Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

dev.workers.kikoribera03.flat-rate-llm/x402-tools

REMOTE · FLAT-RATE-LLM.KIKORIBERA03.WORKERS.DEV

61 x402 pay-per-call tools that chain: each answer names the next call. No API key, no account.

Available components

remote · flat-rate-llm.kikoribera03.workers.dev 72
0 this week 72 Trust /100

Last scanned (3 hours ago)

Scores higher than 58% of remote servers

Reachable. Last reached 5 Nov 2026.

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →

Endpoint Security46
Transport & Reachability100
Schema Quality & AI Usability70
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 13734 tokens (~173/item across 79 items; 79 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
  • No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Tool Safety75
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • 0 of 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "evm_can_i_send" implies "send" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
  • An AI judge read all 80 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 5 Nov 26 0
    • Tool “security_prompt_injection” rewrote its description, which is the text the model reads security
    • Tool “time_convert” rewrote its description, which is the text the model reads security
    • Tool “time_now” rewrote its description, which is the text the model reads security
    • Tool “util_uuid” rewrote its description, which is the text the model reads security
  • 3 Nov 26 0
    • “do” added an optional parameter “auto_plan” cosmetic
    • “do” added an optional parameter “market_steps” cosmetic
    • “do” added an optional parameter “plan_steps” cosmetic

    3 cosmetic changes on this day. Switch on “Show cosmetic changes” to see them.

  • 27 Oct 26 −1
    • The server rewrote its instructions, which are the text every model session reads security
    • Tool “catalog” rewrote its description, which is the text the model reads security
    • Tool “evm_verdict” rewrote its description, which is the text the model reads security
    • Destructive annotations: pass → 0 functional
    • New tool “evm_can_i_send” functional
    • New tool “evm_gas_window” functional
    • New tool “messages” functional
    • New tool “security_prompt_injection” functional
    • New tool “x402_recommend” functional
    • “evm_verdict” added an optional parameter “requestKey” cosmetic
  • 26 Oct 26 −1
    • Tool “util_units” rewrote its description, which is the text the model reads security
    • Tool “util_sha256” rewrote its description, which is the text the model reads security
    • Tool “ai_document” rewrote its description, which is the text the model reads security
    • Tool “ai_image” rewrote its description, which is the text the model reads security
    • Tool “ai_image_describe” rewrote its description, which is the text the model reads security
    • Tool “ai_image_edit” rewrote its description, which is the text the model reads security
    • Tool “ai_image_styled” rewrote its description, which is the text the model reads security
    • Tool “ai_speech” rewrote its description, which is the text the model reads security
    • Tool “ai_transcribe” rewrote its description, which is the text the model reads security
    • Tool “ai_translate” rewrote its description, which is the text the model reads security
    • Tool “chat_completions” rewrote its description, which is the text the model reads security
    • Tool “content_advice” rewrote its description, which is the text the model reads security
    • Tool “content_fact” rewrote its description, which is the text the model reads security
    • Tool “content_horror_story” rewrote its description, which is the text the model reads security
    • Tool “content_joke” rewrote its description, which is the text the model reads security
    • Tool “content_riddle” rewrote its description, which is the text the model reads security
    • Tool “content_roast” rewrote its description, which is the text the model reads security
    • Tool “content_word_of_the_day” rewrote its description, which is the text the model reads security
    • Tool “crypto_sanctions” rewrote its description, which is the text the model reads security
    • Tool “do” rewrote its description, which is the text the model reads security
    • Tool “evm_balance” rewrote its description, which is the text the model reads security
    • Tool “evm_block” rewrote its description, which is the text the model reads security
    • Tool “evm_call” rewrote its description, which is the text the model reads security
    • Tool “evm_chains” rewrote its description, which is the text the model reads security
    • Tool “evm_ens” rewrote its description, which is the text the model reads security
    • Tool “evm_erc20_allowance” rewrote its description, which is the text the model reads security
    • Tool “evm_erc20_balance” rewrote its description, which is the text the model reads security
    • Tool “evm_estimate_gas” rewrote its description, which is the text the model reads security
    • Tool “evm_fees” rewrote its description, which is the text the model reads security
    • Tool “evm_gas” rewrote its description, which is the text the model reads security
    • Tool “evm_is_contract” rewrote its description, which is the text the model reads security
    • Tool “evm_nft_owner” rewrote its description, which is the text the model reads security
    • Tool “evm_nonce” rewrote its description, which is the text the model reads security
    • Tool “evm_portfolio” rewrote its description, which is the text the model reads security
    • Tool “evm_receipt” rewrote its description, which is the text the model reads security
    • Tool “evm_storage” rewrote its description, which is the text the model reads security
    • Tool “evm_token_info” rewrote its description, which is the text the model reads security
    • Tool “evm_token_price” rewrote its description, which is the text the model reads security
    • Tool “evm_token_safety” rewrote its description, which is the text the model reads security
    • Tool “evm_tx” rewrote its description, which is the text the model reads security
    • Tool “evm_verdict” rewrote its description, which is the text the model reads security
    • Tool “fx_convert” rewrote its description, which is the text the model reads security
    • Tool “random_coinflip” rewrote its description, which is the text the model reads security
    • Tool “random_dice” rewrote its description, which is the text the model reads security
    • Tool “random_number” rewrote its description, which is the text the model reads security
    • Tool “random_password” rewrote its description, which is the text the model reads security
    • Tool “random_pick” rewrote its description, which is the text the model reads security
    • Tool “random_shuffle” rewrote its description, which is the text the model reads security
    • Tool “red_asn” rewrote its description, which is the text the model reads security
    • Tool “red_cert” rewrote its description, which is the text the model reads security
    • Tool “red_dnsbl” rewrote its description, which is the text the model reads security
    • Tool “red_domain_check” rewrote its description, which is the text the model reads security
    • Tool “red_email_check” rewrote its description, which is the text the model reads security
    • Tool “red_ip” rewrote its description, which is the text the model reads security
    • Tool “red_whois” rewrote its description, which is the text the model reads security
    • Tool “time_convert” rewrote its description, which is the text the model reads security
    • Tool “time_now” rewrote its description, which is the text the model reads security
    • Tool “time_zones” rewrote its description, which is the text the model reads security
    • Tool “util_address” rewrote its description, which is the text the model reads security
    • Tool “util_base64” rewrote its description, which is the text the model reads security
    • Tool “util_hex” rewrote its description, which is the text the model reads security
    • Tool “util_iban” rewrote its description, which is the text the model reads security
    • Tool “util_keccak256” rewrote its description, which is the text the model reads security
    • Tool “util_phone” rewrote its description, which is the text the model reads security
    • Tool “util_selector” rewrote its description, which is the text the model reads security
    • Tool “util_uuid” rewrote its description, which is the text the model reads security
    • Tool “util_vat” rewrote its description, which is the text the model reads security
    • Tool “util_verify_signature” rewrote its description, which is the text the model reads security
    • Tool “weather_forecast” rewrote its description, which is the text the model reads security
    • Tool “weather_now” rewrote its description, which is the text the model reads security
    • Tool “web_read” rewrote its description, which is the text the model reads security
    • Tool “web_status” rewrote its description, which is the text the model reads security
    • Schema quality: 136 → 165 ▼ functional
  • 18 Oct 26 0
    • The server rewrote its instructions, which are the text every model session reads security
    • Tool “catalog” rewrote its description, which is the text the model reads security
    • Tool “llm_completion” rewrote its description, which is the text the model reads security
    • New tool “chat_completions” functional
  • 13 Oct 26 0
    • Tool “do” rewrote its description, which is the text the model reads security
  • 12 Oct 26 0
    • The server rewrote its instructions, which are the text every model session reads security
    • Tool “catalog” rewrote its description, which is the text the model reads security
    • New tool “do” functional
    • New tool “evm_verdict” functional
  • 9 Oct 26 +2
    • Stability: 0.90 → pass security
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 5 Nov 2026 · Probed https://flat-rate-llm.kikoribera03.workers.dev/mcp

TLS valid

Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .

Subject Issuer Valid from Valid until Key Signature Serial
CN=kikoribera03.workers.dev CN=WE1,O=Google Trust Services,C=US 8 Sept 2026 7 Dec 2026 ECDSA 256 ECDSA-SHA256 9e9a4a2d2a49facd13f6a9a565df5132
SANs: kikoribera03.workers.dev, *.kikoribera03.workers.dev
CN=WE1,O=Google Trust Services,C=US (CA) CN=GTS Root R4,O=Google Trust Services LLC,C=US 13 Dec 2023 20 Feb 2029 ECDSA 256 ECDSA-SHA384 7ff31977972c224a76155d13b6d685e3
CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE 15 Nov 2023 28 Jan 2028 ECDSA 384 SHA256-RSA 7fe530bf331343bedd821610493d8a1b

Background: What to check on a remote MCP endpoint →

DNSSEC insecure

Validation of flat-rate-llm.kikoribera03.workers.dev. — Not signed

Zone DS Keys Algorithms Outcome
. trust_anchor 20326, 38696 8, 8 Verified
dev. present 60074 8 Verified
workers.dev. absent Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation
Authentication No authorisation required

The endpoint answered without asking for a token. Anyone who knows the URL can reach it.

Result No authorisation required
HTTP status 200

Background: How OAuth 2.1 works in the 2026 MCP spec →

Transports 2 probes
Transport URL Outcome Status Location
streamable-http https://flat-rate-llm.kikoribera03.workers.dev/mcp Verified 200
http (plaintext) http://flat-rate-llm.kikoribera03.workers.dev/mcp Served over HTTP 200
MCP tools · 79 exposed · ~13,662 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
random_shuffle ~125

Use when an agent must put a list in an order nobody can claim was arranged: a uniformly random shuffle with Fisher-Yates over the platform CSPRNG, so every permutation is equally likely, which sorting by a random key does not give you. Do not use to take just one or a few items (/v1/random/pick). No API key, no account. $0.005 per call, paid over x402 (USDC).

NameTypeReqDescription
itemsstringyesThe list to shuffle, comma-separated. A JSON array of strings is also accepted in a POST body.

No output schema declared.

No examples provided.

red_asn ~151

Use when an agent has an origin ASN and must decide who is behind a network and whether it is still live: the RDAP registry record (holder, status, allocation dates, abuse contact), the AS name, country and RIR, and the prefixes it announces right now, split IPv4 and IPv6 with a sample. The natural second call after /v1/red/ip. Do not use for one address (/v1/red/ip) or for a domain (/v1/red/whois). $0.005 per call, paid over x402 (USDC).

NameTypeReqDescription
asnstringyesThe AS number, with or without the AS prefix: 15169 or AS15169.

No output schema declared.

No examples provided.

red_cert ~152

Use when an agent must audit what certificates exist for a domain: every currently valid one publicly issued for it, read from the Certificate Transparency logs - issuer, validity window, days to expiry, revocation status and every hostname each certificate covers. It reports what was ISSUED, which is how you find certificates you did not know existed - not what the server is serving today. No API key, no account. $0.005 per call, paid over x402 (USDC).

NameTypeReqDescription
domainstringyesThe domain to look up. A full URL or an email address is accepted and reduced to its host.
subdomainsboolean–Also return certificates issued for subdomains. Defaults to false.

No output schema declared.

No examples provided.

red_dnsbl ~161

Use when an agent must decide whether an IP is already known for abuse: it checks one IPv4 address against nine public DNS blocklists at once — SpamCop, UCEPROTECT, PSBL, Barracuda, DroneBL and four more — and returns each list's raw code and the reason text it publishes, not a score. Every list is re-checked on each call with its RFC 5782 test entry, so a dead list comes back as unavailable instead of reading as clean. Includes the delisting URL for each hit. $0.005 per call, paid over x402 (USDC).

NameTypeReqDescription
ipstringyesThe IPv4 address to check. IPv6 is not accepted: these nine lists are IPv4 zones.

No output schema declared.

No examples provided.

red_domain_check ~131

Use when an agent must decide whether a domain is real and reachable before trusting it: everything DNS says about it in one call - whether it is registered, its A and AAAA addresses, nameservers, MX servers, SPF and DMARC, DNSSEC, and whether it looks parked. Built for going through a list of domains one at a time. Live DNS, no API key, no account. $0.005 per call, paid over x402 (USDC).

NameTypeReqDescription
domainstringyesThe domain to check. A full URL or an email address is accepted and reduced to its host.

No output schema declared.

No examples provided.

red_email_check ~162

Use when an agent must decide whether to write to an address, or clean a list before sending: it scores one email 0-100 with a verdict (ok, risky, disposable, undeliverable, invalid) and the evidence under it: every point lost is itemised with the field that proves it. 12,141 disposable domains from two maintained open lists pinned to a commit, 4,897 free providers, 1,018 role names, typo fix (gmial.com > gmail.com), live MX/SPF/DMARC. No SMTP probe, no API key. $0.005 per call, paid over x402 (USDC).

NameTypeReqDescription
emailstringyesThe address to check, e.g. someone@example.com.

No output schema declared.

No examples provided.

red_ip ~146

Use when an agent must decide who an IP belongs to before blocking or trusting it: one IPv4 or IPv6 address against the two authoritative, keyless public sources - RDAP registry data (holder, country, date, abuse contact) via the ARIN-to-RIR chain, and the origin ASN from Team Cymru's DNS service. No city-level geolocation and no VPN/proxy detection: that needs a licensed database this route deliberately does not use. Built for going through a list of IPs one at a time. $0.005 per call, paid over x402 (USDC).

NameTypeReqDescription
ipstringyesThe IPv4 or IPv6 address to look up.

No output schema declared.

No examples provided.

red_whois ~154

Use when an agent must judge how established a domain is, or when it expires: registration data read from the registry's own RDAP service through the IANA bootstrap — not scraped from port-43 whois text. Returns creation, expiry and last-change dates, age and days to expiry, registrar, EPP status codes, nameservers, DNSSEC and the abuse contact. TLDs with no RDAP server say so instead of reporting the domain as unregistered. No API key, no account. $0.005 per call, paid over x402 (USDC).

NameTypeReqDescription
domainstringyesThe domain to look up. A full URL or an email address is accepted and reduced to its host.

No output schema declared.

No examples provided.

security_prompt_injection ~208

Use when untrusted text - an email, a web page, another tool's output - enters a model's context and may carry instructions aimed at your agent. Returns safe/suspicious/malicious, a 0-1 score and each match with its excerpt, offset and what it would do. Also decodes base64, hex, URL-encoded and reversed payloads, and flags invisible characters. Deterministic, no model, and it says what it could not inspect. Not for ERC20 contracts (/v1/evm/token-safety). Flat price, no key. $0.003 per call, paid over x402 (USDC).

NameTypeReqDescription
sourcestring–Optional label echoed back, so a batch of calls can be matched to its items (for example "email:1842").
textstringyesThe untrusted text to classify, up to 32 kB. Anything longer is truncated and the response says so in unknown[].

No output schema declared.

No examples provided.

time_convert ~210

Use when an agent is about to commit to a time in someone else's zone and cannot be an hour wrong: converts between any two IANA zones with daylight saving applied from the runtime's own tz database. Returns both sides with their UTC offset, abbreviation and DST flag, plus the UTC instant and the difference in hours. Warns when the time asked for does not exist or happens twice because the clocks change that day: the two cases that quietly make a hand-made conversion wrong. $0.0018 per call, paid over x402 (USDC).

NameTypeReqDescription
fromstringyesSource IANA time zone, e.g. "Europe/Madrid". Required.
timestring–Wall clock as YYYY-MM-DD HH:MM in the "from" zone, or an ISO string with Z or an offset, or a unix timestamp, or "now". Defaults to now.
tostringyesTarget IANA time zone, e.g. "Asia/Tokyo". Required.

No output schema declared.

No examples provided.

time_now ~120

Use when an agent must stamp or schedule something in a particular place and needs every form at once: ISO with offset, 24-hour, 12-hour, weekday, unix timestamp and UTC. It also says whether daylight saving is active right now and what the zone's standard offset is, so a shifted clock can be told apart from a permanent one. $0.002 per call, paid over x402 (USDC).

NameTypeReqDescription
zonestringyesIANA time zone, e.g. "Asia/Tokyo" or "UTC". Required.

No output schema declared.

No examples provided.

time_zones ~172

Use when an agent has a city or a country and needs the exact zone name the other routes expect: searches the full IANA list and gives each zone's current UTC offset, abbreviation, local time and DST state. Use it to turn a city or a country into the exact zone name the other endpoints expect, or to find every zone sitting at a given offset right now. $0.005 per call, paid over x402 (USDC).

NameTypeReqDescription
limitnumber–Maximum zones returned, 1-500. Defaults to 50.
offsetstring–Keep only zones at this current UTC offset, e.g. "+09:00" or "-5".
searchstring–Substring matched against the zone name, case-insensitive. Omit to list them all.

No output schema declared.

No examples provided.

util_address ~132

Use when an agent is handed an address and must decide whether it is safe to use before sending anything: it validates it and returns the EIP-55 mixed-case checksum form, plus whether the input was already checksummed. An address that fails the checksum is almost always mistyped. Do not use to find out whether it is a wallet or a contract (/v1/evm/is-contract) or to resolve a name (/v1/evm/ens). $0.005 per call, paid over x402 (USDC).

NameTypeReqDescription
addressstringyesThe address to validate, in any case.

No output schema declared.

No examples provided.

util_base64 ~163

Use when an agent must put bytes through a header, a URL or a JSON field, or read what came back: base64 in both directions, including the URL-safe alphabet, with UTF-8 handled properly. x402 itself rides on base64, so this is the one that reads a payment header. Do not use for hashing (/v1/util/sha256) or for hex (/v1/util/hex). No API key, no account. $0.005 per call, paid over x402 (USDC).

NameTypeReqDescription
inputstringyesThe text or base64 to convert.
modestring–encode | decode. Defaults to encode.
urlSafeboolean–Use the URL-safe alphabet (-_ instead of +/).

No output schema declared.

No examples provided.

util_hex ~141

Use when an agent has raw RPC output and must read it as a number or as text: converts between hex, decimal and UTF-8 in one call, with big integers kept exact because a 32-byte word overflows a JavaScript number. Do not use to decode a whole ABI-encoded struct: this converts one value. No API key, no account. $0.005 per call, paid over x402 (USDC).

NameTypeReqDescription
asstring–hex | decimal | text. What the value IS. Defaults to autodetect.
valuestringyesA 0x-prefixed hex string, a decimal number, or text.

No output schema declared.

No examples provided.

util_iban ~124

Use when an agent must decide whether a bank account it was given can be paid before trying: validates one IBAN offline - country, expected length, ISO 7064 mod-97 check digits, whether it is inside SEPA, and the account number split out. Deterministic, no network call and no third party that can go down. Built for cleaning a list of accounts one at a time. $0.005 per call, paid over x402 (USDC).

NameTypeReqDescription
ibanstringyesThe IBAN to check. Spaces and lowercase are accepted.

No output schema declared.

No examples provided.

util_keccak256 ~149

Use when an agent is building something Ethereum will hash and must get the same digest the chain gets: Keccak-256 of any string or hex payload, with the byte count. It is NOT SHA3-256, and that confusion is the usual reason a selector or a CREATE2 address comes out wrong. Do not use for file digests or API signatures outside Ethereum (/v1/util/sha256) or for a function selector, which is already built for you (/v1/util/selector). $0.005 per call, paid over x402 (USDC).

NameTypeReqDescription
inputstringyesPlain text, or a 0x-prefixed hex payload to hash as bytes.

No output schema declared.

No examples provided.

util_phone ~186

Use when an agent must decide whether a phone number is usable before writing or calling: checks it offline, normalises it to E.164, works out its country (including the twelve calling codes shared by several countries) and validates the national length against that country's numbering plan, returning the tel: URI and the national dialling form. Data from Google's libphonenumber, no network call, so it cannot fail because a third party is down. $0.005 per call, paid over x402 (USDC).

NameTypeReqDescription
countrystring–Optional ISO 3166-1 alpha-2 country, e.g. ES. Only used when the number carries no country code.
phonestringyesThe phone number, in any usual notation: +34 612 34 56 78, 0034612345678, (612) 345-678.

No output schema declared.

No examples provided.

util_selector ~134

Use when an agent is building calldata by hand or filtering logs and needs the exact identifiers: it turns a Solidity signature such as transfer(address,uint256) into its 4-byte function selector and its 32-byte event topic0. Do not use to run the call once you have the calldata (/v1/evm/call) or to hash arbitrary data (/v1/util/keccak256). No API key, no account. $0.005 per call, paid over x402 (USDC).

NameTypeReqDescription
signaturestringyesCanonical signature: name(type1,type2), no spaces and no argument names.

No output schema declared.

No examples provided.

util_sha256 ~137

Use when an agent must prove two payloads are the same byte for byte, or sign an API request: SHA-256 of any string or hex payload, returned as hex and as base64, which are the two forms signatures and content addresses are written in. Do not use for anything Ethereum hashes: the chain uses Keccak-256 (/v1/util/keccak256), which gives a different digest. No API key, no account. $0.005 per call, paid over x402 (USDC).

NameTypeReqDescription
inputstringyesPlain text, or a 0x-prefixed hex payload to hash as bytes.

No output schema declared.

No examples provided.

util_units ~168

Use when an agent must turn an on-chain integer into a human amount, or back, without losing money to rounding: converts between wei, gwei, ether and any token decimals with exact integer maths, no floating point. Being off by a factor of a thousand on decimals is the mistake that costs real funds. Do not use to find a token's decimals (/v1/evm/token-info returns them). No API key, no account. $0.005 per call, paid over x402 (USDC).

NameTypeReqDescription
amountstringyesThe quantity, as a string to avoid float loss.
fromstringyeswei | gwei | ether, or a number of decimals.
tostringyeswei | gwei | ether, or a number of decimals.

No output schema declared.

No examples provided.

util_uuid ~133

Use when an agent needs ids that must not collide: cryptographically random UUID v4s, up to 100 in one call, straight from the platform CSPRNG. For idempotency keys, request ids and correlation ids, where a repeat means a duplicate charge or a lost trace. Do not use for a secret or a password (/v1/random/password reports its entropy) or for a hash (/v1/util/sha256). $0.002 per call, paid over x402 (USDC).

NameTypeReqDescription
countnumber–How many to generate, 1-100. Defaults to 1.

No output schema declared.

No examples provided.

util_vat ~121

Use when an agent must decide whether a company's tax number is usable before invoicing: validates one EU VAT number offline - country prefix, the format that country uses, and the published check-digit algorithm where one exists. Says explicitly whether the check digits were verified or only the format. Deterministic, no network call. Built for cleaning a list of companies one at a time. $0.005 per call, paid over x402 (USDC).

NameTypeReqDescription
vatstringyesThe VAT number, with or without the country prefix and with any spacing.

No output schema declared.

No examples provided.

util_verify_signature ~154

Use when an agent must decide whether whoever is talking to it really controls a wallet: it recovers the address that signed a personal_sign (EIP-191) message and says whether it matches the one you expected. This is the check that turns a claimed address into a proven one. Do not use for EIP-712 typed data or for a contract signature (ERC-1271): this route verifies personal_sign. $0.005 per call, paid over x402 (USDC).

NameTypeReqDescription
expectedstring–Optional address to compare the recovered signer against.
messagestringyesThe exact message that was signed.
signaturestringyes65-byte 0x signature from personal_sign.

No output schema declared.

No examples provided.

weather_forecast ~175

Use when an agent is choosing a date and has to justify the choice: a day-by-day forecast for any point on Earth, up to nine days out, from the Norwegian Meteorological Institute's official model. Each day carries its minimum and maximum temperature, total precipitation, strongest wind and the midday symbol, with the exact model run and the institute's declared units. $0.01 per call, paid over x402 (USDC).

NameTypeReqDescription
daysnumber–How many days to return, 1-9. Defaults to 5. The last day is usually partial and says so.
latnumberyesLatitude in decimal degrees, -90 to 90. Rounded to 4 decimals.
lonnumberyesLongitude in decimal degrees, -180 to 180. Rounded to 4 decimals.

No output schema declared.

No examples provided.

weather_now ~187

Use when an agent must act on the weather right now and be able to cite it: current conditions for any point on Earth, from the Norwegian Meteorological Institute's official model, not an aggregator. Returns temperature, humidity, pressure, wind speed and bearing, cloud cover and the next hour's precipitation, plus the exact model run it came from and the units the institute itself declares, so the figure can be checked. $0.01 per call, paid over x402 (USDC).

NameTypeReqDescription
hoursnumber–How many hourly steps to include after the current one, 0-24. Defaults to 6.
latnumberyesLatitude in decimal degrees, -90 to 90. Rounded to 4 decimals, which is what the institute accepts.
lonnumberyesLongitude in decimal degrees, -180 to 180. Rounded to 4 decimals.

No output schema declared.

No examples provided.

web_read ~146

Use when an agent needs what a page SAYS and not its HTML: it fetches one URL and returns the readable page as markdown - title, description, headings, paragraphs and links with their destinations, plus the canonical URL, language and word count. Boilerplate, scripts and navigation are stripped. Built for going through a list of links one at a time. No API key, no account. $0.01 per call, paid over x402 (USDC).

NameTypeReqDescription
linksboolean–Also return the outbound links as a list. Defaults to false.
urlstringyesThe page to read. http and https only; private and loopback addresses are refused.

No output schema declared.

No examples provided.

web_status ~159

Use when an agent must decide whether a link is alive and where it really lands, without paying for the page: it checks one URL without downloading it - HTTP status, the full redirect chain hop by hop with the code of each, the final URL, whether it ends on HTTPS, content type and size, and the security headers the server sends. Built for going through a list of links one at a time. No API key, no account. $0.005 per call, paid over x402 (USDC).

NameTypeReqDescription
methodstring–HEAD (default) or GET. Some servers refuse HEAD and only answer GET.
urlstringyesThe URL to check. http and https only; private and loopback addresses are refused.

No output schema declared.

No examples provided.

x402_recommend ~207

Use when your agent has a task it cannot do itself and must pick which paid x402 endpoint to call. Returns up to 5 ranked candidates with URL, price, network, method and the seller's own example body - plus the evidence: we challenged it ourselves and it answered 402, and its real payer and repeat counts. Never recommends our own endpoints: the index excludes them by construction. If nothing qualifies you get the near misses and why, never filler. Deterministic, no model. $0.01 per call, paid over x402 (USDC).

NameTypeReqDescription
maxnumber–How many candidates to return, 1 to 5. Default 3.
maxPricenumber–Optional ceiling in USD per call, for example 0.01. Candidates above it are dropped.
needstringyesThe task, in plain words. Scored against the name, tags, description and URL of every verified endpoint in the index.

No output schema declared.

No examples provided.

Install

How do I install the dev.workers.kikoribera03.flat-rate-llm/x402-tools MCP server?

dev.workers.kikoribera03.flat-rate-llm/x402-tools is a hosted endpoint at https://flat-rate-llm.kikoribera03.workers.dev/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

remote · flat-rate-llm.kikoribera03.workers.dev

# add to Claude Code
claude mcp add --transport http dev-workers-kikoribera03-flat-rate-llm-x402-tool 'https://flat-rate-llm.kikoribera03.workers.dev/mcp'
Common questions

What is the dev.workers.kikoribera03.flat-rate-llm/x402-tools MCP server?

dev.workers.kikoribera03.flat-rate-llm/x402-tools is an MCP server listed in the public MCP registry as dev.workers.kikoribera03.flat-rate-llm/x402-tools. 61 x402 pay-per-call tools that chain: each answer names the next call. No API key, no account. This page covers its hosted endpoint (https://flat-rate-llm.kikoribera03.workers.dev/mcp).

Is the dev.workers.kikoribera03.flat-rate-llm/x402-tools MCP server safe to use?

dev.workers.kikoribera03.flat-rate-llm/x402-tools scores 72 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the dev.workers.kikoribera03.flat-rate-llm/x402-tools MCP server expose?

dev.workers.kikoribera03.flat-rate-llm/x402-tools exposes 79 tools: catalog, llm_completion, do, evm_balance, evm_erc20_balance, and 74 more. Their descriptions and schemas cost roughly 13,662 tokens of context every time the server is loaded.

Does the dev.workers.kikoribera03.flat-rate-llm/x402-tools MCP server require authentication?

No. We connected to dev.workers.kikoribera03.flat-rate-llm/x402-tools without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

Is the dev.workers.kikoribera03.flat-rate-llm/x402-tools MCP server still maintained?

dev.workers.kikoribera03.flat-rate-llm/x402-tools is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.