Tolca

ca.tonbot.tolcaPublished by tolca.tonbot.caOfficial publisherv1.0.0Updated Oct 27, 2026

Verify a company before paying it: OFAC sanctions, UK/Canada registries, contractor licences (x402)

VerifiedStreamable HTTPWeb executableWeb Search & ScrapingSecurity & MonitoringBusiness & Commerce

Overview

AI-generated overview

Remote MCP server for pre-payment checks: package safety, business and Québec contractor verification, plus paid text utilities billed in USDC.

What you can do
  • Check npm and PyPI packages: safety verdict with OSV vulnerabilities, deprecation, install scripts and typosquat signals, or cheaper metadata only
  • Verify companies and contractors: US restricted-party lists, UK/Canada registries, GLEIF entity status, and Québec RBQ licence, RENA and SEAO contract checks
  • Search the web and read the top pages in one call, with official-sources mode and freshness filters
  • Run paid text utilities: summarize, translate French/English, and extract text or a fetched URL into JSON matching a schema
  • Assess homework assignments for AI-completion risk with per-question breakdowns
When to use it
Useful when an assistant needs to vet something before money or trust changes hands: installing a dependency, hiring or paying a contractor, onboarding a company, or checking whether an assignment is AI-resistant. Also handy for one-call web research and schema-shaped extraction.
Requirements
Remote streamable HTTP endpoint; no account, API key or environment variable is declared. The summarize, translate, extract and extract_url tools are pay-per-call in USDC on Base over x402, so a funded wallet and the PAYMENT-SIGNATURE header are needed for those. Network access to the endpoint and to the sources it queries.
Before you install
Four tools spend real money per call in USDC on Base (roughly $0.02–$0.04 each) and require signing a payment header, so set spending limits and expect charges on every invocation. Queries, pasted text and URLs are sent to a third-party service. Verdicts are advisory and drawn from external registries and lists, so confirm blocking results before acting. No authentication is declared for the endpoint.

Installation

In SourceWeft

  1. Open Tolca in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/ca.tonbot.tolca%2Ftolca/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "tolca": {
      "type": "http",
      "url": "https://tolca.tonbot.ca/mcp"
    }
  }
}

Tools

11

pkg_check

Package safety check (npm / PyPI)

Is this package safe to install? One call, one verdict: safe / caution / avoid, with a score, concrete reasons (known vulnerabilities from OSV, deprecation, abandonment, adoption, install scripts, typosquat signals) and a one-line recommendation. Input: name, ecosystem (npm | PyPI), optional version. Free over MCP (100/day shared quota); unlimited via x402 at https://tolca.tonbot.ca/v1/pkg-check ($0.02).

Parametersnamerequiredversionecosystemrequired

qc_contractor_check

Québec contractor check (RBQ + RENA + environmental penalties + SEAO public contracts)

Call before hiring, paying or subcontracting a Québec (Canada) contractor. One call checks: active RBQ licence (status, categories, restrictions), RENA listing (banned from public contracts), environmental penalties, public contracts awarded on SEAO (count, total, buyers). Verdict ok / review / blocking with reasons and source dates. Input: name, NEQ or RBQ licence number. Official open data. Free over MCP (10/day shared quota); unlimited via x402 at https://tolca.tonbot.ca/v1/qc-contractor-check ($0.1).

Parametersneqlangnamelicence

summarize

Summarize text (up to 40k chars) into a faithful, tight summary, with optional max_words and target language. Pay-per-call over x402 in USDC on Base; payment challenge answered in ~10 ms, 7-day average processing ~1.5 s across Tolca services. Costs $0.03 USDC per call (x402 v2, Base). Send the HTTP header PAYMENT-SIGNATURE with your x402 payment, or call POST https://tolca.tonbot.ca/v1/summarize with an x402 client.

Parameterstextrequiredlanguagemax_words

translate

Translate text between French (including Quebec French) and English, with optional tone. Pay-per-call over x402 in USDC on Base; payment challenge answered in ~25 ms, 7-day average processing ~1.5 s across Tolca services. Costs $0.04 USDC per call (x402 v2, Base). Send the HTTP header PAYMENT-SIGNATURE with your x402 payment, or call POST https://tolca.tonbot.ca/v1/translate with an x402 client.

Parameterstextrequiredtonetargetrequired

extract

Turn messy text into clean JSON matching the schema you provide (field names and types). Pay-per-call over x402 in USDC on Base; payment challenge answered in ~5 ms, 7-day average processing ~1.5 s across Tolca services. Costs $0.02 USDC per call (x402 v2, Base). Send the HTTP header PAYMENT-SIGNATURE with your x402 payment, or call POST https://tolca.tonbot.ca/v1/extract with an x402 client.

Parameterstextrequiredschemarequired

extract_url

extract-url

Fetch a public URL (HTML article, PDF, or JSON) and return JSON matching your schema in one call, with page title and source. Pay-per-call over x402 in USDC on Base; payment challenge answered in ~8 ms. Costs $0.03 USDC per call (x402 v2, Base). Send the HTTP header PAYMENT-SIGNATURE with your x402 payment, or call POST https://tolca.tonbot.ca/v1/extract-url with an x402 client.

Parametersurlrequiredschemarequiredmax_chars

qc_licence

qc-licence

Cheapest check: does this Québec contractor hold an ACTIVE RBQ licence right now? Returns active true/false, licence number, name, NEQ, city, restriction flag and authorized work categories. Use to vet many contractors fast; use qc-contractor-check for RENA and penalties. Input: name, NEQ or RBQ licence number. Costs $0.01 USDC per call (x402 v2, Base). Send the HTTP header PAYMENT-SIGNATURE with your x402 payment, or call POST https://tolca.tonbot.ca/v1/qc-licence with an x402 client.

Parametersneqnamelicence

pkg_meta

pkg-meta

Package metadata in one call, cheapest tier: latest and resolved version, license, first/last publish dates, weekly downloads, deprecation flag, install scripts, maintainers count. npm or PyPI. No vulnerability scan (see pkg-check for the full safe/caution/avoid verdict). Input: name, ecosystem (npm | PyPI), optional version. Costs $0.005 USDC per call (x402 v2, Base). Send the HTTP header PAYMENT-SIGNATURE with your x402 payment, or call POST https://tolca.tonbot.ca/v1/pkg-meta with an x402 client.

Parametersnamerequiredversionecosystemrequired

homework_check

homework-check

Can this homework be done by an AI? For teachers and schools: paste an assignment (or a public PDF URL) and get an overall AI-completion risk 0-100, a per-question breakdown (risk, why, concrete fix to make it AI-resistant) and general tips. No student data. Input: text or url, optional grade, subject, lang fr|en. / Ce devoir peut-il être fait par une IA? Score par question et corrections concrètes pour l'enseignant. Costs $0.25 USDC per call (x402 v2, Base). Send the HTTP header PAYMENT-SIGNATURE with your x402 payment, or call POST https://tolca.tonbot.ca/v1/homework-check with an x402 client.

Parametersurllangtextgradesubject

verify_business

verify-business

Call before paying, onboarding or contracting a company (KYB). One call: US restricted-party lists (CSL incl. OFAC SDN), company registries (UK Companies House, Canada federal), legal entity status (GLEIF, worldwide), contractor licences (Québec, Washington, Oregon). Verdict ok / review / blocking / not_found with reasons. Input: name, optional country (ISO-2) and region (WA, OR, QC). Businesses only. Costs $0.05 USDC per call (x402 v2, Base). Send the HTTP header PAYMENT-SIGNATURE with your x402 payment, or call POST https://tolca.tonbot.ca/v1/verify-business with an x402 client.

Parametersnamerequiredregioncountry

Version history

2
  1. v1.0.0LatestOct 16, 2026
  2. v0.9.0Oct 12, 2026

Score

83% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts

    Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.

  • LicenseNot applicable

    A hosted service is used under its provider's terms, so no license is expected here. This check is left out of the percentage.