ToolFit audits, pins and diffs AI agent tool definitions and preflights remote MCP servers, reporting token cost, schema errors and changes.
What you can do
Audit a tool list for estimated token cost, provider schema errors with fixed definitions, confusable tool pairs and poisoning lint, and pin it for later comparison. Diff a current tool list or URL against a pin or baseline, with each change labeled breaking or suspicious. Preflight a remote MCP server: handshake, protocol version, sign-in method, payment terms, latency and grade, without calling its tools. Start, check and cancel a paid hosted watch that re-audits a server and sends a signed webhook when its tools or grade change.
When to use it
Useful when you maintain or review the tools an agent loads and want to catch schema errors, token bloat or risky changes before they reach production, or when you are deciding whether a remote MCP server is worth connecting to or paying for.
Requirements
Remote streamable HTTP endpoint; no authentication, environment variables or headers declared. Free tier allows 20 audit/diff and 10 check calls per IP per day; beyond that, x402 payment or prepaid credits. Hosted watches are paid and require an HTTPS webhook endpoint.
Before you install
Paid features: hosted watches cost money per interval and are not refunded on cancellation, and usage beyond the free tier requires x402 payment or credits. Watches need a watch_id and secret, and send signed webhooks to an endpoint you supply. The service fetches tool lists from URLs you give it.
Enable the server for the chats that should use its tools.
Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.
Use with an agent
Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.
Read https://sourceweft.com/mcp/co.youraitools%2Ftoolfit/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.
Check the tool definitions an agent loads, before they cost tokens or fail: estimated tokens per tool, schema errors per provider (OpenAI, Anthropic, Gemini, Bedrock, MCP; add openai_strict for strict mode) with JSON paths and fixed definitions, tool pairs models will confuse with fix hints, basic poisoning patterns, a grade and a pin (set_id) for diff_tools. Pass "tools" (array in any common format) or "url" (public remote MCP server; tools are listed, never called). level "lite" returns the summary only. Free: 20 calls/day per IP (shared with diff_tools), then $0.003 lite / $0.01 full via x402 or credits.
Parametersurlleveltoolsproviders
diff_tools
Diff a tool list against a pin (ToolFit)
What changed in a tool list since you approved it? Compares "tools" or "url" now with "pin" (set_id from audit_tools/diff_tools) or "baseline" (earlier definitions). Each change is labeled breaking (removed tool or param, new required param, type or enum removal), suspicious (new text with injection patterns or hidden characters), review (description, title, annotation or new tool) or additive; descriptions come with before/after text and a word diff. Returns a new pin. Free: 20 calls/day per IP (shared with audit_tools), then $0.002 via x402 or credits.
Parameterspinurltoolsbaseline
check_mcp_server
Preflight a remote MCP server (MCPCheck)
Does this remote MCP server work, and is it worth connecting or paying for? Sends initialize and tools/list only (never calls a tool) and reports reachability, protocol version, sign-in method (OAuth protected-resource metadata), x402 payment terms if it asks for payment, latency, tool count and token cost, provider compatibility, poisoning patterns in tools and server instructions, issues and a grade A-F, plus a pin for later diffs. https public hosts only. Free: 10 checks/day per IP, then $0.005 via x402 or credits.
Parametersurlrequired
watch_mcp_server
Watch a remote MCP server for changes (ToolFit)
Hosted watch (paid only; this MCP call validates and returns how to pay): ToolFit re-audits a public remote MCP server every 24 h ($0.25) or 6 h ($0.60) for 30 days and POSTs an HMAC-SHA256 signed JSON webhook to your https endpoint when its tools/list fingerprint or grade changes, or it goes unreachable or recovers. Pay at POST /v1/watch or /v1/watch/6h with x402 or a credits key; the response has watch_id and the signing secret (shown once).
Parametersurlrequiredeverywebhookrequired
watch_status
Status of a ToolFit watch
Free: state (active, expired, cancelled), interval, expiry, next check, last result (pin, grade, score, tool count) and webhook delivery counters for a watch. Needs watch_id and the secret returned when it was created.
Parameterssecretrequiredwatch_idrequired
watch_cancel
Cancel a ToolFit watch
Free: cancel a watch (no further checks or webhooks; not refunded). Needs watch_id and the secret returned when it was created.
Parameterssecretrequiredwatch_idrequired
Version history
2
v0.1.1LatestOct 25, 2026
v0.1.0Oct 24, 2026
Score
83%
83% of the applicable checks met
How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.
Reached in the last 30 daysRequired25 pts
Auth declaredRequired10 pts
Tools listedRequired15 pts
DescriptionRequired15 pts
Logo10 pts
Documentation15 pts
Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.
LicenseNot applicable
A hosted service is used under its provider's terms, so no license is expected here. This check is left out of the percentage.
