Alpaca Trading API integration for Model Context Protocol (MCP)
Nothing to run from here
MoneyTools Tools is installed from its publisher's own source and answers where it runs, so this marketplace is not in the path of a single call. There is no address here to send one to, and a panel that pretended otherwise would be showing you an answer we made up. Install it and call it from your own client — the Installation tab has the entry for each one.
93/100
tool-list score
90
tools declared
remote
at its publisher
—
calls last 7d
What it does
25 read-only agent utilities: token safety, approvals, tx decode, EIP-712 risk, DNS, time; free tier
Quickstart
# 1 — add it to Claude Code
claude mcp add --scope user --transport http moneytools-tools-mcp https://tools.moneytools.dev/mcp
# 2 — ask your agent for something these tools do
# token_safety_check, address_profile, ens_resolve and 87 more
MoneyTools Tools costs nothing on mcprush: there is no plan to choose here, no cap to set and nothing mcprush can bill you for.
Publishernot claimed
MOAll 5 servers
moneytools5 servers
4 categories
Collected from a public index. Nobody has claimed this account, so nothing here was written by its author — claim it if it is yours.
Installation
Where are you running it?
Every route below installs the same thing and ends at the same approval screen. Nothing here runs on your machine and nothing runs on ours: this server answers at its publisher’s own address, and what you install is the connection straight to it.
Claude Codedeclared by this listing
This is a public server: it answers at its publisher’s own address and this marketplace is not in the path. Claude Code registers it in one command; --scope user makes it available in every project. The transport below is http, as the publisher's own manifest declares it.
claude mcp add --scope user --transport http moneytools-tools-mcp https://tools.moneytools.dev/mcpReconnect, or start a new session, and the tools appear in the model’s tool list.
Free on mcprush, and it answers at its publisher’s own address: this marketplace is not in the path, so there is no key of ours to hold and no card to add.
What it writes
One config entry pointing straight at the publisher’s own address — this marketplace is not in the path, and nothing from this listing executes on your machine.
What you approve
90 tools, with what each one reads, writes and reaches shown before you agree — the same list on every route above. Read the tool surface.
Tool surface
What the model actually sees. Descriptions are diffed on every release — see version history.
Before buying an ERC-20: simulates USDC→token→USDC with aggregator quotes and reads the contract (owner, proxy, paused, supply). Flags no-sell-route (honeypot pattern), high round-trip loss (tax / thin liquidity). Free: 10 calls/day; then $0.003 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| chain | string | yes | chain: base, ethereum, arbitrum, optimism, polygon, bsc, avalanche |
| token | string | yes | ERC-20 contract address |
| usd | number | no | test size in USD, 1-5000 (default 10) |
Profile an EVM address or ENS name across Ethereum, Base, Arbitrum, Optimism, Polygon, BSC, Avalanche: EOA vs contract vs EIP-7702 delegated, nonce, native balances in USD, primary ENS name, known-contract label. Free: 10 calls/day; then $0.002 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| address | string | yes | 0x address or ENS name |
| chains | string | no | comma list to limit chains (default all 7) |
Resolve an ENS name to an address (+ url/avatar/twitter/github records, optional L2 addresses), or an address to its primary ENS name with forward verification. Free: 10 calls/day; then $0.001 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| name | string | no | ENS name (or pass address) |
| address | string | no | 0x address for reverse lookup |
| chains | string | no | also resolve ENSIP-11 addresses on these chains |
Current gas on 7 EVM chains: base fee, priority fee, suggested maxFee, and the USD cost of a transfer, ERC-20 transfer, approve and DEX swap. Tells you the cheapest chain right now. Free: 10 calls/day; then $0.001 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| chains | string | no | comma list (default all 7) |
Name, symbol, decimals, total supply, owner, paused, upgradeable-proxy detection and (optional) a holder's balance for any ERC-20. Free: 10 calls/day; then $0.001 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| chain | string | yes | chain name |
| token | string | yes | ERC-20 contract address |
| holder | string | no | address to read the balance of |
Find risky ERC-20 approvals for a wallet (default: common tokens × 20 well-known routers/spenders, or your own lists) and get UNSIGNED approve(spender,0) revoke transactions. Read-only. Free: 10 calls/day; then $0.003 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| chain | string | yes | chain name |
| owner | string | yes | wallet address |
| tokens | string | no | comma list of token addresses or symbols (USDC,USDT,...) |
| spenders | string | no | comma list of spender addresses |
Explain a transaction in plain words: status, fee in USD, decoded method and arguments, token/NFT transfers, approvals (incl. unlimited / setApprovalForAll), other events. Free: 10 calls/day; then $0.003 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| chain | string | yes | chain name |
| hash | string | yes | 0x transaction hash |
Decode raw EVM calldata before signing: function name and typed arguments via the open Sourcify signature DB (or your ABI / signature), plus a plain-language meaning for risky selectors (approve, setApprovalForAll, permit...). Free: 10 calls/day; then $0.001 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| data | string | yes | 0x calldata |
| signature | string | no | e.g. transfer(address,uint256) |
| abi | array | no | JSON ABI array |
Fetch a verified contract's ABI from Sourcify (open data) with proxy resolution: implementation ABI merged, function and event signature lists. Free: 10 calls/day; then $0.002 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| chain | string | yes | chain name |
| address | string | yes | contract address |
| full | boolean | no | true = include the full ABI JSON |
Verify a personal_sign message or EIP-712 typed-data signature against an address, including smart-contract wallets (ERC-1271 / ERC-6492). Free: 10 calls/day; then $0.001 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| address | string | yes | expected signer (0x address) |
| signature | string | yes | 0x signature (65+ bytes hex) |
| message | string | no | signed text (personal_sign) |
| typedData | object | no | EIP-712 JSON instead of message |
| chain | string | no | chain for smart-wallet checks (default base) |
Before an agent signs EIP-712 data: identifies Permit / Permit2 / EIP-3009 (x402) / Seaport / CoW / delegation messages, explains them in one sentence and flags unlimited amounts, far deadlines, unknown spenders and NFT-drain listings. Free: 10 calls/day; then $0.003 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| typedData | object | yes | EIP-712 JSON {domain, types, primaryType, message} (object in a POST body, or a JSON string in the query) |
| expectedChainId | string | no | flag if the domain chainId differs |
Lint any x402 paid endpoint like a client would: 402 status, PAYMENT-REQUIRED header decode, CAIP-2 network, integer amount, payTo/asset, EIP-712 domain extra, CORS expose headers, bazaar discovery, /.well-known/x402. Score + fixes. Unpaid request only. Free: 10 calls/day; then $0.003 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| url | string | yes | https URL of the paid endpoint |
| method | string | no | GET (default) or POST |
Fetch a URL and report status, redirect chain, latency, size, cache headers, CORS, parsed rate-limit headers (RateLimit-*, X-RateLimit-*, Retry-After) and a security-headers grade. Free: 10 calls/day; then $0.002 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| url | string | yes | http(s) URL |
| method | string | no | GET (default) or HEAD |
Title, description, canonical, language, favicon, Open Graph + Twitter card, JSON-LD types, feeds, word count and what's missing for link previews. Metadata only, not page content. Free: 10 calls/day; then $0.002 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| url | string | yes | page URL |
A/AAAA/CNAME/MX/TXT/NS/CAA (or chosen types) via DNS-over-HTTPS, DNSSEC flag, SPF/DMARC/DKIM detection and common misconfigurations. Free: 10 calls/day; then $0.001 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| domain | string | yes | hostname |
| types | string | no | comma list, e.g. A,MX,TXT |
Registrar, creation/expiry dates, age in days, status codes, nameservers and DNSSEC from RDAP; flags very new domains (phishing signal) and near expiry. Free: 10 calls/day; then $0.002 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| domain | string | yes | domain name |
May this user agent fetch this URL? RFC 9309 evaluation of robots.txt with the matching rule, crawl-delay, sitemaps, llms.txt presence and an allow/deny table for 12 AI crawlers. Free: 10 calls/day; then $0.001 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| url | string | yes | page URL |
| userAgent | string | no | user agent token (default *) |
Validate JSON data against a JSON Schema (draft 4, 7, 2019-09, 2020-12) and get precise error paths. Use it to check tool outputs or API payloads. Free: 10 calls/day; then $0.001 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| schema | object | yes | JSON Schema |
| data | object | yes | JSON value to validate |
| draft | string | no | 4 | 7 | 2019-09 | 2020-12 (default) |
op=now|convert|diff|add: current time in many zones, convert a local time between IANA zones (DST-aware), difference incl. business days, add ISO-8601 durations. Free: 10 calls/day; then $0.001 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| op | string | no | now | convert | diff | add |
| datetime | string | no | ISO 8601 or unix |
| tz | string | no | source IANA zone (default UTC) |
| to | string | no | target zones, comma list |
| end | string | no | end datetime for diff |
| add | string | no | ISO duration for add, e.g. P1DT2H |
Next N run times of a 5-field cron expression (or @daily etc.) in any IANA time zone, with a plain-language description. Free: 10 calls/day; then $0.001 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| expression | string | yes | cron expression |
| tz | string | no | IANA zone (default UTC) |
| count | number | no | 1-50 (default 5) |
Convert fiat amounts with daily reference rates (ECB via Frankfurter; other currencies e.g. TWD from ExchangeRate-API open access, attributed). Not tradable quotes. Free: 10 calls/day; then $0.001 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| from | string | yes | ISO 4217 code |
| to | string | yes | one or more codes, comma list |
| amount | number | no | default 1 |
Length, mass, volume, area (incl. 坪/ping), speed, time, data (KB vs KiB), energy, pressure, temperature and exact wei/gwei/ETH conversion. Free: 10 calls/day; then $0.001 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| value | string | yes | number |
| from | string | yes | unit |
| to | string | yes | unit |
sha256/sha1/sha512/md5/keccak256, function selector, HMAC-SHA256, base64(url), hex, URL encoding, UUIDs, JWT decode (unverified), EVM checksum address. Free: 10 calls/day; then $0.001 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| op | string | yes | operation, e.g. sha256, keccak256, selector, base64-decode, jwt-decode |
| input | string | no | input text |
| inputEncoding | string | no | utf8 (default) | hex | base64 |
| key | string | no | HMAC key |
SVG QR code for any text/URL, or build an EIP-681 payment link + QR for a token amount to an address (for an agent asking a human to pay). We never receive the funds. Free: 10 calls/day; then $0.001 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| text | string | no | text or URL to encode |
| to | string | no | recipient 0x address (payment-link mode) |
| chain | string | no | chain (default base) |
| token | string | no | USDC (default), native symbol, USDT... |
| amount | string | no | human amount |
ERC-721/1155 token: standard, collection name, owner, tokenURI resolved (IPFS/Arweave/data URI) and the metadata JSON with image URL; says whether metadata is on-chain, IPFS or a mutable server. Free: 10 calls/day; then $0.002 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| chain | string | yes | chain: base, ethereum, arbitrum, optimism, polygon, bsc, avalanche |
| contract | string | yes | NFT contract |
| tokenId | string | yes | token id |
Is my transaction pending, confirmed, reverted or not found? Confirmations and a per-chain finality hint. Cheap polling for agents waiting on a tx. Free: 10 calls/day; then $0.001 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| chain | string | yes | chain: base, ethereum, arbitrum, optimism, polygon, bsc, avalanche |
| hash | string | yes | 0x tx hash |
Find the last block at or before a date/time on any of 7 EVM chains (interpolation search). For historical balance queries, snapshots and log ranges. Free: 10 calls/day; then $0.001 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| chain | string | yes | chain: base, ethereum, arbitrum, optimism, polygon, bsc, avalanche |
| timestamp | string | yes | unix seconds or ISO 8601 |
Probe the keyless public RPC endpoints of 7 EVM chains right now: up/down, latency, head block, lag. Returns the recommended RPC per chain. Free: 10 calls/day; then $0.002 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| chains | string | no | comma list (default all 7) |
Chain id → name, native currency, public RPCs, explorers, CAIP-2 id and a ready wallet_addEthereumChain object (ethereum-lists/chains, CC0). Free: 10 calls/day; then $0.001 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| chainId | string | yes | numeric chain id or common name |
Current price and deviation in bps for 15 major stablecoins (USDT, USDC, DAI, USDS, USDe, PYUSD, FDUSD, EURC...) with on_peg / watch / depeg status. Free: 10 calls/day; then $0.001 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| symbols | string | no | comma list (default all) |
Track a bridge transfer by its source tx hash: pending / done / failed, bridge used, sending and receiving tx with amounts (LI.FI public status API). Free: 10 calls/day; then $0.002 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| hash | string | yes | source-chain tx hash |
| fromChain | string | no | source chain (speeds up lookup) |
Executable-style price of any ERC-20 in USDC from DEX aggregator quotes (KyberSwap, quote only), price impact at a chosen size, route DEXes and deviation vs DefiLlama reference. Free: 10 calls/day; then $0.002 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| chain | string | yes | chain: base, ethereum, arbitrum, optimism, polygon, bsc, avalanche |
| token | string | yes | ERC-20 address |
| sizeUsd | number | no | size for impact check (default 1000) |
Is this address a Safe multisig? Owners, threshold (m-of-n), nonce, version, enabled modules, guard, fallback handler, plus risk warnings (1-of-n, modules). Free: 10 calls/day; then $0.002 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| chain | string | yes | chain: base, ethereum, arbitrum, optimism, polygon, bsc, avalanche |
| address | string | yes | Safe address |
Call any view function with a human signature and args, e.g. balanceOf(address) returns (uint256); decoded result. Optional historical block. Free: 10 calls/day; then $0.001 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| chain | string | yes | chain: base, ethereum, arbitrum, optimism, polygon, bsc, avalanche |
| address | string | yes | contract |
| signature | string | yes | function signature with returns |
| args | string | no | comma list or JSON array |
| block | string | no | block number (default latest) |
Build calldata from a function signature and arguments (selector + encoded args). Unsigned bytes only, for agents preparing a tx for a human or wallet to review. Free: 10 calls/day; then $0.001 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| signature | string | yes | function signature |
| args | string | yes | comma list or JSON array |
Is this contract upgradeable? Detects EIP-1967 (impl/admin/beacon), EIP-1167 clones, legacy OZ and Safe-style proxies and EIP-7702 delegated EOAs; returns implementation and admin. Free: 10 calls/day; then $0.001 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| chain | string | yes | chain: base, ethereum, arbitrum, optimism, polygon, bsc, avalanche |
| address | string | yes | contract address |
Recent events of a contract (≤5000 blocks), decoded with your event signature or automatically via the open Sourcify signature DB. Free: 10 calls/day; then $0.002 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| chain | string | yes | chain: base, ethereum, arbitrum, optimism, polygon, bsc, avalanche |
| address | string | yes | contract |
| event | string | no | event signature |
| blocks | number | no | look-back blocks (default 1000, max 5000) |
| fromBlock | string | no | start block |
| toBlock | string | no | end block |
| limit | number | no | max logs 1-100 |
Native + ERC-20 balances for a wallet in one multicall: major tokens on the chain by default or your own list of token addresses/symbols. Free: 10 calls/day; then $0.002 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| chain | string | yes | chain: base, ethereum, arbitrum, optimism, polygon, bsc, avalanche |
| owner | string | yes | wallet address |
| tokens | string | no | comma list of addresses or symbols |
Is name.eth available? Registered / grace period / available, expiry date, yearly base price and registration link. Free: 10 calls/day; then $0.001 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| name | string | yes | label or label.eth |
Yield vault facts: underlying asset, total assets, share price (assets per share), deposits open, and a holder's position. Free: 10 calls/day; then $0.002 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| chain | string | yes | chain: base, ethereum, arbitrum, optimism, polygon, bsc, avalanche |
| vault | string | yes | ERC-4626 vault address |
| holder | string | no | holder address |
Which network is this address for, and is it well-formed? EVM checksum, Bitcoin (legacy/P2SH/SegWit/Taproot), Litecoin, Dogecoin, Tron, Solana, Cosmos bech32, TON. Catches typos before sending. Free: 10 calls/day; then $0.001 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| address | string | yes | any crypto address |
SOL balance (USD), account type (wallet/program), and SPL + Token-2022 balances for any Solana address via public RPC. Free: 10 calls/day; then $0.002 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| address | string | yes | Solana address |
Confirmed and pending BTC balance (USD), tx count, address type and reuse for any Bitcoin address (mempool.space public API). Free: 10 calls/day; then $0.001 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| address | string | yes | BTC address |
Recommended sat/vB for next block, 30 min, 1 hour and economy, and what your transaction will cost in sats and USD. Free: 10 calls/day; then $0.001 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| vbytes | number | no | tx size in vB (default 141) |
Cliff + linear vesting with optional TGE unlock: vested/unvested on any date and the monthly unlock schedule. Free: 10 calls/day; then $0.001 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| total | number | yes | total tokens |
| start | string | yes | vesting start date |
| durationMonths | number | yes | total months |
| cliffMonths | number | no | cliff months |
| tgePercent | number | no | % unlocked at start |
| at | string | no | date to evaluate (default today) |
Convert APR to APY (or back) for any compounding frequency, project earnings over N days with optional performance fee, doubling time. Free: 10 calls/day; then $0.001 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| apr | number | no | APR % |
| apy | string | no | APY % (instead of apr) |
| compounding | string | no | daily|weekly|monthly|hourly|block or times/year |
| principal | number | no | amount |
| days | number | no | days |
| feePercent | number | no | performance fee % |
Perp (isolated margin: side, entry, leverage, maintenance margin) or lending (collateral, debt, liquidation threshold → health factor) liquidation price and distance. Risk math, not advice. Free: 10 calls/day; then $0.001 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| mode | string | no | perp | lending |
| side | string | no | long | short |
| entry | number | no | entry price |
| leverage | number | no | x |
| maintenanceMargin | number | no | % |
| collateral | string | no | lending: collateral amount |
| debt | string | no | lending: debt value |
| price | string | no | lending: collateral price |
| liquidationThreshold | string | no | lending: LT % |
LP value vs holding after a price move: full-range (Uniswap v2) and concentrated range (v3, lower/upper) impermanent loss. Free: 10 calls/day; then $0.001 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| entryPrice | number | no | price at deposit |
| newPrice | number | no | current price |
| priceRatio | string | no | or new/entry ratio |
| lower | string | no | v3 range lower |
| upper | string | no | v3 range upper |
Monthly payment, total interest and schedule for annuity (本息平均攤還) or equal-principal (本金平均攤還) loans. Free: 10 calls/day; then $0.001 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| principal | number | yes | loan amount |
| annualRate | number | yes | annual rate % |
| months | number | yes | term in months |
| method | string | no | annuity | equal-principal |
Graded audit of HSTS, CSP (unsafe-inline/eval, wildcards), clickjacking, nosniff, Referrer/Permissions-Policy, cookie flags, version leaks and CORS misconfig, with fixes. Free: 10 calls/day; then $0.002 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| url | string | yes | page URL |
Latest unexpired certificates for a domain from Certificate Transparency logs: issuer, names, expiry date, days left, expiring-soon warning. Free: 10 calls/day; then $0.002 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| domain | string | yes | hostname |
Does the page's og:image work in link previews? Fetches it and checks status, type, file size, pixel dimensions and aspect ratio (1200×630). Free: 10 calls/day; then $0.002 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| url | string | no | page URL |
| image | string | no | or an image URL directly |
Find (via robots.txt) and parse a sitemap or sitemap index: URL count, lastmod range, sample URLs and protocol issues. Free: 10 calls/day; then $0.002 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| url | string | yes | site or sitemap URL |
| limit | number | no | sample size |
Parse a feed (or autodiscover it from a web page) into clean JSON: title, latest items with link, date and summary. Free: 10 calls/day; then $0.002 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| url | string | yes | feed or page URL |
| limit | number | no | items 1-50 |
Extract links from a page and check up to 12 of them (HEAD, GET fallback): status, redirects, latency, broken list. Free: 10 calls/day; then $0.003 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| url | string | yes | page URL |
| scope | string | no | all | internal | external |
| limit | number | no | 1-12 |
Query 6 public resolvers (Cloudflare, Google, AdGuard, NextDNS, AliDNS, DNSPod) and compare answers: has my DNS change propagated? Free: 10 calls/day; then $0.002 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| domain | string | yes | hostname |
| type | string | no | A|AAAA|CNAME|MX|TXT|NS|CAA |
Recursively expand SPF includes, count DNS lookups against the RFC limit of 10, flag +all/?all, duplicate records and weak DMARC policy. Free: 10 calls/day; then $0.002 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| domain | string | yes | domain |
Who owns this IP? Network name, CIDR, country, organization and abuse contact from the regional internet registries (RDAP). Free: 10 calls/day; then $0.001 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| ip | string | yes | IPv4/IPv6 |
Split a URL into parts and query params, strip tracking params (utm_*, fbclid, gclid...) and flag phishing tricks (user@host, raw IP, shorteners, punycode). Free: 10 calls/day; then $0.001 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| url | string | yes | URL |
Decode punycode, detect mixed scripts and look-alike characters (Cyrillic а vs Latin a) and one-letter typos of major brands/wallets. Anti-phishing for agents. Free: 10 calls/day; then $0.001 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| domain | string | yes | domain or URL |
Connect to an MCP server (streamable HTTP) or take a tools/list array and lint every tool: names, descriptions, JSON Schema, required params, annotations; score + fixes. Free: 10 calls/day; then $0.003 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| url | string | no | MCP endpoint |
| tools | array | no | or the tools/list JSON |
Lint an OpenAPI/Swagger JSON or YAML: operationIds, descriptions, responses, undeclared path params, missing security schemes, servers, x402 payment info. Free: 10 calls/day; then $0.003 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| url | string | no | spec URL |
| spec | object | no | or the spec (JSON object or YAML string) |
Check a site's /llms.txt against the llmstxt.org format: H1, summary, sections, link entries with notes; optional link check. Free: 10 calls/day; then $0.002 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| url | string | no | site or llms.txt URL |
| text | string | no | or the file content |
| checkLinks | boolean | no | true to check up to 8 links |
Fetch /.well-known/agent-card.json (or legacy agent.json) and validate required A2A fields, skills, transport and security declarations. Free: 10 calls/day; then $0.002 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| url | string | no | agent base URL or card URL |
| card | object | no | or the card JSON |
Run a JavaScript regex on text: all matches with index and capture groups, optional replace, and a ReDoS warning for nested quantifiers. Free: 10 calls/day; then $0.001 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| pattern | string | yes | regex source |
| text | string | yes | input text |
| flags | string | no | flags |
| replace | string | no | replacement string |
Line, word or character diff between two texts with a unified patch, added/removed counts and similarity. Free: 10 calls/day; then $0.001 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| a | string | yes | old text |
| b | string | yes | new text |
| mode | string | no | lines | words | chars |
Generate UUID v4/v7, ULID or nanoid (up to 100), or decode a UUID/ULID to its version and embedded timestamp. Free: 10 calls/day; then $0.001 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| type | string | no | uuid4 | uuid7 | ulid | nanoid |
| count | number | no | 1-100 |
| decode | string | no | a UUID or ULID to decode |
Decode a JWT, explain its claims (expired? lifetime?) and verify RS/PS/ES/EdDSA signatures against a public JWKS URL or the issuer's OIDC discovery. No secrets needed or stored. Free: 10 calls/day; then $0.002 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| token | string | yes | JWT |
| jwksUrl | string | no | JWKS URL |
| discover | boolean | no | true = use iss OIDC discovery |
Convert big integers between bases 2-36 (hex/bin/oct/dec, 0x/0b/0o prefixes) with two's complement for 8-256 bits. Free: 10 calls/day; then $0.001 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| value | string | yes | number |
| from | string | no | base 2-36 (auto from prefix) |
| to | string | no | extra target base |
| bits | number | no | two's complement width |
Render GitHub-flavored Markdown to HTML with raw HTML escaped and script URLs removed; also returns the heading outline. Free: 10 calls/day; then $0.001 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| markdown | string | yes | Markdown text |
CSV to JSON (auto delimiter, headers, typed values, error rows) or JSON array to CSV. Free: 10 calls/day; then $0.001 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| input | string | yes | CSV text or JSON array |
| direction | string | no | csv-to-json | json-to-csv (auto) |
| delimiter | string | no | delimiter (auto) |
YAML (multi-document, with line-numbered errors) to JSON, or JSON to YAML. Free: 10 calls/day; then $0.001 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| input | string | yes | YAML or JSON text |
| direction | string | no | yaml-to-json | json-to-yaml (auto) |
Validate JSON (error line + context), pretty-print/minify/sort keys, measure depth and size, and pick a value by path like a.b[0].c. Free: 10 calls/day; then $0.001 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| json | string | yes | JSON text |
| op | string | no | pretty | minify |
| sortKeys | boolean | no | true/false |
| path | string | no | e.g. a.c[1] |
Parse and compare semantic versions, check a version against a range (^1.2, ~2.0, >=1 <2), max satisfying version and sort a list. Free: 10 calls/day; then $0.001 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| version | string | no | version |
| range | string | no | range |
| compare | string | no | other version |
| versions | string | no | comma list |
Characters, words (CJK-aware), sentences, paragraphs, reading time, LLM token estimate and top words. Free: 10 calls/day; then $0.001 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| text | string | yes | text |
Detect the language of a text (82 languages, ISO 639-3 + BCP 47), including Traditional vs Simplified Chinese. Free: 10 calls/day; then $0.001 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| text | string | yes | text (20+ chars best) |
URL slug (accents removed; CJK kept or ASCII-only) and a filesystem-safe filename from any title. Free: 10 calls/day; then $0.001 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| text | string | yes | title |
| ascii | boolean | no | true = ASCII only |
| maxLength | number | no | max length |
IPv4/IPv6 subnet math: network, range, size, netmask/wildcard, private/reserved type, contains-check and subnet split. Free: 10 calls/day; then $0.001 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| cidr | string | yes | CIDR or IP |
| contains | string | no | IP to test |
| split | number | no | new prefix length |
Browser, engine, OS, device type, and whether it is a known crawler or AI agent (GPTBot, ClaudeBot, PerplexityBot, scripts...). Free: 10 calls/day; then $0.001 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| ua | string | yes | User-Agent string |
Convert hex/rgb/hsl/CSS names to hex, RGB, HSL, CMYK; luminance, best text color and WCAG AA/AAA contrast against another color. Free: 10 calls/day; then $0.001 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| color | string | yes | color |
| against | string | no | second color |
Entropy, common-password and pattern checks (sequences, years, Word123!), crack-time estimates and feedback. Never stored or logged. Free: 10 calls/day; then $0.001 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| password | string | yes | password to rate (use a similar pattern, not your real one) |
Validate and format phone numbers for 240+ regions (libphonenumber): E.164, international/national format, type (mobile/fixed), country. Free: 10 calls/day; then $0.001 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| number | string | yes | phone number |
| country | string | no | default region ISO code |
Check an IBAN's country length and mod-97 check digits, return BBAN and print format. Not stored. Free: 10 calls/day; then $0.001 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| iban | string | yes | IBAN |
Luhn checksum, brand (Visa, Mastercard, Amex, JCB, UnionPay...) and length check; returns only a masked number. Never stored. Free: 10 calls/day; then $0.001 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| number | string | yes | card number (test numbers recommended) |
Checksum and format for 國民身分證, 居留證 (old and 2021 new format) and 統一編號 (company tax ID, new ÷5 rule). Not stored. Free: 10 calls/day; then $0.001 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| id | string | yes | ID or 8-digit 統編 |
Official Taiwan government office calendar (holidays, 補假, make-up workdays) or US federal holidays with observed dates, plus the next holiday. Free: 10 calls/day; then $0.001 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| country | string | no | TW | US |
| year | number | no | year |
Count business days between dates or add N business days, using the official Taiwan calendar, US federal holidays or plain weekdays. Free: 10 calls/day; then $0.001 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| start | string | yes | YYYY-MM-DD |
| end | string | no | YYYY-MM-DD to count to |
| add | string | no | or add N business days |
| country | string | no | TW | US | none |
Gregorian ↔ Chinese lunar date (incl. leap months) with 干支 year and zodiac; e.g. find the solar date of 中秋 (8/15). Free: 10 calls/day; then $0.001 via the HTTP endpoint or X-API-Key credits.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| date | string | no | YYYY-MM-DD (default today, Taipei) |
| lunarYear | string | no | for lunar→solar |
| lunarMonth | string | no | 1-12 |
| lunarDay | string | no | 1-30 |
| leap | boolean | no | leap month |
Create a temporary URL that records any HTTP request sent to it (method, path, query, headers, body ≤16 KB, up to 100 requests, kept 24 h); read them back with the secret token. For testing webhooks and callbacks. Free: 3/day.
No parameter schema on file.
Read requests captured by a webhook_inbox_create inbox (free).
| Parameter | Type | Required | Notes |
|---|---|---|---|
| id | string | yes | inbox id from webhook_inbox_create |
| token | string | yes | secret read token from webhook_inbox_create |
Free
$0 forever
- Every tool — any call limit is its publisher’s, not ours
- No card, and mcprush charges nothing for it
- Runs at its publisher’s own address — this marketplace is not in the path
- Nothing to cap, because mcprush bills nothing
What counts against your monthly calls
| Tool | Unit | Calls used | Out of the allowance |
|---|
Nothing here is billable: mcprush charges nothing to install MoneyTools Tools or to call it, at any volume.
Call allowance · this installenforced at the gateway
Monthly allowance, in calls
—
—
Alert at 80% · then the tool returns a normal MCP error
Used this month: —
ATool-list grade · score 93 / 100
Release 1.0.0 · scanned 4 Nov 2026
Graded from the tools this server lists, not from its source code.
Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.
Threat score100
Client score93
Findings0 threat · 15 capability
Capabilitymoderate
Coveragemanifest
Verificationnot in this report
Surface digest0c801d2f2807fbd1ceceeec23befdf0ae03e4cf4ae93728a8f2fb6120c621f1d
Score vectorthreat 100 → client 93
| Term | Level | What it prices | Points |
|---|---|---|---|
| capability-exposure | moderate | capability blast radius (moderate) — client exposure if the model is manipulated | −3 |
| coverage-honesty | manifest | inspection depth (manifest) — how much of the target the scan could see | −4 |
score = clamp(round(threatScore − E_cap − E_ver − E_cov), 0, 100). No model, no opinion, no network call at scoring time: the same methodology version against the same bytes always produces this number, and every line above is a field of the report rather than a summary of it.
What the scan could actually read
A grade is only as meaningful as its coverage, so the scanner publishes its own depth before it publishes its result.
The scan read each tool’s name, description, input schema and annotations exactly as the server listed them the last time it answered us; no code was reviewed. We ask the server again about once a month, and a list that changed is graded again.
Tool surfaceread
Implementation sourcenot available
Package metadatanot available
Live transportnot available
The implementation source was not read — this reflects the declared tool metadata only.
Capability — what it could do if the model were manipulated
Tags derived from each tool’s schema and the implementation, not from what the tool calls itself. moderate is the level these add up to.
| Tool | Capability tags | Why the tag was assigned |
|---|---|---|
| token_safety_check | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| address_profile | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| ens_resolve | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| gas_compare | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| erc20_info | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| allowance_revoke_plan | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| tx_explain | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| calldata_decode | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| contract_abi | untrusted-input | untrusted-input: keyword "fetch", declares openWorldHint: true (interacts with entities outside the server) |
| signature_verify | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| typed_data_risk | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| x402_validate | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| http_inspect | untrusted-input | untrusted-input: keyword "fetch", declares openWorldHint: true (interacts with entities outside the server) |
| url_metadata | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| dns_lookup | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| domain_rdap | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| robots_check | untrusted-input | untrusted-input: keyword "fetch", declares openWorldHint: true (interacts with entities outside the server) |
| json_schema_validate | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| time_convert | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| cron_next_runs | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| currency_convert | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| unit_convert | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| hash_encode | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| qr_payment_link | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| nft_metadata | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| tx_status | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| block_at_time | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| rpc_health | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| chain_info | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| stablecoin_peg | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| bridge_status | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| dex_price | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| safe_multisig_info | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| contract_read | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| abi_encode | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| proxy_inspect | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| event_logs | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| token_balances | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| ens_available | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| erc4626_vault | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| address_validate | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| solana_account | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| btc_address | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| btc_fees | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| vesting_schedule | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| apr_apy | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| liquidation_price | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| impermanent_loss | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| loan_amortization | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| security_headers_audit | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| ssl_certificate | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| og_image_check | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| sitemap_parse | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| feed_parse | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| broken_links | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| dns_propagation | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| spf_dmarc_check | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| ip_owner | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| url_parse_clean | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| idn_homograph_check | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| mcp_tools_lint | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| openapi_lint | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| llms_txt_validate | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| a2a_card_validate | untrusted-input | untrusted-input: keyword "fetch", declares openWorldHint: true (interacts with entities outside the server) |
| regex_test | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| text_diff | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| id_generate | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| jwt_inspect | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| number_base | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| markdown_to_html | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| csv_json_convert | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| yaml_json_convert | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| json_format | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| semver_check | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| text_stats | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| language_detect | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| slugify | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| ip_cidr | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| user_agent_parse | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| color_convert | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| password_strength | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| phone_format | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| iban_validate | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| card_number_check | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| taiwan_id_check | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| public_holidays | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| business_days | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| lunar_date | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| webhook_inbox_create | external-sink | external-sink: keyword "http_request", declares readOnlyHint: false, openWorldHint: true |
| webhook_inbox_read | external-sink | external-sink: keyword "webhook" |
Toxic-flow graph
The lethal trifecta, checked as a graph rather than as a checklist: untrusted input, a sensitive source and an external sink have to meet before there is a path worth worrying about.
flow-1
Untrusted input can drive an external action even though no sensitive source is exposed.
Supply chain and provenance
Integrityfirst-seen
Surface digest0c801d2f2807fbd1
Scanned2026-11-04
This is the first scan of this surface here, so there is nothing yet to compare it against.
Every result on this tab comes from one deterministic pass over the published package — offline, rule by rule, and auditable line by line above. Same methodology version, same bytes, same score.
Release history
This is an address its publisher runs: which release it serves is theirs to choose, so there is nothing here to pin. The history below is for reading; the current release on file is 1.0.0.
1.0.0
undated
latestNo release note was published with this version.
—
no reviews yet
Who can review
One review per account, from a signed-in account that does not publish this listing. Nothing else is asked — you can say what you think before you install it. Publishers can reply once per review, and a review can be edited or deleted by whoever wrote it.
Sign in to write one
Any signed-in account that does not publish MoneyTools Tools can review it, once — before installing it or after. A review from an account that has installed it is marked as one.
No reviews yet
Nobody has reviewed this listing. The rating on the card is the mean of the reviews written here and nothing else, so there is no rating until somebody writes the first — which takes a signed-in account that does not publish it, and nothing else.