v1/bulk-check

Check up to 100 vendors (domains or company names) for ransomware leak-site claims. $0.5 USDC on Base per call. Returns matching claims per vendor with group, dates and sources. Don't use this for risk levels and actions; use /v1/vendor-report. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Input parameters:

- `vendors` (string, required): vendors

### `dragonseye_watch` (~138 tokens)

Dragons Eye Lookup: POST /v1/watch

Watch a list of company or vendor domains (items) for new ransomware leak-site claims, sent to your webhook_url. POST /v1/watch. $0.30 USDC on Base per call. Covers up to 25 vendors for 30 days, each re-checked about once a day. For a one-time lookup, use dragonseye lookup ($0.01) instead. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Input parameters:

- `items` (required): JSON body field items
- `webhook_url` (required): JSON body field webhook_url

### `dragonseye_indicator_check` (~135 tokens)

Dragons Eye Lookup: GET /v1/indicator-check

Is this domain or IP malicious? Check against a 30-day high-confidence IOC feed. $0.01 USDC on Base per call. Returns listed or not_listed, match type, stated reason, linked reports, ThreatCluster clusters and feed freshness. If the feed is older than 3 hours it returns 503, not charged. Don't use this as proof a domain is safe; no match is not proof of absence. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Input parameters:

- `q` (string, required): q

### `dragonseye_indicator_batch` (~118 tokens)

Dragons Eye Lookup: GET /v1/indicator-batch

Check up to 100 domains or IPv4 addresses against a threat IOC feed in one call. $0.25 USDC on Base per call. Same check as /v1/indicator-check at one flat price. Stale feed returns 503, not charged. Don't use this for one indicator; /v1/indicator-check costs less. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Input parameters:

- `q` (string, required): q

### `dragonseye_cve` (~156 tokens)

Dragons Eye Lookup: GET /v1/cve

Is this CVE exploited? CVE lookup with KEV, ransomware use, EPSS and public exploits. $0.03 USDC on Base per call. Returns CVSS, affected products, advisories, CISA KEV and ransomware use, EPSS, public exploit repos, an AI-generated ATT&CK attack flow (flagged) and D3FEND countermeasures. Uncached CVEs return 404, not charged. Don't use this for CVEs not yet cached; they return 404 and are queued. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Input parameters:

- `id` (string, required): id

### `dragonseye_cve_batch` (~132 tokens)

Dragons Eye Lookup: GET /v1/cve-batch

Look up up to 50 CVEs in one call: KEV, EPSS, exploits and ATT&CK. $0.5 USDC on Base per call. Returns the /v1/cve record for each. Charged only if every CVE is covered; otherwise 404 before payment listing uncovered and covered ids. Don't use this for one CVE; /v1/cve costs less. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Input parameters:

- `ids` (string, required): ids

### `dragonseye_group_intel` (~137 tokens)

Dragons Eye Lookup: GET /v1/group-intel

Get intel on a ransomware group: activity trend, tools, malware, ATT&CK and CVEs. $0.05 USDC on Base per call. Returns leak-site listing counts with a momentum status (30-day vs lifetime), reported tools, co-mentioned malware, campaigns, ATT&CK techniques and CVEs (not attribution), headlines and D3FEND defenses. Don't use this for attribution; co-mentions are not proof. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Input parameters:

- `name` (string, required): name

### `freesmallbiztools_late_fee_notice` (~204 tokens)

Free Small Biz Tools API: GET /v1/late-fee-notice

Write a late-fee reminder email for an overdue invoice. $0.01 USDC on Base per call. Calculates the late fee and returns a ready-to-send subject and body in a polite, firm or final tone. Bad input returns 400 and is not charged. Don't use this for sending email; it only returns text. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Input parameters:

- `amount` (string, required): amount
- `business_name` (string): business_name
- `client_name` (string): client_name
- `due_date` (string, required): due_date
- `grace_days` (string): grace_days
- `invoice_number` (string): invoice_number
- `paid_date` (string): paid_date
- `rate` (string): rate
- `rate_type` (string): rate_type
- `tone` (string): tone

### `freesmallbiztools_quote_pack` (~204 tokens)

Free Small Biz Tools API: POST /v1/quote-pack

Turn a list of line items into a priced customer quote, with optional tax, discount, deposit, valid-days, currency, business name and better/best markup tiers. POST /v1/quote-pack. $0.05 USDC on Base per call. For plain totals only, use the free quote tool. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Input parameters:

- `best_markup_percent`: JSON body field best_markup_percent
- `better_markup_percent`: JSON body field better_markup_percent
- `business_name`: JSON body field business_name
- `currency`: JSON body field currency
- `deposit_percent`: JSON body field deposit_percent
- `discount_percent`: JSON body field discount_percent
- `items` (required): JSON body field items
- `tax_percent`: JSON body field tax_percent
- `valid_days`: JSON body field valid_days

### `freesmallbiztools_stack_report` (~157 tokens)

Free Small Biz Tools API: GET /v1/stack-report

Pick free or freemium software for a small business by business type. $1 USDC on Base per call. Returns one tool per need from freesmallbiztools.com's checked listings (vendor quote and check date), with alternatives and caveats. Types: service, trades, retail, online_store, creator, consultant, agency, nonprofit. Don't use this for paid enterprise software comparisons. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Input parameters:

- `business_type` (string, required): business_type
- `free_only` (string): free_only
- `needs` (string): needs
- `team_size` (string): team_size

### `inboxguards_report` (~182 tokens)

InboxGuards Email Test: GET /v1/report

Test why a real sent email lands in spam: SPF, DKIM, DMARC and deliverability report. $0.05 USDC on Base per call. Get a free test address via POST /v1/tests, send one email to it, then call this with test_id and X-Read-Token. Returns SPF, DKIM, DMARC, ARC, BIMI, rDNS, SpamCop, unsubscribe and content checks, a 0-100 score and top fixes. Don't use this for checking a domain without sending mail; use /v1/fix-plan. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Input parameters:

- `X-Read-Token` (string, required): X-Read-Token
- `test_id` (string, required): test_id

### `inboxguards_email_check` (~128 tokens)

InboxGuards Email Test: GET /v1/email-check

Validate an email address before sending: syntax, MX, disposable and role account. $0.005 USDC on Base per call. Returns a verdict of ok, risky or undeliverable with syntax, MX, disposable (CC0 list), role account and free provider flags. Bad syntax returns 400, not charged. Don't use this for confirming a mailbox exists; no SMTP probe is made. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Input parameters:

- `email` (string, required): email

### `inboxguards_fix_plan` (~135 tokens)

InboxGuards Email Test: GET /v1/fix-plan

Get the exact SPF, DKIM and DMARC DNS records to publish for a domain. $1 USDC on Base per call. Reads live MX, NS, SPF, DKIM and DMARC, detects the mail provider and DNS host, and returns records in order (create, replace or keep) with one merged SPF and a staged DMARC policy. Don't use this for testing a real sent message; use /v1/report. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Input parameters:

- `domain` (string, required): domain

### `mailsecuritytools_score` (~151 tokens)

Mail Security Tools API: GET /v1/score

Grade a domain's email security: SPF, DMARC, DKIM and MX score. $0.01 USDC on Base per call. Returns a 0-100 score and A-F grade (SPF 30, DMARC 40, DKIM 25, MX 5) from live DNS, with findings and the top 3 fixes. Bad input 400, unknown domain 404, not charged. Don't use this for the exact records to publish; use /v1/fix-plan. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Input parameters:

- `domain` (string, required): domain

### `mailsecuritytools_email_check` (~113 tokens)

Mail Security Tools API: GET /v1/email-check

Validate an email address: syntax, MX, disposable and role account. $0.01 USDC on Base per call. Returns a verdict of ok, risky or undeliverable without sending mail. Bad syntax returns 400, not charged. Don't use this for confirming a mailbox exists; no SMTP probe is made. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Input parameters:

- `email` (string, required): email

### `mailsecuritytools_fix_plan` (~150 tokens)

Mail Security Tools API: GET /v1/fix-plan

Get the exact SPF, DKIM and DMARC records to publish, with steps for your DNS host. $1 USDC on Base per call. Reads live MX, NS, SPF, DKIM and DMARC, detects the mail provider and DNS host, and returns records in order with a staged DMARC rollout. Non-sending domains get a lock-down set. Bad input 400, unknown domain 404, not charged. Don't use this for a quick grade; use /v1/score. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Input parameters:

- `domain` (string, required): domain

### `mailsecuritytools_bulk_score` (~138 tokens)

Mail Security Tools API: GET /v1/bulk-score

Score email security (SPF, DMARC, DKIM, MX) for up to 100 domains in one call. $0.5 USDC on Base per call. Returns per-domain score, grade and issues plus a summary: grade counts, missing DMARC/SPF and worst 10. Bad input 400 and widespread DNS failure 502, not charged. Don't use this for one domain; /v1/score costs less. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Input parameters:

- `domains` (string, required): domains

### `mailsecuritytools_watch` (~145 tokens)

Mail Security Tools API: POST /v1/watch

Monitor the email security setup of a list of domains (items) and send updates to your webhook_url. POST /v1/watch. $0.30 USDC on Base per call. Covers up to 25 domains for 30 days; SPF, DMARC, DKIM, MX and score are re-checked about once a day. For a one-time score, use /v1/score ($0.01). [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Input parameters:

- `items` (required): JSON body field items
- `webhook_url` (required): JSON body field webhook_url

### `paidpilot_invoice_pdf` (~216 tokens)

PaidPilot Invoice API: POST /v1/invoice.pdf

Generate an invoice PDF from JSON. $0.02 USDC on Base per call. Computes line items, tax, discount and totals server-side; 12 currencies; multi-page. Validate free first at POST /v1/invoice/validate. Don't use this for sending the invoice; it only returns the PDF. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Input parameters:

- `buyer` (required): JSON body field buyer
- `currency`: JSON body field currency
- `discount`: JSON body field discount
- `due_date`: JSON body field due_date
- `invoice_number` (required): JSON body field invoice_number
- `issue_date` (required): JSON body field issue_date
- `line_items` (required): JSON body field line_items
- `notes`: JSON body field notes
- `payment_instructions`: JSON body field payment_instructions
- `seller` (required): JSON body field seller
- `tax_rate`: JSON body field tax_rate

### `paidpilot_reminder_draft` (~224 tokens)

PaidPilot Invoice API: POST /v1/reminder-draft

Write a payment reminder email for an unpaid invoice (friendly, firm or final notice). $0.01 USDC on Base per call. Returns subject and plain-text body, days overdue, the recommended tone and the next step. Template-based and deterministic. Don't use this for sending email; it only drafts. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Input parameters:

- `amount`: JSON body field amount
- `as_of`: JSON body field as_of
- `client_name`: JSON body field client_name
- `currency`: JSON body field currency
- `due_date`: JSON body field due_date
- `final_deadline_days`: JSON body field final_deadline_days
- `from_name` (required): JSON body field from_name
- `invoice_number`: JSON body field invoice_number
- `late_fee_terms`: JSON body field late_fee_terms
- `payment_link`: JSON body field payment_link
- `tone` (required): JSON body field tone

### `paidpilot_late_fee` (~209 tokens)

PaidPilot Invoice API: POST /v1/late-fee

Calculate a late fee on an overdue invoice. $0.01 USDC on Base per call. Flat, monthly % or annual %, simple or compounding, with grace days. Returns days late, fee, new total and a paste-ready invoice line. Don't use this for legal advice; state caps are not looked up. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Input parameters:

- `amount` (required): JSON body field amount
- `as_of`: JSON body field as_of
- `compounding`: JSON body field compounding
- `currency`: JSON body field currency
- `due_date` (required): JSON body field due_date
- `fee_type` (required): JSON body field fee_type
- `flat_fee`: JSON body field flat_fee
- `grace_days`: JSON body field grace_days
- `rate_percent`: JSON body field rate_percent
- `state`: JSON body field state

### `paidpilot_payment_terms` (~186 tokens)

PaidPilot Invoice API: POST /v1/payment-terms

Work out an invoice due date and early-pay discount from terms like Net 30 or 2/10 Net 30. $0.01 USDC on Base per call. Parses Net N, D/N Net M, Due on receipt, EOM and Net N EOM. Returns due date, days until due or overdue, discount and deadline, the annualized cost of skipping it and reminder dates. Don't use this for late fees; use /v1/late-fee. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Input parameters:

- `amount`: JSON body field amount
- `as_of`: JSON body field as_of
- `currency`: JSON body field currency
- `invoice_date` (required): JSON body field invoice_date
- `terms` (required): JSON body field terms

### `paidpilot_invoice_from_timesheet` (~270 tokens)

PaidPilot Invoice API: POST /v1/invoice-from-timesheet

Turn timesheet entries into invoice JSON. $0.02 USDC on Base per call. Hours x rate, optional rounding, grouping, expenses, tax and terms become a validated invoice JSON with totals, ready for /v1/invoice.pdf. Don't use this for the PDF itself; send the result to /v1/invoice.pdf. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Input parameters:

- `buyer` (required): JSON body field buyer
- `currency`: JSON body field currency
- `default_rate`: JSON body field default_rate
- `discount`: JSON body field discount
- `due_date`: JSON body field due_date
- `entries` (required): JSON body field entries
- `expenses`: JSON body field expenses
- `group_by`: JSON body field group_by
- `invoice_number` (required): JSON body field invoice_number
- `issue_date` (required): JSON body field issue_date
- `notes`: JSON body field notes
- `payment_instructions`: JSON body field payment_instructions
- `rounding`: JSON body field rounding
- `seller` (required): JSON body field seller
- `tax_rate`: JSON body field tax_rate
- `terms`: JSON body field terms

### `paidpilot_receivables_report` (~200 tokens)

PaidPilot Invoice API: POST /v1/receivables-report

Analyze accounts receivable aging from an invoice CSV or JSON export. $1 USDC on Base per call. Takes up to 1000 open invoices (QuickBooks, Xero, FreshBooks, Wave, Stripe or custom). Returns an A-F health grade, 0-100 score, aging buckets, overdue %, DSO and a collection priority list. Don't use this for a single invoice; use /v1/reminder-draft or /v1/late-fee. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Input parameters:

- `as_of`: JSON body field as_of
- `csv`: JSON body field csv
- `currency`: JSON body field currency
- `default_terms`: JSON body field default_terms
- `invoices`: JSON body field invoices
- `revenue_window_days`: JSON body field revenue_window_days

### `pulsewatch_status` (~121 tokens)

PulseWatch Status API: GET /v1/status

Is a vendor down right now? Current outage status for one SaaS vendor. $0.01 USDC on Base per call. Returns status, active-incident summary, last-checked time, source URL and freshness fields, read live from PulseWatch. Unknown vendors return 404, not charged. Don't use this for past incidents; use /v1/incidents. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Input parameters:

- `vendor` (string, required): vendor

### `pulsewatch_incidents` (~117 tokens)

PulseWatch Status API: GET /v1/incidents

List recent outages and incidents for one SaaS vendor. $0.01 USDC on Base per call. Returns up to 10 most recent incidents (title, status, severity, start and resolve times) from PulseWatch. Unknown vendors return 404, not charged. Don't use this for live up/down status; use /v1/status. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Input parameters:

- `vendor` (string, required): vendor

### `aeoinspector_domain_report` (~131 tokens)

AEO Inspector: GET /api/v1/domain-report

Audit one domain for website security and AI search visibility (AEO) in one call. $2 USDC on Base per call. Returns a site security grade, an AEO grade and one priority-sorted fixes[] list with paste-ready DNS, robots.txt, llms.txt and JSON-LD fixes and verify commands. Don't use this for asking AI engines whether they mention the brand; use /report. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Input parameters:

- `url` (string, required): url

### `aeoinspector_report_page` (~146 tokens)

AEO Inspector: GET /report

Check if ChatGPT, Gemini, Claude, Perplexity and 12 other AI engines mention or cite a website. $9 USDC on Base per call. Returns per-engine answers to 5 category questions asked 3 times (240 answers), mention rate, citation rate, a visibility score and competitor share of mentions. Don't use this for technical crawl fixes; use /api/v1/scan. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Input parameters:

- `brand` (string): brand
- `topic` (string): topic
- `url` (string, required): url

### `aeoinspector_scan` (~136 tokens)

AEO Inspector: GET /api/v1/scan

Find why AI crawlers can't read a website, with paste-ready fixes. $0.05 USDC on Base per call. Crawls the homepage and up to 9 sitemap pages. Returns a score, grade and fixes covering robots.txt for 21 AI crawlers, AI bot blocks, browser vs crawler fetch gaps and JSON-LD checks. Don't use this for measuring brand mentions in AI answers; use /api/v1/report. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Input parameters:

- `url` (string, required): url

### `aeoinspector_report` (~145 tokens)

AEO Inspector: GET /api/v1/report

Check if ChatGPT, Gemini, Claude, Perplexity and 12 other AI engines mention or cite a website, as JSON. $9 USDC on Base per call. Same as /report: per-engine answers (240 total), mention rate, citation rate, visibility score and competitor share of mentions. Don't use this for a one-off crawl check; /api/v1/scan costs less. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Input parameters:

- `brand` (string): brand
- `topic` (string): topic
- `url` (string, required): url

### `aeoinspector_track` (~143 tokens)

AEO Inspector: POST /api/v1/track

Track a website's AI search visibility every week for 4 weeks. $19 USDC on Base per call. Runs the 16-engine report now, then each Monday until 4 successful runs. Returns a private tracking_url with a trend chart and competitor shifts, plus emails. Settles only if the first run succeeds (12+ of 16 engines). Don't use this for a single snapshot; use /api/v1/report. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Input parameters:

- `email` (string, required): email
- `url` (string, required): url

### `watchlist_watchlists` (~143 tokens)

Dragons Eye Watchlist: POST /v1/watchlists

Create a Dragons Eye watchlist from a list of entries (such as vendor domains), with a delivery target like a webhook_url, for ransomware claim alerts. POST /v1/watchlists. $2.00 USDC on Base per call. Covers up to 25 domains for 30 days; the response shows manage_token and webhook_secret once. For a one-time check, use the Dragons Eye lookup or bulk-check tools. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Input parameters:

- `delivery` (required): JSON body field delivery
- `entries` (required): JSON body field entries

### `watchlist_watchlists_renew` (~132 tokens)

Dragons Eye Watchlist: POST /v1/watchlists/renew

Renew an existing Dragons Eye watchlist by watchlist_id. You need the Authorization: Bearer manage_token you got when it was created. POST /v1/watchlists/renew. $2.00 USDC on Base per call. Adds 30 days. Don't use this to create a new watchlist; use /v1/watchlists. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Input parameters:

- `Authorization` (string, required): Authorization
- `watchlist_id` (required): JSON body field watchlist_id

### `vendorsafety_vendor_safety` (~144 tokens)

Vendor Safety Check: GET /v1/vendor-safety

Should we trust this vendor? One-call vendor safety check for a domain. $0.04 USDC on Base per call. Combines TLS certificate, DNS/DMARC, email-security score, ransomware leak-site claims (claims, not confirmed) and live outage status into a safe/caution/risk/incomplete verdict with reasons. Charged only if at least one check returns real data. Don't use this as proof of a breach. [x402: pays from the caller's wallet (X402_PRIVATE_KEY); without a key the tool returns the live 402 price only.]

Input parameters:

- `domain` (string, required): domain
- `vendor` (string): vendor

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/dario933-x402-paid-checks/x402-paid-checks-mcp#diagnostics

## Score history

- 2026-11-05: 64
- 2026-11-04: 64
- 2026-11-03: 64
- 2026-11-02: 64
- 2026-11-01: 64
- 2026-10-31: 64
- 2026-10-30: 64
- 2026-10-29: 61
- 2026-10-28: 61
- 2026-10-27: 61
- 2026-10-26: 61
- 2026-10-25: 61
- 2026-10-24: 46

## Common questions

### What is the io.github.dario933/x402-paid-checks MCP server?

io.github.dario933/x402-paid-checks is an MCP server listed in the public MCP registry as io.github.dario933/x402-paid-checks. Domain, email, vendor and ransomware checks paid per call in USDC via x402 from your wallet. This page covers its npm package (x402-paid-checks-mcp).

### Is the io.github.dario933/x402-paid-checks MCP server safe to use?

io.github.dario933/x402-paid-checks scores 64 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the io.github.dario933/x402-paid-checks MCP server expose?

io.github.dario933/x402-paid-checks exposes 53 tools: orioncmd_cert, orioncmd_dns, orioncmd_expiry, orioncmd_email_auth, orioncmd_headers, and 48 more. Their descriptions and schemas cost roughly 7,733 tokens of context every time the server is loaded.

### Is the io.github.dario933/x402-paid-checks MCP server still maintained?

io.github.dario933/x402-paid-checks is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the io.github.dario933/x402-paid-checks MCP server under?

io.github.dario933/x402-paid-checks declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- npm package: https://www.npmjs.com/package/x402-paid-checks-mcp
- Socket report: https://socket.dev/npm/package/x402-paid-checks-mcp
- Changelog RSS feed: https://verifymcp.io/servers/dario933-x402-paid-checks/x402-paid-checks-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/dario933-x402-paid-checks/x402-paid-checks-mcp.json
- HTML version of this page: https://verifymcp.io/servers/dario933-x402-paid-checks/x402-paid-checks-mcp