# Agent Utils (x402) (remote · agent-utils-x402-production.revenue-agent-jw.workers.dev)

Public records, email-auth DNS and OSV package vuln checks for agents: SEC, FDA, trials. x402 USDC

- Trust score: 68/100 (medium)
- Change this week: +3
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- remote · `agent-utils-x402-production.revenue-agent-jw.workers.dev`: 68/100 (this document), [markdown](https://verifymcp.io/servers/dev-workers-revenue-agent-jw-agent-utils-x402-production-agent-utils/agent-utils-x402-production.md), [page](https://verifymcp.io/servers/dev-workers-revenue-agent-jw-agent-utils-x402-production-agent-utils/agent-utils-x402-production)

## Channel facts

- Endpoint: `https://agent-utils-x402-production.revenue-agent-jw.workers.dev/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `1.7.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Endpoint Security**: 63/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - No authorisation is required to call this server. Nothing on it is marked destructive, but we can't show that an anonymous caller can only read: full credit needs the server to list at least one tool and every tool to be verifiably read-only. We use a best-effort check of tool names and descriptions to tell read-only tools from tools that change things, so some genuinely read-only tools may not get full credit. Names that start with a read verb (get, list, read, search and similar) and accurate readOnlyHint annotations help. Meet that to earn full credit, or require authorisation.
  - HTTPS enforcement could not be verified: the plaintext port answered with HTTP 405, which proves neither a plaintext path nor enforcement.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 59/100
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 4486 tokens (~213/item across 21 items; 21 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 47/100
  - Stability observed for 14 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 88/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 65% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 21 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 22 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 60/100
  - Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28.

## Install

### How do I install the Agent Utils (x402) MCP server?

Agent Utils (x402) is a hosted endpoint at https://agent-utils-x402-production.revenue-agent-jw.workers.dev/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http dev-workers-revenue-agent-jw-agent-utils-x402-pr 'https://agent-utils-x402-production.revenue-agent-jw.workers.dev/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "dev-workers-revenue-agent-jw-agent-utils-x402-pr": {
      "url": "https://agent-utils-x402-production.revenue-agent-jw.workers.dev/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "dev-workers-revenue-agent-jw-agent-utils-x402-pr": {
      "type": "http",
      "url": "https://agent-utils-x402-production.revenue-agent-jw.workers.dev/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.dev-workers-revenue-agent-jw-agent-utils-x402-pr]
url = "https://agent-utils-x402-production.revenue-agent-jw.workers.dev/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "dev-workers-revenue-agent-jw-agent-utils-x402-pr": {
      "type": "remote",
      "url": "https://agent-utils-x402-production.revenue-agent-jw.workers.dev/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add dev-workers-revenue-agent-jw-agent-utils-x402-pr --url 'https://agent-utils-x402-production.revenue-agent-jw.workers.dev/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  dev-workers-revenue-agent-jw-agent-utils-x402-pr:
    url: "https://agent-utils-x402-production.revenue-agent-jw.workers.dev/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "dev-workers-revenue-agent-jw-agent-utils-x402-pr": {
      "Transport": "http",
      "Url": "https://agent-utils-x402-production.revenue-agent-jw.workers.dev/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add dev-workers-revenue-agent-jw-agent-utils-x402-pr -t streamable-http -u 'https://agent-utils-x402-production.revenue-agent-jw.workers.dev/mcp'
```

### Other

```json
{
  "mcpServers": {
    "dev-workers-revenue-agent-jw-agent-utils-x402-pr": {
      "type": "http",
      "url": "https://agent-utils-x402-production.revenue-agent-jw.workers.dev/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-05 (score 68, +1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-11-04 (score 67, 0)

- [functional] Server version: 1.5.0 → 1.6.0
- [functional] New tool “email_auth_audit”

### 2026-11-03 (score 67, +1)

- [security] The server rewrote its instructions, which are the text every model session reads
- [security] Tool “caller_avoidance_score” rewrote its description, which is the text the model reads
- [security] Tool “climate_day” rewrote its description, which is the text the model reads
- [security] Tool “recall_check” rewrote its description, which is the text the model reads
- [security] Tool “sec_filings” rewrote its description, which is the text the model reads
- [security] Tool “us_business_days” rewrote its description, which is the text the model reads
- [security] Tool “us_weather” rewrote its description, which is the text the model reads
- [security] Tool “x402_check” rewrote its description, which is the text the model reads
- [functional regression] Schema quality: 1932 → 3761
- [functional] Server version: 1.4.0 → 1.5.0
- [functional] New tool “clinical_trial_study”
- [functional] New tool “clinical_trials_search”
- [functional] New tool “fda_adverse_events”
- [functional] New tool “fda_drug_label”
- [functional] New tool “fda_ndc_lookup”
- [functional] New tool “federal_register_search”
- [functional] New tool “sec_13f_holdings”
- [functional] New tool “sec_8k_filings”

### 2026-11-01 (score 66, +1)

No change was recorded against any check on this day. Stability & Change Management went from 30 to 33. That category is still filling its 30-day observation window: 9 days of observed history at the previous scan, 10 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-31 (score 65, 0)

- [security] Tool “climate_day” rewrote its description, which is the text the model reads
- [security] Tool “injection_scan” rewrote its description, which is the text the model reads
- [security] Tool “recall_check” rewrote its description, which is the text the model reads
- [security] Tool “sanctions_address_check” rewrote its description, which is the text the model reads
- [security] Tool “sec_filings” rewrote its description, which is the text the model reads
- [security] Tool “us_business_days” rewrote its description, which is the text the model reads
- [security] Tool “us_weather” rewrote its description, which is the text the model reads
- [security] Tool “x402_check” rewrote its description, which is the text the model reads
- [functional regression] Schema quality: 173 → 193

### 2026-10-29 (score 65, +1)

No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-27 (score 64, +1)

No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-25 (score 63, +1)

No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.

## MCP tools (21)

### `recall_check` (~295 tokens)

US recall check (NHTSA, CPSC, FDA)

Product and vehicle recall lookup across US agencies in one call: NHTSA (cars, by VIN or make/model/year), CPSC (consumer products, by UPC or product name) and FDA enforcement reports (food, drugs, medical devices). Useful for safety checks before buying, selling or using a product or vehicle. Returns normalized recalls (number, date, hazard/reason, remedy, link), newest first, plus anyRecall. Errors: 400 JSON {error} for invalid input. PAID: $0.002 USDC per call on Base via x402 (MCP transport: retry with params._meta["x402/payment"]). Same tool over plain HTTP: GET /v1/recalls/check.

Input parameters:

- `brand` (string): optional manufacturer/firm filter for q
- `limit` (integer): max rows per source, default 10
- `make` (string)
- `model` (string)
- `q` (string): product name or keywords, 3-100 chars, e.g. 'stroller' or 'peanut butter'
- `since` (string): only recalls on/after this date
- `upc` (string): UPC/EAN/GTIN digits (6-14)
- `vin` (string): 17-char VIN; recalls for its decoded make/model/year
- `year` (string): 4-digit model year (with make and model)

### `sanctions_address_check` (~178 tokens)

OFAC sanctions check for crypto addresses

OFAC sanctions screening for crypto wallet addresses: exact match against every digital currency address on the U.S. Treasury OFAC SDN list (BTC, ETH, USDT, USDC, TRX, SOL, LTC, XMR and more). Useful for compliance and AML checks before paying a counterparty or an x402 payTo. Up to 20 comma-separated addresses; returns sanctioned true/false, SDN name, programs, official link and list freshness. Errors: 400 JSON {error} for invalid input. PAID: $0.002 USDC per call on Base via x402 (MCP transport: retry with params._meta["x402/payment"]). Same tool over plain HTTP: GET /v1/sanctions/address.

Input parameters:

- `address` (string, required): crypto address, or up to 20 comma-separated

### `climate_day` (~272 tokens)

NWS climate-day high/low + official CLI

Daily high and low temperature for a US weather station from NWS: running provisional high/low over the station's climate day (midnight-midnight local standard time) and the official NWS Daily Climate Report (CLI) high/low once issued, flagged preliminary or final. Useful for temperature settlement, weather prediction markets and climate records. Optional temperature buckets (width/offset or explicit edges). Errors: 400 JSON {error} for invalid input. PAID: $0.002 USDC per call on Base via x402 (MCP transport: retry with params._meta["x402/payment"]). Same tool over plain HTTP: GET /v1/weather/climate-day.

Input parameters:

- `bucket_offset` (number): bucket origin, default 0
- `bucket_width` (number): bucket width, default 1
- `cli` (string): override CLI location code (default: station without leading K)
- `date` (string): climate date (LST), default today; up to ~6 days back
- `edges` (string): comma-separated increasing bucket edges; overrides width/offset
- `round` (string)
- `station` (string, required): NWS/ICAO station id, e.g. KNYC, KMDW, KLAX
- `units` (string)

### `us_weather` (~147 tokens)

US weather (NWS)

US weather forecast, current conditions and severe-weather alerts for a latitude/longitude from the National Weather Service (NWS) in one call. Useful when an agent needs local temperature, a forecast or active alerts for a US location. Returns the latest station observation, next 12 hourly periods, 6-period forecast and active alerts as normalized JSON. Errors: 400 JSON {error} for invalid input. PAID: $0.002 USDC per call on Base via x402 (MCP transport: retry with params._meta["x402/payment"]). Same tool over plain HTTP: GET /v1/weather/us.

Input parameters:

- `lat` (number, required)
- `lon` (number, required)

### `sec_filings` (~213 tokens)

SEC EDGAR filings + XBRL facts

SEC EDGAR company filings and financials for a stock ticker or CIK in one call: latest 10-K, 10-Q, 8-K and other forms with dates, accession numbers, primary document and index URLs, plus optional XBRL facts (revenue, net income, shares outstanding). Useful for company research, due diligence and earnings monitoring. Errors: 400 JSON {error} for an unknown ticker; 503 while the shared SEC rate limit is busy. PAID: $0.002 USDC per call on Base via x402 (MCP transport: retry with params._meta["x402/payment"]). Same tool over plain HTTP: GET /v1/sec/filings.

Input parameters:

- `cik` (string): alternative to ticker
- `facts` (boolean): include key XBRL facts
- `forms` (string): comma-separated form types, e.g. 10-K,10-Q,8-K
- `limit` (integer)
- `ticker` (string)

### `injection_scan` (~176 tokens)

Prompt-injection pre-filter

Prompt-injection detection for untrusted text (web pages, emails, documents, tool output) before it reaches an LLM; a guardrail for agent pipelines. Flags instruction overrides, role spoofing, secret/system-prompt exfiltration, image beacons, tool-call markup, hidden Unicode, hidden HTML and base64 payloads. Returns a 0-100 risk score, risk level and matched rules. Deterministic rules, no LLM. JSON body {text}, max 32 KB. Errors: 400 missing text, 413 too large. PAID: $0.002 USDC per call on Base via x402 (MCP transport: retry with params._meta["x402/payment"]). Same tool over plain HTTP: POST /v1/text/injection-scan.

Input parameters:

- `text` (string, required)

### `us_business_days` (~139 tokens)

US federal business days

US business days calculator: counts working days between two dates (inclusive), excluding weekends and observed US federal holidays per 5 U.S.C. 6103 and OPM rules. Useful for deadlines, SLAs, shipping and payment due dates. Returns the count and lists the holidays skipped. Errors: 400 JSON {error} for invalid input. PAID: $0.002 USDC per call on Base via x402 (MCP transport: retry with params._meta["x402/payment"]). Same tool over plain HTTP: GET /v1/calendar/us-business-days.

Input parameters:

- `from` (string, required)
- `to` (string, required)

### `x402_check` (~172 tokens)

x402 endpoint readiness check

x402 endpoint validator and payment-readiness checker, useful for sellers debugging a paywall or buyers vetting an endpoint before paying. Fetches the URL unpaid, decodes the 402 challenge and grades network, USDC asset, payTo, price vs facilitator fees, EIP-712 domain, CORS and Bazaar metadata. Returns a 0-100 score and a fix list. Never pays the target. Errors: 400 JSON {error} for invalid input. PAID: $0.002 USDC per call on Base via x402 (MCP transport: retry with params._meta["x402/payment"]). Same tool over plain HTTP: GET /v1/x402/check.

Input parameters:

- `method` (string)
- `url` (string, required): https URL of the x402-protected endpoint

### `caller_avoidance_score` (~195 tokens)

Caller Avoidance Score (callers-avoid-0.1, outcome-only; honesty deferred): toxicity / avoid grade for a Crypto Twitter handle from public-call follower sim (post+5m, fees). Returns avoid_score 0-100, band, components with receipts (sim_mean, sim_win_rate, rug_rate, hit_2x_24h + Wilson CI), verdict (copy_buy_loses|insufficient_sample|mixed), and public post id links — not full post text. Free when n_scored<4 via GET /v0/callers/score. Not financial advice. PAID: $0.002 USDC per call on Base via x402 (MCP transport: retry with params._meta["x402/payment"]). Same tool over plain HTTP: GET /v1/callers/score.

Input parameters:

- `handle` (string, required): X/Twitter handle without required @

### `federal_register_search` (~242 tokens)

Federal Register document search

Federal Register search for US rules, proposed rules, notices and presidential documents by keyword, agency, type and publication date, or one document by number. Useful for regulatory monitoring and compliance research. Returns title, type, action, abstract, agencies, effective and comment-close dates, docket IDs, RINs, CFR parts, citation and official HTML/PDF links, with source URL and retrievedAt. Errors: 400 invalid input, 404 unknown document. PAID: $0.002 USDC per call on Base via x402 (MCP transport: retry with params._meta["x402/payment"]). Same tool over plain HTTP: GET /v1/federal-register/search.

Input parameters:

- `agency` (string): agency slug, e.g. environmental-protection-agency
- `document_number` (string): fetch one document, e.g. 2026-22396
- `limit` (integer)
- `order` (string)
- `q` (string): full-text keywords
- `since` (string)
- `type` (string): rule, proposed_rule, notice, presidential (comma-separated)
- `until` (string)

### `clinical_trials_search` (~283 tokens)

ClinicalTrials.gov study search

ClinicalTrials.gov study search (official v2 API) by condition, intervention/drug, sponsor, location, keyword, recruitment status and phase. Useful for trial finding, pipeline and competitive research. Returns total count, NCT IDs, titles, status, phases, conditions, interventions, sponsor, enrollment, key dates, has-results flag and study links, with paging token, source URL and retrievedAt. Errors: 400 invalid input. PAID: $0.002 USDC per call on Base via x402 (MCP transport: retry with params._meta["x402/payment"]). Same tool over plain HTTP: GET /v1/clinical-trials/search.

Input parameters:

- `condition` (string)
- `intervention` (string): drug, device or procedure
- `limit` (integer)
- `location` (string): city, state or country
- `page_token` (string): nextPageToken from a previous call
- `phase` (string): comma-separated: early1, 1, 2, 3, 4, na
- `q` (string): any-field keywords
- `sort` (string)
- `sponsor` (string)
- `status` (string): comma-separated: RECRUITING, NOT_YET_RECRUITING, ACTIVE_NOT_RECRUITING, COMPLETED, TERMINATED, ...

### `clinical_trial_study` (~178 tokens)

ClinicalTrials.gov study by NCT ID

ClinicalTrials.gov study lookup by NCT ID (official v2 API). Useful when an agent needs the facts of one trial. Returns titles, sponsor and collaborators, status and why stopped, key dates, phases, design, enrollment, conditions, interventions, primary outcomes, eligibility (ages, sex, criteria text), summary, site count, countries and up to 25 sites, plus results link, source URL and retrievedAt. Errors: 400 bad NCT ID, 404 not found. PAID: $0.002 USDC per call on Base via x402 (MCP transport: retry with params._meta["x402/payment"]). Same tool over plain HTTP: GET /v1/clinical-trials/study.

Input parameters:

- `nct` (string, required): NCT ID, e.g. NCT04368728

### `fda_drug_label` (~236 tokens)

FDA drug label (openFDA)

FDA drug label (package insert, SPL) lookup via openFDA by brand or generic name, NDC or set ID; prefers the original packager's latest label. Useful for indications, dosing, boxed warnings, contraindications, interactions and adverse reactions. Returns label metadata (brand, generic, manufacturer, application number, NDCs, RxCUI) and selected sections trimmed to max_chars, plus DailyMed link and retrievedAt. Errors: 400 invalid input, 404 no label. PAID: $0.002 USDC per call on Base via x402 (MCP transport: retry with params._meta["x402/payment"]). Same tool over plain HTTP: GET /v1/fda/drug-label.

Input parameters:

- `max_chars` (integer): per section, default 1500
- `name` (string): brand or generic name
- `ndc` (string): product or package NDC
- `sections` (string): comma-separated section keys, e.g. boxed_warning,indications_and_usage,drug_interactions
- `set_id` (string): SPL set id (UUID)

### `fda_adverse_events` (~213 tokens)

FDA adverse event counts (FAERS)

FDA adverse event report counts (FAERS via openFDA) for a drug by generic or brand name, optionally filtered by reaction, date range or serious reports only. Useful for drug safety signal checks and pharmacovigilance research. Returns total, serious, non-serious and death report counts and the top reported reactions, with source URL, FDA data date and retrievedAt. Reports do not prove causation. Errors: 400 invalid input. PAID: $0.002 USDC per call on Base via x402 (MCP transport: retry with params._meta["x402/payment"]). Same tool over plain HTTP: GET /v1/fda/adverse-events.

Input parameters:

- `drug` (string, required): generic or brand name
- `limit` (integer): top reactions to return, default 10
- `reaction` (string): MedDRA preferred term, e.g. myalgia
- `serious_only` (boolean)
- `since` (string)
- `until` (string)

### `fda_ndc_lookup` (~215 tokens)

FDA NDC directory lookup

FDA National Drug Code (NDC) directory lookup via openFDA by product or package NDC (dashed, or 10/11-digit billing format) or by drug name. Useful for pharmacy, claims and inventory data. Returns product NDC, brand and generic names, labeler, dosage form, route, active ingredients and strengths, marketing category and dates, application number, DEA schedule and packages, with DailyMed link and retrievedAt. Errors: 400 invalid input, 404 no match. PAID: $0.002 USDC per call on Base via x402 (MCP transport: retry with params._meta["x402/payment"]). Same tool over plain HTTP: GET /v1/fda/ndc.

Input parameters:

- `limit` (integer)
- `name` (string): brand or generic name
- `ndc` (string): product NDC (58151-155), package NDC (58151-155-77) or 11-digit (58151015577)

### `sec_8k_filings` (~239 tokens)

SEC 8-K current reports

SEC 8-K current reports from EDGAR: one company's 8-Ks by ticker or CIK, or the latest 8-Ks market-wide, optionally by item code (2.02 earnings, 5.02 officer changes, 1.01 agreements) or full-text phrase. Useful for event monitoring and research. Returns company, CIK, tickers, filing date, accession number, decoded items and document and index URLs, with retrievedAt. Errors: 400 invalid input, 503 SEC rate limit busy. PAID: $0.002 USDC per call on Base via x402 (MCP transport: retry with params._meta["x402/payment"]). Same tool over plain HTTP: GET /v1/sec/8k.

Input parameters:

- `cik` (string)
- `items` (string): comma-separated 8-K item codes, e.g. 2.02,5.02
- `limit` (integer)
- `q` (string): exact phrase full-text search
- `since` (string)
- `ticker` (string)
- `until` (string)

### `sec_13f_holdings` (~227 tokens)

SEC 13F institutional holdings

SEC 13F-HR institutional holdings for a filer by CIK or ticker (latest quarter or a given accession), parsed from the EDGAR information table. Useful for tracking what funds like Berkshire Hathaway hold. Returns period, holdings ranked by value with issuer, CUSIP, class, shares, put/call and portfolio percent, totals checked against the cover page, recent 13F filings and source URLs. Tables over 1.5 MB return 422. Errors: 400, 404 no 13F. PAID: $0.002 USDC per call on Base via x402 (MCP transport: retry with params._meta["x402/payment"]). Same tool over plain HTTP: GET /v1/sec/13f.

Input parameters:

- `accession` (string): specific 13F accession number
- `cik` (string): 13F filer CIK, e.g. 0001067983
- `limit` (integer): holdings returned, default 50
- `ticker` (string): alternative to cik when the filer is listed

### `email_auth_audit` (~201 tokens)

Email auth DNS audit (SPF, DMARC, DKIM, MTA-STS)

Email authentication DNS audit for a domain or email address: SPF with recursive 10-lookup count and all qualifier, DMARC policy, pct and report addresses, DKIM selector probe, MTA-STS with policy file, TLS-RPT, BIMI and MX. Useful for deliverability checks, Google/Yahoo bulk-sender readiness and spoofing risk. Returns grade A-F, score, spoofable flag, parsed records and plain-language issues. Errors: 400 invalid domain, 404 NXDOMAIN. PAID: $0.002 USDC per call on Base via x402 (MCP transport: retry with params._meta["x402/payment"]). Same tool over plain HTTP: GET /v1/dns/email-auth.

Input parameters:

- `domain` (string, required): domain or email address, e.g. paypal.com
- `selectors` (string): optional comma-separated DKIM selectors to probe (max 12); default probes 12 common ones

### `osv_package_vulns` (~308 tokens)

Package vulnerability check (OSV.dev)

Open-source package vulnerability check via OSV.dev for npm, PyPI, Go, crates.io, Maven, RubyGems, NuGet, Packagist and more, by ecosystem+name+version, purl, or up to 10 purls. Useful before installing or upgrading a dependency. Returns vulnerable flag, count, CVE/GHSA aliases, CVSS score and severity, fixed versions and a verified upgradeTo version. Errors: 400 invalid input, 502 OSV unavailable. PAID: $0.002 USDC per call on Base via x402 (MCP transport: retry with params._meta["x402/payment"]). Same tool over plain HTTP: GET /v1/osv/package.

Input parameters:

- `ecosystem` (string): OSV ecosystem, case-insensitive: npm, PyPI, Go, crates.io, Maven, RubyGems, NuGet, Packagist, Hex, Pub, Debian:12 ...
- `limit` (integer): max vulns returned per package, default 50
- `name` (string): package name; Maven uses groupId:artifactId, Go uses the module path
- `packages` (string): batch: up to 10 comma-separated purls
- `purl` (string): alternative to ecosystem+name+version, e.g. pkg:npm/lodash@4.17.20
- `version` (string): optional exact version; omit for all known advisories

### `solana_pre_promo` (~201 tokens)

Solana pre-promo covered-shelf aggregates vs matched null

Pre-promo tape lookup for a Solana token when we hold a locked [-60m,0] window around its DexScreener paid-promo timestamp (specialty covered shelf, not a universal catalog). Returns raw aggregates only: net buy USD, unique buyers, largest buyer share, and the same stats vs a matched-null mean from other covered tokens (intensity-tercile leave-one-out). Uncovered token -> 404 with coverage:false and the live coverage rate — never fabricated numbers. Free coverage probe: GET /v0/solana/pre-promo-coverage. Not financial advice; no wallet-to-person attribution. PAID: $0.01 USDC per call on Base via x402 (MCP transport: retry with params._meta["x402/payment"]). Same tool over plain HTTP: GET /v1/solana/pre-promo.

Input parameters:

- `token` (string, required): Solana mint address (base58)

### `us_federal_holidays` (~51 tokens)

US federal holidays (free)

FREE. US federal holidays (observed dates) for a year, per 5 U.S.C. 6103. Useful to test the connection before paying.

Input parameters:

- `year` (integer)

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/dev-workers-revenue-agent-jw-agent-utils-x402-production-agent-utils/agent-utils-x402-production#diagnostics

## Score history

- 2026-11-05: 68
- 2026-11-04: 67
- 2026-11-03: 67
- 2026-11-02: 66
- 2026-11-01: 66
- 2026-10-31: 65
- 2026-10-30: 65
- 2026-10-29: 65
- 2026-10-28: 64
- 2026-10-27: 64
- 2026-10-26: 63
- 2026-10-25: 63
- 2026-10-24: 62
- 2026-10-23: 62
- 2026-10-22: 61

## Common questions

### What is the Agent Utils (x402) MCP server?

Agent Utils (x402) is an MCP server listed in the public MCP registry as dev.workers.revenue-agent-jw.agent-utils-x402-production/ag…. Public records, email-auth DNS and OSV package vuln checks for agents: SEC, FDA, trials. x402 USDC. This page covers its hosted endpoint (https://agent-utils-x402-production.revenue-agent-jw.workers.dev/mcp).

### Is the Agent Utils (x402) MCP server safe to use?

Agent Utils (x402) scores 68 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Agent Utils (x402) MCP server expose?

Agent Utils (x402) exposes 21 tools: recall_check, sanctions_address_check, climate_day, us_weather, sec_filings, and 16 more. Their descriptions and schemas cost roughly 4,381 tokens of context every time the server is loaded.

### Does the Agent Utils (x402) MCP server require authentication?

No. We connected to Agent Utils (x402) without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

### Is the Agent Utils (x402) MCP server still maintained?

Agent Utils (x402) is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What did VerifyMCP test on the Agent Utils (x402) MCP server?

VerifyMCP ran 12 checks on Agent Utils (x402), covering TLS certificate, Authorization, HSTS header, DNSSEC and 8 more. One item could not be completed, a gap on our side rather than a finding about Agent Utils (x402): HTTPS. Supply Chain Security and Provenance & Transparency do not apply to a hosted endpoint, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out.

## Links

- Remote endpoint: https://agent-utils-x402-production.revenue-agent-jw.workers.dev/mcp
- Website: https://agent-utils-x402-production.revenue-agent-jw.workers.dev/
- Changelog RSS feed: https://verifymcp.io/servers/dev-workers-revenue-agent-jw-agent-utils-x402-production-agent-utils/agent-utils-x402-production.xml
- Changelog JSON feed: https://verifymcp.io/servers/dev-workers-revenue-agent-jw-agent-utils-x402-production-agent-utils/agent-utils-x402-production/changelog.json
- Trust report (JSON): https://verifymcp.io/servers/dev-workers-revenue-agent-jw-agent-utils-x402-production-agent-utils/agent-utils-x402-production.json
- HTML version of this page: https://verifymcp.io/servers/dev-workers-revenue-agent-jw-agent-utils-x402-production-agent-utils/agent-utils-x402-production