VerifyLite

io.github.SecondShotAI由 GitHub 帳號 SecondShotAI 發布v1.2.1更新於 Nov 5, 2026

Verify before you pay or act: site, transaction, token and injection checks for agents. x402 USDC.

已驗證Streamable HTTP可網頁執行網頁搜尋與抓取金融安全與監控

概覽

AI 產生的概覽

遠端 x402 付費驗證工具集,讓助理在行動或付款前檢查網址、網站、Base 交易、代幣、錢包、套件與不可信文字。

可以做什麼
  • 驗證與評估網址:URL 語法、網站安全報告、批次檢查、連結預覽、網頁轉 Markdown、SEO 與電子郵件檢查
  • 查詢網域、RSS/Atom 摘要、時間、UUID、隨機數、IP 分類與美國聯邦公報文件
  • 檢視 Base 主網:餘額、交易、代幣、合約、Gas、區塊、持倉、NFT、事件、名稱與 Chainlink 價格
  • 付款或簽署前的風險篩檢:代幣盡職調查、蜜罐與買賣稅模擬、授權檢查、制裁名單、交易預檢
  • 以 OSV 檢查相依套件漏洞、偵測不可信文字中的提示注入、修復格式錯誤的 JSON、依連結轉錄影音
  • 列出各工具價格並執行 x402 付款整合測試
適用情境
適合助理在採取行動前判斷連結、網站、代幣、錢包、交易或相依套件是否安全,或需要快速查詢 Base 鏈上資訊與網頁工具。也適合已透過 x402 USDC 按次付費的代理程式。
執行需求
遠端 streamable HTTP 端點;未宣告任何套件、環境變數或標頭。多數工具按次以 USDC 透過 x402 付費,需要已儲值的付費用戶端;部分工具免費或不收費。
安裝前請注意
每次呼叫會花費 USDC,助理可能在沒有逐次確認的情況下付費,建議先呼叫 list_prices。送出的網址、地址、文字、影音連結與套件名稱會傳送給營運方及 Google Web Risk、OSV.dev、制裁名單等第三方。檢查結果僅供參考,不構成保證。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 VerifyLite,將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Web executable,透過 Streamable HTTP。 遠端服務在工作區中設定後即可從網頁執行環境執行。

交給代理程式安裝

把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式,或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南,先向你展示發布者、端點和登入方式,經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。

閱讀 https://sourceweft.com/mcp/io.github.SecondShotAI%2Fverifylite/install.md,並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前,先告訴我它的發布者、端點和登入方式,等我確認。不要把 API 金鑰寫進命令或我會提交的檔案;問我金鑰應從哪裡取得。

檢視代理程式所依據的安裝指南

其他 MCP 客戶端

把它新增到你客戶端的 mcpServers 設定中。

{
  "mcpServers": {
    "verifylite": {
      "type": "http",
      "url": "https://verifylite.hydratinghealingtouch.workers.dev/mcp"
    }
  }
}

工具

40

list_prices

VerifyLite prices

Lists every VerifyLite tool and its current price. Free.

無需輸入參數。

verify_url

Verify URL syntax

URL syntax validator. Takes one absolute HTTP or HTTPS URL and returns its normalized form, or a specific error code: unparseable, unsupported scheme, embedded credentials, IP literal, or local/metadata hostname. Never contacts the destination, so it is fast and side-effect free. Useful for cleaning URLs from user input, scraped pages, or LLM output before fetching them. Paid via x402; see list_prices.

輸入參數url必填

check_site_safety

Website safety check

Website safety check for one URL. Passively fetches the site and returns a verdict (safe, caution, unsafe), a 0-100 score, and evidence-backed flags: TLS validity, HTTP-to-HTTPS redirect, redirect chain and offsite redirects, security headers, mixed content, insecure forms, and domain age from the official registry. Useful before visiting, linking to, buying from, or submitting data to an unfamiliar site. Not charged if the host cannot be checked. Paid via x402; see list_prices.

輸入參數url必填

check_site_safety_pro

Website safety check with malware/phishing blocklist

Website safety check plus a Google Web Risk lookup for malware, phishing, and unwanted software. Includes the full /safe report: verdict (safe, caution, unsafe), 0-100 score, TLS, redirects, security headers, mixed content, insecure forms, and domain age. A blocklist hit makes the verdict unsafe. Useful for screening links before a payment, login, or download. Not charged if the blocklist cannot be reached. Paid via x402; see list_prices.

輸入參數url必填

check_sites_batch

Batch website safety check

Batch website safety check: the full /safe report for several URLs in one call, priced per site and cheaper than single checks. Each result has a verdict (safe, caution, unsafe), a 0-100 score, and evidence-backed flags for TLS, redirects, security headers, mixed content, insecure forms, and domain age, plus a summary count. Useful for screening every link in a search result, email, or document at once. Not charged if no site can be checked. Paid via x402; see list_prices.

輸入參數urls必填

transcribe_audio

Transcribe audio or video

Speech-to-text for one audio or video file by URL, using Whisper (turbo) on a GPU. Returns the full transcript, timed segments, ready-made SRT and WebVTT captions, and the detected language; optional translation to English. Files up to 25 MB (about 25 minutes of typical MP3). Useful for captioning videos, indexing podcasts, or reading meetings. Not charged if the file can't be fetched or transcribed. Paid via x402; see list_prices.

輸入參數url必填languagetranslate

read_page

Read a web page as markdown

Web page to markdown for AI agents: fetch one URL and get its main content as clean, LLM-ready markdown (navigation, ads, footers and scripts removed) with title, description, language, word count and a token estimate. Uses the site's own Markdown version when it offers one. Useful for RAG, summarizing articles, research and feeding pages to an LLM. Not charged if the page can't be fetched or isn't text. Paid via x402; see list_prices.

輸入參數url必填

domain_report

Domain registration, DNS, and email security

Domain intelligence: WHOIS/RDAP registration (registrar, created and expiry dates, status, name servers) plus DNS records (A, AAAA, MX, NS, TXT, CAA) and email security (SPF, DMARC), with flags for new, expiring or misconfigured domains, as one JSON object. Useful for vetting a company, vendor or link before trusting it. Not charged for invalid or reserved domain names. Paid via x402; see list_prices.

輸入參數domain必填

check_email

Email address check

Email check: validates the address format, confirms the domain exists and accepts mail (MX), and flags disposable providers, role accounts (info@, support@), and free providers. Returns deliverable_likely, risky, undeliverable, or invalid with a reason. No message is sent. Useful for cleaning sign-up lists and lead data before outreach. Paid via x402; see list_prices.

輸入參數email必填

seo_check

SEO check for a page

SEO check for one page: whether search engines can index it (meta robots, X-Robots-Tag, robots.txt rules), title and meta description length, canonical URL, H1 headings, viewport, language, Open Graph tags, sitemap, HTTPS, and redirects, with a 0-100 score and a list of issues by severity. Useful for site audits and pre-launch checks. Not charged if the page can't be fetched. Paid via x402; see list_prices.

輸入參數url必填

chain_balance

Base wallet balance: ETH, USDC and any ERC-20 tokens, transaction count, wallet or contract

Base mainnet balance for one address: ETH and USDC (human-readable and raw), plus up to 10 ERC-20 tokens you list (with symbol and decimals), transaction count, and whether it is a wallet or a contract. One price for 0 to 10 tokens. Useful for checking a wallet is funded before a payment, confirming a payout or airdrop landed, tracking agent or treasury wallets, or screening a counterparty. Read-only. Not charged for invalid addresses or when Base can't be reached. Paid via x402; see list_prices.

輸入參數tokensaddress必填

chain_tx

Base transaction status: success/failed/pending, fee, confirmations, USDC transfers

Base mainnet transaction lookup by hash: status (success, failed, or pending), block, timestamp, confirmations, from, to, ETH value, total fee including the L1 data fee, method id, and every USDC transfer in the transaction decoded to sender, recipient, and amount. Useful for confirming that a USDC or x402 payment really settled before delivering goods. Read-only. Not charged for an invalid hash, a hash not found on Base, or when Base can't be reached. Paid via x402; see list_prices.

輸入參數hash必填

chain_token

ERC-20 token info on Base: name, symbol, decimals, total supply

ERC-20 token metadata for one contract on Base mainnet: name, symbol, decimals, and total supply (human-readable and raw), with a flag for whether it behaves like an ERC-20 at all and whether it is native USDC. Handles older tokens that return bytes32 names. Useful for formatting token amounts correctly and spotting look-alike tokens. Read-only. Not charged for an invalid address or an address with no contract. Paid via x402; see list_prices.

輸入參數address必填

chain_contract

Base contract inspection: code size, proxy implementation, ERC-20/721/1155 detection

Inspects one Base mainnet address: whether it holds contract code and how large, whether it is an EIP-1967 upgradeable proxy (and its implementation address), EIP-7702 delegation, and which standards it reports or behaves like (ERC-165, ERC-721 NFT, ERC-1155, ERC-20). Useful for knowing what kind of contract an agent is about to interact with or approve. Read-only. Not charged for an invalid address or when Base can't be reached. Paid via x402; see list_prices.

輸入參數address必填

chain_gas

Base gas prices now: gas price, base fee, priority fee, typical transaction costs

Current Base mainnet gas: gas price, base fee, and priority fee in gwei, plus estimated execution cost in ETH for an ETH transfer, a USDC transfer, and a typical swap, from the latest block. Useful for timing transactions and budgeting fees before sending. No input needed. Not charged when Base can't be reached. Paid via x402; see list_prices.

無需輸入參數。

chain_block

Base block info: number, timestamp, transaction count, gas used, base fee

Base mainnet block details for the latest block or a given block number: number, hash, timestamp, transaction count, gas used and limit, and base fee. Useful for checking chain head and freshness, timestamping events, and counting confirmations. Read-only. Not charged for an invalid or future block number or when Base can't be reached. Paid via x402; see list_prices.

輸入參數number

token_report

Token due diligence in one call: owner powers, holder concentration and blocklists, with one verdict

One-call due diligence for a Base token before buying, accepting or listing it: owner powers in the contract (mint, pause, blacklist, fees, proxy), who holds the supply (top wallets, concentration), whether it can actually be sold and its real buy/sell tax (simulated), and whether the token or its owner is on the OFAC sanctions list or a scam blacklist. Returns one verdict (ok, caution, avoid, known issuer), a 0-100 risk score and plain reasons. Not charged for invalid input. Paid via x402; see list_prices.

輸入參數token必填

honeypot_check

Can this Base token be sold? Honeypot check with real buy and sell tax from a simulated trade

Honeypot and sell-tax check for a Base token. Finds its deepest WETH or USDC pool (Uniswap V2/V3, Aerodrome, Slipstream) and simulates a buy then a sell on a Base node: no money moves. Returns whether selling works, the actual buy tax and sell tax, round-trip loss, pool and liquidity, with a verdict: clean, taxed, high_tax, honeypot, no_liquidity or inconclusive. Useful before an agent buys, swaps or accepts a token. Not charged for invalid input or tokens with no WETH or USDC pool. Paid via x402; see list_prices.

輸入參數token必填amountEth

tx_preflight

Should I sign this? Plain-words check of a Base transaction or signature request, with red flags

Pre-signing check for Base. Send a transaction (to, data, value, from) or a typed-data signature request and get what it does in plain words plus red flags: unlimited or wallet-targeted approvals, NFT approve-all, off-chain permits, sends to a token's own contract or the dead address, OFAC or scam-listed counterparties, risky tokens, and calls that would fail (simulated from your wallet). Verdict ok, caution, danger or block. Not charged for invalid input. Paid via x402; see list_prices.

輸入參數todatafromvaluetypedData

token_safety_check

Token safety check on Base: can the owner mint, pause, blacklist, change taxes, or upgrade?

Risk check for an ERC-20 token on Base before buying, accepting, or holding it: reads the contract and its proxy implementation for owner powers (minting, pausing, blacklisting wallets, changing buy/sell taxes, trade limits, trading switches, burning others' tokens, upgrades), checks whether ownership was renounced and how much supply the owner holds. Returns a verdict, 0-100 risk score, and plain-language flags. Read-only. Not charged for invalid addresses or non-tokens. Paid via x402; see list_prices.

輸入參數address必填

token_allowance_check

Token approval check on Base: how much each spender can move from a wallet, incl. Permit2

Approval check for one wallet and one ERC-20 token on Base: how much each spender (up to 10 app or router addresses) is allowed to move, flagging unlimited approvals and approvals covering the full balance, plus approvals made through Uniswap Permit2 with their expiry. Defaults to checking Permit2 itself. Useful before signing, for wallet hygiene, and for spotting approvals to revoke. Read-only. Not charged for invalid addresses or non-tokens. Paid via x402; see list_prices.

輸入參數owner必填token必填spenders

wallet_sanctions_check

Wallet screening: is this address on the OFAC sanctions list or a known scam/drainer list?

Screens 1 to 20 wallet addresses against the US Treasury OFAC SDN sanctions list (crypto addresses) and the ScamSniffer scam and drainer blacklist, in one call at one price. Returns block or clear per address with the reason, plus list sizes and freshness. Address-level, so it works for Base, Arc, Ethereum and any EVM chain. Useful before sending a payment, paying an x402 seller, accepting funds, or approving a spender. Read-only. Not charged for invalid addresses. Paid via x402; see list_prices.

輸入參數addresses必填

wallet_transfers

Wallet transfer history on Base: recent token transfers in and out, newest first

Recent token transfers for one Base wallet, incoming and outgoing, newest first: token, symbol, amount, sender, recipient, transaction hash, block and time, with likely spam airdrops flagged. Filter by one token or by direction, up to 50 per call. Reports the block window searched. Useful for checking a counterparty's activity, confirming deposits, reconciling payments, or watching an agent's wallet. Read-only. Not charged for invalid input or when Base can't be reached. Paid via x402; see list_prices.

輸入參數limittokenaddress必填direction

contract_events

Contract activity on Base: recent events a contract emitted, decoded, admin actions flagged

Recent events (logs) one Base contract emitted, newest first, decoded: token transfers and approvals with amounts, Uniswap/Aerodrome swaps, liquidity and reserve updates, WETH wraps, NFT transfers, and admin actions (ownership changes, proxy upgrades, pauses, role grants) flagged. Filter by event name to search about 22 hours back. Counts by event type and the block window searched. Read-only. Not charged for invalid input or when Base can't be reached. Paid via x402; see list_prices.

輸入參數eventlimitcontract必填

token_holders

Top holders of a Base token and how concentrated its supply is

The largest holders of an ERC-20 token on Base, ranked, with balance, percent of supply and wallet/contract/burn type, read straight from the chain. Top 1/5/10 concentration (burns excluded), a wallets-only share, burned percent and a low-to-very-high level. For tokens whose whole transfer history fits (most new and small tokens) the list and holder count are exact; otherwise coverage is reported. Not charged for invalid input. Paid via x402; see list_prices.

輸入參數limittoken必填

nft_lookup

NFT lookup on Base: current owner, collection, and metadata (name, image, traits)

Look up one NFT on Base by contract and token ID: ERC-721 or ERC-1155, current owner (wallet or contract), collection name and symbol, and its metadata: name, description, image link, animation, traits. Reads ipfs://, ar://, https and inline on-chain metadata. Pass owner to confirm a wallet holds it (and its ERC-1155 balance). Read-only. Not charged for invalid input, tokens that don't exist, or when Base can't be reached. Paid via x402; see list_prices.

輸入參數ownertokenId必填contract必填includeImage

contract_call

Read any contract function on Base and get the decoded result

Call any read-only (view/pure) function on a Base contract and get the decoded answer. Give the function as a signature like balanceOf(address) returns (uint256) plus args, or raw 0x calldata. Supports address, bool, uint/int, bytesN, string, bytes and arrays, an optional historical block, and plain revert reasons. Raw return data is always included. Not charged for invalid input, reverted calls, or when Base can't be reached. Paid via x402; see list_prices.

輸入參數argsdatablockreturnscontract必填function

name_lookup

Basename and ENS lookup: name to address, or address to its verified primary name

Resolves Basenames (name.base.eth, on Base) and ENS names (name.eth, on Ethereum) to wallet addresses, including a Base-specific address and profile records (avatar, description, url, X, GitHub). Or give an 0x address to get its primary name, verified by resolving the name back to the same address. A bare name like jesse means jesse.base.eth. Useful before sending funds to a name or labeling counterparties. Read-only. Not charged for invalid or unregistered names. Paid via x402; see list_prices.

輸入參數name必填

crypto_price

Crypto prices from Chainlink on Base: ETH, BTC, cbBTC, SOL, USDC, DAI, EUR in USD

Current prices in USD from Chainlink Data Feeds on Base mainnet: ETH, BTC, cbBTC, SOL, USDC, DAI, and EUR. One pair or all at once, each with the feed's last update time, age in seconds, and a stale flag, read straight from the oracle contracts (the same prices DeFi protocols use). Useful for valuing balances, converting USDC amounts, and checking a stablecoin peg. Not charged for an unknown pair or when the feeds can't be read. Paid via x402; see list_prices.

輸入參數pair

package_vulnerabilities

Package vulnerability check: known CVEs and advisories for npm, PyPI, Go, Maven, Cargo and more

Check dependencies for known vulnerabilities before installing or shipping: up to 20 packages (npm, PyPI, Go, Maven, crates.io, RubyGems, NuGet, Packagist and more, by name and version or purl) against the OSV.dev database. Returns each advisory with CVE IDs, severity and CVSS score, fixed versions, the smallest safe upgrade, and links. Not charged for invalid input or if OSV.dev can't be reached. Paid via x402; see list_prices.

輸入參數namepurlversionpackagesecosystem

check_prompt_injection

Prompt injection detection: classify agent-bound text or a web page as clean, suspicious or malicious

Prompt injection detection for AI agents: classify untrusted, agent-bound text or a URL (web pages, emails, tool and MCP output, RAG documents) as clean, suspicious or malicious before your LLM reads it. Returns a 0-100 risk score, each matched pattern (instruction overrides, jailbreaks, fake system prompts, requests for keys or seed phrases, exfiltration links, invisible Unicode, hidden HTML) and cleaned text. Up to 50,000 characters. Not charged on bad input. Paid via x402; see list_prices.

輸入參數urltext

repair_json

JSON repair for LLM output: fixes broken JSON and checks it against your schema

Turns messy LLM output into valid JSON: strips Markdown code fences and surrounding prose, fixes trailing commas, single quotes, unquoted keys, comments, Python True/None, cut-off brackets, and stringified JSON. Optionally validates the result against a JSON Schema (draft 4 to 2020-12) and lists each error with its location. Returns the parsed data, the JSON text, and what was changed. Not charged if no JSON can be recovered or the input is invalid. Paid via x402; see list_prices.

輸入參數text必填schema

read_feed

News and RSS reader: latest headlines, links, dates, summaries from any site or feed

RSS and Atom reader: give a feed URL or any news site, blog, or podcast page and get its latest items as clean JSON: title, link, published date, author, a plain-text summary, and media (podcast audio) links. Finds the feed automatically from the page when needed. Useful for news monitoring, research digests, and tracking competitors or releases. Not charged if no feed is found or it can't be fetched. Paid via x402; see list_prices.

輸入參數url必填limit

get_time

Current time: UTC, Unix, and local time in any IANA time zone

Current time from a reliable server clock: UTC ISO timestamp, Unix seconds and milliseconds, and optionally the local date, time, weekday, and UTC offset in any IANA time zone (daylight saving handled). Useful because language models don't know the current date or time. Not charged for an unknown time zone. Paid via x402; see list_prices.

輸入參數tz

new_uuid

UUID generator: v4 (random) or v7 (time-ordered), up to 100 at once

Generates standards-compliant UUIDs from a cryptographic random source: version 4 (random) or version 7 (time-ordered, sorts by creation time, good for database keys), one or up to 100 per call. Useful for idempotency keys, record IDs, and correlation IDs. Not charged for invalid options. Paid via x402; see list_prices.

輸入參數countversion

random_number

Secure random numbers in a range, or a random pick from a list

Cryptographically secure, unbiased randomness: whole numbers between min and max (default 1 to 100), or random picks from a list of choices, one or up to 100 per call. Useful because language models are bad at being random: fair draws, sampling, shuffling decisions, and A/B assignment. Not charged for invalid options. Paid via x402; see list_prices.

輸入參數maxmincountchoices

ip_info

IP address check: IPv4/IPv6, public or private, reserved ranges; or your own IP

Classifies an IPv4 or IPv6 address: family, canonical form, and whether it is public, private (RFC 1918 or unique local), loopback, link-local, carrier-grade NAT, multicast, documentation, or reserved, including IPv4-mapped IPv6. With no input over HTTP, returns the caller's own public IP and country. Useful for validating network input and filtering internal addresses. Not charged for an invalid address. Paid via x402; see list_prices.

輸入參數ip

ping

x402 integration test: pay $0.001, get back the payer, network and amount the server saw

x402 integration test for agents and payment clients: after a real USDC payment it confirms the payment arrived and echoes back what the server saw: network (Base or Arc), scheme, payer address, amount, asset and recipient, plus server time and an optional echo string. Useful for checking that a wallet, x402 client and budget limits work end to end before calling costlier services, and for uptime monitoring. The cheapest paid call VerifyLite offers. Paid via x402; see list_prices.

輸入參數echo

版本歷史

3
  1. v1.2.1最新Nov 5, 2026
  2. v1.2.0Nov 1, 2026
  3. v1.0.0Oct 21, 2026

評分

已滿足適用檢查項的 83%

該評分衡量此收錄條目的完整程度,依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價,也不表示伺服器安全或目前可用:可連通性是帶日期的檢查結果,評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通必需25 分
  • 已宣告認證方式必需10 分
  • 已列出工具必需15 分
  • 描述必需15 分
  • 圖示10 分
  • 文件15 分

    請宣告包含 README 的 GitHub 儲存庫,或在 OAuth 受保護資源後設資料中提供 resource_documentation。

  • 授權條款不適用

    託管服務按其提供方的條款使用,因此這裡不要求授權條款。此檢查項不計入百分比。