org.sky-1/rate-hub
REMOTE · X402-V1.SKY-1.ORG
Indicative fiat and crypto rates over MCP, paid per request via x402 at $0.0001/request.
Available components
Last scanned (1 day ago)
Scores higher than 57% of remote servers
Reachable. Last reached 17 Oct 2026.
Category Finance and Payments
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security57
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation not fully verified: no authorisation is required to call this server, and 7 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe. See how to fix → View diagnostics → Unverified
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability74
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 1817 tokens (~227/item across 8 items; 7 tools + 1 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management20
- Stability observed for 6 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 7 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 8 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 17 Oct 26 0
- Server version: 0.20.0-119806c → 0.21.1-a78bfbd functional
- 16 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.
- 14 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.
- 12 Oct 26 +1
- Stability: unverified → 0.03 ▲ functional
- 11 Oct 26 64
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 17 Oct 2026 · Probed https://x402-v1.sky-1.org/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=x402-v1.sky-1.org | CN=WE1,O=Google Trust Services,C=US | 3 Oct 2026 | 1 Jan 2027 | ECDSA 256 | ECDSA-SHA256 | 7f16af2e7eaea08f13a3d787de01b3a4 |
| SANs: x402-v1.sky-1.org | ||||||
| CN=WE1,O=Google Trust Services,C=US (CA) | CN=GTS Root R4,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | ECDSA 256 | ECDSA-SHA384 | 7ff31977972c224a76155d13b6d685e3 |
| CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 15 Nov 2023 | 28 Jan 2028 | ECDSA 384 | SHA256-RSA | 7fe530bf331343bedd821610493d8a1b |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of x402-v1.sky-1.org. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| org. | present | 26974 | 8 | Verified |
| sky-1.org. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://x402-v1.sky-1.org/mcp | Verified | 200 | |
| http (plaintext) | http://x402-v1.sky-1.org/mcp | HTTPS enforced | 301 | https://x402-v1.sky-1.org/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
get_categories ~138
Coin categories (GET /v1/categories): each category id and name with the catalog uids that belong to it, for example layer-1 or stablecoins. Join it with uids from get_rates or search_assets to group holdings. It changes about once a day; as_of says when it was refreshed. A coin can be in several categories, and only the larger coins of a category are listed. Categories without a catalog member are omitted. The result grows with the catalog (one uid list per category, both copies of the result). not_ready (503) before the first daily refresh; not_found when the server has categories switched off.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| as_of | string | yes | – |
| build | string | yes | – |
| categories | null|array | yes | – |
| server_time | string | yes | – |
No examples provided.
get_daily ~215
Immutable daily rates for uids and UTC days (POST /v1/rates/daily). Days are UTC calendar dates (YYYY-MM-DD) in the past. Crypto history older than about a year is served at daily granularity from daily candles (source s8) back to the earliest day each asset has; an asset with no such history is out_of_range. Each item carries a status: ok = exact immutable rate; out_of_range = the day is before the archive start, after today UTC, before the first available day of a crypto asset, or before the asset was listed (final, do not retry); pending = transient upstream miss, retry after retry_after seconds; unsupported = unknown uid. Limits (assets, quotes, assets times days) are in get_meta. Edge cases: read resource ratehub://docs/behavior (behaviour notes).
| Name | Type | Req | Description |
|---|---|---|---|
| assets | array | yes | Catalog uids |
| days | array | yes | Past UTC calendar days, YYYY-MM-DD |
| vs | array | yes | Quote currencies |
| Name | Type | Req | Description |
|---|---|---|---|
| build | string | yes | – |
| rates | null|array | yes | – |
| server_time | string | yes | – |
No examples provided.
get_meta ~25
API limits, supported quote currencies, and build info (GET /v1/meta).
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| api_version | string | yes | – |
| build | string | yes | – |
| collector | null|object | – | – |
| max_assets | integer | yes | – |
| max_body_bytes | integer | yes | – |
| max_daily_pairs | null|integer | – | – |
| max_vs | integer | yes | – |
| pending_retry_after_seconds | null|integer | – | – |
| stale_after_seconds | null|object | – | – |
| supported_vs | null|array | yes | – |
| upstreams | null|object | – | – |
No examples provided.
get_rates ~445
Batch indicative prices for catalog uids (POST /v1/rates). Prices are decimal strings. Uids are class-ranged (uid = class*1e8+seq; 1=fiat e.g. usd 100000001, 2=crypto e.g. btc 200000001). Use search_assets to find uids. Per-rate status: ok = fresh price; stale = last known price, upstream is late (see as_of); pending = in the catalog but not priced yet, wait retry_after seconds for that asset and ask again; unsupported = the uid is not in the catalog (a dynamic coin may have expired; look it up again). Size: about 0.4 KB per asset and quote without include (the result is sent twice, as text and as structuredContent; sizes here count both); sparkline adds a long price array per asset, so request it only when needed. Limits (max assets, max quote currencies) are in get_meta. Optional source (a code such as s1) returns that source's own price instead of the server's choice: source_code equals it, and an asset the source has no reading for is unsupported, never another source's price; exchange codes only answer when the deployment runs multi-source aggregation. A dynamic coin expires after 7 days without use and may get a new uid when registered again (also after a server reset): match it by symbol or a new search, not by a stored uid. Edge cases: read resource ratehub://docs/behavior (behaviour notes).
| Name | Type | Req | Description |
|---|---|---|---|
| assets | array | yes | Catalog uids to price (class*1e8+seq; use search_assets to find uids) |
| include | null|array | – | Optional extras: change, market, sparkline. sparkline is large (a long price array per asset); ask for it only when needed |
| source | null|string | – | Optional source code such as s1: every rate is then that source's own reading, or unsupported when it has none (never another source's price) |
| vs | array | yes | Quote currency codes (usd, eur, btc, ...) |
| Name | Type | Req | Description |
|---|---|---|---|
| build | string | yes | – |
| rates | null|array | yes | – |
| server_time | string | yes | – |
No examples provided.
get_series ~344
Price history of one asset for charts (GET /v1/rates/series). Crypto: every range. Fiat: 1d and 7d from rate-hub's own readings taken about every 30 minutes; 30d, 90d, 1y and max one point per UTC day from the daily archive (it has a start day, days without a document are skipped, a cold range fills over a few retries, so an early answer may have fewer points). A fiat with no reading in the range, or an unknown uid, answers status unsupported with empty points, not an error. status: ok = fresh series; stale = last cached series, upstream failed (see fetched_at); pending = not ready, retry after retry_after seconds; unsupported = unknown uid, an asset no upstream knows, or a fiat with no reading in the range. Size: about 110 bytes per point (both copies of the result). max_points (2..500, default 100) downsamples evenly and keeps the first and last point; pass 500 for full detail. A non-USD fiat quote clips the series at the start of the fiat archive (range max only), and with a dynamic coin an unsupported answer may mean its uid expired. Edge cases: read resource ratehub://docs/behavior (behaviour notes).
| Name | Type | Req | Description |
|---|---|---|---|
| max_points | null|integer | – | Downsample to at most this many points, 2..500 (default 100); first and last points are kept |
| range | string | yes | Chart range |
| uid | integer | yes | Catalog uid of a crypto asset |
| vs | string | yes | Quote currency |
| Name | Type | Req | Description |
|---|---|---|---|
| build | string | yes | – |
| fetched_at | null|string | – | – |
| points | null|array | yes | – |
| range | string | yes | – |
| retry_after | null|integer | – | – |
| server_time | string | yes | – |
| source | null|string | – | – |
| status | string | yes | – |
| uid | integer | yes | – |
| vs | string | yes | – |
No examples provided.
get_top ~178
Top crypto assets by market rank (GET /v1/top), with change and, by default, the market block (rank, market cap, volume, supply). Size: about 1 KB per asset with market (both copies of the result), smaller without. Default limit is 20 (max 250); pass include_market=false for a compact list. Items that cannot be priced in the requested quote are skipped. Edge cases: read resource ratehub://docs/behavior (behaviour notes).
| Name | Type | Req | Description |
|---|---|---|---|
| include_market | null|boolean | – | Include the market block (rank, market cap, volume, supply) per asset; default true. false makes the result smaller |
| limit | null|integer | – | Ranked assets to return (1..250, default 20) |
| vs | null|array | – | Quote currencies (default usd) |
| Name | Type | Req | Description |
|---|---|---|---|
| build | string | yes | – |
| rates | null|array | yes | – |
| server_time | string | yes | – |
No examples provided.
search_assets ~416
Catalog lookup (GET /v1/assets); use it to turn tickers or names into uids. Filters: q (free text), symbol, symbols (several tickers in one call), candidate (the uid of a candidates entry; registers that coin on demand; use alone), chain+contract (an unknown Solana mint can be registered on demand; mints are case-sensitive). Size: about 0.4 KB per asset (both copies of the result). Without any filter the default limit is 50 (the whole catalog is hundreds of assets); page with limit (1..1000) and after (next_after of the previous page). An explicit limit of 0 is an error. For a q lookup with few catalog hits, candidates lists at most 5 unregistered coins (not yet priced); pass a candidate's uid as candidate to register it and make it priceable. Dynamic coins expire after 7 days without use and may get a new uid after expiry or a server reset, so do not store a dynamic uid as identity; asset.icon is a placeholder image for an asset with no image source. Edge cases: read resource ratehub://docs/behavior (behaviour notes).
| Name | Type | Req | Description |
|---|---|---|---|
| after | null|integer | – | Uid cursor for pagination (next_after from the previous page) |
| candidate | integer | – | The uid of a candidates entry from an earlier search; registers that coin on demand and returns its asset. Use alone |
| chain | string | – | Chain name with contract |
| contract | string | – | Token contract address |
| limit | null|integer | – | Page size 1..1000. Default 50 when no filter is given, otherwise no limit |
| q | string | – | Free-text search over symbol and name |
| symbol | string | – | Exact symbol (non-unique, all matches returned) |
| symbols | null|array | – | Several exact symbols in one call, e.g. [btc, eth, sol]; all matches for each are returned |
| Name | Type | Req | Description |
|---|---|---|---|
| assets | null|array | yes | – |
| build | string | yes | – |
| candidates | null|array | – | – |
| candidates_status | null|string | – | – |
| next_after | null|integer | – | – |
| total | null|integer | – | – |
No examples provided.
How do I install the org.sky-1/rate-hub MCP server?
org.sky-1/rate-hub is a hosted endpoint at https://x402-v1.sky-1.org/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · x402-v1.sky-1.org
claude mcp add --transport http org-sky-1-rate-hub 'https://x402-v1.sky-1.org/mcp'
What is the org.sky-1/rate-hub MCP server?
org.sky-1/rate-hub is an MCP server listed in the public MCP registry as org.sky-1/rate-hub. Indicative fiat and crypto rates over MCP, paid per request via x402 at $0.0001/request. This page covers its hosted endpoint (https://x402-v1.sky-1.org/mcp).
Is the org.sky-1/rate-hub MCP server safe to use?
org.sky-1/rate-hub scores 67 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the org.sky-1/rate-hub MCP server expose?
org.sky-1/rate-hub exposes 7 tools: get_categories, get_daily, get_meta, get_rates, get_series, and 2 more. Their descriptions and schemas cost roughly 1,761 tokens of context every time the server is loaded.
Does the org.sky-1/rate-hub MCP server require authentication?
No. We connected to org.sky-1/rate-hub without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the org.sky-1/rate-hub MCP server still maintained?
org.sky-1/rate-hub is still listed as active in the MCP registry. We last reached this channel on 17 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.