# dev.true402/mcp-server (npm · @true402.dev/mcp-server)

Pay-per-call AI + web + on-chain tools over x402 (USDC on Base): LLM, SEO, extract, token safety.

- Trust score: 68/100 (medium)
- Change this week: +41
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `@true402.dev/mcp-server`: 68/100 (this document), [markdown](https://verifymcp.io/servers/dev-true402-mcp-server/true402-dev-mcp-server.md), [page](https://verifymcp.io/servers/dev-true402-mcp-server/true402-dev-mcp-server)

## Channel facts

- Registry: `npm`
- Package: `@true402.dev/mcp-server`
- Version: `1.0.4`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (110 of 114), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (110 of 114), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 7 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 67/100
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 1402 tokens (~127/item across 11 items; 11 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add dev-true402-mcp-server -- npx -y @true402.dev/mcp-server
```

### Codex

```bash
codex mcp add dev-true402-mcp-server -- npx -y @true402.dev/mcp-server
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "dev-true402-mcp-server": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@true402.dev/mcp-server"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add dev-true402-mcp-server --command npx --arg -y --arg @true402.dev/mcp-server
```

### Hermes

```yaml
mcp_servers:
  dev-true402-mcp-server:
    command: "npx"
    args: ["-y", "@true402.dev/mcp-server"]
```

### Other

```json
{
  "mcpServers": {
    "dev-true402-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@true402.dev/mcp-server"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 68, +4)

- [functional improvement] Stability: unverified → 0.27

### 2026-08-02 (score 64, +51)

- [security regression] Provenance: fail → unverified
- [security regression] Install scripts: pass → unverified
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Malware scan: unverified → pass
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional regression] Maintenance: pass → unverified
- [functional regression] License: pass → unverified
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Tool coverage: unverified → 100
- [functional improvement] Dependency health: unverified → partial
- [functional] Licence: MIT

### 2026-08-01 (score 13, −39)

- [security regression] Known CVEs: partial → unverified
- [security] Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.
- [functional regression] Capabilities: pass → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional regression] Dependency health: partial → unverified
- [functional] First check of Schema quality: unverified

### 2026-07-31 (score 52, +14)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 38, −22)

- [security regression] Install scripts: pass → unverified
- [security regression] Known CVEs: partial → unverified
- [security regression] Provenance: fail → unverified
- [functional regression] Maintenance: pass → unverified
- [functional regression] Dependency health: partial → unverified
- [functional regression] License: pass → unverified
- [functional] Licence: MIT

### 2026-07-28 (score 60, +33)

- [security regression] Provenance: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [functional improvement] License: unverified → pass
- [functional improvement] Schema quality: unverified → good
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional] Licence: MIT

### 2026-07-27 (score 27)

First indexed and scored.

## MCP tools (11)

### `list_models` (~103 tokens)

List every LLM model available through true402's pay-per-call inference, with live per-token pricing (3% over provider cost, min $0.0001/request). Returns each model's id, provider, and input/output token prices across OpenAI, Anthropic, Google, Groq, Mistral and Together — so an agent can pick a model and know the exact cost before paying via x402 (USDC on Base, no account or API key).

### `chat` (~95 tokens)

Send a chat completion request to an LLM via true402 (PAID x402 service, USDC on Base). Requires a funded wallet (WALLET_PRIVATE_KEY) on the MCP server.

Input parameters:

- `max_tokens` (number): Maximum tokens to generate
- `messages` (array, required): Chat messages
- `model` (string, required): Model ID (e.g. gpt-4o, claude-3-5-sonnet)

### `seo_audit` (~124 tokens)

Audit a web page for SEO + GEO (generative-engine-optimization). Returns a structured JSON report: meta tags, an SEO score with per-category breakdown + issues, a GEO score with breakdown + issues, and a combined percentage. PAID x402 service (USDC on Base) — needs a funded wallet on the MCP server.

Input parameters:

- `mode` (string): Which audit(s) to run: 'both' (default), 'seo' only, or 'geo' only
- `url` (string, required): Absolute http(s) URL of the page to process

### `web_extract` (~81 tokens)

Fetch a URL and return its clean readable text, a light markdown rendering, all links (in document order), and metadata (title, description, word count, byte size). PAID x402 service (USDC on Base) — needs a funded wallet on the MCP server.

Input parameters:

- `url` (string, required): Absolute http(s) URL of the page to process

### `link_preview` (~90 tokens)

Fetch a URL and return its link-preview / Open Graph unfurl card: title, description, image, siteName, type, canonical URL, favicon, and theme color (image/canonical/favicon resolved to absolute URLs). PAID x402 service (USDC on Base) — needs a funded wallet on the MCP server.

Input parameters:

- `url` (string, required): Absolute http(s) URL of the page to process

### `robots_check` (~104 tokens)

Report a site's AI-crawler policy (GPTBot, ClaudeBot, Google-Extended, PerplexityBot, and ~15 other AI bots: allow | block | unspecified), plus declared sitemaps and whether an llms.txt is present. Pass any URL on the target site. PAID x402 service (USDC on Base) — needs a funded wallet on the MCP server.

Input parameters:

- `url` (string, required): Absolute http(s) URL of the page to process

### `headers_check` (~93 tokens)

Analyse a URL's HTTP security headers (HSTS, CSP, X-Frame-Options, and more) into a present/missing breakdown plus a 0-100 score, along with status, HTTPS flag, and server banner. PAID x402 service (USDC on Base) — needs a funded wallet on the MCP server.

Input parameters:

- `url` (string, required): Absolute http(s) URL of the page to process

### `token_safety` (~173 tokens)

Rug/honeypot safety check for an ERC-20 token on Base (on-chain reads, no API key): ERC-20 conformance, ownership renounce, mint capability, WETH/USDC liquidity depth (Uniswap V3 + Aerodrome), and a buy/sell honeypot simulation (a gas-free eth_call that round-trips a tiny WETH→token→WETH trade to catch tokens you can buy but not sell). Returns a 0-100 score + risk band + flags. PAID x402 service (USDC on Base) — needs a funded wallet on the MCP server.

Input parameters:

- `chain` (string): Chain to check; only 'base' is supported (default)
- `token` (string, required): ERC-20 contract address (0x…) on Base

### `new_pairs` (~173 tokens)

Recently-created Base DEX pairs (Uniswap V3 + Aerodrome) — fresh token launches for trading/sniper agents. Returns each new token, its quote (WETH/USDC), pool, fee|stable, block and approx age, newest first. Bundle with token_safety for a pre-trade rug/honeypot check. On-chain log indexing, no API key. PAID x402 service (USDC on Base) — needs a funded wallet on the MCP server.

Input parameters:

- `dex` (string): Filter by DEX
- `limit` (integer): Max pairs to return (1–200, default 50)
- `since` (integer): Only pairs first seen at or after this block
- `withToken` (boolean): Only token launches (vs all pools); default true

### `liquidity_pulls` (~176 tokens)

Liquidity-pull / rug alerts on Base — liquidity-removal (Burn) events on recently-launched DEX pools (Uniswap V3 + Aerodrome). Returns the pool, token, and WETH/USDC amount removed (the rug magnitude), newest first — an early rug warning. Cross-check the token with token_safety. On-chain log indexing, no API key. PAID x402 service (USDC on Base) — needs a funded wallet on the MCP server.

Input parameters:

- `dex` (string): Filter by DEX
- `limit` (integer): Max pulls to return (1–200, default 50)
- `minQuote` (number): Only removals of at least this much WETH/USDC
- `since` (integer): Only pulls first seen at or after this block

### `whale_swaps` (~190 tokens)

Recent large ($-value) Base DEX Swap events (whale trades) on tracked pools — a whale-following / copy-trade signal. Returns the pool, dex, token, quote (WETH/USDC), USD size, direction (buy/sell of the non-quote token), block and approx age, newest first. On-chain log indexing, no API key. PAID x402 service (USDC on Base) — needs a funded wallet on the MCP server.

Input parameters:

- `dex` (string): Filter by DEX
- `direction` (string): Filter by trade direction (of the non-quote token)
- `limit` (integer): Max swaps to return (1–200, default 50)
- `min` (number): Only swaps of at least this USD size (default 10000)
- `since` (integer): Only swaps at or after this block

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/dev-true402-mcp-server/true402-dev-mcp-server#diagnostics

## Score history

- 2026-08-03: 68
- 2026-08-02: 64
- 2026-08-01: 13
- 2026-07-31: 52
- 2026-07-30: 38
- 2026-07-29: 60
- 2026-07-28: 60
- 2026-07-27: 27

## Links

- npm package: https://www.npmjs.com/package/@true402.dev/mcp-server
- Socket report: https://socket.dev/npm/package/@true402.dev/mcp-server
- Repository: https://github.com/true402/mcp-server
- Website: https://true402.dev/
- Changelog RSS feed: https://verifymcp.io/servers/dev-true402-mcp-server/true402-dev-mcp-server/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/dev-true402-mcp-server/true402-dev-mcp-server/changelog.json
- HTML version of this page: https://verifymcp.io/servers/dev-true402-mcp-server/true402-dev-mcp-server