Transparency log · MCP tool definitions
Your AI client trusts the tool descriptions an MCP server sends it — and a server can change them after you approved it. HISTOR keeps a public, signed record of what every remote MCP server in the official registry advertised, and tells you the day it changed.
Remote endpoints: it lists tools and never calls one. Registry packages: bounded canary calls run inside the isolated sandbox. It never says a server is safe — it tells you what was said, and when.
WebGL is unavailable here. The picture is the log itself: each label is a leaf, leaf hashes climb a Merkle tree, and a signed tree head seals the root.
What HISTOR is for
When you connect an MCP server, its tool descriptions go straight to the model as instructions. A server can pass your review with harmless descriptions and change them next week — one added sentence is all a prompt injection needs, and most clients never ask you again.
Every day HISTOR reads what each remote (streamable-HTTP) endpoint in the official MCP registry advertises, fingerprints it, signs what it saw and appends it to a log that can only grow. When a server's definitions change, the change gets a date and a diff.
Look up any server before you trust it. Paste what your client received and learn whether everyone else sees the same thing. Follow changes in a feed, or put a badge in your README. Every answer is signed, so you can verify it instead of believing it.
io.github.bck-stack/sitecheck-shop-social · https://api.shopsocial-api.workers.dev/mcp?ref=registry
113 pay-per-call agent tools: e-commerce, product, price and social media data tools. x402
ecommerce_1688 — 1688.com (Alibaba's China wholesale market) offer search: offer id, product title, unit price in CNY, minimum order text, supplier company, supplier service scores (overall, returns, quality, logistics...), repeat-purchase/return rate text, ad flag and offer link, about 60 offers per page. From s.1688.com's public search through a rendering residential proxy (titles appear as 1688's machine transl …ecommerce_ace_hardware — Ace Hardware (US) product search: total hits and up to 30 products per page with product code, name, brand, price, MSRP, on-sale flag, UPC, manufacturer part number, product type, online stock, rating, review count, image and product link. From acehardware.com via a residential proxy. Price: $0.02 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.ecommerce_aliexpress — AliExpress product search from the public search page: product ID, title, sale price and original price with currency code, discount %, promo label (welcome-gift cards have no price), star rating and units-sold text when shown, listing date, image and product URL; 60 products per page plus the total result count. Language and currency can follow the caller's region (the currency code is always ret …ecommerce_amazon_bestsellers — Top items on Amazon.com's Best Sellers page: rank, ASIN and product page link, read from the public HTML. Names are taken from the product URL, so they can be shortened. No prices or stock (not on this page). Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.ecommerce_avantor_vwr_international — Avantor / VWR catalog search (US or Canada site): product code, name, short description, VWR catalog and article number, supplier/vendor, list prices per unit of measure (e.g. pack of 6, case of 24) in USD or CAD, stock status, discontinued / restricted / chemical flags and product URL, plus total matches. Anonymous list prices from the API behind avantorsciences.com; contract prices need an accou …ecommerce_backmarket — Back Market refurbished-product search on a country site (en-us, en-gb, fr-fr, de-de, es-es, it-it, ...): total hits and the first page of products with listing id, title, brand, model, category, condition grade, price and currency, new-device price, stock, review average and count, warranty months, colours, sales bucket, image and product link. From backmarket.com via a residential proxy. Price: …ecommerce_chemist_warehouse — Chemist Warehouse (Australia) category products (first page, about 20): product id, name, price (AUD), saving off RRP (AUD), rating and review count, image and product link. Category as on the site, e.g. 81/vitamins-supplements, 1093/cold-flu, 109/foot-care. From chemistwarehouse.com.au via a rendering residential proxy. Price: $0.02 in USDC per successful call, paid with x402 (Base, Solana or Arc …ecommerce_chewy_com — Chewy (US) item tracker: for 1-10 Chewy item IDs (the number after /dp/ in a chewy.com URL) returns name, brand, price, strike-through price, Autoship price and discount, per-unit price, in-stock / discontinued flags, shipping timeframe, GTIN, rating and rating count, active promotions, size/flavor variants with their prices and stock, and key attributes. From the GraphQL API chewy.com's product p …ecommerce_chrome_web_store — Chrome Web Store search results: extension name, id and detail-page link, from the public results page (first page only). No ratings, user counts or prices: the results HTML does not include them. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.ecommerce_costco — Costco Canada (costco.ca) product tracker: for 1-5 product IDs (the number at the end of a costco.ca product URL) returns name, brand, item number (SKU), price in CAD, availability (in stock / out of stock), shipping rate, rating and rating count, category path, description, image and URL, from each public product page's schema.org data. No keyword search; costco.com (US) is not reachable from the …ecommerce_costplusdrugs — Cost Plus Drugs mail-order cash prices from its official pricing API: search by drug name (optionally strength) or NDC; returns medication and brand name, generic/brand, form, strength, treatment categories, pack size, RxNorm ID, in-stock flag, price per unit (USD, incl. markup), cash dispensing fee, 30/60/90-count pack prices with and without fee, total with shipping, and product URL. Only drugs …ecommerce_cpsc_recalls — U.S. Consumer Product Safety Commission product recalls from SaferProducts.gov. Searches recall titles only (not all text). Returns recall number, date, hazard, remedy and the official CPSC page. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.ecommerce_dealstream — DealStream businesses for sale: listing title, asking price (USD), short description, industry, city and state, listing id and link, 25 per page (page 1 to 50), newest first, for the whole US or one state. From dealstream.com's public listing pages via a residential proxy; financial details beyond the asking price are on the listing page. Price: $0.002 in USDC per successful call, paid with x402 ( …ecommerce_dealstream_listings — DealStream businesses for sale: listing title, asking price (USD), short description, industry, city and state, listing id and link, 25 per page (page 1 to 50), newest first, for the whole US or one state. From dealstream.com's public listing pages via a residential proxy; financial details beyond the asking price are on the listing page. Price: $0.002 in USDC per successful call, paid with x402 ( …ecommerce_digikala_iran — Digikala (Iran) product search: product ID, Persian and English title, brand, category, selling price and list price in Iranian rial (and toman), discount %, stock, rating (0-100) and count, default seller (name, rating, trusted/official flags), warranty, colours, image and product URL, plus total items and pages. Sort by relevance, views, newest, best-selling, cheapest or most expensive. Price: $ …ecommerce_eu_safety_gate_rapex — EU Safety Gate (RAPEX) weekly product-safety report index from the European Commission's public XML list: newest reports first, with reference, publication date, week and the link to each report's alerts. Product-level details are not included; open the returned link for them. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.ecommerce_faire — Faire wholesale marketplace category listing (logged-out view): product token, name, brand name and token, suggested retail price (USD), case quantity, stock units, brand rating and review count, new / bestseller / promoted flags, brand's country, image and product link. Wholesale prices need a retailer login and are not included. From faire.com via a residential proxy. Price: $0.02 in USDC per su …ecommerce_falabella_latam — Falabella Chile product search: product ID, name, brand, seller, prices in CLP (Falabella CMR card price, internet/event price and crossed-out normal price) with discount badge, rating and review count, best-seller and sponsored flags, delivery stickers (e.g. arrives tomorrow), image and product URL; 48+ per page plus the total number of results. Price: $0.002 in USDC per successful call, paid wit …ecommerce_fisher_scientific — Fisher Scientific (US) lab product search: product family title, description, leaf category, starting list price (USD, as shown to logged-out visitors), catalog (part) numbers in the family, key specifications and link; 15 families per page (page 1 to 10). From fishersci.com's public search through a residential proxy; account-specific pricing is not included. Price: $0.002 in USDC per successful …ecommerce_flixbus — FlixBus and FlixTrain trips between two cities on a date: departure and arrival times and stations, duration, number of transfers, price in EUR (with and without platform fee), seats left and availability status, from FlixBus's public search API. One adult, one way. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.ecommerce_gamenation — GameNation.in (India) game, console and accessory search from the JSON API its website uses: product name, product ID, condition (new or pre-owned), selling price and MRP in INR, discount %, trade-in cash and trade-in store-credit offers, availability and image. Returns the total match count and up to 200 products. Unofficial endpoint, may change. Price: $0.002 in USDC per successful call, paid wi …ecommerce_gmx_arbitrum_prices — GMX token prices on Arbitrum from the public api.gmx.io/prices feed. Returns token contract addresses (the feed has no symbols) and USD price per token, scaled by 1e30 as GMX does. Use the address to match the token yourself. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.ecommerce_grubhub — Grubhub restaurants delivering to a US ZIP code (or lat/lng), optionally matching a search such as pizza or sushi: restaurant id, name, cuisines, rating and rating count, price level (1-4), delivery fee and order minimum (USD), delivery time window (minutes), pickup/delivery, open now, phone, address, distance (miles) and Grubhub link. Up to 20 per page. From Grubhub's own diner API through a US p …ecommerce_hepsiburada — Hepsiburada (Turkey) product search: product name, product ID (HB SKU), final price and crossed-out price in TRY, discount %, rating and number of reviews, campaign lines (e.g. installments, lowest price in 30 days), image and product URL; 36 per page plus the total number of results. Sort by relevance, price, reviews, rating or newest. Price: $0.002 in USDC per successful call, paid with x402 (Ba …ecommerce_invaluable_auctions — Auction lots from Invaluable (thousands of auction houses worldwide) for a keyword: upcoming lots with current bid, bid count, estimate range, sale date and type (live/timed), or past lots with the hammer price result. Each lot: title, lot number, category path, artist, auction house, location and country, currency, image and lot URL; plus the total matching lots. Bidder identities are not returne …ecommerce_lazada_products — Lazada product search for Singapore, Malaysia, Philippines, Thailand, Vietnam and Indonesia, from the JSON the Lazada catalog page itself loads: product name, item ID, price and original price in local currency, discount, rating, review count, units sold, seller, brand, ship-from location, stock flag, sponsored flag, image and product URL. Up to 40 products per page. Unofficial endpoint, may chang …ecommerce_made_in_china — Made-in-China.com wholesale product search: product name, supplier company, price range (USD, as the page's structured data gives it) and stock state from the public results page. Only the first page (about 20 products). Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.ecommerce_mediamarkt_eu — MediaMarkt / MediaWorld product search for Germany, Austria, Switzerland, Italy (MediaWorld) and Poland, read from the schema.org product list on the public search page: product name, price and currency (EUR, CHF or PLN), average rating, review count, image and product URL for the top 12 results, plus the total number of matching products. A search that matches a category or brand returns that pag …ecommerce_metalprices_com — Latest precious-metal prices from MetalpriceAPI (gold XAU, silver XAG, palladium XPD, platinum XPT): USD per troy ounce, plus the raw rate (ounces per 1 USD) and the time the price is from (end of day on the free plan). Not a retail price list. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.ecommerce_mood_fabrics — Fabrics listed on Mood Fabrics' public product feed: title, type, variant prices and whether each variant is in stock. Only the feed's first page is read (newest products first). Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.ecommerce_newegg — Newegg (US) product search: item number, title, model, price, list price, instant rebate, lowest price in 30 days, in-stock flag, rating, review count, seller count, category, best-selling rank, free-shipping flag and link, about 36-42 items per page (page 1 to 20), plus the total result count. From newegg.com's public search page via a residential proxy. Price: $0.002 in USDC per successful call, …ecommerce_nykaa_beauty — Nykaa (India) beauty product search: name, brand, price and MRP in INR, discount, rating, rating count, in-stock flag, shade/variant count, offer count, category path, tags (bestseller, featured) and product link, about 20 per page (page 1 to 10), plus the total found and the Nykaa listing the search maps to. From nykaa.com through a residential proxy. Price: $0.002 in USDC per successful call, pa …ecommerce_openbeautyfacts_products — Beauty and personal-care products by brand from Open Beauty Facts (community open data, crowd-sourced). Gives name, barcode, size and product page. No prices or stock: this source does not have them. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.ecommerce_petco — Petco.com (US) product search read from the public search page: product name, brand, price, list price, Repeat Delivery (autoship) price in USD, average rating, review count, category, same-day delivery / store pickup / in-store-only flags, number of variations, image and product URL, plus the total result count. 48 products per page. Prices are Petco's online prices at the time of the call. Price …ecommerce_pricerunner — Price comparison from PriceRunner (Klarna) in the UK, Sweden or Denmark: for a search, products with lowest price and currency, number of shops offering it, category, popularity rank, rating average and count, price-drop info, condition, stock flag, image and comparison URL, plus the total number of hits and the categories found. Price: $0.002 in USDC per successful call, paid with x402 (Base, Sol …ecommerce_rakuten_japan — Rakuten Ichiba (Japan) product search from the official Rakuten Web Service API: item name, price in JPY, shop, review average and count, point rate, availability, shipping flags and item link. Search results only, no stock history. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.ecommerce_rappi — Rappi restaurant menu and prices (Mexico, Brazil, Colombia, Argentina, Chile, Peru, Uruguay, Ecuador, Costa Rica): for a Rappi store ID returns store name, brand, address, open status, ETA, delivery fee, rating and reviews, cuisine tags, weekly schedule, active offers, and the menu by section with each product's price, original price, discount %, availability and description. From the public resta …ecommerce_restaurant_depot_sysco_us_foods_chef_store — Restaurant-supply prices from US Foods CHEF'STORE (cash-and-carry, open to the public): products with brand, description, category, pack and size, UPCs, item number and, at the chosen store, unit and case price, regular price, sale flag and end date, low-stock flag and aisle; plus store count and lowest/highest unit price across stores. Restaurant Depot and Sysco publish no prices without an accou …ecommerce_revzilla — RevZilla motorcycle gear and parts in a category (e.g. motorcycle-helmets, motorcycle-jackets, motorcycle-tires): product name, brand, price (USD), in-stock flag, rating, review count, badge (top rated, new...), free-shipping flag, image and link; 96 per page (page 1 to 20), plus the category's product count. From revzilla.com's public category pages via a residential proxy. Price: $0.002 in USDC …ecommerce_sephora_products — Sephora (US) product search from Sephora's own catalog search: for a keyword up to 60 products per page with product ID, SKU ID, brand, name, price or price range (USD), sale price, rating, review count, number of shades, flags (bestseller, new, Sephora exclusive, limited edition, online only, sale), product link and image, plus the total product count and Sephora's matching categories. Price: $0. …ecommerce_shopify_stores — Products of a Shopify store from its public /products.json feed: title, type, vendor, variant prices and whether each variant is in stock. Works only for stores that keep the feed public; you give the store domain, e.g. allbirds.com. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.ecommerce_singlecare — SingleCare prescription coupon prices for a drug: price at each nearby pharmacy (Kroger, CVS, Walgreens, Walmart...) with loyalty price and distance, the lowest price, form, strength and quantity priced, usual retail cash price, generic/brand flag and monthly price history. From singlecare.com's public drug pages via a residential proxy; the pharmacy list depends on the ZIP. Price: $0.002 in USDC …ecommerce_smart_apify_actor — Searches the public Apify Store for scraper actors by keyword: name, author, short description, and 30-day user count. Lists actors only; it does not run them or return product data. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.ecommerce_takealot_south_africa — Takealot.com (South Africa) product search from the JSON API the Takealot website uses: product ID (PLID), title, brand, price or price range in ZAR, list price, saving badge, star rating, review count, stock status, delivery estimate, image and product URL, plus the total result count. Up to 36 products per call. Unofficial endpoint, may change without notice. Price: $0.002 in USDC per successful …ecommerce_target_reviews — Reviews of a Target product by TCIN (the number after A- in a target.com product URL): rating statistics (average, count, 1-5 star distribution, % recommended, review and question counts) and reviews with rating, title, text, recommended and verified-purchase flags, helpful votes, photo count and date. Sort by most recent, most helpful, highest or lowest rating; optional verified-only. Price: $0.0 …ecommerce_trendyol_turkey — Trendyol (Turkey) product search: total hits and 36 products per page with product id, name, brand, category, price (TRY), original price and discount, rating and review count, best-seller rank, favourites and order counts (as shown, e.g. 55K / 200+), free-shipping flag, merchant id, variant, image and product link. From trendyol.com via a Turkish residential proxy. Price: $0.01 in USDC per succes …ecommerce_uline — Uline industrial supply product by item number (e.g. S-4119): description, category, and the unit price the Uline page reports. Read from the public product page; no stock or shipping data. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.ecommerce_vestiaire_collective — Vestiaire Collective listing tracker (US site, USD): for 1-10 listing IDs (the number before .shtml in a listing URL) returns title, brand, category, condition, color, material, current price, seller price and buyer fee, sold / reserved / available flags, likes, seller country, listed items and items sold, shipping origin and URL. Reads each public listing page; no catalog search. Price: $0.002 in …ecommerce_vestiairecollective — Vestiaire Collective listing tracker (US site, USD): for 1-10 listing IDs (the number before .shtml in a listing URL) returns title, brand, category, condition, color, material, current price, seller price and buyer fee, sold / reserved / available flags, likes, seller country, listed items and items sold, shipping origin and URL. Reads each public listing page; no catalog search. Price: $0.002 in …ecommerce_vintage_photo_restorer — Restores an old, scratched or faded photo with an AI image model (Cloudflare Workers AI, img2img). Returns a new image; it does not recover lost detail or identify people. Send the photo as base64. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.ecommerce_webstaurantstore — WebstaurantStore search results for restaurant and foodservice supplies: item number, description, shown price per unit and product link, from the public results page (first page only). Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.ecommerce_zazzle — Zazzle (US) product search from the public search page: product ID, title, product type, price and current sale price in USD, discount %, promo label, all-time order count, store name and handle, image and product URL; 60 products per page plus the total number of matching products and pages. Prices are Zazzle's default-configuration prices at the time of the call. Price: $0.002 in USDC per succes …social_aemet_spain_weather — Spanish weather station observations from AEMET OpenData (official): latest hourly readings (temperature, humidity, wind, pressure, precipitation…) for all stations or one station ID (idema, e.g. 3195 Madrid Retiro), as published by AEMET. Requires the operator's free AEMET OpenData key. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.social_alltrails — Hiking trails from OpenStreetMap (via the free Waymarked Trails API), not from AllTrails, which blocks automated access: search by trail name or list routes around a point. Per trail: OSM ID, name, ref, network level, length in km, loop/linear, hardest OSM sac_scale difficulty, surfaces, operator, website, Wikidata, description and center point. No user ratings, reviews or photos (OSM has none). C …social_bea_national_accounts — US national accounts from the Bureau of Economic Analysis (official API): any NIPA table (e.g. T10101 real GDP percent change, T10105 GDP in dollars, T20100 personal income) at annual, quarterly or monthly frequency for chosen years, returned as BEA publishes the rows (line, description, period, value, unit). Requires the operator's free BEA API UserID. Price: $0.002 in USDC per successful call, p …social_bilibili_comments — Hot comments on one Bilibili video from Bilibili's public comment endpoint: comment id, author name, text, like count, reply count and time (up to 20, most-liked first). Needs the video's numeric aid (the number in the av<aid> URL); the tool does not convert BV ids. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.social_carparts_com — CarParts.com product search: for a keyword (e.g. 'brake pads', 'headlight', a part number) up to 20 products per page with SKU, manufacturer number, brand, private-label flag, category path (top level, category, sub-category, part), price, list price and saving, shipping cost, universal-fit flag, product attributes (warranty, notes …), image and product link, plus the total result count and page c …social_carsandbids — Live Cars & Bids auctions from the site's public RSS feed (about 250 current items, newest first): auction title, auction link and id, start date, short description and photo. The feed has no current bid, reserve or end-time data, so those are not returned. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.social_contact_info — Contact details published on one public web page you name (https only): mailto and tel links, email addresses written in the page text, and links to social profiles, plus the page title. Reads the single page only, does not crawl, and returns nothing that the page does not show. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.social_copart_public_search — Copart (US) salvage and used vehicle auctions for a search (make, model, year...): lot number, vehicle title, odometer and its status, title type and state, primary damage, keys, AutoGrade score, yard location, auction timing/status, current bid (USD) and lot link, 20 to 50 lots per search. From copart.com's public search through a rendering residential proxy; buying requires a Copart account. Pri …social_facebook_comments — Comments on a public Facebook post as a logged-out visitor sees them (the 'Most relevant' comments of the first page load, usually about 10): comment id, author, author link, text, time, reaction count, reply count and link, plus the post's text and total reaction / comment / share counts. From facebook.com via a residential proxy. Price: $0.01 in USDC per successful call, paid with x402 (Base, So …social_facebook_events — Events listed on a Facebook Page's Events tab (logged-out view): event id, name, date text, place, city, cancelled flag, organiser and event link, plus the Page name. From facebook.com via a residential proxy. Price: $0.01 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.social_facebook_followers_following — Facebook Page follower counts from Facebook's public Page Plugin: for up to 10 Pages (username, numeric ID or facebook.com URL) the Page name, numeric page ID, verified badge, profile picture URL and exact follower count, sorted by followers. Counts only: the lists of individual followers or followed accounts require a logged-in Facebook session and are not returned. Unknown pages are listed under …social_facebook_groups — Facebook group snapshot as a logged-out visitor sees it: group name, id, Public/Private, member count and the posts shown in the first page load (post id, link, author, text, time, reactions, comments, shares). Private groups return the header only. From facebook.com via a residential proxy. Price: $0.01 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charge …social_facebook_likes — Reaction, comment and share counts for up to 10 public Facebook post URLs, from Facebook's public Embedded Post plugin: counts as shown (e.g. 1.2K) with a numeric estimate, page or author name, verified badge, publish time (UTC) and attached image. Totals only: who reacted is not available without login. Private, deleted or non-embeddable posts are listed under notFound. Price: $0.002 in USDC per …social_facebook_marketplace — Facebook Marketplace search for a city (logged-out view, the first ~15-25 listings): listing id, title, price, amount, city, state, seller name, sold / pending flags, delivery types, created time, photo and listing link. From facebook.com/marketplace via a residential proxy. Price: $0.01 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.social_facebook_page_contact_info — Contact details from a Facebook Page's About tab (logged-out view): category, email, phone, website(s), address, other social links and the raw list of fields Facebook shows, plus the Page name and follower count. From facebook.com via a residential proxy. Price: $0.01 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.social_facebook_pages — Facebook Page profile from Facebook's public Page Plugin: page name, follower count, verified flag and page link. Posts and discussions are not in the public plugin and are not returned. Facebook may block or rate-limit automated requests (503). Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.social_facebook_photos — Latest photos on a Facebook Page's Photos tab (logged-out view, usually 8): photo id, alt-text caption, image URL, width, height and photo link, plus the Page name and follower count. Image URLs are signed and expire. From facebook.com via a residential proxy. Price: $0.01 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.social_facebook_posts — Latest public posts of a Facebook Page as a logged-out visitor sees them (Facebook shows the first 1-3 posts without login): post id, link, text, time, reaction / comment / share counts and media type, plus the Page name and follower count. From facebook.com via a residential proxy. Price: $0.01 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.social_facebook_reels — Facebook Reel details from the public reel page (logged-out view): reel id, title, summary, caption, duration (seconds), thumbnail, owner name and id, post time, reaction, comment and share counts. Input a reel link or id. From facebook.com via a residential proxy. Price: $0.01 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.social_facebook_search — Facebook people search by name via Facebook's public people directory (facebook.com/public/<name>, logged-out view, up to ~24 results): profile id, rank, name, profile link and profile photo. Only profiles whose owners allow public search appear. From facebook.com via a residential proxy. Price: $0.01 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.social_instagram — Engagement snapshot of a public Instagram account from Instagram's web profile JSON: followers, total posts, and the 12 newest posts with likes, comments, video views and per-post engagement rate ((likes+comments)/followers), plus averages, median likes, best post and posting frequency over those 12. Comment text is not served anonymously, only counts. Hidden like counts give null. Throttling give …social_instagram_contact — Public contact details of an Instagram account from Instagram's web profile JSON: business email, phone and address (only when the account shows them as public contact buttons), contact method, category, website and bio links, plus emails and phone-like numbers written in the bio. Nothing hidden is looked up. Anonymous access is throttled by Instagram (503, not charged). Unknown usernames return 4 …social_instagram_highlights — Story highlights of a public Instagram profile (the highlights tray a logged-out visitor sees): highlight id, title, cover thumbnail and link, plus the profile's full name, followers, following, bio, verified and private flags. Highlight story items themselves need a login and are not returned. From instagram.com via a residential proxy. Price: $0.01 in USDC per successful call, paid with x402 (Ba …social_instagram_posts — The 12 most recent grid posts of a public Instagram account from Instagram's web profile JSON: shortcode, URL, type (image/carousel/video/reel), full caption, post time, likes, comments, video views and duration, location and image URL, plus the account's total post count. Only the newest 12 are served anonymously (no paging, no comment text). Private accounts return an empty list. Throttling give …social_instagram_profile — Public Instagram profile from Instagram's web profile JSON: ID, username, full name, bio, external link and bio links, verified/private/business flags, category, exact follower, following and post counts, reel/highlight counts and profile picture. Anonymous access is throttled by Instagram, so a call can fail with 503 (not charged); a few business profiles hit an Instagram-side error (502). Unknow …social_instagram_reel — Recent reels and videos of a public Instagram account from Instagram's web profile JSON: reels and videos among the 12 newest grid posts and the newest long-form (IGTV) videos, each with URL, caption, post time, views, likes, comments and duration. Instagram does not serve the full reels tab or single-reel lookups anonymously, so only these recent items appear. Throttling gives 503 (not charged); …social_instagram_related_profiles — Accounts Instagram lists as related to a public profile (the suggested-accounts set in Instagram's web profile JSON, often up to ~50): ID, username, full name, verified and private flags, profile picture. No follower counts for the related accounts. Some accounts have no related list (empty result). Throttling gives 503 (not charged); unknown users 404. Price: $0.002 in USDC per successful call, p …social_labx_com — Listings of one LabX seller (lab equipment marketplace) from the seller's public profile page: listing id, title, price range, currency, condition, category, source link and availability date (about 20 per page), plus the seller's active-listing count. Prices are the seller's asking prices as listed; 'Request a Quote' listings have no price. Price: $0.002 in USDC per successful call, paid with x40 …social_olx — OLX classified listings search (Poland, Romania, Portugal, Ukraine, Bulgaria, Kazakhstan, Uzbekistan) from OLX's public listing API: title, URL, price with currency and negotiable flag, city/region, category ID, posted and refreshed dates, private vs business seller, photo URL, short description and promotion flags, plus the total number of matching ads. Newest first by default. Price: $0.002 in U …social_pinterest — Latest pins of a public Pinterest profile from Pinterest's own RSS feed: profile name and description, and for each of the newest 25 pins the pin URL and ID, text, image URL and publish date. Works for public profiles without login; boards, search and engagement counts are not part of the feed. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not ch …social_reddit_posts — Posts of one subreddit from Reddit's public feed, sorted hot, new, top or rising (about 25 items): id, title, author, date and link. The feed has no scores or comment counts, so it cannot rank by votes. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.social_reddit_posts_comments — Reddit community discussions from Reddit's public RSS feeds: top posts of a subreddit for hour/day/week/month/year/all, or one thread (post id) with its visible comments. Feeds carry title, author, link, date and text only; no scores or comment counts. Reddit may rate-limit (503). Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.social_reddit_profiles — Reddit user profile from Reddit's public user feed: the user's name, the profile subtitle, and their latest submitted posts (title, subreddit, date, link; about 25 items). No karma, account age or hidden profile data; the feed does not show them. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.social_snapchat — Public Snapchat profile from its web profile page: username, display name, page title and description, snapcode image and canonical link. Stories, Spotlight posts and follower counts are not shown on the public page and are not returned. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.social_socialblade — Social Blade creator statistics for a YouTube, Instagram, TikTok or Twitch account: followers/subscribers, views or likes, uploads, engagement rate and averages where Social Blade has them, Social Blade grade and ranks, country and category, plus the daily history Social Blade shows publicly (about 15 days). From socialblade.com's public profile pages through a residential proxy. Price: $0.002 in …social_sos — Business entity search in official Secretary of State open data for Colorado (all entities), New York (active corporations) and Oregon (active businesses): name contains-search, newest first, with entity ID, name, type, status, jurisdiction, formation date, principal or process address and registered agent. Only these three states; refresh follows each state's portal. Price: $0.002 in USDC per suc …social_telegram_channel — Public Telegram channel from its t.me/s preview page: title, description, subscriber/photo/video/link counts, and the latest ~20 posts with text, view count text and time. Only public channels that show a preview; private chats and groups are not returned. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.social_telegram_homepage — Latest public posts of one Telegram channel as shown on its public web preview (t.me/s/<channel>): post id, text, view count text and date, about 20 per page. Only public channels with a preview; the Telegram homepage itself has no data, so this tool reads a channel's public feed. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.social_telegram_keyword_search — Keyword search inside one public Telegram channel, using the channel's own preview search: matching posts with id, text, view count text and date (about 20 per page). It cannot search across all of Telegram; private chats and groups are not searchable here. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.social_threads_profile — Threads (Meta) profile: name, verified flag, bio, follower count and bio links, plus the latest posts the public profile page shows (about 10, including the author's own thread continuations) with text, time, likes, replies, reposts, quotes, media URLs and link. From threads.net through a residential proxy; logged-out pages show a limited number of posts. Price: $0.002 in USDC per successful call, …social_threads_replies — Replies to a Threads post: the post itself (text, likes, reply/repost/quote counts) and the replies the public post page shows (first page, typically 10-25, including short reply chains and the author's own thread continuations) with author, text, time, likes and who each reply answers. From threads.net through a residential proxy. Price: $0.002 in USDC per successful call, paid with x402 (Base, S …social_threads_search — Threads (Meta) post search: the top posts for a keyword or hashtag as the logged-out search page shows them (typically 10-20) with author, text, time, likes, replies, reposts, quotes, media and link. From threads.net through a residential proxy; Threads decides the ranking and there is no date filter. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are …social_tiktok — One public TikTok video by URL from the video page's embedded data: caption, hashtags, creation date, duration, size, cover image, region, language, ad flag, exact play, like, comment, share, save and repost counts, the author (ID, username, nickname, verified, follower and like totals) and the sound. Keyword, hashtag and profile video lists are not available anonymously. Deleted or private videos …social_tiktok_comments — Top-level comments of a public TikTok video from TikTok's web comment list JSON: comment ID, text, likes, reply count, time, language, pinned/liked-by-creator flags and the commenter's ID, username and nickname, plus the video's total comment count. Up to 60 comments in TikTok's own ranking order (no reply threads). An unknown or deleted video ID returns an empty list with total 0. Price: $0.002 i …social_tiktok_creative_center_top_ads — TikTok Creative Center Top Ads: the top-performing TikTok auction ads the public gallery shows first for a region and period (logged-out view: the first 4 cards): ad id, campaign objective, industry, likes, CTR percentile band, budget band, thumbnail and the Creative Center analytics link. From ads.tiktok.com/business/creativecenter via a rendering residential proxy. Price: $0.02 in USDC per succe …social_tiktok_hashtag_analytics — TikTok hashtag stats from TikTok's public hashtag detail JSON: hashtag ID, title, description, exact video count and total view count, average views per video and commerce flag, for up to 10 hashtags compared side by side (sorted by views). Lifetime totals only: no time series, no top-video list and no audience demographics. Unknown hashtags are listed under notFound. Price: $0.002 in USDC per suc …social_tiktok_profile — Public TikTok profile from the profile page's embedded data: user ID, secUid, nickname, bio, bio link, verified, private and organization flags, language, avatar, creation date, and exact counts of followers, following, likes, videos and friends. The page carries no video list for anonymous visitors, so videos are not included. Unknown usernames return 404. Price: $0.002 in USDC per successful cal …social_tiktok_shop — TikTok Shop (US) category products: the products the public category page shows first (about 10) with title, price, original price, rating, review count, units sold, shop name, brand and product link, plus a few recent buyer reviews and the category tree. Pass a category URL from shop.tiktok.com/us/c/... or its slug and id. Via a residential proxy. Price: $0.002 in USDC per successful call, paid w …The signed observations, every earlier tool set and a diff of each change: this page with scripts on, or /api/v1/servers/4d3f8491d23575f2.
Read → digest → label → append → sign → compare
Six steps, every one of them checkable by someone who does not trust HISTOR. The only thing you have to take on faith is that the observation happened when the label says it did — and the log makes it impossible to change that story afterwards.
Remote endpoints in the official MCP registry: initialize, then tools/list, drained across every page; no tool is called, and private addresses are refused before the connection opens. npm and PyPI packages: installed and started in the sandbox described below, with no route out.
The tool set is reduced to name, description, input and output schema, sorted by UTF-16 code units and hashed over its RFC 8785 canonical form. Anyone holding the same tools gets the same digest — which is what makes a comparison possible.
Four MTL/1 methods, one signed AWR/2 document each: what was observed, what the WARDEN pattern set matched, whether the definitions changed since the last label, and whether the name is on a threat list. No score, ever.
Every label becomes a leaf of an RFC 9162 Merkle tree: leaf hash = SHA-256(0x00 ‖ JCS(label)). The label you download is the leaf input, so you can recompute its hash yourself.
After each crawl HISTOR signs a tree head: the size and the root. Keep yesterday's head; ask for a consistency proof to today's; if anything was removed or rewritten, the proof fails.
Each day a continuity label compares the new digest with the last one. Equal: "unchanged since". Different: a change, with the date and a per-tool diff. A client that checks what it received adds the view no crawler has.
Where an npm or PyPI package is run
A package observation is true for these conditions, and no others. Every package page names the exact image it ran in and any configuration it was given.
Linux x86_64, inside gVisor (runsc): the package talks to a kernel written for sandboxing, not to the host's. An unprivileged user, no capabilities, a read-only root.
npm packages in histor-node:22, PyPI packages in histor-python:3.12: the official node:22-bookworm-slim and python:3.12-slim images plus bash, git, Python 3 or Node 22 and a Java 21 runtime — never Docker — built when a sandbox host is installed. A package whose Requires-Python excludes 3.12 runs on histor-python:3.13 or 3.14; one that requires a newer Node runs again on histor-node:24. The exact image a package ran in is on its page.
npm with --ignore-scripts, then the install scripts in a traced stage of their own. PyPI: wheels only — a package that ships only source is reported, never built.
No route out. Every name the package looks up resolves to HISTOR's own traps, which record what was sent and forward nothing. A server that needs the internet to start shows that here.
None are real. Decoy credentials sit in HOME and a decoy .env in the working directory. A variable the package says it needs gets a placeholder; where the placeholder was sent is recorded.
512 MB of memory, one CPU, 64 MB of /tmp. 360 s to install, 150 s to start and answer; up to 15 tools called once each with canary arguments, 8 s per call.
Only names: required variables its registry entry declares or that it printed when it exited, and a start argument such as serve when its usage text offers one. Never a value from anyone else.
The profile HISTOR implements forbids the words safe, secure, audited, certified, approved and trusted. Here is why, in the terms of what the log can and cannot show.
A pattern match is a reason to read a definition, not a finding. Three of the four methods can never return fail. There is no score to rank by, because no score HISTOR could compute would mean what a reader takes it to mean.
Labels are about advertised text. A remote endpoint's source is never read and its tools are never invoked; a package runs only in the sandbox, against nothing real. A server can keep identical definitions and behave differently for real users; the log cannot see that, and says so inside every label.
A version bump changes definitions too. A change is shown as a date and a diff, in amber, never red. What you do with it is yours: re-read, re-approve, or pin the old digest.
An npm or PyPI server is observed under the test conditions above: Linux, no internet, placeholder keys. One that needs Windows, a real account or the network may show fewer tools or none; its page says why it exited.
Today one party runs the log. A second observer on another network is the next step, and any AIMarket hub can run one. Until then, what the key proves is who said it — not that it is true.
Endpoints that require authentication answer 401 to everyone without a key, including HISTOR. They are counted and listed as not observed, never dropped from the numbers.
For clients, registries and server authors
Before your agent trusts a server, send the tools it received. The answer is signed by the log's did:key and names the tree head it was given under.
curl -sS https://histor.modelmarket.dev/api/v1/check \
-H 'Content-Type: application/json' \
-d '{"endpoint":"https://example.com/mcp","tools":[ …tools/list result… ],"contribute":true}'
# -> {"type":"histor.check/v1","match":"same"|"different"|"previously-observed"|…,
# "observed":{"unchangedSince":"…","changes":0}, "patternScan":{…}, "signature":{…}}
# README badge for your server
[](https://histor.modelmarket.dev/s/<id>)
# Atom feed of every observed change
https://histor.modelmarket.dev/feed.xml
No. The server list is the log's index: every remote endpoint in the official MCP registry, with what HISTOR could observe about it. Nothing here is for sale and nothing is ranked by quality.
No, and it never will. It tells you what a server advertised, whether that changed, and which published patterns matched the text. Whether to trust the server is your decision — HISTOR makes sure you decide on the same facts as everyone else.
Most remote MCP endpoints require a login (they answer 401 to anyone without a key), some use the legacy SSE transport or need per-user values in the URL, and some are simply down. They stay on the list with the reason, so the numbers never hide them.
Open the Check tab, paste the server's endpoint and the tools/list result your client received, and press Check. You get back, signed, whether HISTOR observed the same definitions — or different ones, or an older set.
Find your endpoint on the Servers tab, open it, and copy the Markdown snippet under the facts. The badge shows the date your definitions were pinned or last changed, and links to the full history.
You do not have to. Every label and every tree head is signed with one published key; the Log tab proves in your browser that the log only grew; and the command-line auditor does the same from any machine. What remains is that one operator runs it today — a second, independent observer is the next step.
Looking things up, the badges, the feed and /check are free. HISTOR also offers histor.check@v1 to the AIMarket Hub, so agents can reach it through the market.
Once a day: initialize, notifications/initialized and tools/list — never a tool call, never a redirect followed, at most two connections per host, from a User-Agent that starts with histor/. To be left out, open an issue on the histor repository with your endpoint or host; it is then listed as not observed (operator-opt-out), with the reason, rather than silently dropped. Labels already in the log stay: the log only grows.