Transparency log · MCP tool definitions
Your AI client trusts the tool descriptions an MCP server sends it — and a server can change them after you approved it. HISTOR keeps a public, signed record of what every remote MCP server in the official registry advertised, and tells you the day it changed.
Remote endpoints: it lists tools and never calls one. Registry packages: bounded canary calls run inside the isolated sandbox. It never says a server is safe — it tells you what was said, and when.
WebGL is unavailable here. The picture is the log itself: each label is a leaf, leaf hashes climb a Merkle tree, and a signed tree head seals the root.
What HISTOR is for
When you connect an MCP server, its tool descriptions go straight to the model as instructions. A server can pass your review with harmless descriptions and change them next week — one added sentence is all a prompt injection needs, and most clients never ask you again.
Every day HISTOR reads what each remote (streamable-HTTP) endpoint in the official MCP registry advertises, fingerprints it, signs what it saw and appends it to a log that can only grow. When a server's definitions change, the change gets a date and a diff.
Look up any server before you trust it. Paste what your client received and learn whether everyone else sees the same thing. Follow changes in a feed, or put a badge in your README. Every answer is signed, so you can verify it instead of believing it.
io.github.bck-stack/sitecheck-health-travel · https://api.healthtravel-api.workers.dev/mcp?ref=registry
120 pay-per-call agent tools: health care, drug, provider and travel data tools. x402
health_blood_center_accreditation — AABB-accredited facilities from AABB's public lists: blood banks, transfusion services and blood centers, immunohematology and molecular labs, perioperative and out-of-hospital transfusion, cord blood, HPC and cell therapy facilities, and relationship (DNA) testing labs. Per facility: name, city, state, country, AABB codes, and website and phone for DNA labs. Filter by state, country or name. Pric …health_cdc_wonder_mortality — CDC/NCHS leading causes of death by US state and year (data.cdc.gov open data): cause, deaths and age-adjusted death rate per 100,000. Published table only, not the CDC WONDER query tool. Up to 50 rows per call. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.health_cell_line_depmap_cancer — Cancer cell line lookup with DepMap IDs, from Cellosaurus (SIB, the reference cell line knowledge base): find a line by name (e.g. MCF-7), Cellosaurus accession (CVCL_…) or DepMap ID (ACH-…), or list DepMap lines for a disease. Returns names and synonyms, DepMap ID, ATCC catalog number, disease (NCIt), species, sex, donor age, sampling site, genetic ancestry and the Cellosaurus link. Price: $0.002 …health_chEMBL_bioactive_molecules — EMBL-EBI ChEMBL molecule search: ChEMBL ID, preferred name, maximum clinical phase, molecule type, molecular weight, canonical SMILES, first approval year and ATC codes. Up to 20 molecules per call, with total match count. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.health_clia_laboratory_finder — CMS CLIA-certified clinical laboratories in one US state (Provider of Services File, latest quarterly release): CLIA provider number, lab name, city, street address, phone, certification date and program termination code. Does not list tests performed. Up to 50 labs per call. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.health_clinical_evidence_cochrane — Cochrane systematic reviews of health interventions, found through PubMed (journal Cochrane Database Syst Rev): PMID, title, publication date and DOI for a search term. Citation records only (no abstract, no full text). Up to 10 per call. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.health_clinical_pharmacogenetics — CPIC pharmacogenetics guidelines (api.cpicpgx.org) for a gene symbol: guideline name, genes covered, guideline version, and ClinPGx link. Lists guidelines only; recommendation text is not included. Up to 20 guidelines per call. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.health_clinical_trials_gov — ClinicalTrials.gov study search (API v2): NCT ID, title, status, phase, start and completion dates, sponsor, conditions, interventions, enrollment and primary outcome. Up to 10 studies per call. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.health_clinvar_genetic_variants — NCBI ClinVar variants for a human gene symbol: VCV accession, variant type, germline clinical significance (e.g. Pathogenic, Likely pathogenic) and last evaluation date. Up to 10 variants per call. Variant names and protein changes are not included. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.health_cms_medicare_part_d — CMS Medicare Part D prescriber rows (by provider and drug): prescriber NPI, name, specialty, state, drug name, claims, 30-day fills and total drug cost. Filter by 10-digit NPI, or by generic drug name with an optional state. Up to 20 rows per call. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.health_cosmetics_inci_ingredients — Cosmetic ingredient lookup by INCI name: INCI name, cosmetic functions (e.g. skin conditioning, preservative), chemical description, CAS and EC numbers and CosIng ID, from the European Commission's CosIng ingredient inventory (the EU's INCI reference). Safety assessments of the US Personal Care Products Council (CIR) are not included; use eu-cosing-cosmetics for EU restrictions. Price: $0.002 in U …health_covid19_cdc_wastewater — CDC National Wastewater Surveillance System (NWSS) sampling sites in one US state (data.cdc.gov): wastewater plant, county, population served, 15-day detection proportion, percentile and sample dates. The pathogen is not named in the dataset; this is not confirmed COVID-19 activity. Up to 50 sites per call. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed cal …health_cpt_hcpcs_procedure — HCPCS Level II billing code search (CMS code set, via NLM Clinical Tables): code and short description for procedures, supplies and drugs, with total match count. CPT codes are AMA-licensed and not included. Up to 20 codes per call. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.health_daily_med_label_spl — NLM DailyMed drug label listings (structured product labeling) matching a drug name: title with labeler, set ID, label version, published date and total match count. Lists labels only; label section text is not included. Up to 10 labels per call. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.health_dbSNP_polymorphisms — NCBI dbSNP short variant record by rs number: variant type, placement (sequence and position), reference and alternate sequence, and study allele frequencies (e.g. 1000 Genomes allele counts). Up to 10 frequency rows per call. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.health_dea_controlled_substances — DEA controlled substance schedules (21 CFR 1308.11-1308.15, via eCFR): substance name and DEA Controlled Substances Code Number for schedule I to V table entries matching a name. Substances listed only in paragraphs are not searched. Does not include registration status. Up to 20 matches per call. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not …health_dental_board_verify — Dental license verification from official state open data: Colorado (dentists and hygienists, with discipline history) and Illinois (dentists, specialists, hygienists, sedation permits, controlled-substance licenses, ever-disciplined flag): license number, name, type, status, issue, renewal and expiry dates, city and discipline details. Search by license number, name or city; active by default. Pr …health_drugbank_interaction — Drug-drug interaction text from the FDA label (openFDA) of drug A that mentions drug B: matching sentences from the label's drug interactions section, with label set ID and effective date. Label text only; no severity score. If no sentence matches, that does NOT mean there is no interaction. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charg …health_ema_human_medicines — European Medicines Agency (EMA) centrally authorised human medicines (EMA bulk JSON, updated twice a day): name, EMA product number, status, active substance, ATC code, therapeutic indication, first authorisation date and holder. Searches name or active substance. Up to 20 per call. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.health_ema_shortages_safety — European Medicines Agency (EMA) human medicine supply shortages (EMA shortages JSON): medicine, INN, shortage status, affected forms, availability of alternatives, start and expected resolution dates. Shortages only; safety signals and pharmacovigilance data are not included. Up to 20 per call. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not ch …health_eu_cosing_cosmetics — EU cosmetics regulatory status for a substance name: matching Annex II (prohibited), III (restricted), IV (colorants), V (preservatives) and VI (UV filters) entries of Regulation (EC) No 1223/2009 from the European Commission's CosIng database, with reference number, maximum concentration, conditions and warnings, CAS/EC numbers, amending regulation and SCCS opinions. Price: $0.002 in USDC per suc …health_fda_adverse_events_faers — FDA FAERS drug adverse event reports (openFDA) for a generic drug name: report ID, receive date, seriousness, patient age and sex, drugs and reported reactions. Spontaneous reports only; a report does not prove the drug caused the reaction. Up to 10 reports per call. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.health_fda_device_gudid — FDA AccessGUDID device record by Device Identifier (DI, the GS1/GUDID number on a device label): brand, company, model, description, GMDN term, MRI safety status, sterile and single-use flags. Lookup by DI only; no name search. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.health_fda_drug_shortages — FDA drug shortage listings (openFDA): generic name, availability status (e.g. Available, Currently in Shortage), manufacturer, package NDC, posting dates and FDA contact number. Up to 10 listings per call. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.health_fda_medical_device_510k — FDA 510(k) premarket notifications (openFDA): K-number, device name, applicant, decision (e.g. Substantially Equivalent), decision and received dates, product code and advisory committee. Up to 10 per call. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.health_fda_orange_book — FDA Drugs@FDA approved applications (openFDA) by active ingredient: application number, sponsor, brand names, dosage form, marketing status and Orange Book therapeutic equivalence (TE) code. Up to 10 applications per call. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.health_fda_purple_book — FDA Purple Book licensed biological products matching a name (brand or proper name, e.g. adalimumab): applicant, BLA number, license type (351(a) originator, 351(k) biosimilar or interchangeable), strength, dosage form, route, marketing status, approval date, reference product and exclusivity expiry dates, plus the products newly approved or updated this month. From FDA's monthly Purple Book data …health_fda_recalls_enforcement — FDA drug recall enforcement reports (openFDA) matching a product word: recall number, class I/II/III, status, recalling firm, reason, product description and dates. Drug recalls only, not food or cosmetics. Up to 10 per call. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.health_fluview_influenza_cdc — CDC FluView weekly influenza-like illness (ILI) and weighted ILI for the US or a region (served via Delphi Epidata, which mirrors CDC FluView): epiweek, ILI %, weighted ILI %, patient and provider counts. Give an epiweek range of up to 12 weeks. No outbreak maps. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.health_formulary_coverage_lookup — Medicare Part D drug coverage from CMS monthly formulary files, current and next plan year: for a drug (name or RxCUI), in one plan, across a state's plans or over every formulary: coverage per strength, cost-share tier, prior authorization, step therapy, quantity limit, IRA negotiated-price flag, 30-day retail/mail cost, plan premium and deductible. Includes the CMS release date. Price: $0.003 in …health_gwas_catalog_associations — EMBL-EBI GWAS Catalog genome-wide association hits for a gene symbol (REST API v2): reported trait, EFO trait, SNP and locus, p-value, odds ratio or beta, study accession and PubMed ID. Searches by mapped gene only. Up to 10 hits per call. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.health_health_insurance_exchange — ACA Health Insurance Marketplace (HealthCare.gov) overview for a US ZIP code from CMS's QHP Landscape data: number of plans and insurers, plans per metal level, the cheapest plan of each metal level and the benchmark silver plan (second-lowest-cost silver, which sets ACA subsidies) with monthly premium before subsidies for the nearest published age, deductible and out-of-pocket maximum. Federal-pl …health_hhs_hipaa_breach_portal — HIPAA breaches affecting 500+ people from the HHS Office for Civil Rights portal (last 24 months, under investigation): entity name, state, entity type, individuals affected, submission date, breach type, location of the information and business-associate flag. Newest 100 reports, filterable by state, entity type, breach type, minimum individuals or name; plus total open cases. Price: $0.002 in US …health_hospitallink_cms_ratings — CMS Hospital General Information (data.cms.gov): hospital name, city, type, ownership, emergency services, overall star rating (1-5, when CMS publishes one) and counts of measures better, no different or worse than the national rate for mortality, safety and readmission. Up to 50 hospitals per state per call. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed c …health_icd10_cm_diagnosis — ICD-10-CM diagnosis code search (NLM Clinical Tables, CDC code set): matching codes and their official names, with the total match count. Codes and names only; no cross-walks or clinical descriptions. Up to 20 codes per call. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.health_indian_health_service_ihs — Indian Health Service, tribal and urban Indian health facilities from IHS's official map: filter by state, IHS Area, city, name or service (dental, pharmacy, behavioral health, urgent care...). Per facility: IHS code, name, Area and service unit, address, county, coordinates, phone, fax, hours, website, facility and service type, services, operator (IHS, tribal, urban), beds and accreditation. Pri …health_kegg_pathway_genes — KEGG human pathway (KEGG REST, flat file): pathway name, class, description and the genes in it (KEGG gene ID, symbol and description). Give a human pathway number such as 05200. Up to 100 genes per call. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.health_loinc_laboratory_codes — Regenstrief LOINC laboratory and clinical test codes (via NLM Clinical Tables): LOINC number and long common name matching a term, with total match count. Codes and names only, no units or reference ranges. Up to 20 per call. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.health_mammography_facility_fda — FDA MQSA certified mammography facilities in one US state (FDA public search): facility name, phone, city, ZIP and FDA facility ID. Parsed from the FDA results page, which shows the facilities on the first results page only. Radiation safety data is not included. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.health_medicare_advantage_star — Official CMS Medicare Star Ratings for Medicare Advantage (Part C) and Part D contracts from the newest Star Ratings Data Tables: contract number, organization type, contract and marketing name, parent organization, SNP flag, Part C summary, Part D summary and overall star rating (1-5, half stars). Search by contract ID, organization or parent name, organization type or minimum overall stars. Pric …health_medicare_inpatient_drg — CMS Medicare inpatient hospital averages per MS-DRG (data.cms.gov, fee-for-service Part A): hospital name, state, DRG code and description, discharges, average submitted charge, average total payment and average Medicare payment. Hospital-level averages, not the IPPS national rate table. Filter by 3-digit DRG code and optional state; up to 20 rows. Price: $0.002 in USDC per successful call, paid w …health_mental_health_samhsa — SAMHSA FindTreatment substance use and mental health treatment facilities near a latitude and longitude (FindTreatment.gov locator export): facility name, address, phone, website, miles from the point and facility type. Give lat and lng; ZIP or city search is not offered. Up to 20 facilities per call. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are …health_mesh_biomedical_thesaurus — NLM MeSH (Medical Subject Headings) descriptor for an exact heading: MeSH ID, label, entry terms (synonyms) and allowable subheadings (qualifiers). Exact match only; no scope notes (the public lookup API does not return them). Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.health_nih_reporter_grants — NIH RePORTER funded research projects matching a text search (NIH RePORTER API v2): project number, title, fiscal year, award amount, lead organization and principal investigators. Up to 20 projects per call, most relevant first. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.health_npi_provider_registry — CMS NPPES NPI Registry search: NPI number, name, credential, status, taxonomy (specialty code and description) and practice location. Matches can be fuzzy; the registry decides the match. Up to 10 records per call. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.health_nursing_licensure_nursys — Registered nurse license verification for Texas (a Nurse Licensure Compact state) from the Texas Board of Nursing's open data: license number, name, status, status and expiry dates, issue date, original licensure state, county, advanced practice recognition, board action flag, highest degree and school. Search by license number or name (+ county). Nursys has no open API. Price: $0.002 in USDC per …health_open_payments_cms — CMS Open Payments (Sunshine Act) general payments from drug and device makers to US physicians, prescribers and teaching hospitals for a program year (2019-2025): company, recipient (name, type, NPI, specialty, city, state), amount (USD), date, form and nature of payment, related products, plus match count. Filter by company, recipient last name or NPI, state and product. Price: $0.002 in USDC per …health_orphanet_rare_diseases — Orphanet rare disease by ORPHAcode (Orphadata open data, CC BY 4.0): preferred name, synonyms, disorder group and typology, and associated genes with association type. Prevalence is not included. Up to 20 genes per call. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.health_osha_occupational_health — OSHA Permissible Exposure Limits (Table Z-1, 29 CFR 1910.1000, read from eCFR): chemical name, CAS number, 8-hour TWA in ppm and mg/m3, and notes such as ceiling or see-other-section. Matches by name words. Up to 20 chemicals per call; not the full OSHA chemical database. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.health_physician_compare_cms — CMS Medicare Doctors and Clinicians file: clinician NPI, name, credential, specialty, medical school, graduation year and practice location, by last name and optional state. Hospital affiliations are not in this file (only the practice group name). Up to 20 records per call. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.health_pubchem_chemical_cid — NIH PubChem compound lookup by name (PUG REST): PubChem CID, title, molecular formula, molecular weight and IUPAC name for the best match. Safety and hazard data are not included. One compound per call. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.health_pubmed_abstracts — PubMed search (NCBI E-utilities): matching articles with PMID, title, authors, journal, publication date and DOI. Citation metadata only, no abstract text. Up to 20 results. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.health_reactome_biological_paths — Reactome curated human biological pathways matching a term (Reactome ContentService, CC BY 4.0): stable ID, pathway name, whether it is a disease pathway and a short summary. Human pathways only. Up to 20 per call. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.health_rxnorm_concept_id — NIH RxNorm concept lookup (RxNav): RxCUI identifiers for a drug name with each concept's name and term type (e.g. IN = ingredient, SCD = clinical drug). Up to 5 concepts per call. Exact-name lookup, no fuzzy matching. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.health_state_medical_board_fl — Florida health-care license verification (Department of Health, MQA): search by name (and city) or license number within a board (medicine, osteopathic, nursing, dentistry, pharmacy, psychology...): license number, name, profession, city and status, plus match count. With a license number also issue and expiry dates, address of record, discipline on file and prescriber flags. Price: $0.002 in USDC …health_state_medical_board_ny — New York medical board disciplinary actions (NYS DOH Board for Professional Medical Conduct open data since 1990): search physicians and physician or specialist assistants by license number or name for every public action: date, license type, action (revocation, suspension, probation...) and case summary. An empty result means no public action; it is not a licence-status check. Price: $0.002 in US …health_state_medical_board_tx — Texas Medical Board license verification and disciplinary status from TMB open data (data.texas.gov, daily): physicians, PAs, acupuncturists and other TMB licenses. Look up a license number or search by name, city, specialty or type; returns license type, degree, specialties, issue and expiry dates, registration and disciplinary status, board action, practice address and license status. Price: $0. …health_string_protein_networks — STRING protein-protein interaction partners for a human gene (STRING API, CC BY 4.0): partner gene name, combined confidence score (0-1) and evidence scores for experiments, databases and text mining. Up to 20 partners. No enrichment analysis. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.health_uniprot_protein_knowledge — UniProt reviewed (Swiss-Prot) human protein entries for a gene symbol: accession, protein name, gene, sequence length and the curated function summary. Human only (taxon 9606). Up to 5 entries per call. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.health_usp_monographs_standards — USP Reference Standards catalog search (official USP Store): total matches and per item the catalog number, name, package size, CAS number, chemical name, molecular formula, category (e.g. Active Pharmaceutical Ingredients), product line, price (USD), in-stock / ready-to-ship flags, current lot number and release date, associated monograph, therapeutic categories and store link. From store.usp.org …health_usps_prescription_ship — US rules for mailing prescription drugs from the official texts, section by section with citations: USPS Publication 52 section 453 (definitions, mailer responsibility, what may be mailed, packaging and marking) and DEA 21 CFR Part 1306 (who may prescribe and fill, Schedule II-V refills, labeling, online pharmacies, telemedicine). Filter by source or words in the text. Price: $0.002 in USDC per su …health_veterinary_license_db — Veterinarian license verification from official state open data — Colorado (DORA, VET licenses with degrees and discipline history) and Illinois (IDFPR: licensed veterinarians, controlled-substance licenses, certified veterinary technicians, ever-disciplined flag): license number, name, type, status, issue/renewal/expiry dates, city and discipline details. Search by license number, name or city; a …health_who_global_health_stats — WHO Global Health Observatory values for one country and one indicator (OData API): indicator name, year, sex or group breakdown, value with uncertainty interval. Up to 20 rows, newest year first. Default indicator is life expectancy at birth. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.travel_agoda — Top hotels in a city from Agoda's city guide page (no dates needed): about 10 properties with Agoda hotel ID, name, star rating, area, amenities (Wi-Fi, parking, breakfast, pool …), review score out of 10 with its label and number of reviews, a recent guest quote, average price per night with currency, and the Agoda hotel link. The city is Agoda's URL slug, e.g. bangkok-th, tokyo-jp, bali-id, lond …travel_airbnb — Airbnb stays for a place and dates (first results page, usually 18): listing id, name, type, total price for the stay in the chosen currency (and original price when discounted), rating out of 5 with review count, beds/bathrooms, badges such as Guest favourite, free-cancellation note, coordinates and room URL. From Airbnb's public search page; availability and prices as Airbnb shows them at call t …travel_airbnb_reviews — Review summary for one Airbnb listing (by room id or URL): overall guest rating out of 5 and number of reviews, the six category ratings (cleanliness, accuracy, check-in, communication, location, value), share of 5/4/3/2/1-star reviews, review themes with mention counts (e.g. 'Hot tub' 165), Guest favourite and Superhost flags, host's total review count. Individual review texts are not included (A …travel_amtrak_train_tracker — Live Amtrak train status from Amtrak's Track Your Train map feed: train number, route, origin/destination, state (Predeparture/Active/Completed), current GPS position, speed (mph), heading, last update, and every stop with scheduled and estimated/actual arrival and departure plus on-time/late comments. Filter by train number, route name or station code. Price: $0.002 in USDC per successful call, p …travel_autonation — AutoNation cars for sale (new and used) for a make and optional model: VIN, condition, year, make/model, trim, mileage, AutoNation 1Price (USD), store name, stock status, distance and vehicle page link; about 24 per page. From autonation.com's public inventory pages through a rendering residential proxy; store and distance reflect the proxy's US location. Price: $0.02 in USDC per successful call, …travel_autotrader — Vehicle listings from AutoTrader.ca (Canada; the US and UK AutoTrader sites block datacenter traffic): up to 20 per page with title, year, make, model, trim, price in CAD, AutoTrader's price label, mileage in km, transmission, fuel, new/used, dealer, city, province and URL, plus the total matching count and min/median/max price of the page. Filter by make, model, province and city. Price: $0.002 i …travel_aviationweather_metar_taf — Current airport weather from NOAA Aviation Weather Center: latest METAR (observed temperature, dewpoint, wind, visibility, altimeter, flight category) and the TAF forecast text for a 4-letter ICAO airport code. Raw text is included alongside the parsed fields. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.travel_booking_com — Booking.com hotel price guide for a city (e.g. fr / paris): the lowest 'from' nightly price in the page title and Booking.com's published average nightly prices for 3-, 4- and 5-star hotels (typical, this weekend, tonight, as stated on the city page), plus the hotels Booking.com names as best or popular with their URLs. Currency selectable. Averages are Booking.com's own figures, not a live date s …travel_booking_com_hotels — Hotels featured on a Booking.com city page (e.g. us / new-york): name, property id, sample nightly price as displayed (in the currency you pick), guest score out of 10, review count, stars, district, coordinates, a featured guest review and the hotel URL. Comes from the page's 'top hotels' and 'most booked' blocks (usually 10-15 hotels). Prices are Booking.com's landing-page samples, not a live da …travel_booking_com_reviews — Booking.com guest reviews featured on a city page (e.g. us / new-york): hotel reviews with hotel name, hotel guest score and review count, reviewer name, country and traveller type; guests' reviews of the city itself (score out of 10); and the highlighted review of each top hotel. Typically 10-25 reviews in total; it is the selection Booking.com shows on the city page, not a hotel's full review hi …travel_bringatrailer_auctions — Live Bring a Trailer auctions (collector cars, motorcycles, parts), optionally filtered by words in the title (e.g. porsche 911) or no-reserve only: title, model year, current bid with currency, auction end time, no-reserve flag, country and listing URL, soonest-ending first, from BaT's public auctions page. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed ca …travel_carfax — CARFAX used-car listings by body style or price ceiling (optionally near a US ZIP): total matches and 24 cars per page with VIN, year, make, model, trim, mileage, price, value badge, history flags (one owner, no accidents, service history), colour, drivetrain, engine, fuel, MPG, dealer, rating, location, phone, photo and link. From carfax.com via a stealth proxy. Price: $0.03 in USDC per successfu …travel_carmax — CarMax used cars for a make (and optional model): stock number, VIN, year, make, model, trim, body, price, original price and price-drop flag, mileage, colors, drivetrain, engine, MPG, store name/city/state, highlights (single owner, warranty...), date listed and link; about 20-24 per page, plus the nationwide total. From carmax.com's public search pages via a residential proxy. Price: $0.002 in U …travel_carsdirect_vehicle — CarsDirect used-car listings near a US ZIP code (optionally one make and model): vehicle name, year, make, model, condition, mileage, exterior and interior colour, price (USD), dealer name with distance, photo and listing link, about 20-25 per page. From carsdirect.com via a residential proxy. Price: $0.02 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not char …travel_carvana — Carvana used cars for a make (and optional model): year, make, model, trim (from the listing text), color, mileage, price (USD), VIN, Carvana stock id, image and link, about 20 per page (page 1 to 20). From carvana.com's public inventory pages via a residential proxy. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.travel_craigslist — Current Craigslist listings for one site and category (e.g. sfbay + cta = cars & trucks, newyork + apa = apartments), optionally matching a search query: title, price, area and listing URL, newest first as Craigslist orders them, read from the public search page. Up to ~300 results per call; no contact details or full post text. Price: $0.002 in USDC per successful call, paid with x402 (Base, Sola …travel_crtsh_certificate_transparency — Certificate transparency records for a domain from the CertSpotter public CT index: certificate id, validity dates, revocation flag and the DNS names on each certificate (including subdomains). Shows issued certificates only, not live TLS configuration. crt.sh was unavailable during testing, so CertSpotter is used. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); fa …travel_data_wa_gov_electric_vehicle — Washington State Department of Licensing registered electric vehicles (BEV and plug-in hybrid): make, model, model year, EV type, electric range, city, county and ZIP. Vehicles are registrations, not current status; the range field is 0 where not yet researched. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.travel_equibase — Horse racing entries from Equibase's free entry pages for a track and date (e.g. BEL, 2026-10-22): race card with purse, type, distance, surface, starters and post time; with a race number, the field with program number, post position, horse, age/sex, medication, jockey, weight, trainer and morning-line odds. US tracks (CAN for Canada). No past performances or results. Price: $0.002 in USDC per su …travel_ev_database — Electric car models listed on the public EV Database home page: make, model name (with battery size where listed), availability text and EV-Database detail URL. Only the models on that page are returned; specs such as range are not on the list. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.travel_fipe_brazil_vehicle_prices — Brazilian FIPE reference price for one car: brand, model, model year, fuel, FIPE code and reference month, from the public FIPE API. Needs the FIPE brand, model and year codes (numbers and a 'year-fuel' code); lookup lists are at /cars/brands. Reference prices are not a sale offer. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.travel_flightaware_public_tracker — Public FlightAware flight page for one flight number: airline, aircraft type, origin and destination airports (IATA, name), status (e.g. arrived, en route) and the flight ident. Read from the JSON embedded in the public page; no login. Live altitude and speed are not included on the page used. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not cha …travel_flightradar24_live_flights — Live aircraft inside a lat/lon box from the public Flightradar24 feed: callsign, position, altitude (ft), speed (kts), heading, aircraft type, registration, origin/destination airport codes and on-ground flag. Position data is seconds old; the feed does not include every flight worldwide and has no key or history. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); fai …travel_forsalebyowner — Homes listed for sale by owner (FSBO) on ForSaleByOwner.com for a US city: the first 20 listings with address, ZIP, coordinates, asking price (USD), property type, the owner's description (beds, baths, size and features as written by the seller), photo and listing link, plus the total number of FSBO listings in the city. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Ar …travel_france_annuaire_entreprises — Search French companies and establishments in the official Annuaire des Entreprises (SIRENE data): SIREN, full name, head-office address, main activity code (NAF) and active state. Public register data only; no financial statements. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.travel_google_flights — One-way flight options with prices from Google Flights for a route and date (IATA codes, e.g. JFK to LHR): lowest fare in USD, airline(s), stops, departure and arrival airport, local times and dates, total duration and layover airports, as shown on Google's public results page. Economy, 1 adult. Prices change constantly and are Google's displayed 'from' fares, not bookings. Price: $0.002 in USDC p …travel_google_hotels_price — Lowest nightly hotel prices for a city and stay dates from Google Hotels' public results page (about 18-20 hotels, Google's order): hotel name, 'prices starting from' amount, currency as Google shows it (it follows the server's region, so check the currency field) and Google's deal flag with % below usual. Confirms the dates Google applied. Not a booking; prices change constantly. Price: $0.002 in …travel_google_travel — Google Travel hotels and vacation rentals for a place (about 20, Google's order): name, type, lowest price and currency (Google picks currency by server region), deal flag and % below usual, guest rating with review count and star distribution, hotel class, amenities, topics guests mention, eco-certified flag and link. Optional stay dates; otherwise Google's default dates (returned). Price: $0.002 …travel_greatschools — US schools in a city from GreatSchools: name, GreatSchools rating (1-10) and label, sub-ratings (test scores, student progress, equity...), school type (public, charter, private), grade levels, district, address, enrollment, students per teacher, % low-income, parent rating and review count, coordinates and profile URL, plus the total number of schools. Filter by level (preschool, elementary, midd …travel_guidestar — Search US tax-exempt nonprofits (IRS Form 990 index) by name via the ProPublica Nonprofit Explorer API: EIN, name, city, state, NTEE code and total result count. Search results only; financial detail pages are not included. GuideStar itself has no free public API, so this uses ProPublica's index. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not …travel_hk_mtr_realtime — Hong Kong MTR realtime next-train arrivals at one station on one line, from the Hong Kong government open data feed: direction, destination platform, minutes to next train (ttnt) and scheduled time. Times are the feed's; the feed can be delayed or empty late at night. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.travel_hostelworld — Hostels in a city as listed on Hostelworld's public city page (up to 30, Hostelworld's own order): name, address, coordinates, guest rating out of 10 with review count, lowest 'from' price per night as shown (currency depends on the visitor region) and property URL. Needs the continent, country and city as in Hostelworld URLs (e.g. europe / germany / berlin). No live availability for dates. Price: …travel_hotel_booking_sites_direct_hotel_websites — KAYAK hotel prices for a city (KAYAK compares booking sites and hotel websites): the city's lowest nightly price headline and KAYAK's 'best hotels' list (usually ~16) with name, star rating, street address, price shown per night in USD, guest rating out of 10 with review count, phone and KAYAK hotel URL. The city is matched with KAYAK's own place search. Prices are KAYAK's recent prices on its pub …travel_kayak — KAYAK flight route overview between two city or airport codes (e.g. LON to PAR): up to 20 recent round-trip deals KAYAK found (airline, departure/arrival airport, departure time, duration, price in USD), the route's lowest recent price and KAYAK's published route insights as question/answer text (typical price range, cheapest month, day and airline, delays, flights per week). From KAYAK's public r …travel_korn_ferry_tour_leaderboard — Korn Ferry Tour leaderboard for the current or most recent tournament (or the event on a given date): tournament name, dates and status, then each player's place, name, country, score to par, round scores and total strokes, from ESPN's public golf scoreboard feed. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.travel_marketwatch — MarketWatch quote for a stock, ETF or fund: name, exchange, currency, last price, change and change %, quote time, plus the Key Data panel (open, day range, 52-week range, market cap, shares outstanding, float, beta, P/E, EPS, yield, dividend, ex-dividend date, short interest, average volume). From marketwatch.com's public quote pages via a residential proxy; prices may be delayed. Price: $0.002 i …travel_mbta_realtime — Live MBTA Boston vehicle positions for one route (e.g. Red, Orange, Blue, 1): vehicle label, latitude/longitude, bearing, speed, current status, current stop id and occupancy when reported. Anonymous access is rate limited by MBTA. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.The signed observations, every earlier tool set and a diff of each change: this page with scripts on, or /api/v1/servers/33ba0b38c35a9975.
Read → digest → label → append → sign → compare
Six steps, every one of them checkable by someone who does not trust HISTOR. The only thing you have to take on faith is that the observation happened when the label says it did — and the log makes it impossible to change that story afterwards.
Remote endpoints in the official MCP registry: initialize, then tools/list, drained across every page; no tool is called, and private addresses are refused before the connection opens. npm and PyPI packages: installed and started in the sandbox described below, with no route out.
The tool set is reduced to name, description, input and output schema, sorted by UTF-16 code units and hashed over its RFC 8785 canonical form. Anyone holding the same tools gets the same digest — which is what makes a comparison possible.
Four MTL/1 methods, one signed AWR/2 document each: what was observed, what the WARDEN pattern set matched, whether the definitions changed since the last label, and whether the name is on a threat list. No score, ever.
Every label becomes a leaf of an RFC 9162 Merkle tree: leaf hash = SHA-256(0x00 ‖ JCS(label)). The label you download is the leaf input, so you can recompute its hash yourself.
After each crawl HISTOR signs a tree head: the size and the root. Keep yesterday's head; ask for a consistency proof to today's; if anything was removed or rewritten, the proof fails.
Each day a continuity label compares the new digest with the last one. Equal: "unchanged since". Different: a change, with the date and a per-tool diff. A client that checks what it received adds the view no crawler has.
Where an npm or PyPI package is run
A package observation is true for these conditions, and no others. Every package page names the exact image it ran in and any configuration it was given.
Linux x86_64, inside gVisor (runsc): the package talks to a kernel written for sandboxing, not to the host's. An unprivileged user, no capabilities, a read-only root.
npm packages in histor-node:22, PyPI packages in histor-python:3.12: the official node:22-bookworm-slim and python:3.12-slim images plus bash, git, Python 3 or Node 22 and a Java 21 runtime — never Docker — built when a sandbox host is installed. A package whose Requires-Python excludes 3.12 runs on histor-python:3.13 or 3.14; one that requires a newer Node runs again on histor-node:24. The exact image a package ran in is on its page.
npm with --ignore-scripts, then the install scripts in a traced stage of their own. PyPI: wheels only — a package that ships only source is reported, never built.
No route out. Every name the package looks up resolves to HISTOR's own traps, which record what was sent and forward nothing. A server that needs the internet to start shows that here.
None are real. Decoy credentials sit in HOME and a decoy .env in the working directory. A variable the package says it needs gets a placeholder; where the placeholder was sent is recorded.
512 MB of memory, one CPU, 64 MB of /tmp. 360 s to install, 150 s to start and answer; up to 15 tools called once each with canary arguments, 8 s per call.
Only names: required variables its registry entry declares or that it printed when it exited, and a start argument such as serve when its usage text offers one. Never a value from anyone else.
The profile HISTOR implements forbids the words safe, secure, audited, certified, approved and trusted. Here is why, in the terms of what the log can and cannot show.
A pattern match is a reason to read a definition, not a finding. Three of the four methods can never return fail. There is no score to rank by, because no score HISTOR could compute would mean what a reader takes it to mean.
Labels are about advertised text. A remote endpoint's source is never read and its tools are never invoked; a package runs only in the sandbox, against nothing real. A server can keep identical definitions and behave differently for real users; the log cannot see that, and says so inside every label.
A version bump changes definitions too. A change is shown as a date and a diff, in amber, never red. What you do with it is yours: re-read, re-approve, or pin the old digest.
An npm or PyPI server is observed under the test conditions above: Linux, no internet, placeholder keys. One that needs Windows, a real account or the network may show fewer tools or none; its page says why it exited.
Today one party runs the log. A second observer on another network is the next step, and any AIMarket hub can run one. Until then, what the key proves is who said it — not that it is true.
Endpoints that require authentication answer 401 to everyone without a key, including HISTOR. They are counted and listed as not observed, never dropped from the numbers.
For clients, registries and server authors
Before your agent trusts a server, send the tools it received. The answer is signed by the log's did:key and names the tree head it was given under.
curl -sS https://histor.modelmarket.dev/api/v1/check \
-H 'Content-Type: application/json' \
-d '{"endpoint":"https://example.com/mcp","tools":[ …tools/list result… ],"contribute":true}'
# -> {"type":"histor.check/v1","match":"same"|"different"|"previously-observed"|…,
# "observed":{"unchangedSince":"…","changes":0}, "patternScan":{…}, "signature":{…}}
# README badge for your server
[](https://histor.modelmarket.dev/s/<id>)
# Atom feed of every observed change
https://histor.modelmarket.dev/feed.xml
No. The server list is the log's index: every remote endpoint in the official MCP registry, with what HISTOR could observe about it. Nothing here is for sale and nothing is ranked by quality.
No, and it never will. It tells you what a server advertised, whether that changed, and which published patterns matched the text. Whether to trust the server is your decision — HISTOR makes sure you decide on the same facts as everyone else.
Most remote MCP endpoints require a login (they answer 401 to anyone without a key), some use the legacy SSE transport or need per-user values in the URL, and some are simply down. They stay on the list with the reason, so the numbers never hide them.
Open the Check tab, paste the server's endpoint and the tools/list result your client received, and press Check. You get back, signed, whether HISTOR observed the same definitions — or different ones, or an older set.
Find your endpoint on the Servers tab, open it, and copy the Markdown snippet under the facts. The badge shows the date your definitions were pinned or last changed, and links to the full history.
You do not have to. Every label and every tree head is signed with one published key; the Log tab proves in your browser that the log only grew; and the command-line auditor does the same from any machine. What remains is that one operator runs it today — a second, independent observer is the next step.
Looking things up, the badges, the feed and /check are free. HISTOR also offers histor.check@v1 to the AIMarket Hub, so agents can reach it through the market.
Once a day: initialize, notifications/initialized and tools/list — never a tool call, never a redirect followed, at most two connections per host, from a User-Agent that starts with histor/. To be left out, open an issue on the histor repository with your endpoint or host; it is then listed as not observed (operator-opt-out), with the reason, rather than silently dropped. Labels already in the log stay: the log only grows.