Transparency log · MCP tool definitions
Your AI client trusts the tool descriptions an MCP server sends it — and a server can change them after you approved it. HISTOR keeps a public, signed record of what every remote MCP server in the official registry advertised, and tells you the day it changed.
Remote endpoints: it lists tools and never calls one. Registry packages: bounded canary calls run inside the isolated sandbox. It never says a server is safe — it tells you what was said, and when.
WebGL is unavailable here. The picture is the log itself: each label is a leaf, leaf hashes climb a Merkle tree, and a signed tree head seals the root.
What HISTOR is for
When you connect an MCP server, its tool descriptions go straight to the model as instructions. A server can pass your review with harmless descriptions and change them next week — one added sentence is all a prompt injection needs, and most clients never ask you again.
Every day HISTOR reads what each remote (streamable-HTTP) endpoint in the official MCP registry advertises, fingerprints it, signs what it saw and appends it to a log that can only grow. When a server's definitions change, the change gets a date and a diff.
Look up any server before you trust it. Paste what your client received and learn whether everyone else sees the same thing. Follow changes in a feed, or put a badge in your README. Every answer is signed, so you can verify it instead of believing it.
io.github.bck-stack/sitecheck-agent-intel-dev · https://api.fadeandco.workers.dev/mcp?ref=registry
135 pay-per-call agent tools: agent intelligence, token risk, developer and AI data tools. x402
agent_intel_agent_json_schema_guard — Checks an agent's JSON output against a JSON Schema (draft 2020-12 keywords: type, properties, required, additionalProperties, items, enum, const, length, pattern, minimum/maximum, item counts). Returns valid yes/no, each error with its path and the value with disallowed fields removed. $ref, allOf/anyOf/oneOf, if/then and format return an error instead of passing silently. Price: $0.001 in USDC p …agent_intel_anti_whale_limit_detector — Static search of a VERIFIED Ethereum contract's Solidity source (Blockscout) for max-wallet, max-transaction and cooldown rules, with the matching lines. Unverified contracts are reported as such, not guessed. Bytecode-only and non-Ethereum chains are not covered; a hit is a clue, not proof of a trap. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are …agent_intel_api_sla_liveness_benchmark — Liveness and latency of one public HTTPS endpoint, measured from this server: three GET requests, returning each HTTP status and the time to the response headers, the median and the worst time, and an UP/DEGRADED/DOWN level. One location only: it does not test other regions, and it does not measure the TLS handshake on its own. Price: $0.001 in USDC per successful call, paid with x402 (Base, Solan …agent_intel_bundle_sniper_detector — Looks at the first Solana slot where a token mint appears (public RPC): if its history fits in 8 pages of signatures, it counts the distinct fee payers of the transactions in that slot. Several different fee payers in one slot is a bundle-sniping signal, not proof. Mints with longer history return HISTORY_TOO_LONG; this tool cannot see Jito bundle metadata. Price: $0.003 in USDC per successful cal …agent_intel_bytecode_similarity_radar — Compares the runtime bytecode of two Ethereum contracts you name: the share of shared PUSH4 function selectors (Jaccard) and the cosine similarity of their opcode frequencies, combined into one 0 to 1 score with a SIMILAR, PARTIAL or DIFFERENT label. It compares two addresses only; it has no database of known scam or exploit templates, so it cannot say a contract is a known clone. Price: $0.003 in …agent_intel_cex_exchange_reserve_flows — Ethereum native-ETH balance snapshot of up to 10 wallets that a community label dataset (brianleect/etherscan-labels, GitHub) tags as Binance, Coinbase or OKX. It is a snapshot of a sample, not total exchange reserves: no token balances, no inflow or outflow history, and the labels are community-made and may be out of date. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or …agent_intel_citation_verifier — Checks up to 5 references against public registries: DOI through Crossref, arXiv ids through the arXiv API, ISBN-10/13 through Open Library (checksum first). Returns title, year, venue and a BibTeX entry plus an APA-style string for each verified one; unknown ones come back as not_found. Authors are given for DOI and arXiv only. Price: $0.001 in USDC per successful call, paid with x402 (Base, Sola …agent_intel_consumer_product_recalls — Recent US recalls matching a keyword: CPSC consumer-product recalls (saferproducts.gov, by recall date and description text) and FDA food enforcement reports (openFDA, reason for recall). Vehicle (NHTSA) and FDA drug/device recalls are not included. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.agent_intel_cors_security_misconfig_audit — CORS check for a public HTTPS endpoint: three GET requests with a made-up origin, the null origin and no origin, reporting whether the server echoes the origin, allows null, returns a wildcard, and allows credentials. Only reads response headers of GET requests; it does not test preflight, methods or authentication. Price: $0.001 in USDC per successful call, paid with x402 (Base, Solana or Arc); f …agent_intel_cross_chain_bridge_liquidity — Across bridge limits for USDC between two chains: the largest instant-fill amount the bridge can take right now, the largest deposit it accepts, and the smallest deposit. Across only (not Stargate, Hop or CCTP), USDC only, and the chain pair must be one the Across limits API accepts. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.agent_intel_crosschain_gas_priority_fee — Current base fee and priority-fee percentiles (10th, 50th, 99th) for Ethereum, Base or Arbitrum from public RPC nodes, with the next block's base fee projected from the last block's fullness (EIP-1559 rule). Solana is not included here. Forecasts are a one-block projection, not a congestion model. Price: $0.001 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not …agent_intel_deep_research — Research starter: searches English Wikipedia (not the open web) for a query and returns the top articles with their summary text, description and last edit time. No AI synthesis; the caller reads and combines the sources. Price: $0.005 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.agent_intel_defi_yield_risk_optimizer — Ranks DeFi pools by total APY from DefiLlama's public yields data, filtered by chain, minimum TVL and optional stablecoin-only, with each pool's TVL, 7-day impermanent loss, reward share of APY and IL-risk flag. Ranking is by APY, not by safety: there is no audit or exploit-history score (none is in this free source). Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); …agent_intel_deployer_rug_forensics — Contracts created by a deployer wallet on Ethereum, from its most recent 50 transactions (Blockscout public API): creation hash, time and new contract address. Only that recent page is read, so older launches are missing. No rug-pull or abandoned-pool judgement: liquidity history is not included. Price: $0.003 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not …agent_intel_dex_depth_slippage_calculator — Estimated output, price impact and minimum output for a swap in one DEX pair, using the pair's reserves from DexScreener and a constant-product (x*y=k) model with a fee. Exact for constant-product pools (for example Aerodrome volatile pools, Uniswap V2 style); for concentrated-liquidity pools (labelled v3 or v4) it is only an approximation. Raydium is not covered. Price: $0.002 in USDC per success …agent_intel_dnssec_trust_chain_validator — DNSSEC status for a domain using Cloudflare's public resolver (1.1.1.1 DNS-over-HTTPS): whether the resolver validated the answer (AD flag), the DS records in the parent zone, and the DNSKEY records with key-signing keys. The validation is done by Cloudflare's resolver, not by this tool walking the chain to the root. Price: $0.001 in USDC per successful call, paid with x402 (Base, Solana or Arc); …agent_intel_domain_authority_credibility — Registration facts for a domain from the public RDAP directory: registration date, age in days, expiry, registrar, lock status. No authority score, backlink or spam index: no free public source for those was found (Tranco rank API needs a key; DNS-over-HTTPS was unreachable from the test network). Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not …agent_intel_ecb_institutional_fx_rates — European Central Bank euro reference rates (published once per working day around 16:00 CET): the rate for one currency against the euro, and an optional conversion of an amount between two of the listed currencies. Rates are the ECB's daily reference, not a live market quote; the list has about 30 currencies. Price: $0.001 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed …agent_intel_eu_vies_vat_batch_validator — Checks up to 5 EU VAT numbers (country code + number, e.g. DE143208032) with the European Commission's VIES service and returns valid yes/no, the registered name and address when the member state releases them, and any member-state error. Some member states do not release names or addresses, and VIES can be unavailable for one country at a time. Price: $0.002 in USDC per successful call, paid with …agent_intel_fact_brief_synthesizer — Entity brief for a statement: finds up to 3 capitalised names or phrases in it and looks each up in Wikidata (public knowledge graph), returning the Wikidata ID, label, short description and link. It confirms the entities exist; it does NOT judge whether the claim is true, and it finds no numbers or dates. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed call …agent_intel_gleif_corporate_lei_registry — Legal entity identifier (LEI) records from GLEIF's public database: search by legal name (up to 5 matches) or look up one 20-character LEI. Returns legal name, country, city, entity and registration status. Parent companies are not expanded here (a second request per entity would be needed). Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charg …agent_intel_global_postal_geocode_resolver — Resolves a postal code in one country (ISO 2-letter code, e.g. US, DE, TR, GB) to its place names, state or province, and latitude and longitude, from Zippopotam.us. Covers only the countries that service publishes. No time zone or administrative municipality is returned, since no free source for them was used. Price: $0.001 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed …agent_intel_hallucination_claim_checker — Checks the named entities in an AI answer (up to 5 capitalised names) against Wikidata: each name is marked found or not found, with its Wikidata ID and description, and sentences containing a year are listed for review. It checks that entities exist, not that claims about them are true, so a found entity can still have a wrong fact. Price: $0.003 in USDC per successful call, paid with x402 (Base, …agent_intel_highres_qr_code_generator — Makes a QR code as scalable SVG (21x21 modules, version 1) for up to 17 bytes at level L, 14 at M, 11 at Q or 7 at H, with the mask chosen by the standard penalty rules. Returns the SVG and a base64 copy. Larger versions are not supported; longer text returns 400. Price: $0.001 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.agent_intel_holder_cluster_analyzer — Holder concentration for an EVM token (Ethereum, BSC, Base, Arbitrum, Polygon): share of supply held by the top 1, top 3 and top 10 holders, total holder count, and how much of the top 10 are contracts. GoPlus gives only the top 10 holders, so the top-20 view and funding-source clustering are NOT provided. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed call …agent_intel_honeypot_trap_detector — Trap flags for an EVM token (Ethereum, BSC, Base, Arbitrum, Polygon) from GoPlus token security, which simulates buy and sell: honeypot result, buy/sell/transfer tax, blacklist, pausable transfers, hidden owner, mintable, anti-whale and slippage modifiers. The tool reports GoPlus's flags; it runs no simulation of its own. Price: $0.003 in USDC per successful call, paid with x402 (Base, Solana or A …agent_intel_html_dom_to_clean_markdown — Converts raw HTML you send (up to 500 KB) to GitHub-flavoured Markdown: headings, paragraphs, links, images, lists, code blocks, quotes, bold and italic. Scripts, styles, navigation, footers, forms and comments are removed; tables are flattened to text. Relative links need a base URL to become absolute. Price: $0.001 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls a …agent_intel_iban_routing_swift_resolver — Validates an IBAN (MOD-97 checksum and country length, computed here) and, if it passes, looks up the bank name, city and BIC (SWIFT) through OpenIBAN's public validation. The bank lookup depends on OpenIBAN's directory and may be missing for some banks; a valid checksum does not prove the account exists. Price: $0.001 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls …agent_intel_invoice_document_ocr — Extracts vendor name, tax ID, line items, net subtotal, VAT rates and payment details (IBAN, BIC) from an invoice image (PNG or JPEG, base64, up to 4 MB) with a Cloudflare Workers AI vision model. Model output is parsed as JSON and checked for the expected keys; unparseable output is an error, not a guess. Requires the env.AI binding. Price: $0.004 in USDC per successful call, paid with x402 (Base …agent_intel_ip_fraud_reputation_score — IP type check: country, ISP and ASN, whether the address is a known Tor exit (Tor Project's public list), a proxy or VPN and a hosting/datacenter address (ip-api.com flags), and a LOW/MEDIUM/HIGH level from those flags. It is not a threat score: no abuse-report or spam history is included. ip-api's free tier is for non-commercial use only. Price: $0.001 in USDC per successful call, paid with x402 …agent_intel_known_scams_blacklist_db — Is this address or domain on the ScamSniffer community blacklist (public GitHub scam-database: wallet addresses, or phishing domains with their linked addresses)? Returns listed yes or no and the list size. A 'no' does not prove safety, and the list is not updated in real time. Price: $0.001 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.agent_intel_leverage_liquidation_levels — For one perpetual on Hyperliquid (public info API): mark price, open interest (in coins and USD), funding rate, and estimated liquidation prices for longs and shorts at 5x, 10x, 20x and 50x. The estimates are formula-based from the mark price and the asset's maximum leverage, not observed positions: the public API does not show which price each trader is liquidated at. Price: $0.003 in USDC per su …agent_intel_liquidity_lock_inspector — Share of a token's LP tokens that are burned (dead or zero address) or locked, from GoPlus lp_holders on Ethereum, BSC, Base, Arbitrum or Polygon. Lists the top 10 LP holders with GoPlus's lock flag and tag (a locker's name only when GoPlus gives it). Does not query Uncx, Team.Finance or Streamflow directly. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed ca …agent_intel_live_page_diff — Compares a public page now with its earliest Internet Archive (Wayback) snapshot on or after a date: changed yes/no, word similarity, added and removed text lines, and the price-like amounts ($, €, £) before and after. Only what the archive captured is compared; pages the archive never saved return 404. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls a …agent_intel_marine_weather_tide_forecast — Current wave height and period at a coordinate (Open-Meteo Marine), and, when a US NOAA tide station id is given, the next high and low tide predictions for the next 24 hours. Tide predictions exist only for NOAA stations; no wind or pressure forecast is included. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.agent_intel_mev_sandwich_risk_analyzer — Theoretical sandwich-attack profit for a swap of a given size in one DEX pool, at the pool's current reserves (DexScreener) and the swap's slippage tolerance: the largest front-run that still lets the victim's trade succeed, and the profit it would give. Constant-product pools only, no mempool view, no competing bots: a worst-case estimate, not a prediction. Suggests a slippage tolerance. Price: $ …agent_intel_multilingual_voice_tts — Turns text (up to 1000 characters) into speech with a Cloudflare Workers AI TTS model, in English, Spanish, French or Japanese. Returns base64 audio as the model gives it. German and Turkish are not offered: the model used here does not list them. Requires the env.AI binding. Price: $0.003 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.agent_intel_news_radar — Latest BBC News headlines from one section feed (world, business, technology, science_and_environment, health, politics) with summary, link and publication time, optionally filtered by a keyword. BBC only: no other publishers, no entity tags and no trust rating (no free source for those was found). Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are no …agent_intel_ofac_sanctions_preflight — Name screening against the US OFAC SDN list (with aliases, sanctions programs, type and addresses, via the US Consolidated Screening List API) and the UN Security Council consolidated list, returning matching entries. Optional fuzzy matching for the SDN part. It does NOT screen crypto addresses and does NOT check the EU list. A match is a lead for a human reviewer, not a legal decision. Price: $0. …agent_intel_onchain_mvrv_valuation — Daily MVRV ratio (market cap / realized cap) for BTC or ETH from CoinMetrics' free community data, with the latest value, the window mean and standard deviation, and its z-score. Labels are plain statistics (HIGH_Z, LOW_Z, MID), not buy or sell calls. Realized cap in USD is not in the free tier, so only the ratio is returned. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana …agent_intel_options_implied_volatility — Deribit option market summary for BTC, ETH or SOL: put/call open-interest and volume ratios, max-pain strike and ATM mark implied volatility for the nearest expiries. Computed from Deribit's public book summary. No 25-delta skew (needs per-option greeks, not fetched) and no order flow. Price: $0.003 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.agent_intel_perp_funding_rate_heatmap — Current perpetual-futures funding rate for one coin (USDT-margined) on Binance, OKX and Bybit, with each rate annualised (3 payments a day), mark price, and from Bybit: open interest value and the long/short account ratio. A table of exchanges, not a time-series heatmap; funding history is not included. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls a …agent_intel_phone_carrier_hlr_lookup — Parses an international phone number (E.164), checks it against Google's open libphonenumber metadata, and returns the country, line type (mobile, fixed line, fixed-or-mobile, VoIP, toll free, premium, pager and more), E.164/international/national formats and the carrier that the number range was originally allocated to. Not a live HLR query: ported numbers keep the original carrier and active/ina …agent_intel_pii_credentials_redaction — Masks likely secrets and personal data in agent logs or chat text: 0x private keys (64 hex), labelled base58 private keys, JWTs, AWS access key ids, common API token prefixes (sk-, ghp_, xoxb-), payment card numbers that pass the Luhn check, and email addresses. Returns the redacted text and counts. Pattern-based: it can miss unusual formats and does not detect seed phrases or names. Price: $0.002 …agent_intel_prompt_injection_firewall — Screens one text for prompt-injection patterns in English (instruction override, role or system-prompt extraction, jailbreak personas, hidden or encoded instructions) using a fixed rule list based on OWASP LLM01 categories. Returns HIGH/MEDIUM/LOW/NONE, each match, and the text with matches removed. A rule list misses rewording and other languages: treat NONE as no known pattern, not as safe. Pric …agent_intel_reader_markdown_extract — Reader view of one public https page: its <title> and the <main> or <article> content (else <body>) as Markdown, with links and images resolved. Removes scripts, styles, navigation, footers, forms and iframes. Cookie banners built as plain divs are NOT removed. Pages that block automated requests return a 503. Price: $0.001 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed …agent_intel_scam_phishing_message_filter — Screens one message (DM, email or chat text) for common crypto and phishing scam signals in English: urgency, fake support or giveaway, wallet-connect or seed-phrase requests, guaranteed returns, and suspicious links. Returns HIGH/MEDIUM/LOW/NONE with each matched phrase. A fixed rule list: it misses new wording and other languages, and it never sees the sender's account. Price: $0.002 in USDC per …agent_intel_sec_edgar_filings_search — Full-text search of US SEC EDGAR filings (SEC public index): matching filings with company name, CIK, form type (10-K, 10-Q, 8-K, 4 and others), filing date and a link to the filing index. Optional form type and date range; up to 10 results. Full-text only: no financial figures are extracted. Price: $0.003 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not char …agent_intel_smart_contract_linter_audit — Heuristic Solidity linter for a snippet or file (up to 60000 characters): unchecked low-level call/send/delegatecall, value-sending external calls before a storage write (possible reentrancy), arithmetic under pragma below 0.8.0 (overflow risk), and public or external state-changing functions without a visible owner or sender check, with line numbers. Not an audit; misses most real bugs. Price: $0 …agent_intel_smart_money_inflow_tracker — Finds the top-ROI accounts on Hyperliquid's public perp leaderboard (week, month or all-time window, with a minimum account size) and reads their live open positions from Hyperliquid's public info API, then sums net long/short USD exposure per coin. Shows where the best-performing Hyperliquid traders are positioned now. Hyperliquid perps only, not spot wallets on other chains; not investment advic …agent_intel_social_signal_aggregator — Keyword discussion velocity on Hacker News (Algolia HN Search, public): stories in the last 24 hours, stories in the last 7 days, velocity (24h count vs. 7-day daily average) and the top 24h stories with points and comments. Only Hacker News: Reddit and Bluesky blocked automated requests in testing, and no sentiment score is given. Price: $0.003 in USDC per successful call, paid with x402 (Base, S …agent_intel_solana_authority_audit — Solana SPL token mint audit from the public Solana RPC: is the mint authority revoked (no more minting), is the freeze authority revoked, supply and decimals. Metadata immutability is NOT checked (it needs a separate Metaplex lookup this tool does not do). Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.agent_intel_sopr_profit_taking_ratio — Bitcoin Spent Output Profit Ratio (SOPR) daily series for all holders, short-term holders (sth) or long-term holders (lth) from the free bitcoin-data.com (BGeometrics) API, with the latest value, 7/30-day averages and days spent in profit (>1) vs loss (<1). The free feed is delayed about 7 days. Statistics only, not a trading signal. Bitcoin only. Price: $0.002 in USDC per successful call, paid wi …agent_intel_speech_to_text_transcribe_turbo — Transcribes an audio file (base64, up to 6 MB; WAV, MP3, M4A or OGG as the model accepts them) to text with a Cloudflare Workers AI Whisper model, returning the text and any timestamped segments the model gives. Requires the env.AI binding. Price: $0.004 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.agent_intel_ssl_certificate_transparency — Recent TLS certificates logged for a domain (Certificate Transparency via Cert Spotter's public index): issuer, validity dates, names on the certificate, and any name outside the domain. Shows the 10 newest; does not check revocation or the live server's certificate chain. Price: $0.001 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.agent_intel_stablecoin_peg_integrity_radar — Current USD price and deviation from the $1 peg for USDT, USDC, DAI, FDUSD and PYUSD (CoinGecko public price data). Flags MICRO_DEPEG at 0.15% or more and DEPEG at 1% or more. A single snapshot of CoinGecko's aggregate price: no per-pool Curve imbalance and no redemption-liquidity data. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.agent_intel_subdomain_takeover_monitor — Subdomain takeover check: lists up to 10 subdomains seen in certificate transparency logs for a domain (Cert Spotter), fetches each over HTTPS, and flags pages that show a known 'unclaimed service' message (GitHub Pages, S3, Heroku, Fastly). Looks at the page text only, not DNS records, so it can miss dangling records that show no such message. Price: $0.002 in USDC per successful call, paid with …agent_intel_sybil_airdrop_farmer_check — Checks 2 to 10 Ethereum wallets for shared counterparties: addresses that several of them sent to or received from in their most recent 50 transactions (Blockscout). Reports the shared addresses and a POSSIBLE_CLUSTER signal. Recent-page only, no funding-source trace, so it finds some clusters and misses others. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); faile …agent_intel_token_composite_safety_score — Fixed-weight 0-100 safety score for an EVM token (Base, Ethereum, BSC, Arbitrum, Polygon): contract (40 pts: honeypot, taxes, verified source, proxy), liquidity (30 pts: deepest DEX pair) and holder spread (30 pts: top-10 holder share). Shows each part. It is a heuristic from two public sources, not a security audit. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); …agent_intel_token_liquidity_migration_watch — Snapshot of a token's DEX pool liquidity now (DexScreener, deepest pair and every pair's USD liquidity). Stateless: pass the liquidityUsd you saved last time as previousLiquidityUsd and it returns the % change and a DROP/DRAIN flag. It keeps no history itself and does not show lock expiry dates. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not c …agent_intel_token_verdict_engine — PASS / CAUTION / AVOID verdict for an EVM token (Base, Ethereum, BSC, Arbitrum, Polygon) from GoPlus token security (honeypot flag, buy/sell tax, open source, proxy, top holder share) and DexScreener (deepest pair liquidity, 24h volume). Rules are fixed and listed in the answer. Not financial advice; Solana is not covered. Price: $0.003 in USDC per successful call, paid with x402 (Base, Solana or …agent_intel_typosquat_phishing_domain_radar — For a brand domain (e.g. paypal.com), builds up to 15 look-alike variants (omitted, doubled and swapped letters, 0/1 homoglyphs, hyphen and login additions, other TLDs) and checks which are registered, using the public RDAP directory. Registered means taken, not malicious: each one needs a content check. Unicode homoglyphs (IDN) are not generated. Price: $0.002 in USDC per successful call, paid wi …agent_intel_viral_trending_radar — Today's trending Google searches for one country (public Google Trends RSS): rank, query, approximate search volume (e.g. '200+'), and the news items behind each trend. Country only: Google's feed has no industry categories, and it lists daily trends, not a breakout history. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.agent_intel_wallet_forensic_profiler — Ethereum wallet profile from Blockscout: ETH balance, contract or EOA, ENS name, Blockscout scam flag and reputation, public tags, and activity over its most recent 50 transactions. NOT included: OFAC sanctions screening (the SDN list is 78 MB, too large per request), mixer (Tornado Cash) checks, and full wallet age. Price: $0.003 in USDC per successful call, paid with x402 (Base, Solana or Arc); …agent_intel_wallet_pnl_performance_audit — Estimated current value of the token amounts a wallet received minus sent in its most recent 50 ERC-20 transfers (Blockscout), priced at current DefiLlama prices. It is NOT profit and loss: there is no cost basis, no historical prices, no realised gains, win rate or Sharpe ratio, and transfers older than the latest 50 are missing. Price: $0.003 in USDC per successful call, paid with x402 (Base, So …agent_intel_wash_trading_volume_filter — Volume plausibility check for an EVM token's DEX pairs (DexScreener): 24h volume against liquidity, average trade size from 24h trade counts, and buy/sell balance, for the 3 deepest pairs. A heuristic that flags suspicious volume (for example volume 20x liquidity); it cannot see wallets, so it does not prove wash trading. Price: $0.003 in USDC per successful call, paid with x402 (Base, Solana or A …agent_intel_web_search_turbo — Web search via DuckDuckGo's public HTML results page: ranked titles, direct result URLs and snippets, no ads. No relevance score (DuckDuckGo does not publish one). DuckDuckGo often answers with an empty page; the tool retries, and if it still gets none the list is empty and 'note' says so. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged …agent_intel_whale_transaction_monitor — Large transfers on Ethereum in the latest 1 to 10 blocks (default 5, about one minute of chain time): native ETH transfers valued at the current ETH price, and USDT and USDC token transfers, each at least a USD threshold (default $100,000), with asset, amount, USD value, hash, block, sender and recipient. Ethereum only; other tokens are not included; a snapshot, not a live stream. Price: $0.003 in …agent_intel_x402_endpoint_health_vetting — Checks an x402 (HTTP 402 payment) endpoint before you pay: one unpaid GET, then the HTTP status, whether a 402 challenge with an accepts list is present, the payment networks, asset, price and pay-to address format, CORS header and response time. Does not pay, does not verify the seller's identity or reputation, and gives one sample, not uptime. Price: $0.001 in USDC per successful call, paid with …dev_academy_sports_outdoors — Academy Sports + Outdoors products on one category page (for example fan-shop): product name, brand, price in USD, product link, image and manufacturer part number, read from the page's schema.org product list. First page of the category only. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.dev_action_network — US sports betting lines from Action Network's scoreboard: games for a league and date (NFL, NBA, MLB, NHL, college, WNBA, soccer) with teams, start time, status, broadcast, total bets tracked and full-game odds from each sportsbook feed (moneyline, spread with juice, total over/under, team totals), as published by Action Network. Books are identified by Action Network's book ID. Price: $0.002 in U …dev_apple_app_store_iphone — App Store iPhone app metadata from Apple's public iTunes Lookup API by App Store id: name, seller, version, price, average rating and rating count, genre and release info. iPhone and universal apps. Ratings are Apple's counts for the chosen country. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.dev_baseball_reference — MLB player season statistics, sorted leaderboard (default home runs): per player team, position, batting (G, AB, R, H, 2B, 3B, HR, RBI, BB, SO, SB, AVG, OBP, SLG, OPS, WAR), pitching (GS, W, L, SV, HLD, IP, ERA, WHIP, K/9, WAR) and fielding. Regular season or postseason, 2002 to now. ERA and WHIP sort lowest first. Data from ESPN's public stats API (Baseball-Reference blocks automated access). Pri …dev_blockchair_multichain_stats — Blockchair chain statistics for one blockchain (bitcoin, ethereum, litecoin, dogecoin, bitcoin-cash, dash, zcash, groestlcoin): block and transaction counts, mempool size and fees, 24-hour hashrate and volume, and the market price in USD as Blockchair reports it. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.dev_bloomberg_articles — Latest Bloomberg Markets headlines from Bloomberg's public RSS feed: title, short description, article link, author and publish time. Feed only (about 20 items); article bodies are not returned. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.dev_bundlephobia — npm package bundle size from Bundlephobia's public size API: minified and gzipped size in bytes, version, number of dependencies, repository and description. Give a package name, optionally with @version (e.g. react@18.3.1). Sizes are as Bundlephobia computes them. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.dev_codecov_stats — Codecov code coverage totals for a public GitHub repository: coverage percentage, lines hit and missed, files, branches and the branch Codecov tracks. Public repos only; per-file detail is not included. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.dev_covers — Sportsbook odds from Covers.com odds screens (NFL, NBA, MLB, NHL, college, WNBA): every listed game with Covers game ID, away/home team, kick-off text and, for each sportsbook shown (e.g. bet365, BetVictor, William Hill, Betway), the away and home price in American, decimal and fractional odds plus Covers' market tag. The books shown depend on the visitor's region. Price: $0.002 in USDC per succes …dev_dicks_sporting_goods — DICK'S Sporting Goods products in a category (e.g. mens-running-shoes, golf-drivers, kayaks): product name, brand, part number, price and list price range (USD), rating, review count, badge (new, sale...), number of SKUs (sizes/colors) and link; 48 per page (page 1 to 20), plus the total count. From dickssportinggoods.com's public category pages via a residential proxy. Price: $0.02 in USDC per su …dev_espn_college_football — ESPN college football scoreboard for one date: every game with home and away team, score, status (scheduled, live, final) and stadium, from ESPN's public site JSON. Times are UTC; days with no games return an empty list. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.dev_espn_f1_results — ESPN Formula 1 race list for one date with the finishing order of the first drivers (position, driver name, winner flag) and session state, from ESPN's public site JSON. Results only as ESPN lists them; a race with no published order returns the entries it has. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.dev_espn_golf — ESPN PGA Tour tournament leaderboard for one date: tournament name, state and the top players or teams with their total score to par and position order, from ESPN's public site JSON. Team events (pairs) are listed as teams. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.dev_espn_mlb_scoreboard — ESPN MLB scoreboard for one date: every game with away and home team, score, status (scheduled, live, final), and venue, from ESPN's public site JSON. Times are UTC. Scores match the MLB Stats API for final games. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.dev_espn_mma — ESPN UFC event card: the current or next UFC event with its fights in card order (fighter names, winner flag, record and fight status), from ESPN's public site JSON. Returns the card ESPN serves now; no date filter. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.dev_espn_nascar — ESPN NASCAR Cup Series race list for one date with the finishing order of the first drivers (position, driver name, winner flag), race name, venue and state, from ESPN's public site JSON. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.dev_espn_nba_scoreboard — ESPN NBA scoreboard for one date: every game with away and home team, score, status (scheduled, live, final), venue and current period, from ESPN's public site JSON. Times are UTC. Days without games return an empty list. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.dev_espn_nfl_scoreboard — ESPN NFL scoreboard for one date: every game with home and away team, score, status (scheduled, live, final) and stadium, from ESPN's public site JSON. Regular season and playoffs as ESPN lists them; times are UTC. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.dev_espn_nhl_scoreboard — ESPN NHL scoreboard for one date: every game with home and away team, score, status (scheduled, live, final) and stadium, from ESPN's public site JSON. Times are UTC; days with no games return an empty list. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.dev_espn_soccer_scoreboard — ESPN soccer scoreboard for one league and date: each match with home and away team, score, status (scheduled, live, full time) and stadium, from ESPN's public site JSON. Default league is the English Premier League (eng.1); times are UTC. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.dev_espn_sports — ESPN latest news headlines for one league (NFL, NBA, MLB, NHL, WNBA, college football, men's college basketball) from ESPN's public site JSON: headline, description, published time and ESPN link. Newest first; ESPN's own feed, no scores. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.dev_espn_standings — ESPN standings for NBA, NFL, MLB or NHL, by conference or division group as ESPN lists them: team, wins, losses, win percentage, games behind and streak, from ESPN's public standings JSON. Current season as ESPN serves it. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.dev_espn_wnba — ESPN WNBA scoreboard for one date: each game with home and away team, score, status (scheduled, live, final) and arena, from ESPN's public site JSON. Times are UTC; days with no games return an empty list. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.dev_fanduel — FanDuel Sportsbook (New Jersey) game lines for NFL, NBA, MLB, NHL, WNBA and college football/basketball: each listed game with FanDuel event ID, away/home team, start time and the moneyline, spread (puck line in NHL) and total, every price in American and decimal odds with the line. Read from the JSON FanDuel's own web app loads; only games FanDuel currently lists, no props or futures. Price: $0.0 …dev_fbref — Soccer competition stats for 16 leagues (Premier League, LaLiga, Bundesliga, Serie A, Ligue 1, Süper Lig, MLS, Champions League …): league table (rank, team, played, W/D/L, goals for/against, goal difference, points, qualification note; any season), or current-season top scorers / top assists with appearances, goals, assists and club. Data from ESPN's public soccer API (FBref blocks automated acce …dev_flashscore — Flashscore match list for one sport and day (7 days back to 7 ahead): every match with Flashscore ID, competition (country: league), start time, home/away team, current or final score and state (scheduled, live with period, finished, after extra time/penalties, postponed, cancelled). Football, tennis, basketball, hockey, American football, baseball, handball, volleyball. Read from the feed the Fla …dev_football_data_couk — European football match results with statistics and betting odds from Football-Data.co.uk (free CSV data): for a league and season — date, kick-off, teams, full-time and half-time score, result, referee, shots, shots on target, corners, fouls, cards, plus market average and Bet365 1X2 odds and average over/under 2.5 odds. 20 leagues (Premier League, La Liga, Bundesliga, Serie A, Ligue 1, Süper Lig …dev_fpl_premier_league — Fantasy Premier League player stats from the official FPL data feed: the top players by total points with team, position, goals, assists, form, price in £m and percentage of managers who selected them. Current season as FPL serves it. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.dev_gmx_arbitrum_stats — GMX total value locked on Arbitrum in USD from DefiLlama's public API: current value and daily history for the last 1 to 30 days. This is TVL as DefiLlama reports it, not GMX's own trading volume or fees. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.dev_google_play_store — Google Play app details from the public app page's JSON-LD: name, developer, category, content rating, average rating and number of ratings, description. Install counts and reviews are not on that block and are not returned. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.dev_hockey_reference — NHL season standings from Hockey-Reference: every team in East and West with division, games, wins, losses, overtime losses, points, goals for and against. Season given by the year it ends (2025 = 2024-25 season). Playoff teams are flagged. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.The signed observations, every earlier tool set and a diff of each change: this page with scripts on, or /api/v1/servers/9aa0577cfd9a08eb.
Read → digest → label → append → sign → compare
Six steps, every one of them checkable by someone who does not trust HISTOR. The only thing you have to take on faith is that the observation happened when the label says it did — and the log makes it impossible to change that story afterwards.
Remote endpoints in the official MCP registry: initialize, then tools/list, drained across every page; no tool is called, and private addresses are refused before the connection opens. npm and PyPI packages: installed and started in the sandbox described below, with no route out.
The tool set is reduced to name, description, input and output schema, sorted by UTF-16 code units and hashed over its RFC 8785 canonical form. Anyone holding the same tools gets the same digest — which is what makes a comparison possible.
Four MTL/1 methods, one signed AWR/2 document each: what was observed, what the WARDEN pattern set matched, whether the definitions changed since the last label, and whether the name is on a threat list. No score, ever.
Every label becomes a leaf of an RFC 9162 Merkle tree: leaf hash = SHA-256(0x00 ‖ JCS(label)). The label you download is the leaf input, so you can recompute its hash yourself.
After each crawl HISTOR signs a tree head: the size and the root. Keep yesterday's head; ask for a consistency proof to today's; if anything was removed or rewritten, the proof fails.
Each day a continuity label compares the new digest with the last one. Equal: "unchanged since". Different: a change, with the date and a per-tool diff. A client that checks what it received adds the view no crawler has.
Where an npm or PyPI package is run
A package observation is true for these conditions, and no others. Every package page names the exact image it ran in and any configuration it was given.
Linux x86_64, inside gVisor (runsc): the package talks to a kernel written for sandboxing, not to the host's. An unprivileged user, no capabilities, a read-only root.
npm packages in histor-node:22, PyPI packages in histor-python:3.12: the official node:22-bookworm-slim and python:3.12-slim images plus bash, git, Python 3 or Node 22 and a Java 21 runtime — never Docker — built when a sandbox host is installed. A package whose Requires-Python excludes 3.12 runs on histor-python:3.13 or 3.14; one that requires a newer Node runs again on histor-node:24. The exact image a package ran in is on its page.
npm with --ignore-scripts, then the install scripts in a traced stage of their own. PyPI: wheels only — a package that ships only source is reported, never built.
No route out. Every name the package looks up resolves to HISTOR's own traps, which record what was sent and forward nothing. A server that needs the internet to start shows that here.
None are real. Decoy credentials sit in HOME and a decoy .env in the working directory. A variable the package says it needs gets a placeholder; where the placeholder was sent is recorded.
512 MB of memory, one CPU, 64 MB of /tmp. 360 s to install, 150 s to start and answer; up to 15 tools called once each with canary arguments, 8 s per call.
Only names: required variables its registry entry declares or that it printed when it exited, and a start argument such as serve when its usage text offers one. Never a value from anyone else.
The profile HISTOR implements forbids the words safe, secure, audited, certified, approved and trusted. Here is why, in the terms of what the log can and cannot show.
A pattern match is a reason to read a definition, not a finding. Three of the four methods can never return fail. There is no score to rank by, because no score HISTOR could compute would mean what a reader takes it to mean.
Labels are about advertised text. A remote endpoint's source is never read and its tools are never invoked; a package runs only in the sandbox, against nothing real. A server can keep identical definitions and behave differently for real users; the log cannot see that, and says so inside every label.
A version bump changes definitions too. A change is shown as a date and a diff, in amber, never red. What you do with it is yours: re-read, re-approve, or pin the old digest.
An npm or PyPI server is observed under the test conditions above: Linux, no internet, placeholder keys. One that needs Windows, a real account or the network may show fewer tools or none; its page says why it exited.
Today one party runs the log. A second observer on another network is the next step, and any AIMarket hub can run one. Until then, what the key proves is who said it — not that it is true.
Endpoints that require authentication answer 401 to everyone without a key, including HISTOR. They are counted and listed as not observed, never dropped from the numbers.
For clients, registries and server authors
Before your agent trusts a server, send the tools it received. The answer is signed by the log's did:key and names the tree head it was given under.
curl -sS https://histor.modelmarket.dev/api/v1/check \
-H 'Content-Type: application/json' \
-d '{"endpoint":"https://example.com/mcp","tools":[ …tools/list result… ],"contribute":true}'
# -> {"type":"histor.check/v1","match":"same"|"different"|"previously-observed"|…,
# "observed":{"unchangedSince":"…","changes":0}, "patternScan":{…}, "signature":{…}}
# README badge for your server
[](https://histor.modelmarket.dev/s/<id>)
# Atom feed of every observed change
https://histor.modelmarket.dev/feed.xml
No. The server list is the log's index: every remote endpoint in the official MCP registry, with what HISTOR could observe about it. Nothing here is for sale and nothing is ranked by quality.
No, and it never will. It tells you what a server advertised, whether that changed, and which published patterns matched the text. Whether to trust the server is your decision — HISTOR makes sure you decide on the same facts as everyone else.
Most remote MCP endpoints require a login (they answer 401 to anyone without a key), some use the legacy SSE transport or need per-user values in the URL, and some are simply down. They stay on the list with the reason, so the numbers never hide them.
Open the Check tab, paste the server's endpoint and the tools/list result your client received, and press Check. You get back, signed, whether HISTOR observed the same definitions — or different ones, or an older set.
Find your endpoint on the Servers tab, open it, and copy the Markdown snippet under the facts. The badge shows the date your definitions were pinned or last changed, and links to the full history.
You do not have to. Every label and every tree head is signed with one published key; the Log tab proves in your browser that the log only grew; and the command-line auditor does the same from any machine. What remains is that one operator runs it today — a second, independent observer is the next step.
Looking things up, the badges, the feed and /check are free. HISTOR also offers histor.check@v1 to the AIMarket Hub, so agents can reach it through the market.
Once a day: initialize, notifications/initialized and tools/list — never a tool call, never a redirect followed, at most two connections per host, from a User-Agent that starts with histor/. To be left out, open an issue on the histor repository with your endpoint or host; it is then listed as not observed (operator-opt-out), with the reason, rather than silently dropped. Labels already in the log stay: the log only grows.