io.github.halowerk/halowerk-mcp

Estimate token use and price for a prompt across several models before you spend anything, including cache and batch discounts. Kostenpflichtig: 0.002 USDC je Aufruf. Bezahlt per x402 auf Base, ohne Konto. Hoechstens 0.002 USDC je Aufruf. Works out what a call would cost. Give either the text itself or a token count, plus the expected output length, and get input, output, cache-read and cache-write cost per model with the total. Token counts derived from text are estimates from character and word statistics, not a tokeniser, and typically land within about 15 percent — where an exact count matters, count with the vendor tokeniser. Prices come from a table with a stated date; a model whose price has moved since is reported with its table date, so an old figure is visible rather than silently wrong. Unknown model names are refused with the closest matches rather than guessed. Preis 0.002 USDC je Aufruf, Abrechnung über x402.

Check a package list against known vulnerabilities and get, per package, the severity breakdown and the lowest version that closes every finding. Kostenpflichtig: 0.005 USDC je Aufruf. Bezahlt per x402 auf Base, ohne Konto. Hoechstens 0.005 USDC je Aufruf. Queries OSV.dev for a list of packages with versions across npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist and the Linux distributions. For each package it returns the vulnerabilities found with their identifiers, severity and summary, and the single figure that decides what to do next: the lowest version that fixes all of them, derived from the fixed-version events in the affected ranges. Findings are counted by severity and the whole list gets one worst-case verdict so a pipeline can gate on it. Severity is read from several places because databases disagree on where they put it, and the source of the rating is reported. OSV records what is published — a package with no finding is not proven safe, only unreported, and an internal or vendored package is invisible here. Preis 0.005 USDC je Aufruf, Abrechnung über x402.

Compares two versions of a document — PDF, DOCX, ODT, HTML, Markdown or plain text — and returns which paragraphs were removed, added or reworded, with a word-level diff inside every reworded paragraph and a symmetric similarity score. Kostenpflichtig: 0.002 USDC je Aufruf. Bezahlt per x402 auf Base, ohne Konto. Hoechstens 0.002 USDC je Aufruf. Takes two documents, by URL, inline base64 or raw text, extracts the text of each and compares them. Paragraphs are the unit: the answer lists every block that was removed, added, or kept but reworded, and for reworded blocks it names the individual words that went and came, so a single changed number in a long clause is visible instead of the whole clause being flagged. Alongside the content diff a structural comparison reports headings, paragraph, list and table-line counts on both sides. The similarity score is deliberately symmetric — two times the shared words divided by the sum of both lengths — because a one-sided measure would rate a heavily shortened document as almost unchanged. Both sides are measured the same way over the same units; if the two inputs arrive in different formats, so that one text comes out of a PDF and the other out of a DOCX, that is reported as a caveat, because part of any structural difference then comes from the extraction path and not from the documents. Ordering and duplicate paragraphs are handled by a shortest-edit-script diff, not by set comparison. What this endpoint does not do is judge: it says what changed, never whether the change is favourable, material or lawful. Preis 0.002 USDC je Aufruf, Abrechnung über x402.

Lists every HALOWERK service with its price, hub and one-line summary. Free — no wallet needed and no payment is made. Use this first to see what is available before spending anything.

Returns what a planned call would cost, which amount the budget check uses, and whether it would pass the per-call cap and the session budget. Free — makes no payment. For tiered prices this reports the ceiling, not the minimum.

Recompute an invoice from its line items: totals, tax per rate, discounts and rounding, and report every deviation with the exact amount. Kostenpflichtig: 0.002 USDC je Aufruf. Bezahlt per x402 auf Base, ohne Konto. Hoechstens 0.002 USDC je Aufruf. Rebuilds an invoice from its lines and compares the result with the stated totals. Line by line it checks quantity times unit price against the line total, applies line and document discounts in the right order, groups the net amounts by tax rate and computes the tax per group, then compares net, tax and gross with what the document claims. All arithmetic runs in whole cents, because adding decimal amounts as floating point produces cent-level noise that reads like an error by the issuer when it is an error by the checker. Rounding differences up to one cent per tax group are reported separately from real discrepancies. It also checks the formal side: a due date before the invoice date, a tax rate that is not one of the country standard rates, a negative line without a credit-note marker, and a missing VAT number where the reverse charge is claimed. Preis 0.002 USDC je Aufruf, Abrechnung über x402.

Verify a JWT signature and claims, and name the classic token attacks explicitly: alg none, HMAC confusion, unbounded lifetime, missing audience. Kostenpflichtig: 0.002 USDC je Aufruf. Bezahlt per x402 auf Base, ohne Konto. Hoechstens 0.002 USDC je Aufruf. Decodes a JWT and checks it in two layers. Structure and claims: expiry, not-before and issued-at against the current time with the clock skew you allow, issuer and audience against the values you expect, and the token lifetime. Signature: HMAC with a shared secret, or RSA, RSA-PSS and ECDSA against a PEM key or a JWKS you point at, with the kid matched to the right key. On top of that it names the attacks that live in this exact spot: alg set to none, an HMAC algorithm where an asymmetric key is expected which is the classic key-confusion path, a token with no expiry at all, and an audience that does not name you. Without a key or secret the token is decoded and its claims judged, and the signature is reported as unverified rather than assumed good. Preis 0.002 USDC je Aufruf, Abrechnung über x402.

Resolve package licences and classify them for commercial use: which force disclosure, which only need attribution, and which are unknown. Kostenpflichtig: 0.002 USDC je Aufruf. Bezahlt per x402 auf Base, ohne Konto. Hoechstens 0.002 USDC je Aufruf. Looks up the declared licence of each package through deps.dev and sorts the result by the only question that matters for a closed, sold product: what does this licence demand. Permissive licences need attribution. Weak copyleft affects changes to the library itself. Strong copyleft can force disclosure of the whole work on distribution. Network copyleft such as AGPL and SSPL bites on operating the software as a service, which is the sharpest case for a paid API. Multi-licence expressions are handled by their operator — with OR the mildest applies because you may choose, with AND the strictest does. Packages whose licence is undeclared or outside the table are reported as unknown instead of assumed harmless. This is a classification to triage with, not legal advice, and the licence deps.dev records is what the package declared, which is not always what its files say. Preis 0.002 USDC je Aufruf, Abrechnung über x402.

Check a model answer against a JSON schema and get every deviation named in plain language with its path, plus whether the JSON was wrapped in prose or a code fence. Kostenpflichtig: 0.002 USDC je Aufruf. Bezahlt per x402 auf Base, ohne Konto. Hoechstens 0.002 USDC je Aufruf. Validates output against a JSON Schema and reports each violation with its JSON path, the rule it broke and a sentence saying what to change. Accepts either a parsed object or the raw string a model returned: a payload wrapped in a code fence or surrounded by prose is unwrapped, and the wrapping is reported separately from schema errors so you fix the right layer. Draft 2020-12 and draft-07 are both supported, along with the common string formats. Optionally the repairable problems are listed: missing fields that have a default, and unexpected extra fields. It validates structure, never truth — a document that satisfies the schema perfectly can still be factually wrong, and nothing here checks that. Preis 0.002 USDC je Aufruf, Abrechnung über x402.

Store, read, list and delete small pieces of agent state under a namespace, with a mandatory expiry so nothing is kept forever. Kostenpflichtig: 0.002 USDC je Aufruf. Bezahlt per x402 auf Base, ohne Konto. Hoechstens 0.002 USDC je Aufruf. Key-value state for agents that need to survive between calls. Every write carries a time-to-live; the maximum is 30 days and there is no way to store something permanently. Values are opaque JSON up to 64 KB, at most 1000 live keys per namespace. Actions: set, get, list, delete. A get on a missing or expired key answers found=false, it is not an error. The namespace is a plain string chosen by the caller and is not authenticated — anyone who knows it can read it, so do not put secrets in it. Expired rows are removed on access, not on a timer, so a list can lag a few seconds behind the exact expiry moment. Preis 0.002 USDC je Aufruf, Abrechnung über x402.

Read the TLS certificate chain of a host: every certificate with its names, validity, key type and signature, plus expiry warnings and whether the hostname is actually covered. Kostenpflichtig: 0.002 USDC je Aufruf. Bezahlt per x402 auf Base, ohne Konto. Hoechstens 0.002 USDC je Aufruf. Opens a TLS connection and reports the chain the server presents. Per certificate: subject and issuer, validity window with days remaining, serial, SHA-256 fingerprint, key type and size, and the subject alternative names. Above that it answers the questions a monitor asks: is the requested hostname covered by the leaf certificate including wildcard rules, how many days until the nearest expiry, is any certificate self-signed or signed with a weak algorithm, does the server send its intermediates or leave the client to find them — a chain that validates in a browser can still fail in a language runtime that does not fetch missing intermediates. The negotiated protocol version and cipher are reported. It connects to the host itself, so there is no third-party dependency and no rate limit. Preis 0.002 USDC je Aufruf, Abrechnung über x402.

Check tool arguments against their schema before an expensive or irreversible call, and get warnings for values that pass the schema but look like mistakes. Kostenpflichtig: 0.002 USDC je Aufruf. Bezahlt per x402 auf Base, ohne Konto. Hoechstens 0.002 USDC je Aufruf. Two checks in one. First the arguments are validated against the tool input schema and every violation is reported with its path and a sentence saying what to change. Second, values that satisfy the schema but look wrong are flagged: an unset required field filled with a placeholder like "string" or "TODO", a number at a suspicious order of magnitude, an address that fails its checksum shape, a destructive flag set to true, an empty string where content was expected. Fields whose names suggest an irreversible effect — amounts, recipients, deletion and force flags — are held to the stricter standard. Warnings are heuristics and can be wrong in both directions: treat them as a prompt to look, not a verdict, and never as a substitute for the tool own checks. Preis 0.002 USDC je Aufruf, Abrechnung über x402.

List archived versions of a URL with dates, status codes and content changes, and get the snapshot closest to any date you name. Kostenpflichtig: 0.005 USDC je Aufruf. Bezahlt per x402 auf Base, ohne Konto. Hoechstens 0.005 USDC je Aufruf. Queries the Internet Archive for the captured versions of a URL and returns them with capture time, HTTP status, MIME type and content digest, oldest and newest first. Because consecutive captures share a digest when nothing changed, the versions where the content actually differed are marked — that is the list worth reading, not the raw capture log. A target date returns the nearest snapshot with the gap in days, which is what a citation of a page as it stood on a given day needs. Captures that returned an error at the time are separated from successful ones, so a run of 404s reveals when a page disappeared. The CDX index is the complete source but goes down regularly; when it does, the availability endpoint answers with the closest capture and the degraded state is reported rather than passed off as an empty history. Preis 0.005 USDC je Aufruf, Abrechnung über x402.

Verify a signed webhook from GitHub, Stripe, Shopify, Slack, Svix or a plain HMAC scheme, with the timestamp window checked where the provider signs one. Kostenpflichtig: 0.002 USDC je Aufruf. Bezahlt per x402 auf Base, ohne Konto. Hoechstens 0.002 USDC je Aufruf. Providers each build their signing string differently — some sign only the body, others prepend a timestamp, an id, or a version marker in a fixed order — and getting that order wrong produces a mismatch that looks exactly like an attack. This checks the signature the way the named provider actually specifies, with constant-time comparison, and returns the string that was signed so a mismatch can be debugged instead of guessed at. Where the provider signs a timestamp, it is checked against a tolerance window, because a signature valid forever lets any captured delivery be replayed. The body must be passed exactly as received, byte for byte: a re-serialised JSON payload has different bytes and will never match, which is the single most common cause of a failed check and is called out when the body looks reformatted. Preis 0.002 USDC je Aufruf, Abrechnung über x402.