x402 Toolbox
REMOTE · X402-TOOLBOX.SWIFTBOTLAB.WORKERS.DEV
62 pay-per-call web, DNS, EVM and data tools. x402 USDC on Base, $0.003-$0.02 per call, no signup.
Available components
Last scanned (5 hours ago)
Scores higher than 52% of remote servers
Reachable. Last reached 5 Nov 2026.
Category Developer Tools
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security63
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one. See how to fix → View diagnostics → Partial
- HTTPS enforcement could not be verified: the plaintext port answered with HTTP 405, which proves neither a plaintext path nor enforcement. View diagnostics → Unverified
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability64
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 8018 tokens (~129/item across 62 items; 62 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management30
- Stability observed for 9 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage77
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 30% of tool parameters carry a description.Partial
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "cidr_aggregate" implies "merge" and declares readOnlyHint instead, contradicting what its own name says it does. See how to fix → Fail
- An AI judge read all 63 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 27 to 30. That category is still filling its 30-day observation window: 8 days of observed history at the previous scan, 9 at this one. The score rises as the window fills, whether or not the server changes.
- 3 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.
- 1 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.
- 30 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.
- 28 Oct 26 +1
- Stability: unverified → 0.03 ▲ functional
- 27 Oct 26 61
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Probed https://x402-toolbox.swiftbotlab.workers.dev/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=swiftbotlab.workers.dev | CN=YE1,O=Let's Encrypt,C=US | 19 Oct 2026 | 17 Jan 2027 | ECDSA 256 | ECDSA-SHA384 | 662875c942ee25dc5ba72d7ad82445b00c6 |
| SANs: *.swiftbotlab.workers.dev, swiftbotlab.workers.dev | ||||||
| CN=YE1,O=Let's Encrypt,C=US (CA) | CN=Root YE,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | ECDSA 384 | ECDSA-SHA384 | 5ddd70dd31f801c85c186a7a04b80afe |
| CN=Root YE,O=ISRG,C=US (CA) | CN=ISRG Root X2,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | ECDSA-SHA384 | 872165fc34b6e5fba8add5b3705fb53a |
| CN=ISRG Root X2,O=Internet Security Research Group,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | SHA256-RSA | 6c8f1dc727c7117f7baf853ac980f9cd |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of x402-toolbox.swiftbotlab.workers.dev. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| dev. | present | 60074 | 8 | Verified |
| workers.dev. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
| Header | Value |
|---|---|
| x-content-type-options | nosniff |
| referrer-policy | no-referrer |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://x402-toolbox.swiftbotlab.workers.dev/mcp | Verified | 200 | |
| http (plaintext) | http://x402-toolbox.swiftbotlab.workers.dev/mcp | Inconclusive | 405 |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
abi_decode ABI-decode calldata, return data or log data with known types or a signature ~111
ABI-decode calldata, return data or log data with known types or a signature. Decodes hex data with a list of ABI types or a function signature (the 4-byte selector is stripped and checked when present). Strict: every offset and length is bounds-checked and dirty padding is rejected. Price: $0.003 USDC per call via x402 (eip155:8453).
| Name | Type | Req | Description |
|---|---|---|---|
| data | string | yes | – |
| signature | string | – | – |
| types | array|string | – | – |
No output schema declared.
No examples provided.
abi_encode ABI-encode values (or full calldata for a function signature) ~144
ABI-encode values (or full calldata for a function signature). Encodes values per the Solidity ABI: all integer sizes (range-checked), address, bool, bytesN, bytes, string, fixed and dynamic arrays and tuples (nested). With a function signature, returns calldata with the selector. Integers may be decimal or 0x strings. Price: $0.003 USDC per call via x402 (eip155:8453).
| Name | Type | Req | Description |
|---|---|---|---|
| signature | string | – | Function signature, e.g. transfer(address,uint256) |
| types | array|string | – | Alternatively a list of types |
| values | array | yes | Values in order; tuples as arrays |
No output schema declared.
No examples provided.
calldata_decode Decode unknown transaction calldata: find the function signature and decode the arguments ~106
Decode unknown transaction calldata: find the function signature and decode the arguments. Looks up the selector (built-in list, then openchain / 4byte), tries each candidate signature and keeps the first one that decodes and re-encodes to exactly the same bytes, so collisions are filtered out. Returns the function, arguments and the other candidates. Price: $0.005 USDC per call via x402 (eip155:8453).
| Name | Type | Req | Description |
|---|---|---|---|
| data | string | yes | – |
No output schema declared.
No examples provided.
cidr_aggregate Merge / summarize a list of CIDRs into the smallest equivalent set ~101
Merge / summarize a list of CIDRs into the smallest equivalent set. Collapses overlapping and adjacent IPv4/IPv6 ranges (route summarization), returning the minimal CIDR list that covers exactly the same addresses. Price: $0.003 USDC per call via x402 (eip155:8453).
| Name | Type | Req | Description |
|---|---|---|---|
| cidrs | array|string | yes | CIDR blocks or single IPs (JSON array, or a comma/space separated string) |
No output schema declared.
No examples provided.
cidr_contains Which of these IPs fall inside which CIDR ranges (allowlist / blocklist check) ~137
Which of these IPs fall inside which CIDR ranges (allowlist / blocklist check). Checks up to 1,000 IPs against up to 1,000 CIDR blocks (IPv4 and IPv6) and returns, per IP, every matching range. Invalid entries are reported, not fatal. Price: $0.003 USDC per call via x402 (eip155:8453).
| Name | Type | Req | Description |
|---|---|---|---|
| cidrs | array|string | yes | CIDR blocks (JSON array, or a comma/space separated string) |
| ips | array|string | yes | IP addresses (JSON array, or a comma/space separated string) |
No output schema declared.
No examples provided.
cidr_info Subnet calculator for an IPv4/IPv6 CIDR block ~112
Subnet calculator for an IPv4/IPv6 CIDR block. Network and broadcast addresses, first/last usable host, netmask and wildcard, number of addresses and usable hosts, address class and scope. Notes when the input had host bits set. Price: $0.003 USDC per call via x402 (eip155:8453).
| Name | Type | Req | Description |
|---|---|---|---|
| cidr | string | yes | e.g. 10.0.0.0/22 or 2001:db8::/48 |
No output schema declared.
No examples provided.
cidr_split Split a CIDR block into smaller subnets ~102
Split a CIDR block into smaller subnets. Lists the subnets of a given prefix length inside a parent block (e.g. a /16 into /24s), up to 4,096 per call, with the total count. Price: $0.003 USDC per call via x402 (eip155:8453).
| Name | Type | Req | Description |
|---|---|---|---|
| cidr | string | yes | – |
| limit | integer | – | – |
| newPrefix | integer | yes | – |
No output schema declared.
No examples provided.
color Colour conversion (hex, RGB, HSL) and WCAG contrast ratio between two colours ~119
Colour conversion (hex, RGB, HSL) and WCAG contrast ratio between two colours. Parses hex, rgb(), hsl() or CSS names and returns hex, RGB, HSL and relative luminance. With a second colour, returns the WCAG 2.x contrast ratio and AA / AAA pass/fail for normal and large text. Price: $0.003 USDC per call via x402 (eip155:8453).
| Name | Type | Req | Description |
|---|---|---|---|
| against | string | – | Optional second colour for a contrast check |
| color | string | yes | – |
No output schema declared.
No examples provided.
cron_next Explain a cron expression and list its next run times in any time zone ~141
Explain a cron expression and list its next run times in any time zone. Parses a 5-field cron expression (lists, ranges, steps, month/day names, @daily/@hourly/... macros, Vixie day-of-month OR day-of-week rule) and returns the next N run times (up to 50) in UTC and in the given IANA zone, DST-aware. Price: $0.003 USDC per call via x402 (eip155:8453).
| Name | Type | Req | Description |
|---|---|---|---|
| count | integer | – | – |
| expression | string | yes | – |
| from | string | – | Start time (default now) |
| tz | string | – | – |
No output schema declared.
No examples provided.
csv_to_json CSV / TSV to JSON (RFC 4180 quoting, delimiter auto-detect, type inference) ~140
CSV / TSV to JSON (RFC 4180 quoting, delimiter auto-detect, type inference). Parses CSV with quoted fields, embedded newlines and doubled quotes; auto-detects comma, semicolon, tab or pipe. Returns an array of objects (using the header row) or of arrays, optionally inferring numbers, booleans and nulls. Up to 50,000 rows. Price: $0.003 USDC per call via x402 (eip155:8453).
| Name | Type | Req | Description |
|---|---|---|---|
| csv | string | yes | – |
| delimiter | string | – | – |
| header | boolean | – | – |
| inferTypes | boolean | – | – |
No output schema declared.
No examples provided.
currency_convert Currency conversion with official ECB euro reference rates (30 fiat currencies) ~131
Currency conversion with official ECB euro reference rates (30 fiat currencies). Converts an amount between USD, EUR, GBP, JPY, CHF, CNY, INR, BRL, CAD, AUD and the other currencies the European Central Bank publishes daily (cross rates via EUR). Returns the rate, its date and source. Reference rates, not trading quotes. Price: $0.005 USDC per call via x402 (eip155:8453).
| Name | Type | Req | Description |
|---|---|---|---|
| amount | number | – | – |
| from | string | yes | – |
| to | string | yes | Currency code(s), comma separated, or "all" |
No output schema declared.
No examples provided.
dns_dmarc DMARC record check and parsed policy ~101
DMARC record check and parsed policy. Reads _dmarc.<domain> (falling back to the organizational domain), parses p, sp, pct, rua, ruf, adkim, aspf and fo, and lists weaknesses (p=none, pct<100, no reporting address, duplicates). Price: $0.005 USDC per call via x402 (eip155:8453).
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | – |
No output schema declared.
No examples provided.
dns_lookup DNS lookup for any record type over DNS-over-HTTPS ~137
DNS lookup for any record type over DNS-over-HTTPS. Resolve A, AAAA, MX, TXT, NS, CNAME, SOA, CAA, SRV, PTR, DS, DNSKEY, HTTPS, SVCB, TLSA or NAPTR records for a name. Returns answers with TTLs, the DNS status and whether DNSSEC validated. TXT strings are joined. Price: $0.005 USDC per call via x402 (eip155:8453).
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | Domain name (IDN allowed), e.g. example.com |
| type | string | – | Record type |
No output schema declared.
No examples provided.
dns_mx Mail servers (MX) of a domain, sorted, with the mail provider ~111
Mail servers (MX) of a domain, sorted, with the mail provider. MX records sorted by priority, null-MX detection (RFC 7505), the implicit-MX fallback (A/AAAA) when no MX exists, and the detected mail provider (Google Workspace, Microsoft 365, Zoho, Proton, ...). Price: $0.005 USDC per call via x402 (eip155:8453).
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | Domain, e.g. example.com |
No output schema declared.
No examples provided.
dns_reverse Reverse DNS (PTR) for an IPv4 or IPv6 address, with forward confirmation ~92
Reverse DNS (PTR) for an IPv4 or IPv6 address, with forward confirmation. Looks up the PTR name of an IP address and checks forward-confirmed reverse DNS (FCrDNS): whether the PTR hostname resolves back to the same IP. Price: $0.005 USDC per call via x402 (eip155:8453).
| Name | Type | Req | Description |
|---|---|---|---|
| ip | string | yes | IPv4 or IPv6 address |
No output schema declared.
No examples provided.
dns_spf SPF record check: full include tree, DNS lookup count, problems ~111
SPF record check: full include tree, DNS lookup count, problems. Fetches the SPF record, expands include: and redirect= recursively, counts DNS-querying mechanisms against the RFC 7208 limit of 10, lists ip4/ip6 ranges and flags problems (multiple records, +all, ?all, missing includes, ptr, loops, void lookups). Price: $0.008 USDC per call via x402 (eip155:8453).
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | – |
No output schema declared.
No examples provided.
domain_rdap Domain registration data (RDAP/WHOIS): registrar, created, expires, age, status ~118
Domain registration data (RDAP/WHOIS): registrar, created, expires, age, status. Looks up the registry RDAP server for the TLD (IANA bootstrap) and returns the registrar, registration / expiry / last-changed dates, domain age in days, days until expiry, EPP status codes, nameservers and DNSSEC delegation. Useful for fraud and phishing checks (young domains). Price: $0.01 USDC per call via x402 (eip155:8453).
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | – |
No output schema declared.
No examples provided.
email_security E-mail security audit of a domain: MX, SPF, DMARC, DKIM, MTA-STS, TLS-RPT, BIMI, grade ~154
E-mail security audit of a domain: MX, SPF, DMARC, DKIM, MTA-STS, TLS-RPT, BIMI, grade. One call audits a domain's mail setup: MX + provider, SPF tree and lookup count, DMARC policy, DKIM keys at common selectors, MTA-STS record and policy file, TLS-RPT, BIMI. Returns a 0-100 score, a letter grade and a prioritized list of fixes. Price: $0.02 USDC per call via x402 (eip155:8453).
| Name | Type | Req | Description |
|---|---|---|---|
| dkimSelectors | string | – | Optional comma-separated extra DKIM selectors to check (max 5) |
| domain | string | yes | – |
No output schema declared.
No examples provided.
email_validate E-mail address check: syntax, MX, disposable, role, free provider, typos ~123
E-mail address check: syntax, MX, disposable, role, free provider, typos. Validates an address without sending mail: RFC syntax, normalized IDN domain, MX (or implicit A) records, null-MX, disposable-domain list, role accounts (info@, admin@), free providers and typo suggestions (gmial.com -> gmail.com). Verdict: deliverable, risky, undeliverable or invalid. Price: $0.005 USDC per call via x402 (eip155:8453).
| Name | Type | Req | Description |
|---|---|---|---|
| string | yes | – |
No output schema declared.
No examples provided.
encode Convert between UTF-8, hex, base64, base64url, base32, base58; URL and HTML escaping ~131
Convert between UTF-8, hex, base64, base64url, base32, base58; URL and HTML escaping. Re-encodes data from one encoding to another (utf8, hex, base64, base64url, base32, base58), or applies url-encode / url-decode / html-escape / html-unescape. Reports invalid UTF-8 instead of guessing. Price: $0.003 USDC per call via x402 (eip155:8453).
| Name | Type | Req | Description |
|---|---|---|---|
| data | string | yes | – |
| from | string | – | – |
| to | string | – | – |
No output schema declared.
No examples provided.
ens_resolve ENS: resolve a name to an address, or an address to its primary name (verified) ~115
ENS: resolve a name to an address, or an address to its primary name (verified). Give "name" (vitalik.eth) to get its Ethereum address, resolver and namehash; give "address" to get its primary ENS name via reverse resolution, verified by resolving the name forward again. Reads the ENS registry on Ethereum mainnet. Price: $0.005 USDC per call via x402 (eip155:8453).
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | – | – |
| name | string | – | – |
No output schema declared.
No examples provided.
evm_address Validate an EVM address and return its EIP-55 checksum form ~97
Validate an EVM address and return its EIP-55 checksum form. Checks the 0x + 40 hex format, verifies a mixed-case EIP-55 checksum (flags typos), and returns the checksummed and lowercase forms and whether it is the zero address. No network access. Price: $0.003 USDC per call via x402 (eip155:8453).
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | yes | – |
No output schema declared.
No examples provided.
evm_balance Native and ERC-20 balances of an address ~139
Native and ERC-20 balances of an address. Native coin balance plus the balance of up to 10 ERC-20 tokens (raw and formatted with decimals and symbol) for an address on the chosen chain, read at the latest block. Price: $0.005 USDC per call via x402 (eip155:8453).
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | yes | – |
| chain | string | – | One of ethereum, base, arbitrum, optimism, polygon, bsc, avalanche, gnosis, base-sepolia, sepolia (or a chain id) |
| tokens | array|string | – | Token contract addresses (optional) |
No output schema declared.
No examples provided.
evm_contract Is an address a contract or a wallet? Code size, EIP-1967 proxy implementation/admin/beacon, EIP-7702 delegation ~180
Is an address a contract or a wallet? Code size, EIP-1967 proxy implementation/admin/beacon, EIP-7702 delegation. Reads the bytecode of an address on a chain: EOA vs contract, code size and hash, EIP-7702 delegated EOAs, minimal-proxy (EIP-1167) targets, EIP-1967 implementation/admin/beacon slots and legacy ZeppelinOS proxies (e.g. USDC). Also returns the native balance and nonce. Price: $0.005 USDC per call via x402 (eip155:8453).
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | yes | – |
| chain | string | – | One of ethereum, base, arbitrum, optimism, polygon, bsc, avalanche, gnosis, base-sepolia, sepolia (or a chain id) |
No output schema declared.
No examples provided.
evm_gas Current gas price, base fee and priority fee on an EVM chain ~136
Current gas price, base fee and priority fee on an EVM chain. Latest block number, base fee, suggested priority fee and gas price in gwei, plus the cost in native currency of a 21,000-gas transfer and a 65,000-gas ERC-20 transfer at the current price. Price: $0.003 USDC per call via x402 (eip155:8453).
| Name | Type | Req | Description |
|---|---|---|---|
| chain | string | – | One of ethereum, base, arbitrum, optimism, polygon, bsc, avalanche, gnosis, base-sepolia, sepolia (or a chain id) |
No output schema declared.
No examples provided.
evm_selector Function selector and event topic for a Solidity signature ~99
Function selector and event topic for a Solidity signature. Normalizes a function/event/error signature (drops parameter names, expands uint to uint256, handles tuples and arrays) and returns the 4-byte selector and the 32-byte event topic. No network access. Price: $0.003 USDC per call via x402 (eip155:8453).
| Name | Type | Req | Description |
|---|---|---|---|
| signature | string | yes | e.g. transfer(address to, uint256 amount) |
No output schema declared.
No examples provided.
evm_selector_lookup Reverse-lookup 4-byte function selectors and 32-byte event topics to signatures ~113
Reverse-lookup 4-byte function selectors and 32-byte event topics to signatures. Looks up up to 20 selectors (0x + 8 hex) and event topics (0x + 64 hex) in the public openchain signature database (4byte.directory fallback) and returns candidate signatures, verified-contract ones first. Price: $0.005 USDC per call via x402 (eip155:8453).
| Name | Type | Req | Description |
|---|---|---|---|
| selectors | array|string | yes | Selectors/topics, comma separated or array |
No output schema declared.
No examples provided.
evm_token ERC-20 token metadata: name, symbol, decimals, total supply (on-chain) ~132
ERC-20 token metadata: name, symbol, decimals, total supply (on-chain). Reads name(), symbol(), decimals() and totalSupply() directly from the token contract on the chosen chain (handles bytes32 names), and formats the supply with the token's decimals. Price: $0.005 USDC per call via x402 (eip155:8453).
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | yes | – |
| chain | string | – | One of ethereum, base, arbitrum, optimism, polygon, bsc, avalanche, gnosis, base-sepolia, sepolia (or a chain id) |
No output schema declared.
No examples provided.
evm_tx Explain an EVM transaction: status, fee, decoded method, ERC-20/721 transfers ~160
Explain an EVM transaction: status, fee, decoded method, ERC-20/721 transfers. Fetches a transaction and its receipt from a public RPC: from/to, value, status, block and time, gas used, effective gas price and fee in native currency, the decoded method call, and every Transfer event (ERC-20 amounts formatted with token decimals and symbols, ERC-721 token ids). Price: $0.01 USDC per call via x402 (eip155:8453).
| Name | Type | Req | Description |
|---|---|---|---|
| chain | string | – | One of ethereum, base, arbitrum, optimism, polygon, bsc, avalanche, gnosis, base-sepolia, sepolia (or a chain id) |
| hash | string | yes | – |
No output schema declared.
No examples provided.
evm_units Exact conversion between wei, gwei, ether or any token decimals ~123
Exact conversion between wei, gwei, ether or any token decimals. Converts an amount between wei / gwei / ether (or any decimals 0-36, e.g. 6 for USDC) with exact integer arithmetic (no floating-point rounding), and refuses conversions that would drop digits. Price: $0.003 USDC per call via x402 (eip155:8453).
| Name | Type | Req | Description |
|---|---|---|---|
| from | string | – | wei, gwei, ether, or a number of decimals |
| to | string | – | – |
| value | string | yes | – |
No output schema declared.
No examples provided.
evm_verify_message Recover the signer of an EIP-191 personal_sign message and check it against an address ~146
Recover the signer of an EIP-191 personal_sign message and check it against an address. Computes the EIP-191 message hash and recovers the signing address from a 65-byte signature (v = 27/28 or 0/1), optionally comparing it with an expected address. Works for Sign-In-With-Ethereum messages and wallet login challenges. Contract (EIP-1271) wallets are not checked. Price: $0.003 USDC per call via x402 (eip155:8453).
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | – | – |
| message | string | yes | – |
| messageEncoding | string | – | – |
| signature | string | yes | – |
No output schema declared.
No examples provided.
hash Hash text or bytes: SHA-1/2/3, Keccak-256, MD5, RIPEMD-160, BLAKE2/3 ~180
Hash text or bytes: SHA-1/2/3, Keccak-256, MD5, RIPEMD-160, BLAKE2/3. Computes one or all of md5, sha1, sha224, sha256, sha384, sha512, sha3-256, sha3-512, keccak256, ripemd160, blake2b-256/512, blake2s-256, blake3. Input as UTF-8 text, hex, base64 or base58; output hex or base64. Up to 1 MB. Price: $0.003 USDC per call via x402 (eip155:8453).
| Name | Type | Req | Description |
|---|---|---|---|
| algorithm | string | – | – |
| data | string | yes | – |
| inputEncoding | string | – | – |
| outputEncoding | string | – | – |
No output schema declared.
No examples provided.
hmac HMAC (SHA-256/384/512/1, MD5), e.g. to check a webhook signature ~146
HMAC (SHA-256/384/512/1, MD5), e.g. to check a webhook signature. Computes HMAC of a message with a key (text, hex or base64). Optionally compares against an expected signature in constant time and reports whether it matches. Keys are not stored or logged. Price: $0.003 USDC per call via x402 (eip155:8453).
| Name | Type | Req | Description |
|---|---|---|---|
| algorithm | string | – | – |
| expected | string | – | Optional signature to compare (hex or base64, optional "sha256=" prefix) |
| key | string | yes | – |
| keyEncoding | string | – | – |
| message | string | yes | – |
No output schema declared.
No examples provided.
html_extract Convert HTML you already have to clean text / Markdown and extract its metadata and links ~132
Convert HTML you already have to clean text / Markdown and extract its metadata and links. Same engine as web-extract, without fetching: send up to 2 MB of HTML (and an optional base URL for resolving links) and get Markdown and/or plain text, title, description, OpenGraph, headings, links and images. Price: $0.005 USDC per call via x402 (eip155:8453).
| Name | Type | Req | Description |
|---|---|---|---|
| baseUrl | string | – | – |
| format | string | – | – |
| html | string | yes | – |
| maxChars | integer | – | – |
| mode | string | – | – |
No output schema declared.
No examples provided.
iban_validate Validate an IBAN: country length, mod-97 check digits, formatted output ~113
Validate an IBAN: country length, mod-97 check digits, formatted output. Validates International Bank Account Numbers for 80+ countries: structure, country-specific length and the ISO 13616 mod-97 checksum. Returns the normalized and print-formatted IBAN, BBAN and (for DE/GB) the bank code / sort code. Offline; nothing is stored. Price: $0.003 USDC per call via x402 (eip155:8453).
| Name | Type | Req | Description |
|---|---|---|---|
| iban | string | yes | – |
No output schema declared.
No examples provided.
ip_info Parse and classify an IPv4/IPv6 address (private, loopback, CGNAT, documentation, ...) ~130
Parse and classify an IPv4/IPv6 address (private, loopback, CGNAT, documentation, ...). Canonical and expanded forms, integer and hex values, version, scope per the IANA special-purpose registries (private, loopback, link-local, CGNAT, multicast, documentation, 6to4, NAT64, IPv4-mapped with the embedded address), whether it is globally routable, and the reverse-DNS name. Price: $0.003 USDC per call via x402 (eip155:8453).
| Name | Type | Req | Description |
|---|---|---|---|
| ip | string | yes | – |
No output schema declared.
No examples provided.
ip_range_to_cidr Convert an IP range (start - end) to the minimal list of CIDR blocks ~90
Convert an IP range (start - end) to the minimal list of CIDR blocks. Exact conversion of an inclusive address range to CIDR blocks, IPv4 or IPv6, up to 1,000 blocks. Price: $0.003 USDC per call via x402 (eip155:8453).
| Name | Type | Req | Description |
|---|---|---|---|
| end | string | yes | – |
| start | string | yes | – |
No output schema declared.
No examples provided.
json_diff Structural diff of two JSON documents as JSON-Patch-style operations ~112
Structural diff of two JSON documents as JSON-Patch-style operations. Compares two JSON values key by key and index by index and returns add / remove / replace operations with JSON Pointer paths and old and new values (up to 2,000 operations). Price: $0.003 USDC per call via x402 (eip155:8453).
| Name | Type | Req | Description |
|---|---|---|---|
| a | – | yes | Original (a JSON value, or a string containing JSON) |
| b | – | yes | Changed (a JSON value, or a string containing JSON) |
No output schema declared.
No examples provided.
json_format Parse, pretty-print, minify or canonicalize JSON (sorted keys); locate syntax errors ~125
Parse, pretty-print, minify or canonicalize JSON (sorted keys); locate syntax errors. Parses JSON and returns it pretty-printed (2/4 spaces or tabs), minified, or canonical with sorted keys, plus size, node count and depth. On invalid JSON, reports the error position with line and column. Price: $0.003 USDC per call via x402 (eip155:8453).
| Name | Type | Req | Description |
|---|---|---|---|
| indent | integer | – | – |
| json | string | yes | JSON text |
| mode | string | – | – |
| sortKeys | boolean | – | – |
No output schema declared.
No examples provided.
json_query Extract values from JSON with a JSON Pointer or a dotted path (a.b[0].c, items[*].id) ~123
Extract values from JSON with a JSON Pointer or a dotted path (a.b[0].c, items[*].id). Reads one value by RFC 6901 JSON Pointer (/a/b/0) or a dotted path with [index] and [*] wildcards. Up to 20 paths per call. Price: $0.003 USDC per call via x402 (eip155:8453).
| Name | Type | Req | Description |
|---|---|---|---|
| json | – | yes | Document (a JSON value, or a string containing JSON) |
| path | string | – | – |
| paths | array | – | – |
No output schema declared.
No examples provided.
json_to_csv JSON array of objects to CSV (nested objects flattened to dot.keys) ~127
JSON array of objects to CSV (nested objects flattened to dot.keys). Converts an array of objects (or arrays) to CSV with a header row built from the union of keys. Nested objects become dot.separated columns, arrays are JSON-encoded, and cells starting with = + - @ are escaped against spreadsheet formula injection. Price: $0.003 USDC per call via x402 (eip155:8453).
| Name | Type | Req | Description |
|---|---|---|---|
| delimiter | string | – | – |
| flatten | boolean | – | – |
| json | – | yes | Array of objects (a JSON value, or a string containing JSON) |
No output schema declared.
No examples provided.
json_validate Validate JSON data against a JSON Schema (draft 2020-12 / draft-07) ~187
Validate JSON data against a JSON Schema (draft 2020-12 / draft-07). Checks data against a schema: types, enum/const, numeric and string limits, patterns, formats (email, date-time, uri, uuid, ipv4/6, hostname), arrays, objects, $ref (same document), allOf/anyOf/oneOf/not, if/then/else. Returns every error with its JSON Pointer path. Remote $ref is not fetched. Price: $0.003 USDC per call via x402 (eip155:8453).
| Name | Type | Req | Description |
|---|---|---|---|
| data | – | yes | Data to validate (any JSON value; a string is parsed as JSON when it is valid JSON, otherwise validated as a plain string) |
| formats | boolean | – | Assert "format" keywords |
| schema | – | yes | JSON Schema (a JSON value, or a string containing JSON) |
No output schema declared.
No examples provided.
jwt_decode Decode a JWT and check its times; optionally verify an HS256/384/512 signature ~142
Decode a JWT and check its times; optionally verify an HS256/384/512 signature. Decodes header and payload, converts exp/iat/nbf to ISO dates, reports whether the token is expired or not yet valid, and flags alg=none. If a shared secret is given, verifies HMAC signatures (HS256/384/512) in constant time. Secrets are not stored or logged. Price: $0.003 USDC per call via x402 (eip155:8453).
| Name | Type | Req | Description |
|---|---|---|---|
| secret | string | – | Optional HMAC secret to verify the signature |
| secretEncoding | string | – | – |
| token | string | yes | – |
No output schema declared.
No examples provided.
random Cryptographically secure random bytes, tokens and passwords ~121
Cryptographically secure random bytes, tokens and passwords. Generates random bytes (hex/base64/base64url/base58), passwords with chosen character classes, or numeric PINs, from a CSPRNG. Reports the entropy in bits. Nothing is stored. Price: $0.003 USDC per call via x402 (eip155:8453).
| Name | Type | Req | Description |
|---|---|---|---|
| count | integer | – | – |
| encoding | string | – | – |
| kind | string | – | – |
| length | integer | – | bytes for kind=bytes, characters otherwise |
| symbols | boolean | – | – |
No output schema declared.
No examples provided.
semver Semantic versions: parse, compare, sort, and check against npm-style ranges ~157
Semantic versions: parse, compare, sort, and check against npm-style ranges. Parses SemVer 2.0 versions; compares two (a vs b); sorts a list (invalid ones reported); checks versions against npm range syntax (^, ~, x-ranges, hyphen ranges, comparators, ||) with correct prerelease rules; returns the highest version satisfying the range. Price: $0.003 USDC per call via x402 (eip155:8453).
| Name | Type | Req | Description |
|---|---|---|---|
| compareTo | string | – | – |
| range | string | – | Optional npm-style range, e.g. ^1.2.0 || >=2.1 <3 |
| versions | array|string | yes | One or more versions, comma separated |
No output schema declared.
No examples provided.
text_diff Line diff of two texts as a unified diff with added/removed counts ~107
Line diff of two texts as a unified diff with added/removed counts. Computes a minimal line-based diff (LCS) between two texts and returns unified-diff hunks with configurable context, plus counts of added and removed lines. Up to 5,000 lines per side. Price: $0.003 USDC per call via x402 (eip155:8453).
| Name | Type | Req | Description |
|---|---|---|---|
| a | string | yes | – |
| b | string | yes | – |
| context | integer | – | – |
No output schema declared.
No examples provided.
text_stats Text statistics: words, sentences, reading time, readability, top keywords ~105
Text statistics: words, sentences, reading time, readability, top keywords. Counts characters, graphemes, words, sentences, paragraphs and lines; estimates reading and speaking time; computes Flesch reading ease and Flesch-Kincaid grade (English) and the most frequent keywords without stop words. Price: $0.003 USDC per call via x402 (eip155:8453).
| Name | Type | Req | Description |
|---|---|---|---|
| text | string | yes | – |
| top | integer | – | – |
No output schema declared.
No examples provided.
text_transform Slugify and case conversion (camel, snake, kebab, title, constant ...), trim, dedupe lines ~116
Slugify and case conversion (camel, snake, kebab, title, constant ...), trim, dedupe lines. Transforms text: slug, camelCase, PascalCase, snake_case, kebab-case, CONSTANT_CASE, Title Case, Sentence case, upper, lower, strip accents, collapse whitespace, sort or dedupe lines, remove HTML tags. Price: $0.003 USDC per call via x402 (eip155:8453).
| Name | Type | Req | Description |
|---|---|---|---|
| op | string | yes | – |
| text | string | yes | – |
No output schema declared.
No examples provided.
time_convert Convert a time between time zones and formats (ISO, unix, RFC 2822), with DST-aware offsets ~159
Convert a time between time zones and formats (ISO, unix, RFC 2822), with DST-aware offsets. Parses ISO 8601, unix seconds/ms or "now" (a bare local time is read in the "from" zone) and returns it in UTC and in each target IANA zone with offsets, weekday, ISO week, day of year, unix seconds/ms and RFC 2822. Up to 20 target zones. Price: $0.003 USDC per call via x402 (eip155:8453).
| Name | Type | Req | Description |
|---|---|---|---|
| from | string | – | IANA zone used to read a time without an offset |
| time | string | – | – |
| to | array|string | – | IANA zone(s), comma separated |
No output schema declared.
No examples provided.
time_diff Duration between two dates/times, calendar difference and business days ~113
Duration between two dates/times, calendar difference and business days. Exact duration (seconds, minutes, hours, days), calendar difference in years/months/days, and the number of weekdays (Mon-Fri) between two dates, evaluated in a chosen time zone. Optionally adds a duration to a date. Price: $0.003 USDC per call via x402 (eip155:8453).
| Name | Type | Req | Description |
|---|---|---|---|
| end | string | – | – |
| start | string | yes | – |
| tz | string | – | – |
No output schema declared.
No examples provided.
How do I install the x402 Toolbox MCP server?
x402 Toolbox is a hosted endpoint at https://x402-toolbox.swiftbotlab.workers.dev/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · x402-toolbox.swiftbotlab.workers.dev
claude mcp add --transport http swiftbotlab-x402-toolbox 'https://x402-toolbox.swiftbotlab.workers.dev/mcp'
What is the x402 Toolbox MCP server?
x402 Toolbox is an MCP server listed in the public MCP registry as io.github.swiftbotlab/x402-toolbox. 62 pay-per-call web, DNS, EVM and data tools. x402 USDC on Base, $0.003-$0.02 per call, no signup. This page covers its hosted endpoint (https://x402-toolbox.swiftbotlab.workers.dev/mcp).
Is the x402 Toolbox MCP server safe to use?
x402 Toolbox scores 66 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the x402 Toolbox MCP server expose?
x402 Toolbox exposes 62 tools: dns_lookup, dns_mx, dns_reverse, dns_spf, dns_dmarc, and 57 more. Their descriptions and schemas cost roughly 7,918 tokens of context every time the server is loaded.
Does the x402 Toolbox MCP server require authentication?
No. We connected to x402 Toolbox without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the x402 Toolbox MCP server still maintained?
x402 Toolbox is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.