PayCheck

io.github.toolweatherPublished by GitHub account toolweatherv1.0.0Updated Oct 24, 2026

Score merchant domain, https URL, or 0x wallet trust before an agent pays. Does not send payments.

The publisher's own server: check.tattoo: tattoo size and placement guide

VerifiedStreamable HTTPWeb executableFinanceSecurity & Monitoring

Overview

AI-generated overview

Scores a merchant domain, https URL, or 0x wallet for payee trust before an AI agent sends a payment.

What you can do
PayCheck exposes three tools over streamable HTTP. check_merchant returns a deterministic trust score and recommended action for a domain, an https URL, or a 0x wallet address; get_quota reports remaining free checks for the day; get_api_key mints a free pc_live_ key. Scoring starts at 100, subtracts penalties based on allowlist membership, domain age from public RDAP, and scam or typosquat patterns. The server does not send payments, sign transactions, or hold wallet keys.
When to use it
Useful when an autonomous agent is about to pay a merchant, invoice, or transfer and needs a payee trust check first. Call check_merchant once per payee, immediately before checkout. It is not a spend-limit tool and cannot overturn a block verdict.
Requirements
Remote streamable HTTP endpoint; no local install or package needed. Optional Authorization Bearer pc_live_ key raises the free quota from 100 to 1,000 checks per UTC day; keys are minted via POST /v1/keys or the get_api_key tool. Over-cap checks cost $0.001 USDC on Base via x402. Network access to the endpoint and to public RDAP is required.
Before you install
The Authorization header carries a secret pc_live_ key; key minting is capped at 10 keys per IP per UTC day and only a SHA-256 hash is stored. Over-cap checks spend $0.001 USDC on Base through x402, so a configured wallet can be charged. check_merchant may write check history. The server does not send payments or hold keys, but it also cannot override a block verdict.

Installation

In SourceWeft

  1. Open PayCheck in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.toolweather%2Fpaycheck/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "paycheck": {
      "type": "http",
      "url": "https://paycheck.toolweather.workers.dev/mcp"
    }
  }
}

README

This repository has no README.

Tools

3

check_merchant

Check merchant

Decide whether an autonomous agent should pay a merchant, host, or wallet. PayCheck returns a deterministic trust score for one target. It does not send money, does not sign transactions, and does not hold wallet keys. Use this immediately before a payment, a checkout redirect, or a transfer to a new 0x address. Pass the payee as a bare domain (api.openai.com), an https URL, or a 0x address with 40 hex characters. Do not use this tool to execute a payment. Do not use it to overturn a block. Do not call it again with a reworded category, purpose, or amount to fish for a better verdict: those fields are ignored and are not stored. Trusted is returned only for the published allowlist of known AI and developer APIs, served over https on port 443. A new or random domain is never trusted. A wallet is never trusted. Scoring v1 does not analyze on-chain history. If the URL contains an embedded 0x address, this scores the host only and will not return trusted; pass the bare address to score the wallet. Arguments: target (required string); amount_usd (optional number, ignored); category (optional string, ignored); api_key (optional pc_live_ key). You may also send Authorization: Bearer or X-API-Key. Omit the key for the anonymous allowance. Returns: score (integer 0-100), verdict (trusted | unknown | suspicious | block), reasons[], recommended_action (proceed | verify_out_of_band | require_human_review | do_not_pay), signals (host, allowlist, domain age, wallet flags, reason_codes; chain_analysis is always not_in_v1), checked_at (ISO-8601), policy_version ("1"). Free tier: 100 checks per UTC day anonymous, 1,000 per UTC day with a free pc_live_ key or a Toolweather bundle client whose x-tw-bundle-client is hex. A bundle client prefixed anon: stays at 100 per day. The same target for the same caller is idempotent for 60 seconds and does not consume a second check. Over the daily cap, each extra check is $0.001 USDC on Base (eip155:8453) via x402 and the PayAI facilitator.

Parameterstargetrequiredapi_keycategoryamount_usd

get_quota

Get quota

Show how many free PayCheck merchant checks the current caller has left for the current UTC day. Use this before a batch of check_merchant calls, or after an HTTP 402, to read the remaining free allowance and when it resets. Do not use this to score a payee. It accepts no target and it does not consume a check. Do not pay x402 for this tool. It is always free. Identity matches check_merchant. Anonymous IP: 100/day. pc_live_ api_key (api_key argument, Authorization: Bearer, or X-API-Key): 1,000/day. Toolweather bundle headers x-tw-bundle-secret and x-tw-bundle-client: hex client 1,000/day, anon: prefix 100/day, any other client id 100/day. Returns: subject_kind, limit, used, remaining, resets_at (next UTC midnight, ISO-8601), billed (always false), policy_version. No x402 charge.

Parametersapi_key

get_api_key

Get API key

Mint one free PayCheck API key. The key looks like pc_live_ followed by hex and raises the merchant-check allowance from 100 to 1,000 per UTC day. Use this once when you set up a long-running agent, then store the key and pass it on later check_merchant or get_quota calls. The plaintext key is returned only in this response. PayCheck stores a SHA-256 hash. Do not call this every turn. Do not call it to score a payee or to dodge a block verdict. Minting is free and is not an x402 check, and it is limited to 10 new keys per caller IP per UTC day. A new key does not change any merchant score. Checks above the free daily cap still cost $0.001 USDC on Base via x402. Returns: api_key, token_type (bearer), daily_limit (1000), prefix, note.

Takes no parameters.

Version history

1
  1. v1.0.0LatestOct 16, 2026

Score

75% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts

    Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.

  • License10 pts

    Declare a license in the repository or the registry entry.

Other Check integrations

check.tattoo: tattoo size and placement guide

tattoo.checkOfficial publisher

check.tattoo: tattoo size and placement guide's hosted MCP server, published by check.tattoo; no sign-in required; Streamable HTTP; 5 tools.

Streamable HTTPWeb executable
5 toolsOct 24, 2026

iva.pt — EU VAT check (VIES) and Portuguese VAT law

pt.ivaOfficial publisher

Validates EU VAT numbers against VIES and returns Portuguese VAT Code (CIVA) and RITI articles, in Portuguese or English.

Streamable HTTPWeb executable
Business & Commerce4 toolsOct 30, 2026

Check Payment Recipient

dev.kgninja

Remote MCP server that checks a planned payment recipient against sanctions, blocklist and anomaly rules before signing, returning allow, escalate or block.

Streamable HTTPWeb executable
Finance4 toolsNov 6, 2026

PHM Physics Check

Published by GitHub account PHM-Audit

Local MCP server that runs deterministic physics plausibility checks on LLM text, single quantities and robotics records, returning PASS/WARN/FAIL verdicts.

STDIODesktop only
AI & MLNot validated · the package type cannot run in the sandboxNov 6, 2026

Frame Check

Published by GitHub account lluvr

Deterministic structural framing analysis: an assistant can profile which perspectives a document covers or omits and compare two documents' framing.

STDIODesktop only
Data & Analytics2 toolsNov 6, 2026