Tech Risk

ai.greyridgesignals由 greyridgesignals.ai 发布官方发布者v0.1.7更新于 Nov 4, 2026

MCP security scanner: tool-poisoning & prompt-injection audit (OWASP LLM01/LLM08), x402-payable

已验证Streamable HTTP可网页运行金融开发者工具安全与监控

概览

AI 生成的概览

面向 AI 智能体的按次付费 x402 数据与安全 API：MCP 工具投毒扫描、x402 支付预检与回执核验、Base 链上读取，以及加密与 DeFi 行情数据。

可以做什么
  • 扫描 MCP 服务器的工具投毒与提示注入，提供免费计数预览和付费逐项审计
  • 在付款前检查 x402 端点，付款后核验 Base 上的 USDC 结算回执
  • 按 OFAC 与诈骗名单筛查 Base 钱包，并读取余额、Gas、区块与交易
  • 评估 Base ERC-20 代币与兑换，给出蜜罐、跑路风险及 GO/HOLD/BLOCK 交易前结论
  • 获取加密现货价格、跨交易所资金费率、DeFi 收益池与 Polymarket 预测市场
  • 对域名做技术栈指纹、CVE/EPSS/KEV 风险与子域名枚举等情报补充
适用场景
适合智能体需要为 x402 端点付费、因而要做付款前与结算核验的场景；也适合审计某个 MCP 服务器工具中是否藏有隐藏指令，或在 Base 上交易、筛查代币与钱包。多数接口都有免费预览，可先试用再决定是否付费。
运行要求
可连接远程 streamable-HTTP 端点，或通过 uvx 从 greyridge-x402-tools 的 PyPI 包（或 npm 客户端）在本地以 stdio 运行。无需账号或 API 密钥。付费工具需通过支持 x402 的客户端在 Base 主网上以 USDC 按次微支付；免费预览工具无需付款。需要能访问其托管 API 的网络。
安装前请注意
付费工具每次调用都会花费真实 USDC（约 0.001 至 0.05 美元），智能体需准备有余额的钱包并设置支出上限。可选的本地客户端若在 X402_WALLET_PRIVATE_KEY 中配置钱包私钥，会自动完成付款；留空则只能使用免费工具。扫描与情报补充会把目标 URL 或域名发送给第三方服务，且结论只是就绪性信号，并非安全保证。

安装

在 SourceWeft 中

  1. 打开 控制台中的 Tech Risk，将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Web executable，通过 Streamable HTTP。 远程服务在工作区中配置后即可从网页运行时运行。

交给智能体安装

把这段提示词粘贴到 Claude Code、Codex、Cursor 等智能体，或 SourceWeft 对话中。智能体会读取该服务器的安装指南，先向你展示发布者、端点和登录方式，经你同意后再把它添加到你的客户端。密钥不会写进任何命令。

阅读 https://sourceweft.com/mcp/ai.greyridgesignals%2Ftech-risk/install.md，并按其中说明把这个 MCP 服务器接入我的客户端。修改任何配置之前，先告诉我它的发布者、端点和登录方式，等我确认。不要把 API 密钥写进命令或我会提交的文件；问我密钥应从哪里获取。

查看智能体所依据的安装指南

其他 MCP 客户端

把它添加到你客户端的 mcpServers 配置中。

{
  "mcpServers": {
    "tech-risk": {
      "type": "http",
      "url": "https://api.greyridgesignals.ai/mcp"
    }
  }
}

README

Grey Ridge Signals — Agent-Native x402 Data & Security APIs

Pay-per-call crypto, DeFi, prediction-market, and on-chain data for AI agents — plus MCP security scanning — over the x402 payment protocol on Base mainnet.

No account, no API key, no subscription. An agent pays inline in USDC (from $0.001/call) and gets the data back in the same request. Every data endpoint has a free preview so an agent can taste the payload before paying.

  • Base URL: https://x402-data-api.sigrunner.workers.dev
  • MCP endpoint (streamable-http): https://x402-data-api.sigrunner.workers.dev/mcp
  • Canonical domain: https://x402-data-api.sigrunner.workers.dev (same API)
  • Discovery: /.well-known/x402 · /openapi.json · /llms.txt
  • Network: Base mainnet (eip155:8453), USDC. Settles via the non-custodial xpay facilitator — no Coinbase/CDP account needed. Also listed on the CDP x402 Bazaar.

Two flagships — what agents actually pay for

  1. MCP server security scan (/scan/mcp, $0.05) — a prompt-injection / tool-poisoning audit of an MCP server's tools (OWASP LLM01/LLM08). Zero-egress: for private/OAuth-gated servers you POST only the tools/list JSON — nothing else leaves your side. There is no free equivalent for this (unlike token-safety, where free multi-chain scanners exist). Free preview: POST /scan/mcp/preview. CI gate (on the GitHub Marketplace): uses: rezearcher/[email protected].
  2. Pre-trade decision gate (/gate/swap, $0.008 · /chain/token-report, $0.01) — a decision (GO/HOLD/BLOCK, SAFE/CAUTION/AVOID) sized to your trade, not raw flags your agent has to interpret. Base-native; if you trade other chains, keep your multi-chain scanner and use this on Base.

Everything below is the full catalog (crypto/DeFi data, on-chain reads, LLM, enrichment). Measured reliability at /status (not an SLA).

Endpoints

Crypto & DeFi data

EndpointPriceReturns
GET /crypto/prices?coins=bitcoin,ethereum,solana$0.001Spot token prices (DefiLlama), keyless. Up to 25 CoinGecko ids.
GET /crypto/funding?limit=20$0.001Cross-venue perp funding rates (Hyperliquid + OKX, graceful fallback) with the funding spread + best long/short venue — the arb signal, not just a single-venue list.
GET /defi/yields?limit=20&project=&chain=&stable=$0.001Top DeFi lending/LP yields (DefiLlama) with APY breakdown, 7d/30d APY trend, IL risk, and DefiLlama's stability forecast — decision-grade, not a raw list.
GET /pm/markets?query=&limit=20$0.005Live Polymarket prediction markets: question, outcomes, prices, volume, liquidity, end date.

Base on-chain (JSON-RPC read primitives)

Base-native, multi-provider RPC with automatic failover (never fails a paid call on one provider's rate limit).

EndpointPriceReturns
GET /chain/block-number$0.001Current Base block number
GET /chain/gas-price$0.001Current gas price (wei + gwei)
GET /chain/balance?address=$0.001Native ETH balance
GET /chain/token-balance?address=&token=$0.001ERC-20 token balance
GET /chain/tx?hash=$0.001Transaction details
GET /chain/receipt?hash=$0.001Transaction receipt (status, gas used, logs)
GET /chain/code?address=$0.001Contract-code check — is it a contract, and EIP-7702 delegated-EOA detection (is_eip7702_delegate / delegate_address)
GET /chain/wallet?address=$0.003Bundle: ETH balance + tx count + contract flag in one call, EIP-7702 delegated-EOA aware (is_eip7702_delegate / delegate_address)

Agent trading gates (new)

EndpointPriceReturns
GET /gate/swap?token=0x…&side=buy|sell&notional_usd=N$0.008Pre-trade go/hold/block decision for any Base ERC-20: safety verdict, risk score, pool liquidity and price-impact of your size, flags. One call before an agent swaps. Free live sample: /gate/swap/preview
GET /chain/token-report?token=0x…see /openapi.jsonFull token due-diligence report (security + liquidity + metadata) in one call

Security

EndpointPriceReturns
GET /scan/mcp?url=$0.05Security audit of a target MCP server: tool-poisoning / prompt-injection / exfiltration / dangerous-capability / hidden-unicode (OWASP LLM01/LLM08) + risk score
POST /scan/mcp {"tools":[…]}$0.05Zero-egress audit — paste your own tools/list array; same itemized findings, nothing leaves your side and we never fetch/call your server. For OAuth-gated or private MCP servers that won't expose a URL
GET /enrich/tech-risk?domain=$0.05Tech-stack fingerprint → CVE (NVD) + EPSS + CISA-KEV attack-surface risk
GET /enrich/domain?domain=$0.01Firmographic + tech-stack enrichment, incl. full subdomain enumeration (subdomains[]) via crt.sh certificate-transparency logs, RDAP, DoH, HTTP fingerprint

x402 payment verification (before and after your agent pays)

EndpointPriceReturns
GET /x402/preflight?url=$0.001Pre-pay check on any x402 endpoint: will it settle, is the payee safe (OFAC / scam lists), price accuracy, delivery readiness, liveness → PAY / CAUTION / AVOID
GET /x402/receipt-verify?tx=&url=$0.004Post-pay proof: reads the Base settlement tx from two independent RPCs and reconciles the USDC Transfer against the endpoint's own live 402 (payTo + amount) → SETTLED / UNDERPAID / WRONG_RECIPIENT / NO_TRANSFER / REVERTED / NOT_FOUND / UNVERIFIED

Free in MCP: x402_receipt_verify_preview (tx + payto, no payment).

Python agents, no key or wallet: uvx --from greyridge-x402-tools greyridge-x402-verify runs a local stdio MCP server (PyPI 0.6.0) with free x402_preflight and x402_receipt_verify tools. Add it to Claude Desktop/Cursor as command uvx, args --from greyridge-x402-tools greyridge-x402-verify.

Try it now, no key: curl "https://api.greyridgesignals.ai/x402/preflight/preview?url=https://api.greyridgesignals.ai/defi/yields" returns verdict: PAY, will_settle: true with the per-check detail (reachability, challenge, accepts, price accuracy, delivery).

Drop-in safe pay wrapper (free preflight, refuses AVOID, then dual-RPC receipt check on the settlement tx):

  • Python: pip install greyridge-x402-tools (0.7.0), from greyridge_x402.safe_fetch import safe_fetch
  • Node: npm install github:rezearcher/greyridge-x402-tools, import { safeFetch, PreflightBlocked } from "greyridge-x402-tools" (pass your own x402 fetch, e.g. wrapFetchWithPayment)

Already paying with @x402/fetch, wrapFetchWithPayment or a payer MCP such as Crypto APIs' x402_pay? Those pay and hand back the response body; none of them checks that the settlement tx actually moved the advertised amount to the advertised payTo. Keep your payer, and add the verify step after it: pass the tx hash from the X-PAYMENT-RESPONSE header and the URL you paid to x402_receipt_verify. It returns SETTLED, UNDERPAID, WRONG_RECIPIENT, NO_TRANSFER, REVERTED or NOT_FOUND. The x402 FAQ tells buyers to check the transaction themselves; this is that check, in one call.

How x402_receipt_verify differs from the read-only verifier @tensorfeed/x402-base-mcp (verify_x402_settlement, checked against its 0.2.1 README): theirs matches a Transfer against a recipient and amount the caller types in. Ours can pull payTo and amount from the endpoint's live 402 (?url=), so a wrong or stale expectation doesn't pass, and it compares two RPC providers and fails closed if they disagree. Theirs is a good fit if you just want generic Base reads (balances, eth_call) in the same server; ours only does verification.

Free previews: GET /crypto/prices/preview, /crypto/funding/preview, /defi/yields/preview, /chain/block-number/preview, /chain/gas-price/preview (full live data, not truncated), /scan/mcp/preview?url=. Zero-egress MCP scan (for private/OAuth-gated servers): POST /scan/mcp/preview with {"tools":[…]} is the free counts-only preview; POST /scan/mcp with the same body is the paid itemized scan — nothing leaves your side. One-liner: examples/mcp-scan-preview.sh.

MCP server (the pull channel)

Add one remote MCP server and your agent gets the whole toolset. initialize and tools/list are free so agents can discover the tools; paid tools/call returns an x402 challenge.

tools/list advertises 22 tools: crypto_prices, crypto_funding, defi_yields, pm_markets, chain_block_number, chain_gas_price, chain_balance, chain_token_balance, chain_tx, chain_wallet, chain_token_security (paid Base RPC + data, EIP-7702 delegated-EOA aware), crypto_prices_preview, crypto_funding_preview, defi_yields_preview, pm_markets_preview, chain_block_number_preview, chain_gas_price_preview, chain_token_security_preview (free), and scan_mcp_server, scan_mcp_preview, enrich_tech_risk, enrich_domain (security).

jsonc
// add to your MCP client config{  "mcpServers": {    "grey-ridge-x402": {      "type": "streamable-http",      "url": "https://x402-data-api.sigrunner.workers.dev/mcp"    }  }}

MCP client (mcp-client/ — the stdio companion)

For stdio-only MCP clients (Claude Desktop, Cursor, CLI agents), the repo ships a companion package, x402-data-api-mcp, in mcp-client/. It runs on the agent's own machine, speaks MCP over stdio, and proxies to the same Worker /mcp endpoint — it adds no data surface, just a transport + x402 payment shim so stdio-only clients can reach the same tools (22 tools, including paid ones when a wallet key is configured).

Install / run (local path). The package is not yet published to npm, so run it from the repo:

bash
cd mcp-clientnpm installnpm run build          # tsc → dist/server.jsnode dist/server.js    # start (or: npm start)

Published path (one line, no clone): npx @grey-ridge/x402-data-api-mcp — the package is live on npm; its bin target is dist/server.js, so npx runs the same server.

Configuration. Copy mcp-client/.env.example to .env in mcp-client/: WORKER_BASE_URL defaults to the deployed Worker (set it only to point at your own mirror), and X402_WALLET_PRIVATE_KEY is optional — set it to auto-settle paid tools (HTTP 402) via x402; leave it empty to run only the free/preview tools. The client reads both straight from process.env at startup.

jsonc
// stdio client config (local path){  "mcpServers": {    "grey-ridge-x402-local": {      "command": "node",      "args": ["/absolute/path/to/mcp-client/dist/server.js"]    }  }}

Call it (HTTP)

bash
BASE=https://x402-data-api.sigrunner.workers.dev
# free preview — real sample, no paymentcurl -s "$BASE/crypto/funding/preview"
# paid — returns HTTP 402 with an x402 payment-required challenge until you attach paymentcurl -i "$BASE/crypto/funding?limit=10"

Any x402-capable client (e.g. the x402 libraries) handles the 402 → sign → retry automatically.

Measured status

Uptime and latency per safety route are measured from a probe cron and published in docs/STATUS.md (regenerated hourly; window stated in the file, not an SLA).

How it runs

A single Cloudflare Worker implements every HTTP endpoint and the MCP server behind a method-aware x402 gate. All upstreams are free/keyless public APIs (DefiLlama, Hyperliquid, OKX, Polymarket Gamma, Base JSON-RPC, NVD/EPSS/CISA-KEV, crt.sh/RDAP/DoH); every address/hash/domain input is validated and SSRF-guarded (fixed upstream hosts, no user-supplied targets except the explicitly-scoped /scan/mcp and enrichment endpoints).

License

MIT — see LICENSE.

Agent-framework plugins (published)

Pre-trade token guard (/gate/swap, $0.008 USDC via x402 on Base) — drop-in, fails closed, pays inline per call (no API key, no account). Free sample: curl "https://x402-data-api.sigrunner.workers.dev/gate/swap/preview?token=degen"

FrameworkInstallSource
ElizaOSnpm i github:rezearcher/plugin-swap-gateintegrations/elizaos-plugin-swap-gate
LangChain.jsnpm i github:rezearcher/langchain-swap-gate @langchain/core zodintegrations/langchain-swap-gate
Vercel AI SDKnpm i github:rezearcher/vercel-ai-swap-gate ai zodintegrations/vercel-ai-sdk-swap-gate

Install from git — this always pulls the current build (keyless free preview + inline x402, fails closed only if both are unreachable) and compiles on install via prepare. Each also exposes a tokenReport tool wrapping /chain/token-report for standalone token screening. Minimal copy-paste examples live under docs/examples/{swap-gate,langchain,elizaos}/.

Market-data buyer (for agents that buy a price and must not present stale data as real-time — the Decision402 pattern): examples/market-data-decision-buyer.mjs. Runs the full agentic loop — reads the live 402 quote, enforces a per-call USDC budget, proves the feed via the free preview, pays /crypto/prices ($0.001 on Base), then rejects any row older than MAX_AGE_SECONDS. Steps 1-3 run with zero npm installs: node examples/market-data-decision-buyer.mjs bitcoin,ethereum.

Python / LangChain / CrewAI

pip install "git+https://github.com/rezearcher/greyridge-x402-tools" — token_report() and swap_gate() helpers (free preview by default, paid x402 mode optional) plus LangChain tools. Guides: https://rezearcher.github.io/greyridge-x402-tools/

Try it on YOUR token, free

curl "https://x402-data-api.sigrunner.workers.dev/chain/token-report/preview?token=0xYourBaseToken" returns the same full-depth report as the paid route ($0.01). /gate/swap/preview?token=0x… gives 3 free real-token GO/HOLD/BLOCK checks/day/IP.

Agent skill (drop-in SKILL.md for OpenClaw/Hermes-style agents): https://github.com/rezearcher/greyridge-token-safety-skill

CI gate for MCP servers

uses: rezearcher/[email protected] with url: runs the free MCP tool-poisoning preview in CI and fails on a block verdict. Every run also emits a copy-paste README injection-security badge (badge-markdown output / step summary; commit-badge: true auto-commits it between <!-- grsg-badge:start --> markers, degrade-open) — the OWASP-MCP (LLM01/LLM08) dimension generic repo-quality badges omit, re-checked on every CI run and linked to the server's live security report. Listed on the GitHub Marketplace. See actions/mcp-scan/README.md.

Python note: the default Python-urllib User-Agent is rejected with 403 at the Cloudflare edge. Use requests/httpx, or set any custom User-Agent header.

来源：README.md，提交 762bab1

工具

34

enrich_tech_risk

Security enrichment: tech-stack fingerprint + CVE mapping + EPSS + CISA KEV + verdict (clear/review/block) for a domain. Cost: $0.005 USDC per call (x402 micropayment).

输入参数domaintechstack

enrich_domain

Firmographic + tech-stack enrichment: RDAP registrant/registrar, DNS records, full subdomain enumeration + certificate-transparency history, tech-stack fingerprint, verdict (clear/review/block, based on domain age) for a domain. Cost: $0.005 USDC per call via the shared MCP payment gate (the direct HTTP endpoint GET /enrich/domain is $0.01 — MCP tools/call is gated at a flat $0.005 per request).

输入参数domain必填

scan_mcp_server

Security-audit a target MCP server for prompt-injection / tool-poisoning. Fetches the server's advertised tools and statically analyzes each for hidden instructions, data-exfiltration hints, dangerous capabilities, cross-tool shadowing, and invisible-unicode payloads (OWASP LLM01/LLM08). Returns findings + a 0-100 risk score + verdict (clear/review/block). Cost: $0.005 USDC per scan via x402 (GET /scan/mcp HTTP variant is $0.05).

输入参数url必填

scan_mcp_preview

FREE preview scan of a target MCP server for tool-poisoning / prompt-injection. Returns issue count, severity breakdown, risk score, and verdict (clear/review/block) — but NOT which tools or the evidence. Use this to check any MCP server (including your own) at no cost; if issues are found, call the paid scan_mcp_server for the itemized findings + remediation. No payment required.

输入参数url必填

crypto_prices

Live spot token prices (price, change_24h, symbol, confidence, timestamp) for CoinGecko ids, sourced from DefiLlama. Cost: $0.005 USDC per call via x402.

输入参数coins

crypto_funding

Live 6-venue perpetual-futures funding rates from Binance+Bybit+OKX+Hyperliquid+dYdX+Gate (per-venue rate, per-venue open interest in USD, an OI-WEIGHTED CEX↔DEX arb verdict — funding_spread_bps + cheapest-long/richest-short venue computed over an OI-screened set so a thin-book outlier never names an unexecutable venue; excluded_thin_venues + oi_weighted flag report what was screened — premium/basis, annualized_hl/okx/binance/bybit/gate, LONGS_PAY/SHORTS_PAY/NEUTRAL signal, next_funding_ts, mark/oracle price, day volume), ranked by volume. Venues unreachable or not listing a coin are omitted per-coin — Hyperliquid is always present. Cost: $0.004 USDC per call via x402.

输入参数limit

defi_yields

Live DeFi lending/LP yield pools (project, chain, symbol, pool id, APY breakdown incl. 1d/7d/30d trend + apyBase7d/apyMean30d, IL risk incl. il7d, exposure, reward/underlying tokens, outlier flag, mu/sigma, DefiLlama stability forecast, TVL, stablecoin flag) from DefiLlama, ranked by TVL (or risk-adjusted APY = apy/sigma). Cost: $0.005 USDC per call via x402.

输入参数sortchainlimitstableproject

yield_entry_verdict

Per-pool DeFi yield-entry go/no-go. Pass a DefiLlama poolId (the 'pool' field from defi_yields) and get a packaged SUSTAINABLE | DECAYING | OUTLIER | AVOID verdict + 0-100 risk score + field-cited reasons, built from the pool's APY trend (1d/7d/30d), DefiLlama stability forecast, impermanent loss (il7d), volatility (sigma), outlier flag and TVL. Optional token (0x underlying, Base) adds a honeypot-check pointer. The should-I-enter-THIS-pool call after defi_yields. Cost: $0.01 USDC per call via x402.

输入参数pool必填token

simulate

Will this Base transaction revert? Prospective-tx dry-run via eth_simulateV1: pass from, to, optional data (0x calldata) and value (wei) and get will_revert + revert_reason + gas_used + token asset_changes BEFORE the agent spends gas sending it. Keyless, Base-native, Tenderly/Alchemy-class output with no API key. Use before a swap/approve/transfer or alongside gate_swap. Cost: $0.005 USDC per call via x402.

输入参数to必填datafrom必填value

pm_markets

Live Polymarket prediction-market data — question, outcomes, outcome prices, bestBid/bestAsk/spread, volume24hr/volume1wk, oneDayPriceChange, clobTokenIds, conditionId, category tags, liquidity, end date — ranked by volume24hr. Cost: $0.005 USDC per call via x402.

输入参数limitquery

crypto_prices_preview

FREE 1-item sample of live token prices. No payment required.

无需输入参数。

crypto_funding_preview

FREE 1-item sample of live cross-venue funding rates. No payment required.

无需输入参数。

defi_yields_preview

FREE 1-item sample of live DeFi yield pools. No payment required.

无需输入参数。

yield_entry_verdict_preview

FREE sample yield-entry verdict for the current top-TVL pool. Shows the packaged SUSTAINABLE/DECAYING/OUTLIER/AVOID + risk-score output shape before you pay. No payment required.

无需输入参数。

simulate_preview

FREE sample prospective-tx dry-run (benign 0-value call) showing the will_revert/gas_used/asset_changes output shape before you pay. No payment required.

无需输入参数。

pm_markets_preview

FREE top-1 sample of live Polymarket prediction markets, ranked by volume24hr. No payment required.

无需输入参数。

chain_block_number

Current Base mainnet block number via multi-provider JSON-RPC (automatic failover across 4 providers, never fails on one provider's rate limit). Cost: $0.005 USDC per call via x402.

无需输入参数。

chain_gas_price

Current Base mainnet gas price (wei/gwei), EIP-1559 base_fee_gwei/priority_fee_gwei, and gas_price_usd (ETH price cross-call — no price oracle on ETH-only competitors) via multi-provider JSON-RPC. Cost: $0.005 USDC per call via x402.

无需输入参数。

chain_balance

Native ETH balance of a Base mainnet address, incl. balance_usd (ETH price cross-call — no price oracle on ETH-only competitors), via multi-provider JSON-RPC. Cost: $0.005 USDC per call via x402.

输入参数address必填

chain_token_balance

ERC-20 token balance of a Base mainnet address via multi-provider JSON-RPC, incl. symbol/decimals/balance_formatted (per-token-contract cached in-isolate). Cost: $0.005 USDC per call via x402.

输入参数token必填address必填

chain_tx

Transaction details by hash on Base mainnet via multi-provider JSON-RPC. Cost: $0.005 USDC per call via x402.

输入参数hash必填

chain_wallet

Wallet screening bundle (balance, activity, contract vs EOA check): ETH balance + balance_usd (ETH price cross-call) + tx count + contract-code check (EIP-7702 delegated-EOA aware) for a Base mainnet address, in one call. Cost: $0.005 USDC per call via x402.

输入参数address必填

chain_wallet_screen

Is this wallet sanctioned OR a known scammer? Pre-trade screen for a counterparty / recipient / token-spender address before an agent sends, swaps or approves: exact match against (1) the U.S. Treasury OFAC SDN crypto-address list and (2) community scam/phishing/wallet-drainer threat-intel (ScamSniffer + MEW darklist). Returns sanctioned (bool) + malicious (bool) + verdict (blocked/clear) + the list sources and snapshot dates. 'clear' means not on these lists — not a safety guarantee. Cost: $0.004 USDC per call via x402.

输入参数address必填

x402_preflight

Should an agent pay this x402 endpoint? Pre-payment check of an UNKNOWN x402 URL: fetch it once (never pays) to validate the 402 challenge + accepts[] (scheme/network/payTo/amount/asset/resource = will it settle) AND label its LIVENESS (LIVE | ZOMBIE | DEAD — is it a working payable endpoint right now, or listed-active-but-broken) AND flag an absolute PRICE TRAP (a honeypot charging >= $1,000/call trips AVOID even when its advertised==live price looks self-consistent; pass max=<usdc> for your own budget ceiling) AND scan the resource + any advertised MCP tools for LLM01/LLM08 prompt-injection and screen payTo against the OFAC SDN + community scam lists (safe to pay) AND verify the PRICE — does the live accepts[].amount match the advertised price? pass advertised=<usdc> (the figure your catalog quoted) or it self-checks the endpoint's /.well-known/x402: MATCH | OVERCHARGE | UNDERCHARGE. Optional samples=N (1-5) runs a reliability/payability burst (settle-consistency + latency; a flapping endpoint downgrades PAY to CAUTION). Returns verdict PAY | CAUTION | AVOID + per-check fix hints + latency. Read-only, never a settlement guarantee. Cost: $0.001 USDC per call via x402.

输入参数maxurl必填samplesadvertised

x402_receipt_verify

Did my x402 payment actually settle? POST-payment on-chain proof — the other half of x402_preflight (which checks BEFORE paying). Bring your Base settlement tx hash + the resource URL you paid, and this reads the tx receipt from Base mainnet, decodes its USDC Transfer events, and reconciles them against the endpoint's advertised payTo + amount (resolved from the resource's live 402, or pass payto/expect to bind it directly). Returns verdict SETTLED | UNDERPAID | WRONG_RECIPIENT | NO_TRANSFER | REVERTED | NOT_FOUND | UNVERIFIED, the matched transfer, and all USDC transfers in the tx. Read-only ground truth; confirms settlement to the right address + amount, not off-chain resource delivery. Cost: $0.004 USDC per call via x402.

输入参数tx必填urlpaytoexpect

x402_receipt_verify_preview

FREE keyless x402 settlement check on Base: pass a tx hash plus payto (and optionally expect, in USDC). Dual-RPC reads the receipt, decodes USDC Transfers and returns SETTLED | UNDERPAID | WRONG_RECIPIENT | NO_TRANSFER | REVERTED | NOT_FOUND. Binds to the payTo you supply; resolving the payTo from a live 402 url is the paid x402_receipt_verify.

输入参数tx必填payto必填expect

chain_token_security

Token security / honeypot detector for a Base mainnet ERC-20: EIP-1967/1822 proxy + upgradeability detection, bytecode dispatcher scan for mint/pause/blacklist/fee-setter/ownership selectors, owner() renouncement check, and a live eth_call state-override simulation testing whether a synthetic wallet can actually transfer() the token. Returns risk_score (0-100) + verdict (clear/review/block) + human-readable flags. Real compute an agent can't trivially self-serve. Cost: $0.005 USDC per call via x402.

输入参数token必填

chain_block_number_preview

FREE live sample of the current Base mainnet block number — identical data to the paid chain_block_number tool. No payment required.

无需输入参数。

chain_gas_price_preview

FREE live sample of the current Base mainnet gas price — identical data to the paid chain_gas_price tool. No payment required.

无需输入参数。

chain_token_report

Token security check (honeypot detector + rug-pull risk score) for a Base ERC-20 in one call, decision-grade trade-safety verdict: SAFE | CAUTION | AVOID plus risk_score (0-100) and reasons, bundling honeypot/sellability simulation, owner-renounced + mint/pause/blacklist/fee-setter/upgradeable-proxy checks, token symbol/name/decimals, and Uniswap v3 WETH-pool liquidity (USD). Replaces many RPC calls and prevents a bad trade. Cost: $0.005 USDC per call via the shared MCP payment gate (the direct HTTP endpoint GET /chain/token-report is $0.01 — MCP tools/call is gated at a flat $0.005 per request).

输入参数token必填

gate_swap

Pre-trade GO / HOLD / BLOCK gate for a Base ERC-20 swap: honeypot/sellability + admin-control checks + Uniswap v3 liquidity vs. your trade size. Returns a top-level `sized_verdict` one-liner (decision + pool-depth % + max-safe size + round-trip breakeven + exit recovery, read in one shot) AND the full decision-grade sizing — per $100 / $1k / $10k / $50k (and your exact notional_usd): entry-slippage + exit-simulation (net USD recovered vs lost to slippage), round-trip breakeven move %, and max_safe_notional_usd. Cost: $0.005 USDC per call via the shared MCP payment gate (the direct HTTP endpoint GET /gate/swap is $0.008 — MCP tools/call is gated at a flat $0.005 per request).

输入参数sidetoken必填notional_usd

gate_swap_preview

FREE live sample of the gate_swap pre-trade GO/HOLD/BLOCK decision for a demo Base token (usdc|weth|cbbtc|aero|degen), same shape as the paid gate_swap tool. The paid gate_swap tool additionally returns a top-level `sized_verdict` one-liner plus the full `sizing` object (entry/exit slippage simulation + round-trip breakeven + max_safe_notional_usd); the `paid_adds` block here names those fields. No payment required.

输入参数sidetokennotional_usd

chain_token_report_preview

FREE full real trade-safety report (SAFE/CAUTION/AVOID verdict) for Base USDC, same depth as the paid chain_token_report tool. No payment required.

无需输入参数。

chain_token_security_preview

FREE full real analysis of a fixed well-known token (Base WETH) via the token security / honeypot detector — same depth as the paid chain_token_security tool, so you can see the real product before paying. To analyze an arbitrary token, use the paid chain_token_security tool. No payment required.

无需输入参数。

版本历史

5
  1. v0.1.7最新Nov 4, 2026
  2. v0.1.6Oct 31, 2026
  3. v0.1.5Oct 29, 2026
  4. v0.1.4Oct 22, 2026
  5. v0.1.1Oct 19, 2026

评分

已满足适用检查项的 100%

该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。

  • 近 30 天内可连通必需25 分
  • 已声明认证方式必需10 分
  • 已列出工具必需15 分
  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分

其他 Greyridgesignals 集成

US Business Verification MCP Server

ai.greyridgesignals

对照美国州政府官方登记库核验企业，并用 OFAC 制裁名单筛查，返回带评分与来源的记录。

Streamable HTTP可网页运行鉴权
安全与监控需要凭据Nov 7, 2026

Web Extract MCP Server

由 GitHub 账号 rezearcher 发布

托管型 MCP 服务器，让助手把实时网页读成干净文本、筛查提示注入，并从站点地图列出网站页面。

Streamable HTTP可网页运行
网页搜索与抓取3 个工具Nov 1, 2026

Multi-ATS Jobs MCP Server

由 GitHub 账号 rezearcher 发布

托管型 MCP 服务器，让助手跨七个招聘系统搜索实时、统一格式的职位，并预览公司域名信息。

Streamable HTTP可网页运行
网页搜索与抓取5 个工具Oct 30, 2026

Company Enrichment MCP Server

由 GitHub 账号 rezearcher 发布

把公司域名变成实时富化记录：公司概况、联系方式、技术栈和基于 8 个 ATS 的招聘信号，含免费预览与付费深度层。

Streamable HTTP可网页运行
网页搜索与抓取3 个工具Oct 30, 2026

Cve Triage

由 GitHub 账号 rezearcher 发布

一个远程 MCP 服务器，结合 EPSS 评分与 CISA KEV 清单对 CVE 进行分级，给出漏洞利用优先级，按查询计费。

Streamable HTTP可网页运行
安全与监控尚未收录Oct 24, 2026