Agent Utils (x402)

dev.workers.revenue-agent-jw.agent-utils-x402-productionPublished by agent-utils-x402-production.revenue-agent-jw.workers.devOfficial publisherv1.8.0Updated Nov 7, 2026

Public records, email-auth DNS and OSV package vuln checks for agents: SEC, FDA, trials. x402 USDC

VerifiedStreamable HTTPWeb executableFinanceSecurity & MonitoringData & Analytics

Overview

AI-generated overview

Remote MCP server bundling US public-record lookups (recalls, SEC, FDA, trials, weather) plus security and compliance checks, paid per call in USDC via x402.

What you can do
  • Look up product and vehicle recalls, OFAC sanctions on crypto addresses, and FDA drug labels, adverse events and NDC codes
  • Search SEC EDGAR filings, 8-K current reports and 13F institutional holdings, plus Federal Register documents and ClinicalTrials.gov studies
  • Fetch US weather forecasts, alerts and NWS climate-day high/low, and count US business days or list federal holidays
  • Screen untrusted text for prompt injection and redact PII deterministically
  • Audit email authentication DNS (SPF, DMARC, DKIM, MTA-STS) and check open-source package vulnerabilities via OSV.dev
  • Validate x402 payment endpoints and score Crypto Twitter caller track records
When to use it
Useful when an assistant needs authoritative US public data for due diligence, compliance, safety or research tasks, or wants guardrail checks (injection scanning, PII redaction, dependency vulnerabilities) inside an agent pipeline without wiring up each source API itself.
Requirements
A remote streamable HTTP endpoint; no local install, account or API key declared. Paid tools cost $0.002 in USDC on Base through the x402 transport, so a funded wallet and x402-capable client are needed; us_federal_holidays is free and can be used to test the connection.
Before you install
Most tools are paid per call in USDC on Base, so usage spends real money from a wallet. Text submitted to the injection-scan and PII-redaction tools is sent to a third-party endpoint. Results are advisory: sanctions matching is exact-match only, and the caller-avoidance score is outcome-only with honesty deferred.

Installation

In SourceWeft

  1. Open Agent Utils (x402) in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/dev.workers.revenue-agent-jw.agent-utils-x402-production%2Fagent-utils/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "agent-utils-x402": {
      "type": "http",
      "url": "https://agent-utils-x402-production.revenue-agent-jw.workers.dev/mcp"
    }
  }
}

Tools

22

recall_check

US recall check (NHTSA, CPSC, FDA)

Product and vehicle recall lookup across US agencies in one call: NHTSA (cars, by VIN or make/model/year), CPSC (consumer products, by UPC or product name) and FDA enforcement reports (food, drugs, medical devices). Useful for safety checks before buying, selling or using a product or vehicle. Returns normalized recalls (number, date, hazard/reason, remedy, link), newest first, plus anyRecall. Errors: 400 JSON {error} for invalid input. PAID: $0.002 USDC per call on Base via x402 (MCP transport: retry with params._meta["x402/payment"]). Same tool over plain HTTP: GET /v1/recalls/check.

Parametersqupcvinmakeyearbrandlimitmodelsince

sanctions_address_check

OFAC sanctions check for crypto addresses

OFAC sanctions screening for crypto wallet addresses: exact match against every digital currency address on the U.S. Treasury OFAC SDN list (BTC, ETH, USDT, USDC, TRX, SOL, LTC, XMR and more). Useful for compliance and AML checks before paying a counterparty or an x402 payTo. Up to 20 comma-separated addresses; returns sanctioned true/false, SDN name, programs, official link and list freshness. Errors: 400 JSON {error} for invalid input. PAID: $0.002 USDC per call on Base via x402 (MCP transport: retry with params._meta["x402/payment"]). Same tool over plain HTTP: GET /v1/sanctions/address.

Parametersaddressrequired

climate_day

NWS climate-day high/low + official CLI

Daily high and low temperature for a US weather station from NWS: running provisional high/low over the station's climate day (midnight-midnight local standard time) and the official NWS Daily Climate Report (CLI) high/low once issued, flagged preliminary or final. Useful for temperature settlement, weather prediction markets and climate records. Optional temperature buckets (width/offset or explicit edges). Errors: 400 JSON {error} for invalid input. PAID: $0.002 USDC per call on Base via x402 (MCP transport: retry with params._meta["x402/payment"]). Same tool over plain HTTP: GET /v1/weather/climate-day.

Parametersclidateedgesroundunitsstationrequiredbucket_widthbucket_offset

us_weather

US weather (NWS)

US weather forecast, current conditions and severe-weather alerts for a latitude/longitude from the National Weather Service (NWS) in one call. Useful when an agent needs local temperature, a forecast or active alerts for a US location. Returns the latest station observation, next 12 hourly periods, 6-period forecast and active alerts as normalized JSON. Errors: 400 JSON {error} for invalid input. PAID: $0.002 USDC per call on Base via x402 (MCP transport: retry with params._meta["x402/payment"]). Same tool over plain HTTP: GET /v1/weather/us.

Parameterslatrequiredlonrequired

sec_filings

SEC EDGAR filings + XBRL facts

SEC EDGAR company filings and financials for a stock ticker or CIK in one call: latest 10-K, 10-Q, 8-K and other forms with dates, accession numbers, primary document and index URLs, plus optional XBRL facts (revenue, net income, shares outstanding). Useful for company research, due diligence and earnings monitoring. Errors: 400 JSON {error} for an unknown ticker; 503 while the shared SEC rate limit is busy. PAID: $0.002 USDC per call on Base via x402 (MCP transport: retry with params._meta["x402/payment"]). Same tool over plain HTTP: GET /v1/sec/filings.

Parameterscikfactsformslimitticker

injection_scan

Prompt-injection pre-filter

Prompt-injection detection for untrusted text (web pages, emails, documents, tool output) before it reaches an LLM; a guardrail for agent pipelines. Flags instruction overrides, role spoofing, secret/system-prompt exfiltration, image beacons, tool-call markup, hidden Unicode, hidden HTML and base64 payloads. Returns a 0-100 risk score, risk level and matched rules. Deterministic rules, no LLM. JSON body {text}, max 32 KB. Errors: 400 missing text, 413 too large. PAID: $0.002 USDC per call on Base via x402 (MCP transport: retry with params._meta["x402/payment"]). Same tool over plain HTTP: POST /v1/text/injection-scan.

Parameterstextrequired

us_business_days

US federal business days

US business days calculator: counts working days between two dates (inclusive), excluding weekends and observed US federal holidays per 5 U.S.C. 6103 and OPM rules. Useful for deadlines, SLAs, shipping and payment due dates. Returns the count and lists the holidays skipped. Errors: 400 JSON {error} for invalid input. PAID: $0.002 USDC per call on Base via x402 (MCP transport: retry with params._meta["x402/payment"]). Same tool over plain HTTP: GET /v1/calendar/us-business-days.

Parameterstorequiredfromrequired

x402_check

x402 endpoint readiness check

x402 endpoint validator and payment-readiness checker, useful for sellers debugging a paywall or buyers vetting an endpoint before paying. Fetches the URL unpaid, decodes the 402 challenge and grades network, USDC asset, payTo, price vs facilitator fees, EIP-712 domain, CORS and Bazaar metadata. Returns a 0-100 score and a fix list. Never pays the target. Errors: 400 JSON {error} for invalid input. PAID: $0.002 USDC per call on Base via x402 (MCP transport: retry with params._meta["x402/payment"]). Same tool over plain HTTP: GET /v1/x402/check.

Parametersurlrequiredmethod

caller_avoidance_score

Caller Avoidance Score (callers-avoid-0.1, outcome-only; honesty deferred): toxicity / avoid grade for a Crypto Twitter handle from public-call follower sim (post+5m, fees). Returns avoid_score 0-100, band, components with receipts (sim_mean, sim_win_rate, rug_rate, hit_2x_24h + Wilson CI), verdict (copy_buy_loses|insufficient_sample|mixed), and public post id links — not full post text. Free when n_scored<4 via GET /v0/callers/score. Not financial advice. PAID: $0.002 USDC per call on Base via x402 (MCP transport: retry with params._meta["x402/payment"]). Same tool over plain HTTP: GET /v1/callers/score.

Parametershandlerequired

clinical_trial_study

ClinicalTrials.gov study by NCT ID

ClinicalTrials.gov study lookup by NCT ID (official v2 API). Useful when an agent needs the facts of one trial. Returns titles, sponsor and collaborators, status and why stopped, key dates, phases, design, enrollment, conditions, interventions, primary outcomes, eligibility (ages, sex, criteria text), summary, site count, countries and up to 25 sites, plus results link, source URL and retrievedAt. Errors: 400 bad NCT ID, 404 not found. PAID: $0.002 USDC per call on Base via x402 (MCP transport: retry with params._meta["x402/payment"]). Same tool over plain HTTP: GET /v1/clinical-trials/study.

Parametersnctrequired

fda_drug_label

FDA drug label (openFDA)

FDA drug label (package insert, SPL) lookup via openFDA by brand or generic name, NDC or set ID; prefers the original packager's latest label. Useful for indications, dosing, boxed warnings, contraindications, interactions and adverse reactions. Returns label metadata (brand, generic, manufacturer, application number, NDCs, RxCUI) and selected sections trimmed to max_chars, plus DailyMed link and retrievedAt. Errors: 400 invalid input, 404 no label. PAID: $0.002 USDC per call on Base via x402 (MCP transport: retry with params._meta["x402/payment"]). Same tool over plain HTTP: GET /v1/fda/drug-label.

Parametersndcnameset_idsectionsmax_chars

fda_adverse_events

FDA adverse event counts (FAERS)

FDA adverse event report counts (FAERS via openFDA) for a drug by generic or brand name, optionally filtered by reaction, date range or serious reports only. Useful for drug safety signal checks and pharmacovigilance research. Returns total, serious, non-serious and death report counts and the top reported reactions, with source URL, FDA data date and retrievedAt. Reports do not prove causation. Errors: 400 invalid input. PAID: $0.002 USDC per call on Base via x402 (MCP transport: retry with params._meta["x402/payment"]). Same tool over plain HTTP: GET /v1/fda/adverse-events.

Parametersdrugrequiredlimitsinceuntilreactionserious_only

fda_ndc_lookup

FDA NDC directory lookup

FDA National Drug Code (NDC) directory lookup via openFDA by product or package NDC (dashed, or 10/11-digit billing format) or by drug name. Useful for pharmacy, claims and inventory data. Returns product NDC, brand and generic names, labeler, dosage form, route, active ingredients and strengths, marketing category and dates, application number, DEA schedule and packages, with DailyMed link and retrievedAt. Errors: 400 invalid input, 404 no match. PAID: $0.002 USDC per call on Base via x402 (MCP transport: retry with params._meta["x402/payment"]). Same tool over plain HTTP: GET /v1/fda/ndc.

Parametersndcnamelimit

sec_8k_filings

SEC 8-K current reports

SEC 8-K current reports from EDGAR: one company's 8-Ks by ticker or CIK, or the latest 8-Ks market-wide, optionally by item code (2.02 earnings, 5.02 officer changes, 1.01 agreements) or full-text phrase. Useful for event monitoring and research. Returns company, CIK, tickers, filing date, accession number, decoded items and document and index URLs, with retrievedAt. Errors: 400 invalid input, 503 SEC rate limit busy. PAID: $0.002 USDC per call on Base via x402 (MCP transport: retry with params._meta["x402/payment"]). Same tool over plain HTTP: GET /v1/sec/8k.

Parametersqcikitemslimitsinceuntilticker

sec_13f_holdings

SEC 13F institutional holdings

SEC 13F-HR institutional holdings for a filer by CIK or ticker (latest quarter or a given accession), parsed from the EDGAR information table. Useful for tracking what funds like Berkshire Hathaway hold. Returns period, holdings ranked by value with issuer, CUSIP, class, shares, put/call and portfolio percent, totals checked against the cover page, recent 13F filings and source URLs. Tables over 1.5 MB return 422. Errors: 400, 404 no 13F. PAID: $0.002 USDC per call on Base via x402 (MCP transport: retry with params._meta["x402/payment"]). Same tool over plain HTTP: GET /v1/sec/13f.

Parametersciklimittickeraccession

email_auth_audit

Email auth DNS audit (SPF, DMARC, DKIM, MTA-STS)

Email authentication DNS audit for a domain or email address: SPF with recursive 10-lookup count and all qualifier, DMARC policy, pct and report addresses, DKIM selector probe, MTA-STS with policy file, TLS-RPT, BIMI and MX. Useful for deliverability checks, Google/Yahoo bulk-sender readiness and spoofing risk. Returns grade A-F, score, spoofable flag, parsed records and plain-language issues. Errors: 400 invalid domain, 404 NXDOMAIN. PAID: $0.002 USDC per call on Base via x402 (MCP transport: retry with params._meta["x402/payment"]). Same tool over plain HTTP: GET /v1/dns/email-auth.

Parametersdomainrequiredselectors

osv_package_vulns

Package vulnerability check (OSV.dev)

Open-source package vulnerability check via OSV.dev for npm, PyPI, Go, crates.io, Maven, RubyGems, NuGet, Packagist and more, by ecosystem+name+version, purl, or up to 10 purls. Useful before installing or upgrading a dependency. Returns vulnerable flag, count, CVE/GHSA aliases, CVSS score and severity, fixed versions and a verified upgradeTo version. Errors: 400 invalid input, 502 OSV unavailable. PAID: $0.002 USDC per call on Base via x402 (MCP transport: retry with params._meta["x402/payment"]). Same tool over plain HTTP: GET /v1/osv/package.

Parametersnamepurllimitversionpackagesecosystem

text_pii_redact

Deterministic PII redact (email/phone/SSN/card/IP/IBAN/routing/secrets)

Deterministic PII detect-and-redact for untrusted text (tickets, chat logs, LLM prompts) before storage or model input. Finds email, phone, US SSN, credit card (Luhn), IP, IBAN (mod-97), US ABA routing, and secret prefixes (sk-, ghp_, AKIA…). Checksum-validated; no LLM/NER. Returns findings with offsets, placeholders, redacted copy and countsByType. Optional types= filter. POST JSON {text} max 32 KB (GET ?text= max 2,000). Errors: 400 bad input. PAID: $0.002 USDC per call on Base via x402 (MCP transport: retry with params._meta["x402/payment"]). Same tool over plain HTTP: POST /v1/text/pii-redact.

Parameterstextrequiredtypes

solana_pre_promo

Solana pre-promo covered-shelf aggregates vs matched null

Pre-promo tape lookup for a Solana token when we hold a locked [-60m,0] window around its DexScreener paid-promo timestamp (specialty covered shelf, not a universal catalog). Returns raw aggregates only: net buy USD, unique buyers, largest buyer share, and the same stats vs a matched-null mean from other covered tokens (intensity-tercile leave-one-out). Uncovered token -> 404 with coverage:false and the live coverage rate — never fabricated numbers. Free coverage probe: GET /v0/solana/pre-promo-coverage. Not financial advice; no wallet-to-person attribution. PAID: $0.01 USDC per call on Base via x402 (MCP transport: retry with params._meta["x402/payment"]). Same tool over plain HTTP: GET /v1/solana/pre-promo.

Parameterstokenrequired

us_federal_holidays

US federal holidays (free)

FREE. US federal holidays (observed dates) for a year, per 5 U.S.C. 6103. Useful to test the connection before paying.

Parametersyear

Version history

5
  1. v1.8.0LatestNov 7, 2026
  2. v1.7.0Nov 5, 2026
  3. v1.6.0Nov 4, 2026
  4. v1.5.0Nov 3, 2026
  5. v1.2.0Oct 22, 2026

Score

72% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts

    Publish an icon in the registry entry.

  • Documentation15 pts

    Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.

  • LicenseNot applicable

    A hosted service is used under its provider's terms, so no license is expected here. This check is left out of the percentage.