# VerifyLite (remote · verifylite.hydratinghealingtouch.workers.dev)

Pay-per-call web safety, Base on-chain data, CVE and prompt-injection checks for agents. x402 USDC.

- Trust score: 73/100 (medium)
- Change this week: +3
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- remote · `verifylite.hydratinghealingtouch.workers.dev`: 73/100 (this document), [markdown](https://verifymcp.io/servers/secondshotai-verifylite/verifylite.md), [page](https://verifymcp.io/servers/secondshotai-verifylite/verifylite)

## Channel facts

- Endpoint: `https://verifylite.hydratinghealingtouch.workers.dev/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `1.2.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Endpoint Security**: 63/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one.
  - HTTPS enforcement could not be verified: the plaintext port answered with HTTP 405, which proves neither a plaintext path nor enforcement.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 72/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 5926 tokens (~148/item across 40 items; 40 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 50/100
  - Stability observed for 15 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 40 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 40 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### How do I install the VerifyLite MCP server?

VerifyLite is a hosted endpoint at https://verifylite.hydratinghealingtouch.workers.dev/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http secondshotai-verifylite 'https://verifylite.hydratinghealingtouch.workers.dev/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "secondshotai-verifylite": {
      "url": "https://verifylite.hydratinghealingtouch.workers.dev/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "secondshotai-verifylite": {
      "type": "http",
      "url": "https://verifylite.hydratinghealingtouch.workers.dev/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.secondshotai-verifylite]
url = "https://verifylite.hydratinghealingtouch.workers.dev/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "secondshotai-verifylite": {
      "type": "remote",
      "url": "https://verifylite.hydratinghealingtouch.workers.dev/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add secondshotai-verifylite --url 'https://verifylite.hydratinghealingtouch.workers.dev/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  secondshotai-verifylite:
    url: "https://verifylite.hydratinghealingtouch.workers.dev/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "secondshotai-verifylite": {
      "Transport": "http",
      "Url": "https://verifylite.hydratinghealingtouch.workers.dev/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add secondshotai-verifylite -t streamable-http -u 'https://verifylite.hydratinghealingtouch.workers.dev/mcp'
```

### Other

```json
{
  "mcpServers": {
    "secondshotai-verifylite": {
      "type": "http",
      "url": "https://verifylite.hydratinghealingtouch.workers.dev/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-04 (score 73, +1)

No change was recorded against any check on this day. Stability & Change Management went from 43 to 47. That category is still filling its 30-day observation window: 13 days of observed history at the previous scan, 14 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-11-03 (score 72, 0)

- [functional] New tool “federal_register_search”
- [functional] New tool “tx_preflight”

### 2026-11-02 (score 72, 0)

- [security] Tool “domain_report” rewrote its description, which is the text the model reads
- [security] Tool “read_page” rewrote its description, which is the text the model reads
- [security] Tool “token_report” rewrote its description, which is the text the model reads
- [functional] New tool “honeypot_check”

### 2026-11-01 (score 72, +1)

- [security] Tool “check_prompt_injection” rewrote its description, which is the text the model reads
- [security] Tool “ping” rewrote its description, which is the text the model reads
- [functional regression] Schema quality: 4626 → 5195
- [functional] New tool “package_vulnerabilities”
- [functional] New tool “token_report”
- [functional] New tool “wallet_sanctions_check”
- [cosmetic] Tool “check_prompt_injection” changed its title: Prompt-injection check: scans text or a web page for hidden instructions before an agent reads it → Prompt injection detection: classify agent-bound text or a web page as clean, suspicious or malicious
- [cosmetic] Tool “ping” changed its title: Paid ping: the cheapest real x402 call, for testing payment clients → x402 integration test: pay $0.001, get back the payer, network and amount the server saw

### 2026-10-30 (score 71, +1)

No change was recorded against any check on this day. Stability & Change Management went from 27 to 30. That category is still filling its 30-day observation window: 8 days of observed history at the previous scan, 9 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-29 (score 70, 0)

- [security] Tool “token_holders” rewrote its description, which is the text the model reads
- [functional] New tool “contract_call”
- [functional] New tool “nft_lookup”

### 2026-10-28 (score 70, 0)

- [functional regression] Schema quality: 3680 → 4210
- [functional] New tool “contract_events”
- [functional] New tool “token_holders”
- [functional] New tool “wallet_transfers”

### 2026-10-27 (score 70, +1)

- [functional] New tool “name_lookup”
- [functional] New tool “token_allowance_check”

## MCP tools (40)

### `list_prices` (~20 tokens)

VerifyLite prices

Lists every VerifyLite tool and its current price. Free.

### `verify_url` (~104 tokens)

Verify URL syntax

URL syntax validator. Takes one absolute HTTP or HTTPS URL and returns its normalized form, or a specific error code: unparseable, unsupported scheme, embedded credentials, IP literal, or local/metadata hostname. Never contacts the destination, so it is fast and side-effect free. Useful for cleaning URLs from user input, scraped pages, or LLM output before fetching them. Paid via x402; see list_prices.

Input parameters:

- `url` (string, required): Absolute HTTP or HTTPS URL.

### `check_site_safety` (~127 tokens)

Website safety check

Website safety check for one URL. Passively fetches the site and returns a verdict (safe, caution, unsafe), a 0-100 score, and evidence-backed flags: TLS validity, HTTP-to-HTTPS redirect, redirect chain and offsite redirects, security headers, mixed content, insecure forms, and domain age from the official registry. Useful before visiting, linking to, buying from, or submitting data to an unfamiliar site. Not charged if the host cannot be checked. Paid via x402; see list_prices.

Input parameters:

- `url` (string, required): Absolute HTTP or HTTPS URL.

### `check_site_safety_pro` (~120 tokens)

Website safety check with malware/phishing blocklist

Website safety check plus a Google Web Risk lookup for malware, phishing, and unwanted software. Includes the full /safe report: verdict (safe, caution, unsafe), 0-100 score, TLS, redirects, security headers, mixed content, insecure forms, and domain age. A blocklist hit makes the verdict unsafe. Useful for screening links before a payment, login, or download. Not charged if the blocklist cannot be reached. Paid via x402; see list_prices.

Input parameters:

- `url` (string, required): Absolute HTTP or HTTPS URL.

### `check_sites_batch` (~134 tokens)

Batch website safety check

Batch website safety check: the full /safe report for several URLs in one call, priced per site and cheaper than single checks. Each result has a verdict (safe, caution, unsafe), a 0-100 score, and evidence-backed flags for TLS, redirects, security headers, mixed content, insecure forms, and domain age, plus a summary count. Useful for screening every link in a search result, email, or document at once. Not charged if no site can be checked. Paid via x402; see list_prices.

Input parameters:

- `urls` (array, required): Absolute HTTP or HTTPS URLs. Priced per unique URL.

### `transcribe_audio` (~167 tokens)

Transcribe audio or video

Speech-to-text for one audio or video file by URL, using Whisper (turbo) on a GPU. Returns the full transcript, timed segments, ready-made SRT and WebVTT captions, and the detected language; optional translation to English. Files up to 25 MB (about 25 minutes of typical MP3). Useful for captioning videos, indexing podcasts, or reading meetings. Not charged if the file can't be fetched or transcribed. Paid via x402; see list_prices.

Input parameters:

- `language` (string): Optional language code, e.g. 'en'. Detected if omitted.
- `translate` (boolean): Also translate the speech to English.
- `url` (string, required): Absolute HTTP or HTTPS URL of an audio or video file, up to 25 MB.

### `read_page` (~123 tokens)

Read a web page as markdown

Web page to markdown for AI agents: fetch one URL and get its main content as clean, LLM-ready markdown (navigation, ads, footers and scripts removed) with title, description, language, word count and a token estimate. Uses the site's own Markdown version when it offers one. Useful for RAG, summarizing articles, research and feeding pages to an LLM. Not charged if the page can't be fetched or isn't text. Paid via x402; see list_prices.

Input parameters:

- `url` (string, required): Absolute HTTP or HTTPS URL of the page to read.

### `link_preview` (~101 tokens)

Link preview metadata

Link preview: returns the title, description, preview image, site name, favicon, canonical URL, and Open Graph/Twitter card details for one URL, like a chat app's link unfurl. Useful when an agent posts, shares, or summarizes links and needs clean metadata without reading the whole page. Not charged if the page can't be fetched. Paid via x402; see list_prices.

Input parameters:

- `url` (string, required): Absolute HTTP or HTTPS URL to preview.

### `domain_report` (~123 tokens)

Domain registration, DNS, and email security

Domain intelligence: WHOIS/RDAP registration (registrar, created and expiry dates, status, name servers) plus DNS records (A, AAAA, MX, NS, TXT, CAA) and email security (SPF, DMARC), with flags for new, expiring or misconfigured domains, as one JSON object. Useful for vetting a company, vendor or link before trusting it. Not charged for invalid or reserved domain names. Paid via x402; see list_prices.

Input parameters:

- `domain` (string, required): Domain name (example.com) or a URL.

### `check_email` (~101 tokens)

Email address check

Email check: validates the address format, confirms the domain exists and accepts mail (MX), and flags disposable providers, role accounts (info@, support@), and free providers. Returns deliverable_likely, risky, undeliverable, or invalid with a reason. No message is sent. Useful for cleaning sign-up lists and lead data before outreach. Paid via x402; see list_prices.

Input parameters:

- `email` (string, required): Email address to check.

### `seo_check` (~122 tokens)

SEO check for a page

SEO check for one page: whether search engines can index it (meta robots, X-Robots-Tag, robots.txt rules), title and meta description length, canonical URL, H1 headings, viewport, language, Open Graph tags, sitemap, HTTPS, and redirects, with a 0-100 score and a list of issues by severity. Useful for site audits and pre-launch checks. Not charged if the page can't be fetched. Paid via x402; see list_prices.

Input parameters:

- `url` (string, required): Absolute HTTP or HTTPS URL of the page to audit.

### `chain_balance` (~182 tokens)

Base wallet balance: ETH, USDC and any ERC-20 tokens, transaction count, wallet or contract

Base mainnet balance for one address: ETH and USDC (human-readable and raw), plus up to 10 ERC-20 tokens you list (with symbol and decimals), transaction count, and whether it is a wallet or a contract. One price for 0 to 10 tokens. Useful for checking a wallet is funded before a payment, confirming a payout or airdrop landed, tracking agent or treasury wallets, or screening a counterparty. Read-only. Not charged for invalid addresses or when Base can't be reached. Paid via x402; see list_prices.

Input parameters:

- `address` (string, required): 0x address on Base (40 hex characters).
- `tokens` (array): Optional: up to 10 ERC-20 token contract addresses on Base to also return balances for (an array, or one comma-separated string). ETH and USDC are always included.

### `chain_tx` (~133 tokens)

Base transaction status: success/failed/pending, fee, confirmations, USDC transfers

Base mainnet transaction lookup by hash: status (success, failed, or pending), block, timestamp, confirmations, from, to, ETH value, total fee including the L1 data fee, method id, and every USDC transfer in the transaction decoded to sender, recipient, and amount. Useful for confirming that a USDC or x402 payment really settled before delivering goods. Read-only. Not charged for an invalid hash, a hash not found on Base, or when Base can't be reached. Paid via x402; see list_prices.

Input parameters:

- `hash` (string, required): 0x transaction hash (64 hex characters).

### `chain_token` (~120 tokens)

ERC-20 token info on Base: name, symbol, decimals, total supply

ERC-20 token metadata for one contract on Base mainnet: name, symbol, decimals, and total supply (human-readable and raw), with a flag for whether it behaves like an ERC-20 at all and whether it is native USDC. Handles older tokens that return bytes32 names. Useful for formatting token amounts correctly and spotting look-alike tokens. Read-only. Not charged for an invalid address or an address with no contract. Paid via x402; see list_prices.

Input parameters:

- `address` (string, required): Token contract 0x address on Base.

### `chain_contract` (~132 tokens)

Base contract inspection: code size, proxy implementation, ERC-20/721/1155 detection

Inspects one Base mainnet address: whether it holds contract code and how large, whether it is an EIP-1967 upgradeable proxy (and its implementation address), EIP-7702 delegation, and which standards it reports or behaves like (ERC-165, ERC-721 NFT, ERC-1155, ERC-20). Useful for knowing what kind of contract an agent is about to interact with or approve. Read-only. Not charged for an invalid address or when Base can't be reached. Paid via x402; see list_prices.

Input parameters:

- `address` (string, required): 0x address on Base.

### `chain_gas` (~85 tokens)

Base gas prices now: gas price, base fee, priority fee, typical transaction costs

Current Base mainnet gas: gas price, base fee, and priority fee in gwei, plus estimated execution cost in ETH for an ETH transfer, a USDC transfer, and a typical swap, from the latest block. Useful for timing transactions and budgeting fees before sending. No input needed. Not charged when Base can't be reached. Paid via x402; see list_prices.

### `chain_block` (~101 tokens)

Base block info: number, timestamp, transaction count, gas used, base fee

Base mainnet block details for the latest block or a given block number: number, hash, timestamp, transaction count, gas used and limit, and base fee. Useful for checking chain head and freshness, timestamping events, and counting confirmations. Read-only. Not charged for an invalid or future block number or when Base can't be reached. Paid via x402; see list_prices.

Input parameters:

- `number` (string): Block number, or "latest" (default).

### `token_report` (~140 tokens)

Token due diligence in one call: owner powers, holder concentration and blocklists, with one verdict

One-call due diligence for a Base token before buying, accepting or listing it: owner powers in the contract (mint, pause, blacklist, fees, proxy), who holds the supply (top wallets, concentration), whether it can actually be sold and its real buy/sell tax (simulated), and whether the token or its owner is on the OFAC sanctions list or a scam blacklist. Returns one verdict (ok, caution, avoid, known issuer), a 0-100 risk score and plain reasons. Not charged for invalid input. Paid via x402; see list_prices.

Input parameters:

- `token` (string, required): Token contract 0x address on Base.

### `honeypot_check` (~199 tokens)

Can this Base token be sold? Honeypot check with real buy and sell tax from a simulated trade

Honeypot and sell-tax check for a Base token. Finds its deepest WETH or USDC pool (Uniswap V2/V3, Aerodrome, Slipstream) and simulates a buy then a sell on a Base node: no money moves. Returns whether selling works, the actual buy tax and sell tax, round-trip loss, pool and liquidity, with a verdict: clean, taxed, high_tax, honeypot, no_liquidity or inconclusive. Useful before an agent buys, swaps or accepts a token. Not charged for invalid input or tokens with no WETH or USDC pool. Paid via x402; see list_prices.

Input parameters:

- `amountEth` (string): Optional: ETH size of the pretend test buy, 0.0001 to 5 (default: sized to the pool, up to 0.05).
- `token` (string, required): Token contract 0x address on Base.

### `tx_preflight` (~254 tokens)

Should I sign this? Plain-words check of a Base transaction or signature request, with red flags

Pre-signing check for Base. Send a transaction (to, data, value, from) or a typed-data signature request and get what it does in plain words plus red flags: unlimited or wallet-targeted approvals, NFT approve-all, off-chain permits, sends to a token's own contract or the dead address, OFAC or scam-listed counterparties, risky tokens, and calls that would fail (simulated from your wallet). Verdict ok, caution, danger or block. Not charged for invalid input. Paid via x402; see list_prices.

Input parameters:

- `data` (string): Optional: transaction calldata, 0x hex.
- `from` (string): Optional: the signing wallet 0x address. Lets the check simulate the call and compare balances.
- `to` (string): Transaction destination 0x address (a contract or wallet). Omit when sending typedData.
- `typedData` (object): Alternative to a transaction: the EIP-712 signature request (domain, primaryType, message) a site asks you to sign, as an object or JSON string.
- `value` (string): Optional: ETH to send, in wei (decimal or 0x hex). Default 0.

### `token_safety_check` (~136 tokens)

Token safety check on Base: can the owner mint, pause, blacklist, change taxes, or upgrade?

Risk check for an ERC-20 token on Base before buying, accepting, or holding it: reads the contract and its proxy implementation for owner powers (minting, pausing, blacklisting wallets, changing buy/sell taxes, trade limits, trading switches, burning others' tokens, upgrades), checks whether ownership was renounced and how much supply the owner holds. Returns a verdict, 0-100 risk score, and plain-language flags. Read-only. Not charged for invalid addresses or non-tokens. Paid via x402; see list_prices.

Input parameters:

- `address` (string, required): Token contract 0x address on Base.

### `token_allowance_check` (~167 tokens)

Token approval check on Base: how much each spender can move from a wallet, incl. Permit2

Approval check for one wallet and one ERC-20 token on Base: how much each spender (up to 10 app or router addresses) is allowed to move, flagging unlimited approvals and approvals covering the full balance, plus approvals made through Uniswap Permit2 with their expiry. Defaults to checking Permit2 itself. Useful before signing, for wallet hygiene, and for spotting approvals to revoke. Read-only. Not charged for invalid addresses or non-tokens. Paid via x402; see list_prices.

Input parameters:

- `owner` (string, required): Wallet 0x address on Base.
- `spenders` (array): Optional: up to 10 spender addresses (array or comma-separated). Defaults to Uniswap Permit2.
- `token` (string, required): Token contract 0x address on Base.

### `wallet_sanctions_check` (~149 tokens)

Wallet screening: is this address on the OFAC sanctions list or a known scam/drainer list?

Screens 1 to 20 wallet addresses against the US Treasury OFAC SDN sanctions list (crypto addresses) and the ScamSniffer scam and drainer blacklist, in one call at one price. Returns block or clear per address with the reason, plus list sizes and freshness. Address-level, so it works for Base, Arc, Ethereum and any EVM chain. Useful before sending a payment, paying an x402 seller, accepting funds, or approving a spender. Read-only. Not charged for invalid addresses. Paid via x402; see list_prices.

Input parameters:

- `addresses` (array, required): 1 to 20 wallet 0x addresses (an array, or one comma-separated string).

### `wallet_transfers` (~190 tokens)

Wallet transfer history on Base: recent token transfers in and out, newest first

Recent token transfers for one Base wallet, incoming and outgoing, newest first: token, symbol, amount, sender, recipient, transaction hash, block and time, with likely spam airdrops flagged. Filter by one token or by direction, up to 50 per call. Reports the block window searched. Useful for checking a counterparty's activity, confirming deposits, reconciling payments, or watching an agent's wallet. Read-only. Not charged for invalid input or when Base can't be reached. Paid via x402; see list_prices.

Input parameters:

- `address` (string, required): Wallet 0x address on Base.
- `direction` (string): Optional: "in", "out" or "all" (default).
- `limit` (integer): How many transfers, 1 to 50 (default 20).
- `token` (string): Optional: only this token contract (0x address).

### `contract_events` (~183 tokens)

Contract activity on Base: recent events a contract emitted, decoded, admin actions flagged

Recent events (logs) one Base contract emitted, newest first, decoded: token transfers and approvals with amounts, Uniswap/Aerodrome swaps, liquidity and reserve updates, WETH wraps, NFT transfers, and admin actions (ownership changes, proxy upgrades, pauses, role grants) flagged. Filter by event name to search about 22 hours back. Counts by event type and the block window searched. Read-only. Not charged for invalid input or when Base can't be reached. Paid via x402; see list_prices.

Input parameters:

- `contract` (string, required): Contract 0x address on Base.
- `event` (string): Optional: only this event, by name (e.g. "Swap", "Upgraded", "OwnershipTransferred") or 0x topic hash.
- `limit` (integer): How many events, 1 to 50 (default 20).

### `token_holders` (~151 tokens)

Top holders of a Base token and how concentrated its supply is

The largest holders of an ERC-20 token on Base, ranked, with balance, percent of supply and wallet/contract/burn type, read straight from the chain. Top 1/5/10 concentration (burns excluded), a wallets-only share, burned percent and a low-to-very-high level. For tokens whose whole transfer history fits (most new and small tokens) the list and holder count are exact; otherwise coverage is reported. Not charged for invalid input. Paid via x402; see list_prices.

Input parameters:

- `limit` (integer): How many holders to list, 1 to 50 (default 10).
- `token` (string, required): Token contract 0x address on Base.

### `nft_lookup` (~190 tokens)

NFT lookup on Base: current owner, collection, and metadata (name, image, traits)

Look up one NFT on Base by contract and token ID: ERC-721 or ERC-1155, current owner (wallet or contract), collection name and symbol, and its metadata: name, description, image link, animation, traits. Reads ipfs://, ar://, https and inline on-chain metadata. Pass owner to confirm a wallet holds it (and its ERC-1155 balance). Read-only. Not charged for invalid input, tokens that don't exist, or when Base can't be reached. Paid via x402; see list_prices.

Input parameters:

- `contract` (string, required): NFT contract 0x address on Base.
- `includeImage` (boolean): Optional: return inline on-chain images up to 100 KB (default: summary only).
- `owner` (string): Optional: a wallet to check ownership for.
- `tokenId` (string, required): Token ID (decimal or 0x hex).

### `contract_call` (~232 tokens)

Read any contract function on Base and get the decoded result

Call any read-only (view/pure) function on a Base contract and get the decoded answer. Give the function as a signature like balanceOf(address) returns (uint256) plus args, or raw 0x calldata. Supports address, bool, uint/int, bytesN, string, bytes and arrays, an optional historical block, and plain revert reasons. Raw return data is always included. Not charged for invalid input, reverted calls, or when Base can't be reached. Paid via x402; see list_prices.

Input parameters:

- `args` (array): Arguments in order (big numbers as strings; arrays as lists).
- `block` (string): Optional: "latest" (default) or a block number.
- `contract` (string, required): Contract 0x address on Base.
- `data` (string): Optional instead of function: raw 0x calldata.
- `function` (string): Function signature, e.g. "balanceOf(address) returns (uint256)".
- `returns` (string): Optional: return types if not in the signature, e.g. "uint112,uint112,uint32".

### `name_lookup` (~153 tokens)

Basename and ENS lookup: name to address, or address to its verified primary name

Resolves Basenames (name.base.eth, on Base) and ENS names (name.eth, on Ethereum) to wallet addresses, including a Base-specific address and profile records (avatar, description, url, X, GitHub). Or give an 0x address to get its primary name, verified by resolving the name back to the same address. A bare name like jesse means jesse.base.eth. Useful before sending funds to a name or labeling counterparties. Read-only. Not charged for invalid or unregistered names. Paid via x402; see list_prices.

Input parameters:

- `name` (string, required): A name (jesse.base.eth, vitalik.eth, or just jesse) or an 0x address.

### `crypto_price` (~172 tokens)

Crypto prices from Chainlink on Base: ETH, BTC, cbBTC, SOL, USDC, DAI, EUR in USD

Current prices in USD from Chainlink Data Feeds on Base mainnet: ETH, BTC, cbBTC, SOL, USDC, DAI, and EUR. One pair or all at once, each with the feed's last update time, age in seconds, and a stale flag, read straight from the oracle contracts (the same prices DeFi protocols use). Useful for valuing balances, converting USDC amounts, and checking a stablecoin peg. Not charged for an unknown pair or when the feeds can't be read. Paid via x402; see list_prices.

Input parameters:

- `pair` (string): Optional pair, e.g. "ETH/USD" or "BTC". Omit for all: ETH/USD, BTC/USD, CBBTC/USD, SOL/USD, USDC/USD, DAI/USD, EUR/USD.

### `package_vulnerabilities` (~267 tokens)

Package vulnerability check: known CVEs and advisories for npm, PyPI, Go, Maven, Cargo and more

Check dependencies for known vulnerabilities before installing or shipping: up to 20 packages (npm, PyPI, Go, Maven, crates.io, RubyGems, NuGet, Packagist and more, by name and version or purl) against the OSV.dev database. Returns each advisory with CVE IDs, severity and CVSS score, fixed versions, the smallest safe upgrade, and links. Not charged for invalid input or if OSV.dev can't be reached. Paid via x402; see list_prices.

Input parameters:

- `ecosystem` (string): For a single package: npm, PyPI, Go, Maven, crates.io, RubyGems, NuGet, Packagist, Pub, Hex...
- `name` (string): For a single package: its name.
- `packages` (array): Up to 20 packages: {"ecosystem": "npm", "name": "lodash", "version": "4.17.15"} or {"purl": "pkg:npm/lodash@4.17.15"}.
- `purl` (string): Or a package URL, e.g. pkg:npm/lodash@4.17.15.
- `version` (string): For a single package: one exact version (no ranges).

### `check_prompt_injection` (~162 tokens)

Prompt injection detection: classify agent-bound text or a web page as clean, suspicious or malicious

Prompt injection detection for AI agents: classify untrusted, agent-bound text or a URL (web pages, emails, tool and MCP output, RAG documents) as clean, suspicious or malicious before your LLM reads it. Returns a 0-100 risk score, each matched pattern (instruction overrides, jailbreaks, fake system prompts, requests for keys or seed phrases, exfiltration links, invisible Unicode, hidden HTML) and cleaned text. Up to 50,000 characters. Not charged on bad input. Paid via x402; see list_prices.

Input parameters:

- `text` (string): Text to check, up to 50,000 characters.
- `url` (string): Or a web page URL to fetch and check, including its hidden parts.

### `repair_json` (~155 tokens)

JSON repair for LLM output: fixes broken JSON and checks it against your schema

Turns messy LLM output into valid JSON: strips Markdown code fences and surrounding prose, fixes trailing commas, single quotes, unquoted keys, comments, Python True/None, cut-off brackets, and stringified JSON. Optionally validates the result against a JSON Schema (draft 4 to 2020-12) and lists each error with its location. Returns the parsed data, the JSON text, and what was changed. Not charged if no JSON can be recovered or the input is invalid. Paid via x402; see list_prices.

Input parameters:

- `schema` (object): Optional JSON Schema to validate the repaired data against.
- `text` (string, required): The broken JSON or LLM reply, up to 30,000 characters.

### `federal_register_search` (~263 tokens)

US Federal Register search: new rules, proposed rules and notices by topic, agency and date, with comment deadlines

Search the US Federal Register, the government's daily journal of rules, proposed rules, notices and presidential documents. Filter by keyword, type, agency and date range, only items still open for comment, or look up one document by number. Returns title, agency, publication and effective dates, comment deadline, a trimmed abstract, citation, docket IDs and official links. Useful for agents that monitor regulation. Not charged for invalid input or when nothing matches. Paid via x402; see list_prices.

Input parameters:

- `agency` (string): Optional: agency slug, e.g. "environmental-protection-agency".
- `commentsOpen` (boolean): Optional: only items whose public comment period is still open.
- `documentNumber` (string): Optional: look up one document by its Federal Register number instead of searching.
- `limit` (integer): How many results, 1 to 25 (default 10).
- `query` (string): Optional keyword or phrase, e.g. "lead pipes".
- `since` (string): Optional: published on or after this date (YYYY-MM-DD).
- `type` (string): Optional: rule, proposed_rule, notice or presidential.
- `until` (string): Optional: published on or before this date (YYYY-MM-DD).

### `read_feed` (~145 tokens)

News and RSS reader: latest headlines, links, dates, summaries from any site or feed

RSS and Atom reader: give a feed URL or any news site, blog, or podcast page and get its latest items as clean JSON: title, link, published date, author, a plain-text summary, and media (podcast audio) links. Finds the feed automatically from the page when needed. Useful for news monitoring, research digests, and tracking competitors or releases. Not charged if no feed is found or it can't be fetched. Paid via x402; see list_prices.

Input parameters:

- `limit` (integer): How many items, 1 to 50 (default 20).
- `url` (string, required): Feed URL, or any site or page that has a feed.

### `get_time` (~98 tokens)

Current time: UTC, Unix, and local time in any IANA time zone

Current time from a reliable server clock: UTC ISO timestamp, Unix seconds and milliseconds, and optionally the local date, time, weekday, and UTC offset in any IANA time zone (daylight saving handled). Useful because language models don't know the current date or time. Not charged for an unknown time zone. Paid via x402; see list_prices.

Input parameters:

- `tz` (string): Optional IANA time zone, e.g. America/Chicago.

### `new_uuid` (~121 tokens)

UUID generator: v4 (random) or v7 (time-ordered), up to 100 at once

Generates standards-compliant UUIDs from a cryptographic random source: version 4 (random) or version 7 (time-ordered, sorts by creation time, good for database keys), one or up to 100 per call. Useful for idempotency keys, record IDs, and correlation IDs. Not charged for invalid options. Paid via x402; see list_prices.

Input parameters:

- `count` (integer): How many, 1 to 100 (default 1).
- `version` (string): "v4" (default) or "v7".

### `random_number` (~148 tokens)

Secure random numbers in a range, or a random pick from a list

Cryptographically secure, unbiased randomness: whole numbers between min and max (default 1 to 100), or random picks from a list of choices, one or up to 100 per call. Useful because language models are bad at being random: fair draws, sampling, shuffling decisions, and A/B assignment. Not charged for invalid options. Paid via x402; see list_prices.

Input parameters:

- `choices` (array): Optional list to pick from instead of a number range.
- `count` (integer): How many, 1 to 100 (default 1).
- `max` (integer): Highest value (default 100).
- `min` (integer): Lowest value (default 1).

### `ip_info` (~131 tokens)

IP address check: IPv4/IPv6, public or private, reserved ranges; or your own IP

Classifies an IPv4 or IPv6 address: family, canonical form, and whether it is public, private (RFC 1918 or unique local), loopback, link-local, carrier-grade NAT, multicast, documentation, or reserved, including IPv4-mapped IPv6. With no input over HTTP, returns the caller's own public IP and country. Useful for validating network input and filtering internal addresses. Not charged for an invalid address. Paid via x402; see list_prices.

Input parameters:

- `ip` (string): IPv4 or IPv6 address. Omit (HTTP only) to get your own IP.

### `ping` (~125 tokens)

x402 integration test: pay $0.001, get back the payer, network and amount the server saw

x402 integration test for agents and payment clients: after a real USDC payment it confirms the payment arrived and echoes back what the server saw: network (Base or Arc), scheme, payer address, amount, asset and recipient, plus server time and an optional echo string. Useful for checking that a wallet, x402 client and budget limits work end to end before calling costlier services, and for uptime monitoring. The cheapest paid call VerifyLite offers. Paid via x402; see list_prices.

Input parameters:

- `echo` (string): Optional text to echo back (up to 256 characters).

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/secondshotai-verifylite/verifylite#diagnostics

## Score history

- 2026-11-05: 73
- 2026-11-04: 73
- 2026-11-03: 72
- 2026-11-02: 72
- 2026-11-01: 72
- 2026-10-31: 71
- 2026-10-30: 71
- 2026-10-29: 70
- 2026-10-28: 70
- 2026-10-27: 70
- 2026-10-26: 69
- 2026-10-25: 69
- 2026-10-24: 69
- 2026-10-23: 68
- 2026-10-22: 68
- 2026-10-21: 68

## Common questions

### What is the VerifyLite MCP server?

VerifyLite is an MCP server listed in the public MCP registry as io.github.SecondShotAI/verifylite. Pay-per-call web safety, Base on-chain data, CVE and prompt-injection checks for agents. x402 USDC. This page covers its hosted endpoint (https://verifylite.hydratinghealingtouch.workers.dev/mcp).

### Is the VerifyLite MCP server safe to use?

VerifyLite scores 73 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the VerifyLite MCP server expose?

VerifyLite exposes 40 tools: list_prices, verify_url, check_site_safety, check_site_safety_pro, check_sites_batch, and 35 more. Their descriptions and schemas cost roughly 5,926 tokens of context every time the server is loaded.

### Does the VerifyLite MCP server require authentication?

No. We connected to VerifyLite without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

### Is the VerifyLite MCP server still maintained?

VerifyLite is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Remote endpoint: https://verifylite.hydratinghealingtouch.workers.dev/mcp
- Website: https://verifylite.hydratinghealingtouch.workers.dev/
- Changelog RSS feed: https://verifymcp.io/servers/secondshotai-verifylite/verifylite.xml
- Changelog JSON feed: https://verifymcp.io/servers/secondshotai-verifylite/verifylite.json
- HTML version of this page: https://verifymcp.io/servers/secondshotai-verifylite/verifylite