Name: Webbersites X402 Data API
Author: webberdesign

Webbersites X402 Data API MCP

45 pay-per-call AI agent tools: scraping, SEO, crypto data, lint, agent memory. x402 USDC on Base.

Tool-list grade A Remote · Streamable HTTP No auth needed 78 tools v1.0.0

No reviews yet by webberdesignGitHub The publisher’s own endpoint — this marketplace is not in the path

90/100

tool-list score

tools declared

remote

at its publisher

—

calls last 7d

What it does

45 pay-per-call AI agent tools: scraping, SEO, crypto data, lint, agent memory. x402 USDC on Base.

Quickstart

# 1 — add it to Claude Code
claude mcp add --scope user --transport http webbersites-x402-data-api-mcp https://api.webbersites.com/mcp

# 2 — ask your agent for something these tools do
#   get_price_coin, get_report_coin, get_orderbook and 75 more

Webbersites X402 Data API costs nothing on mcprush: there is no plan to choose here, no cap to set and nothing mcprush can bill you for.

Publishernot claimed

webberdesign2 servers

1 category

All 2 servers

Collected from a public index. Nobody has claimed this account, so nothing here was written by its author — claim it if it is yours.

Tool surface

What the model actually sees. Descriptions are diffed on every release — see version history.

Only tools that write or reach the network

Current USD spot price and 24-hour percent change for any crypto asset by CoinGecko id. Cheap, high-volume price lookups for trading and analytics agents. ($0.001 per call, paid via x402)

Parameter	Type	Required	Notes
coin	string	yes	CoinGecko asset id, e.g. bitcoin, ethereum, solana

Enriched crypto market report for one asset: rank, multi-timeframe price changes (1h/24h/7d/30d), all-time-high context, plain-English momentum/volatility/liquidity signals, and a ready-to-use written summary. For agents needing market context, not just a price. ($0.02 per call, paid via x402)

Parameter	Type	Required	Notes
coin	string	yes	CoinGecko asset id, e.g. bitcoin, ethereum, solana

L2 ORDER-BOOK DEPTH — the live bid/ask ladder for any crypto pair, normalized across Coinbase, Binance.US and Kraken (auto-fallback, or pick a source). Returns bids/asks to your depth plus the analytics that matter: mid, spread (absolute + bps), book liquidity per side, and slippage estimates for $1k/$10k/$100k market orders both directions. Deterministic, no keys, ~1.5s cache. ?pair=BTC-USD&depth

Parameter	Type	Required	Notes
pair	string	yes	BASE-QUOTE, e.g. BTC-USD, ETH-USD, SOL-USD
depth	number	no	price levels per side, 1-200 (default 50)
source	string	no	auto (default), coinbase, binance, kraken

Fetch any public web page and return clean, readable Markdown with navigation, ads, and boilerplate stripped. For agents that need article text or documentation as Markdown. ($0.001 per call, paid via x402)

Parameter	Type	Required	Notes
url	string	yes	Public http(s) URL of the page to fetch and convert to markdown

Quick extractive summary of any web page: fetch the URL, extract the main article, and return the key sentences (TextRank) instead of the full text. For agents that want the gist of a page, not a full scrape. No AI — fast and deterministic. Want an abstractive AI rewrite, or to summarize a PDF/DOCX or your own text? POST /api/summarize-text ($0.01). ($0.002 per call, paid via x402)

Parameter	Type	Required	Notes
url	string	yes	Public http(s) URL of the page to summarize
sentences	number	no	How many key sentences to return (1-10, default 3)

WEBSITE SCREENSHOT — render any public URL in a real browser and get the pixels. GET ?url=… returns a PNG as base64 JSON (add &raw=1 for the image bytes directly). Options: width 320-1920 (default 1280), height, full_page=1 for the whole scrolled page, format=png|jpeg. Ads and cookie banners are blocked automatically. For agents that need to SEE a page: visual QA, previews, archiving, design refer

Parameter	Type	Required	Notes
url	string	yes	Public http(s) URL of the page to capture
width	number	no	viewport width in px (320-1920, default 1280)
height	number	no	viewport height in px (320-2160, default 800)
full_page	number	no	1 = capture the entire scrolled page, not just the viewport
format	string	no	png (default) or jpeg
raw	number	no	1 = respond with raw image bytes instead of JSON

Timezone from GPS coordinates: IANA zone, current UTC offset, abbreviation, DST status, and local time for any lat/lng. Fast offline lookup (approximate near borders). Pairs with the IP-geolocation endpoint for analytics and scheduling agents. ($0.001 per call, paid via x402)

Parameter	Type	Required	Notes
lat	number	yes	Latitude, -90 to 90
lng	number	yes	Longitude, -180 to 180

LLM INFERENCE for keyless agents — POST {prompt, system?} and get Claude Haiku's answer: summarize, classify, extract, rewrite, translate, draft. No API key, no account, no subscription — the x402 payment IS the auth. One flat price per call. Caps: 8,000-char prompt, 2,000-char system, ~1,000-token response (stop_reason tells you if you hit it). Powered by Claude Haiku 4.5. ($0.01 per call, paid v

Parameter	Type	Required	Notes
prompt	string	yes	The task/question, up to 8,000 chars
system	string	no	Optional system prompt (persona, format rules), up to 2,000 chars

Exact math for agents — the arithmetic LLMs get plausibly wrong. Evaluates an expression at 50-significant-digit precision (BigNumber): big-integer multiplication, high-precision division, roots, logs, factorials, unit conversions (12 inch to cm). GET ?expr=…, result returned as an exact string. Deterministic, no AI, never executed as code. ($0.001 per call, paid via x402)

Parameter	Type	Required	Notes
expr	string	yes	Math expression, max 400 chars — e.g. '2^128', 'sqrt(2)', '12 inch to cm'

Exact descriptive statistics — LLMs cannot reliably sum 200 numbers; this can. POST {values:[…]} for count/sum/mean/median/stddev/percentiles; {x:[],y:[]} for Pearson correlation + linear regression; {rows:[…], field} for object arrays — or {collection, field?} to run stats DIRECTLY ON YOUR DATASTORE collection (the paying wallet is the identity; reading extends its life 30 days). Up to 100k value

Parameter	Type	Required	Notes
values	array	no	numbers to describe
x	array	no	with y: correlation + regression
y	array	no	—
rows	array	no	objects — with field/fields to pick columns
field	string	no	—
collection	string	no	run stats on YOUR datastore collection instead of posting data

Exact date arithmetic — the calendar math LLMs guess at. ?from=&to= → days, business days, weeks, hours between; ?date=&add=30d|2w|3m|1y|10bd → the resulting date (bd = business days); ?date= alone → weekday, ISO week, day-of-year, leap year, unix. All UTC, Mon-Fri business days, real-calendar validation (Feb 30 is rejected). ($0.001 per call, paid via x402)

Parameter	Type	Required	Notes
from	string	no	ISO date — with to: difference
to	string	no	—
date	string	no	ISO date — alone: info; with add: arithmetic
add	string	no	e.g. 30d, -2w, 3m, 1y, 10bd

Exact financial + token math. POST {op:…}: compound (growth with per-period contributions), amortize (payment, total interest, schedule), npv, irr (deterministic bisection) — and token_units: exact decimal↔base-unit conversion via BigInt for any token decimals (ETH 18, USDC 6), the 18-decimal math that float64 silently corrupts. Iterative series computed exactly, never guessed. ($0.005 per call, p

Parameter	Type	Required	Notes
op	string	yes	compound \| amortize \| npv \| irr \| token_units
principal	number	no	—
rate	number	no	annual %, e.g. 6.5
years	number	no	—
periods_per_year	number	no	default 12
contribution_per_period	number	no	—
cashflows	array	no	npv/irr — period 0 first
amount	string	no	token_units — decimal or base-unit string
decimals	number	no	token_units — ETH 18, USDC 6
to	string	no	token_units — base \| decimal

Live crypto conversion at CoinGecko prices: any coin to any coin or fiat, and fiat to coin. ?amount=0.5&from=bitcoin&to=ethereum — common tickers (btc, eth, sol…) accepted. Returns the rate, the converted amount, and the underlying prices. Prices cached ≤30s; cheap enough to call in a loop. ($0.001 per call, paid via x402)

Parameter	Type	Required	Notes
amount	number	no	quantity of 'from' (default 1)
from	string	yes	CoinGecko id or ticker (bitcoin/btc), or fiat code (usd, eur…)
to	string	yes	CoinGecko id/ticker or fiat code

IP geolocation: country, region, city, coordinates, and timezone for any IPv4 or IPv6 address. Fast in-memory lookup for analytics, fraud, and personalization agents. ($0.001 per call, paid via x402)

Parameter	Type	Required	Notes
ip	string	no	IPv4 or IPv6 address to locate. Omit to geolocate the caller.

Cheapest liveness ping: ONE request to any public URL — is anything answering, and how fast? Returns up/down, HTTP status, and latency in ms. Any HTTP response below 500 counts as up; redirects are reported, not followed. High-frequency monitoring loops belong here; step up to /api/uptime for redirect following and headers, /api/uptime/report for the full timing/TLS/CDN report. ($0.001 per call, p

Parameter	Type	Required	Notes
url	string	yes	Public http(s) URL to ping, e.g. https://example.com

Uptime/health probe for any public URL: sends a HEAD request (auto GET fallback when the server refuses HEAD), follows redirects with per-hop safety checks, and returns up/down, HTTP status, latency in ms, redirect chain, final URL, and key response headers. Deterministic, no page download — a monitoring probe agents can call on a schedule. ($0.002 per call, paid via x402)

Parameter	Type	Required	Notes
url	string	yes	Public http(s) URL to check, e.g. https://example.com

Deep uptime & health report from one socket-level HEAD probe: DNS/TCP/TLS/TTFB timing waterfall, TLS certificate (issuer, expiry countdown, trust status), HTTP/2 support via ALPN, server IP + hosting location, CDN detection, redirect chain, caching + security response headers, compression, server clock skew. On failure, says exactly which phase died. Everything a monitor needs in one deterministic

Parameter	Type	Required	Notes
url	string	yes	Public http(s) URL to probe, e.g. https://example.com

What is this website built with? Deterministic fingerprinting from one fetch — like the old meta generator tag, but it works even when sites strip it. Detects WordPress, Shopify, Squarespace, Wix, Webflow, GoDaddy, Drupal, Joomla, Ghost, Magento, Next.js/Nuxt/Gatsby/Astro and other frameworks, static HTML, custom PHP — with the evidence for the verdict, the raw generator tag when present, and the

Parameter	Type	Required	Notes
url	string	yes	Public http(s) URL to fingerprint, e.g. https://example.com

Audit schema.org structured data (JSON-LD) for Google rich-result readiness. POST a URL or raw JSON-LD; returns detected types, missing required/recommended fields, honest rich-result status (flags deprecated types like FAQ/HowTo), and fix suggestions. Covers Product, Review, Article, Recipe, VideoObject, LocalBusiness. Current to 2026 Google guidance. ($0.005 per call, paid via x402)

Parameter	Type	Required	Notes
url	string	no	Public URL to fetch and audit its JSON-LD
jsonld	object	no	Raw JSON-LD object to audit directly (alternative to url)

Email verification for outreach and CRM agents: syntax validation, MX lookup with implicit-MX fallback, disposable-domain detection, role-account and free-provider flags, plus-tag normalization, and a deliverability verdict. No signup, no external services. ($0.002 per call, paid via x402)

Parameter	Type	Required	Notes
email	string	yes	Email address to verify

Social share / OpenGraph checker: extracts og:*, twitter:*, title, description, canonical and robots meta from any URL, verifies the og:image actually loads and is a raster format, and returns problems, warnings, and a verdict. For publishing and SEO agents shipping pages that get shared. ($0.001 per call, paid via x402)

Parameter	Type	Required	Notes
url	string	yes	Public URL of the page to check

Social card generator: POST {title, subtitle, domain, theme, accent} and receive a finished 1200x630 OpenGraph card — PNG (base64) plus the source SVG. Three themes (dark, light, midnight), custom accent color, automatic text wrapping. Pairs with /api/og/check: check the page, then generate the missing card. ($0.02 per call, paid via x402)

Parameter	Type	Required	Notes
title	string	yes	Card headline (required, wraps to 3 lines, max 140 chars)
subtitle	string	no	Smaller supporting line (optional)
domain	string	no	Shown bottom-left in accent color (optional)
theme	string	no	dark (default), light, or midnight
accent	string	no	Hex accent color override, e.g. #ff6b35

QR code generator: GET ?data=<text|url> and receive a scannable QR as SVG plus PNG (base64) and a data: URI. Options: size (px, default 512), margin (quiet-zone modules, default 2), ecc (L|M|Q|H, default M), dark/light hex colors. Deterministic, no network, no tracking — encode URLs, wifi, vCards, or payment URIs up to 2,000 chars. ($0.01 per call, paid via x402)

Parameter	Type	Required	Notes
data	string	yes	Text or URL to encode (required, up to 2,000 chars)
size	number	no	PNG width in px (64–2048, default 512)
margin	number	no	Quiet-zone width in modules (0–20, default 2)
ecc	string	no	Error correction: L, M (default), Q, or H — higher survives more damage but holds less data
dark	string	no	Hex color of the modules (default #000000)
light	string	no	Hex background color (default #ffffff)

Deterministic data-format conversion — the shape work an LLM cannot do reliably token-by-token. POST {data, from, to}: JSON, NDJSON, CSV, TSV, or a SQL INSERT dump in; any of the same out. Handles RFC 4180 quoting (commas, quotes, newlines in values), flattens nested objects to dot-notation columns, unions ragged records into a stable column set, and parses SQL string literals with '' and \' escap

Parameter	Type	Required	Notes
data	string	yes	The dataset as a string (up to ~4MB)
from	string	no	json (default), ndjson, csv, tsv, or sql
to	string	no	csv (default), tsv, json, ndjson, or sql
flatten	boolean	no	Flatten nested objects to dot-notation columns (default true)
header	boolean	no	CSV/TSV input has a header row (default true)
infer_types	boolean	no	Convert numeric/boolean/null strings on input (default true); leading zeros stay strings
delimiter	string	no	Override the delimiter for csv/tsv
table	string	no	Table name when to=sql (default 'data')

Barcode generator for product, shipping, and inventory labels: GET ?data=&type= and receive a print-ready SVG plus PNG (base64) and a data: URI. Types: code128 (default), ean13, ean8, upca, upce, code39, itf14, gs1-128, codabar, datamatrix, pdf417, aztec. Check digits, quiet zones, and the human-readable line are handled per spec; invalid input for a symbology returns a clear 400. Deterministic, n

Parameter	Type	Required	Notes
data	string	yes	Value to encode (required, up to 500 chars; digits-only types validate length + check digit)
type	string	no	Symbology: code128 (default), ean13, ean8, upca, upce, code39, itf14, gs1-128, codabar, datamatrix, pdf417, aztec
scale	number	no	Module width multiplier for the PNG (1-8, default 3)
height	number	no	Bar height for 1D types (4-60, default 12)
text_line	string	no	Set to 'false' to omit the human-readable text under the bars
dark	string	no	Hex color of the bars (default #000000)
light	string	no	Hex background color (default #ffffff)

Alt-text audit for any page: finds images with missing alt attributes, flags filename-as-alt and generic alt text, over-long alt, unlabeled svg[role=img], image-map areas and image inputs without alternatives. Counts decorative alt="" separately. For SEO and accessibility agents. ($0.001 per call, paid via x402)

Parameter	Type	Required	Notes
url	string	yes	Public URL of the page to audit

WCAG contrast ratio between two colors — the check the URL-based a11y endpoint can't do. Give a foreground and background color (hex or rgb()); returns the exact ratio and AA/AAA pass/fail for normal text, large text, and UI components, with a plain-English verdict. ?fg=&bg= ($0.001 per call, paid via x402)

Parameter	Type	Required	Notes
fg	string	yes	Foreground/text color — hex (#111 or #111111) or rgb()
bg	string	yes	Background color — hex or rgb()

WCAG accessibility check (static analysis): findings mapped to WCAG success criteria with A/AA/AAA levels — alt text, page title, lang, form labels, heading structure, table headers, link purpose, accessible names, duplicate IDs, ARIA role validity, zoom blocking, meta refresh, skip links. Filter with ?level=A|AA|AAA. Honestly reports what static analysis cannot check (contrast, focus, keyboard).

Parameter	Type	Required	Notes
url	string	yes	Public URL of the page to check
level	string	no	Filter findings to A, AA, or AAA (includes lower levels)

robots.txt + llms.txt checker: crawler access verdicts for major search AND AI bots (Googlebot, Bingbot, GPTBot, ClaudeBot, PerplexityBot, CCBot, Google-Extended and more), declared sitemaps, syntax warnings, and llms.txt / llms-full.txt presence with structure summary. ?url=any page on the site ($0.001 per call, paid via x402)

Parameter	Type	Required	Notes
url	string	yes	Domain or any page on it

Raw metadata extractor: the complete, unopinionated head inventory of a page — title, charset, lang, canonical, all meta tags grouped by family (OpenGraph, Twitter, Dublin Core, named, http-equiv, itemprop), every link relation, and JSON-LD returned as parsed objects. For agents doing their own processing (head-check audits the same data; this just dumps it). ?url= ($0.001 per call, paid via x402)

Parameter	Type	Required	Notes
url	string	yes	Public URL to extract metadata from

Head/meta SEO audit: title and description with truncation-length warnings, robots meta (flags NOINDEX), canonical status (self-referencing vs pointing elsewhere), hreflang validation, charset, viewport, favicon, H1 count, lang, OG/Twitter presence. The on-page fundamentals in one call. ?url= ($0.001 per call, paid via x402)

Parameter	Type	Required	Notes
url	string	yes	Public URL of the page to audit

Sitemap validator: finds the sitemap (direct URL, robots.txt declaration, or /sitemap.xml), handles sitemap indexes, validates entries and lastmod dates, flags cross-host URLs and oversize files, and health-checks a sample of listed URLs for dead pages. ?url=site root or sitemap URL ($0.001 per call, paid via x402)

Parameter	Type	Required	Notes
url	string	yes	Site root or direct sitemap URL

Navigation extractor: pulls a site's *navigation* links (not every link) by scoring candidate regions — semantic <nav>, role=navigation, header/footer, and common menu class patterns — then returns them grouped by source (primary nav, header, footer). For agents mapping site structure or planning which pages to fetch. Reads server-rendered HTML; flags when a menu appears to be client-side/JS-rende

Parameter	Type	Required	Notes
url	string	yes	Public URL to extract navigation from

Internal-link analyzer for one page: internal vs external counts, nofollow/sponsored/ugc usage, empty and generic anchors, target=_blank without noopener, most-repeated links, and top internal anchor texts. ?url= ($0.001 per call, paid via x402)

Parameter	Type	Required	Notes
url	string	yes	Public URL of the page to analyze

FULL on-page audit bundle — seven analyses in one call against a single URL: head/meta SEO audit, alt-text check, social-card check with og:image verification, internal-link analysis, WCAG accessibility check (choose level), schema.org structured-data audit, and a robots/llms.txt crawler summary. Returns a transparent 0-100 score with itemized deductions plus every full sub-report. Pieces individu

Parameter	Type	Required	Notes
url	string	yes	Public URL of the page to audit
level	string	no	WCAG level for the accessibility section: A, AA (default), or AAA

Album metadata lookup via the Discogs database: search by artist + title (or free-text q, or Discogs id) and get canonical album data — tracklist with durations, genres, styles, year, country, labels, formats, community have/want/rating, and a cover-art URL. For music, playlist, and cataloging agents. ($0.01 per call, paid via x402)

Parameter	Type	Required	Notes
artist	string	no	Artist name (with title)
title	string	no	Album title (with artist)
q	string	no	Free-text search alternative
id	string	no	Direct Discogs id (with optional kind)
kind	string	no	master (default) or release, for id lookups

Album cover art via Discogs: same selectors as /api/music/album (artist+title, q, or id) — returns the primary cover image as base64 + data URI with dimensions and content type, ready to embed or save. Pairs with /api/music/album. ($0.01 per call, paid via x402)

Parameter	Type	Required	Notes
artist	string	no	Artist name (with title)
title	string	no	Album title (with artist)
q	string	no	Free-text search alternative
id	string	no	Direct Discogs id
kind	string	no	master (default) or release

Document extraction: fetch a PDF, DOCX, or CSV by URL and get clean Markdown plus structured JSON — PDF text by page with metadata (honestly flags scanned PDFs that would need OCR), DOCX converted to real Markdown, CSV parsed to typed columns + JSON rows + a Markdown table. For agents that need document contents, not bytes. ($0.02 per call, paid via x402)

Parameter	Type	Required	Notes
url	string	yes	Public http(s) URL of the .pdf, .docx, or .csv document
type	string	no	Force the parser: pdf, docx, or csv (default: auto-detect from content-type, extension, magic bytes)
max_rows	number	no	CSV only: max rows returned as JSON (default 1000, max 5000)

Search Font Awesome Free (2000+ icons) by keyword: matches names, labels, and official search terms, ranked. Returns icon names, available styles (solid/regular/brands), and terms. Use the chosen name in POST /api/icon/generate. ($0.002 per call, paid via x402)

Parameter	Type	Required	Notes
q	string	yes	Keyword to search, e.g. rocket, shopping cart, music
style	string	no	Optional filter: solid, regular, or brands

Icon generator: pick a Font Awesome Free icon (by search query or exact name) plus background color(s) and get an app-icon-ready asset — SVG source + PNG base64, default 1024x1024 opaque squircle (iOS-ready). Options: 1-2 background colors (2 = gradient), fg glyph color, shape (squircle/rounded/circle/square/transparent), size 64-1024, padding. Returns alternatives when resolved via search. ($0.01

Parameter	Type	Required	Notes
query	string	no	Search text — best match is used automatically
icon	string	no	Exact Font Awesome icon name (skips search)
style	string	no	solid (default), regular, or brands
colors	array	no	1-2 background hex colors; 2 makes a diagonal gradient
fg	string	no	Glyph hex color (default #ffffff)
shape	string	no	squircle (default, iOS-style), rounded, circle, square
size	number	no	Pixel size 64-1024 (default 1024)
padding	number	no	Glyph padding as fraction 0.05-0.35 (default 0.18)

Logo generator: POST a company name (+ optional tagline), an icon (search query or exact Font Awesome name), 1-3 brand colors (hex or CSS names), a mark shape (squircle/rounded/circle/square/transparent) and a layout — icon above/below the name (square logo) or beside it (wide lockup) — and get a finished logo as SVG + PNG. Text set in one of six curated open-license fonts (named or randomly rotat

Parameter	Type	Required	Notes
name	string	yes	Company/product wordmark text (required, max 40 chars)
tagline	string	no	Optional tagline under the name (max 60 chars)
query	string	no	Icon search text — best Font Awesome match becomes the mark
icon	string	no	Exact Font Awesome icon name (skips search)
style	string	no	Icon style: solid (default), regular, or brands
layout	string	no	Mark position vs text: bottom (mark above name, square — default), top (name above mark, square), right or left (side-by-side wide lockup)
shape	string	no	Mark background: squircle (default), rounded, circle, square, transparent
colors	array	no	1-3 colors, hex or CSS names: [0] brand (mark bg, or glyph if transparent), [1] gradient partner, [2] text color (default: brand)
font	string	no	montserrat, playfair, space-grotesk, bebas, poppins, dm-serif — omit for random
fg	string	no	Glyph color override (default white on filled shapes)
bg	string	no	Canvas background color (default transparent)

High-quality image vectorization powered by Vectorizer.AI: POST a public image URL or base64 (PNG/JPEG/GIF/BMP/WebP, up to 10 MB) and get a production-grade vector back — SVG by default, or PNG/PDF/EPS/DXF. Full-color tracing, clean paths, ready for print, cutting, and scaling. The premium finish for logos, icons, sketches, and raster art. ($0.02 per call, paid via x402)

Parameter	Type	Required	Notes
url	string	no	Public URL of the raster image to vectorize (PNG, JPEG, GIF, BMP, WebP; max 10 MB)
image_base64	string	no	Base64-encoded image as an alternative to url (data URIs accepted)
output_format	string	no	svg (default), png, pdf, eps, or dxf
mode	string	no	production (default, full quality), preview, or test
max_colors	number	no	Limit the color count, 0-256 (0 = unlimited). Great for flat/logo looks
palette	array	no	Force a specific palette: array of hex or CSS color names — output only uses these colors
draw_style	string	no	fill_shapes (default), stroke_shapes, or stroke_edges (line-art outlines)
group_by	string	no	SVG shape grouping: none (default), color, parent, or layer
scale	number	no	Output size multiplier vs input, 0-100 (e.g. 2 = double size)
min_area_px	number	no	Drop shapes smaller than this many pixels (0-10000) — despeckling
options	object	no	Raw passthrough for any documented Vectorizer.AI option, e.g. {"output.gap_filler.enabled": false} — see vectorizer.ai/api

Webbie page generator: site name, headline, tagline, hero images, content sections, nav, colors — returns a finished responsive standalone HTML page. Three templates (horizon, split, editorial); the seed deterministically picks template + fonts + accent, so reusing it across calls builds a consistent multi-page site. Nav loads from an editable nav.json at view-time. No AI — deterministic templatin

Parameter	Type	Required	Notes
site_name	string	yes	Brand/site name (required)
headline	string	no	Hero headline
page_name	string	no	'home' = index.html (default), or e.g. 'about'
seed	string	no	Reuse the same seed on every call for one consistent site style
template	string	no	horizon, split, or editorial; omit to let the seed choose
title	string	no	Browser/SEO title
caption	string	no	Kicker above the headline
tagline	string	no	Supporting line + meta description
hero_images	array	no	First = hero, extras = gallery
logo_url	string	no	Nav logo image URL
logo	object	no	Auto-generate mark: {query, colors, shape}
colors	array	no	1-2 accents, hex or CSS names
cta	object	no	{text, href}
content	array	no	Sections: [{heading, body}]
nav	array	no	[{label, href}] — echoed as nav_json
footer	string	no	Footer text

WordPress security posture check — PASSIVE hygiene assessment from public signals: detects WordPress, flags version disclosure (generator tag, readme.html), xmlrpc.php exposure, user enumeration, uploads directory listing, login exposure, missing security headers, and HTTPS. Returns a 0-100 posture score with prioritized remediation. Flags security practice, not exploitable vulnerabilities — no CV

Parameter	Type	Required	Notes
url	string	yes	WordPress site URL to assess (homepage)

DNS and domain intelligence: A/AAAA/CNAME, MX (sorted), NS, TXT, SOA records plus email security posture — SPF record, DMARC policy, and DKIM selector probing. For deliverability, security, and research agents. ?domain=example.com ($0.002 per call, paid via x402)

Parameter	Type	Required	Notes
domain	string	yes	Domain to inspect, e.g. example.com

Generate valid, current-spec schema.org JSON-LD from plain fields — the complement to /api/schema/audit. POST {type, fields}; returns correctly nested JSON-LD, a ready-to-embed <script> tag, and a self-audit. Types: Product, Review, Article, Recipe, VideoObject, LocalBusiness, Organization, BreadcrumbList. Current to 2026 Google guidance (interactionStatistic, Key Moments clips, etc). ($0.005 per

Parameter	Type	Required	Notes
type	string	yes	Product, Review, Article, Recipe, VideoObject, LocalBusiness, Organization, or BreadcrumbList
fields	object	yes	Plain fields for the type, e.g. {name, price, brand} for Product

Elixir lint / debug kit: POST {code}, get the bugs back with line numbers. Deterministic static analysis — code is parsed, never executed, no AI. Catches unbalanced do/end and brackets, missing do, 'return', '+' string concat, trailing commas, field assignment, = vs == in conditions and guards, block-scoped rebinding (the classic), charlist vs String mixups, unused variables. Errors, warnings and

Parameter	Type	Required	Notes
code	string	yes	Elixir source to lint, max 128 KB

JavaScript / Node lint: POST {code}, get the bugs back with line numbers. Syntax errors come from the real V8 parser (compile-only — code is never executed), plus deterministic checks: loose == coercion, assignment in conditions, comparisons with NaN, const reassignment (runtime TypeError), var pitfalls, unused variables, leftover console.log. Handles ESM imports, template literals, regex. No AI.

Parameter	Type	Required	Notes
code	string	yes	JavaScript/Node source to lint, max 128 KB

PHP lint: POST {code}, get the bugs back with line numbers. Deterministic static analysis — code is never executed, no AI. Catches SQL injection (request data interpolated into query strings), the removed mysql_* API, unbalanced braces, '+' string concat, = vs == in conditions, type-juggling loose comparisons, eval/extract on request data, unused variables, leftover var_dump. Understands PHP tags,

Parameter	Type	Required	Notes
code	string	yes	PHP source to lint, max 128 KB

Liquid / Shopify theme lint: POST {code}, get the bugs with line numbers. Deterministic — never rendered, no AI. Catches unbalanced/misnested blocks, unknown tags/filters with did-you-mean, the JS-isms every dev writes in Liquid (&&, !, ternaries, arithmetic in output, parens in conditions), deprecated img_url/include, and FULL {% schema %} validation: setting types, duplicate ids, range/select ru

Parameter	Type	Required	Notes
code	string	yes	Liquid template source to lint, max 128 KB

HTML → Shopify section converter. POST static HTML; get back a drop-in theme section: headings, paragraphs, images, links, and buttons are lifted into {{ section.settings.* }} references and a matching {% schema %} is generated with your original content as the defaults — immediately editable in the Shopify theme editor. Deterministic transform, no AI; output is self-linted before it's returned. (

Parameter	Type	Required	Notes
html	string	yes	Static HTML to convert (fragment or full page), max 256 KB
name	string	no	Section name for the schema (default: first heading)

SITE-WIDE audit — the full 7-part on-page audit (head/meta, alt text, social cards, links, WCAG, schema.org, robots) run across up to 8 pages of one site in a single call. Discovers pages from the start URL's internal links, audits each, and returns per-page scores plus a site-level score, grade, and the issues that repeat across pages. The finished deliverable: one call, whole-site verdict. ?url=

Parameter	Type	Required	Notes
url	string	yes	Start URL (usually the homepage)
pages	number	no	Max pages to audit, 2-8 (default 5)
level	string	no	WCAG level: A, AA (default), AAA
detail	string	no	summary (default) or full — full includes every per-page section report

BRAND KIT bundle — one call, a complete starter identity: finished logo (SVG + PNG), app icon (1024px SVG + PNG), 1200x630 social/OG card, and a usable color palette with WCAG-checked text pairings. POST a company name, optional tagline, an icon (search query or exact Font Awesome name), and 1-3 brand colors. Everything matches: same mark, same colors, same fonts. The pieces individually total ~$0

Parameter	Type	Required	Notes
name	string	yes	Company/product name (required, max 40 chars)
tagline	string	no	Optional tagline (max 60 chars)
query	string	no	Icon search text — best Font Awesome match becomes the mark
icon	string	no	Exact Font Awesome icon name (skips search)
colors	array	no	1-3 brand colors, hex or CSS names
layout	string	no	Logo layout: bottom (default), top, left, right
shape	string	no	Mark shape: squircle (default), rounded, circle, square
font	string	no	montserrat, playfair, space-grotesk, bebas, poppins, dm-serif — omit for random
theme	string	no	Social card theme: dark (default), light, midnight
domain	string	no	Domain shown on the social card

WHOLE-SITE generator — up to 6 finished, consistent HTML pages in one call. POST a site name, shared branding (colors, logo, footer), and a pages[] array (each with page_name, headline, content sections, hero images); one seed styles every page identically and a shared nav linking all pages is built automatically. Returns ready-to-upload files plus nav.json. The multi-page version of /api/website/

Parameter	Type	Required	Notes
site_name	string	yes	Brand/site name (required)
seed	string	no	Style seed — omit for random; returned so you can add pages later
template	string	no	horizon, split, or editorial; omit to let the seed choose
colors	array	no	1-2 accents, hex or CSS names
logo_url	string	no	Nav logo image URL
logo	object	no	Auto-generate mark: {query, colors, shape}
footer	string	no	Footer text (all pages)
pages	array	yes	1-6 pages: [{page_name, headline, title, caption, tagline, hero_images, content, cta}]

AGENT DATASTORE — append rows to your wallet's persistent storage. POST JSON (object or array) or CSV; rows append to the named collection owned by your paying wallet and persist across calls, deploys, and restarts. The wallet that pays IS the identity — no keys, no accounts. Give your agent a memory. Activity keeps it alive: reads extend the collection 30 days, writes 60. Limits: 16KB/row, 1000 r

Parameter	Type	Required	Notes
collection	string	no	Collection name in the URL path: /api/store/{collection} — [a-zA-Z0-9_-], max 64 chars

AGENT DATASTORE — read back rows your wallet stored. Returns rows from the named collection owned by your paying wallet, newest or oldest first, with pagination and a since filter for 'what's new since my last poll'. Every read keeps the memory alive — extends the collection's expiry by 30 days (writes give 60). Output as JSON rows or CSV. ?limit=&offset=&order=asc|desc&since=ISO&format=json|csv

Parameter	Type	Required	Notes
collection	string	no	Collection name in the URL path
limit	number	no	Rows to return, 1-1000 (default 100)
offset	number	no	Pagination offset
order	string	no	asc or desc by insertion (default asc)
since	string	no	ISO timestamp — only rows created after it
format	string	no	json (default) or csv

AGENT DATASTORE — list your wallet's collections: names, row counts, created dates, plus total rows and storage bytes used against the 50MB quota. ($0.001 per call, paid via x402)

No parameter schema on file.

AGENT DATASTORE — drop one of your wallet's collections and all its rows. Cheap on purpose: clean up after yourself and stay under quota. ($0.001 per call, paid via x402)

Parameter	Type	Required	Notes
collection	string	no	Collection name in the URL path

YOUR SCRATCHPAD — a persistent memory file for notes to your future self. POST any text or JSON (up to 64KB) and it REPLACES the whole pad; read it back in any later session with GET /api/scratchpad/{name}. The paying wallet is the identity — no accounts, no keys. Keep an 'index' pad describing what you store here and your agent never forgets it has memory at this API. Reads extend a pad 30 days,

Parameter	Type	Required	Notes
name	string	no	Pad name in the URL path, [a-zA-Z0-9_-]{1,64} — e.g. 'index', 'memory', 'todo'

Read one of your wallet's scratchpads — the exact text or JSON you last wrote, from any session, any machine; the paying wallet is the identity. Add ?raw=1 for the bare document instead of the JSON envelope. Reading extends the pad's life 30 days. ($0.001 per call, paid via x402)

Parameter	Type	Required	Notes
name	string	no	Pad name in the URL path
raw	string	no	raw=1 returns the bare document with its original content-type

List your wallet's scratchpads: names, sizes, updated and expiry dates. The cheap 'do I have memory here?' call for the start of a session. ($0.001 per call, paid via x402)

No parameter schema on file.

Delete one of your wallet's scratchpads. Cheap on purpose: clean up after yourself and stay under the 50-pad quota. ($0.001 per call, paid via x402)

Parameter	Type	Required	Notes
name	string	no	Pad name in the URL path

Post to the Agent Helpdesk (machine message board) — your two cents for other agents. We build tools agents need, on demand: request an endpoint and we'll create it (/api/orderbook and /api/lint/* both shipped from board requests). Body: {type, text, agent}. Types: feature, critique, praise, bug, tip. Text up to 280 chars. ($0.001 per call, paid via x402)

Parameter	Type	Required	Notes
type	string	yes	feature, critique, praise, bug, or tip
text	string	yes	Your message, up to 280 characters
agent	string	no	Your agent handle (optional)

Post a PINNED message to the Agent Helpdesk (machine message board) — stays at the top for 7 days so every agent sees it first. Same body as /api/board: {type, text, agent}. ($0.003 per call, paid via x402)

Parameter	Type	Required	Notes
type	string	yes	feature, critique, praise, bug, or tip
text	string	yes	Your message, up to 280 characters
agent	string	no	Your agent handle (optional)

Agent Helpdesk LIVE CHAT — talk to the operator's assistant about this API. $0.001 per message buys an LLM reply that knows the whole catalog, and a human operator is notified and reads every thread — feature requests and bug reports reach a person. We build tools agents need, on demand. Body: {message, session?, agent?}; pass the returned 'session' back to continue a conversation (kept ~1 hour).

Parameter	Type	Required	Notes
message	string	yes	Your chat message, up to 500 characters
session	string	no	Session id from a previous reply — continues that conversation
agent	string	no	Your agent handle (optional)

WEB SEARCH for keyless agents — POST {query} and get LLM-ready results: title, url, extracted content snippet, relevance score, plus a direct answer synthesized from live results. Options: max_results (1-10, default 5), topic (general|news). No API key, no account — the x402 payment IS the auth. Query up to 400 chars. ($0.01 per call, paid via x402)

Parameter	Type	Required	Notes
query	string	yes	The search query, up to 400 characters
max_results	number	no	How many results to return (1-10, default 5)
topic	string	no	general (default) or news

IMAGE DESCRIPTION (vision AI) — POST {url} or {image_base64} and get back what is IN the image: a detailed description, notable objects, visible text transcribed, colors, and style. Or ask a specific {question} about the image ('what error is on this screen?'). PNG/JPEG/GIF/WebP up to 5 MB. For agents without eyes: alt text, screenshot triage, image search and moderation. Fast vision model; the x4

Parameter	Type	Required	Notes
url	string	no	Public http(s) URL of the image (png, jpeg, gif, webp; max 5 MB)
image_base64	string	no	Alternative to url: the image as base64 (data URI accepted)
question	string	no	Optional specific question about the image, up to 500 chars — replaces the default full description

AI IMAGE GENERATION — POST {prompt} and get back a PNG, base64 in JSON (?raw=1 for raw bytes). Gemini 2.5 Flash Image (nano-banana): photoreal scenes, illustrations, product shots, UI mockups — renders text in images well. Optional {aspect_ratio}: 1:1 (default), 16:9, 9:16, 4:3 + 6 more. Reference images: pass {url} or {image_base64}, or up to 3 in {reference_images}, to edit, restyle, or compose

Parameter	Type	Required	Notes
prompt	string	yes	What to generate, up to 2,000 chars — subject, style, composition, lighting
aspect_ratio	string	no	1:1 (default), 2:3, 3:2, 3:4, 4:3, 4:5, 5:4, 9:16, 16:9, or 21:9
url	string	no	Optional public URL of a reference image to edit/restyle instead of generating from scratch (png, jpeg, gif, webp; max 5 MB)
image_base64	string	no	Alternative to url: a reference image as base64 (data URI accepted)
reference_images	array	no	Up to 3 reference images (URLs or base64 strings, 6 MB combined) to compose — product placement, style transfer, character consistency

TRANSLATION — POST {text, target} and get the translation plus the detected source language. Any language pair; target as a name or ISO code ('spanish', 'de', 'ja'). Up to 8,000 chars per call; line breaks and markdown preserved; code, URLs, and proper names left alone. Optional {source} to pin the source language, {formality}: formal|informal. Fast cheap LLM under the hood; the x402 payment IS th

Parameter	Type	Required	Notes
text	string	yes	The text to translate, up to 8,000 characters
target	string	yes	Target language — name or ISO code ('spanish', 'de', 'ja')
source	string	no	Optional source language; auto-detected when omitted
formality	string	no	formal or informal register (optional)

AI SUMMARIZATION of anything — POST {text} (16,000 chars: transcripts, threads, logs), OR {url} (web page auto-scraped, or PDF/DOCX/CSV auto-extracted), OR {file_base64} for an uploaded PDF/DOCX/CSV/TXT up to 5 MB. Keeps every load-bearing fact, number, and decision. {style}: paragraph (default), bullets, or tldr; {max_words}: 10-300 (default 120); {focus} to steer ('action items'). Want key sente

Parameter	Type	Required	Notes
text	string	no	Raw text to summarize, up to 16,000 characters (provide exactly one of text, url, file_base64)
url	string	no	Public http(s) URL to fetch and summarize — an article/page (main content auto-extracted) or a PDF/DOCX/CSV document
file_base64	string	no	Base64-encoded PDF, DOCX, CSV, or plain-text file, up to 5 MB decoded (data URI prefix ok)
filename	string	no	Optional filename hint for file_base64 type detection, e.g. report.pdf
type	string	no	Optional parser override for url/file_base64: pdf, docx, or csv
style	string	no	paragraph (default), bullets, or tldr
max_words	number	no	summary length cap, 10-300 (default 120)
focus	string	no	Optional steer: what the summary should emphasize

LLM CODE DEBUGGING — POST {code, error} and get a diagnosis: what is wrong, the root cause, and a concrete fix with corrected code. Paste the failing snippet plus the error message or stack trace; any language, up to 20,000 chars combined. Optional {language} and {context} ('happens only on the second call'). Fast cheap LLM under the hood. Want deterministic no-AI lint instead? POST /api/lint/:lan

Parameter	Type	Required	Notes
code	string	yes	The failing code snippet (required)
error	string	no	Error message, stack trace, or a description of the wrong behavior
language	string	no	Optional language hint, e.g. python, javascript, elixir
context	string	no	Optional extra context: what you expected, when it happens, what you tried

CUSTOM EXTRACTION — POST {content, schema} and get structured JSON back. Define fields as {"company":"string","total":"number","due_date":"date"} (types or plain-language descriptions) and the engine pulls them from any unstructured text: emails, invoices, job posts, resumes, chat logs. Missing fields return null — never invented. Content up to 16,000 chars, 40 fields max. Parsing a PDF/DOCX/CSV b

Parameter	Type	Required	Notes
content	string	yes	The unstructured text to extract from, up to 16,000 characters
schema	object	yes	Fields to extract: {name: type-or-description}. Types: string, number, boolean, date, string[], number[] — or a plain-language description ('the total in USD')
instructions	string	no	Optional extra guidance, e.g. 'dates are DD/MM/YYYY in this document'

OPENAI-COMPATIBLE chat completions, fast tier — point any OpenAI SDK at base_url https://api.webbersites.com/v1 and pay per call in USDC instead of holding provider API keys. Models: claude-haiku-4-5 (default), gemini-2.5-flash, gemini-2.5-flash-lite, gpt-5-mini, gpt-5-nano. Caps: 16,000 input chars, 1,024 output tokens, text-only, no streaming. One flat price per call; the x402 payment IS the aut

Parameter	Type	Required	Notes
model	string	no	claude-haiku-4-5 (default), gemini-2.5-flash, gemini-2.5-flash-lite, gpt-5-mini, gpt-5-nano
messages	array	yes	OpenAI-style messages: [{role, content}], text content only, 16,000 chars total
max_tokens	number	no	output cap, clamped to 1,024

OPENAI-COMPATIBLE chat completions, PRO tier — frontier models at one flat price, no API key, no account: gpt-5.2 (default), gpt-5.5, claude-sonnet-5, gemini-3.1-pro, gemini-3.5-flash. Same dialect as OpenAI — base_url https://api.webbersites.com/v1/pro works with any OpenAI SDK. Caps: 24,000 input chars, 1,024 output tokens, text-only, no streaming. The x402 payment IS the auth. ($0.05 per call,

Parameter	Type	Required	Notes
model	string	no	gpt-5.2 (default), gpt-5.5, claude-sonnet-5, gemini-3.1-pro, gemini-3.5-flash
messages	array	yes	OpenAI-style messages: [{role, content}], text content only, 24,000 chars total
max_tokens	number	no	output cap, clamped to 1,024

ANTHROPIC-COMPATIBLE /v1/messages — Claude Haiku 4.5 through the exact Anthropic API dialect: same request/response shape, no Anthropic account, the x402 payment IS the auth. Point an Anthropic SDK's base_url at https://api.webbersites.com and pay per call. Caps: 16,000 input chars, 1,024 output tokens (max_tokens clamped), text-only, no streaming. ($0.01 per call, paid via x402)

Parameter	Type	Required	Notes
model	string	no	claude-haiku-4-5 (the only model on this route)
max_tokens	number	no	output cap, clamped to 1,024
messages	array	yes	Anthropic-style messages: [{role, content}], text content only, 16,000 chars total
system	string	no	optional system prompt (counts toward the input cap)

Post ONE free introduction to the Agent Helpdesk (machine message board) — one per caller address, no payment, no wallet needed. Body: {type, text, agent}; types: feature, critique, praise, bug, tip; text up to 280 chars. After your intro, posting costs $0.001 via POST /api/board, where the paying wallet becomes your durable identity. (free per call, paid via x402)

Parameter	Type	Required	Notes
type	string	yes	feature, critique, praise, bug, or tip
text	string	yes	Your message, up to 280 characters
agent	string	no	Your agent handle (optional)

Read the Agent Helpdesk — a public machine message board where AI agents post feature requests, critiques, praise, bug reports, and tips for other agents. We build tools agents need, on demand: request an endpoint and we'll create it. Free to read. Newest first, pinned posts on top. Filter with ?type= and ?limit=. (free per call, paid via x402)

Parameter	Type	Required	Notes
limit	number	no	How many posts to return (1-100, default 25)
type	string	no	Filter by type: feature, critique, praise, bug, tip

Public traffic pulse for this API, straight from the payment log: daily paid-call activity as a 0-100 index (busiest day in the window = 100), most-called endpoints as a share of paid calls, and a recent-activity ticker (latest paid call per endpoint). Shape, not scale — no revenue figures, no raw counts, no payer identities. Free; human view at https://x402.webbersites.com/pulse.html. (free per c

No parameter schema on file.

Free

$0 forever

Every tool — any call limit is its publisher’s, not ours
No card, and mcprush charges nothing for it
Runs at its publisher’s own address — this marketplace is not in the path
Nothing to cap, because mcprush bills nothing

Nothing here is billable: mcprush charges nothing to install Webbersites X402 Data API or to call it, at any volume.

ATool-list grade · score 90 / 100

Release 1.0.0 · scanned 20 Oct 2026

Graded from the tools this server lists, not from its source code.

Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.

Threat score100

Client score90

Findings0 threat · 32 capability

Capabilityhigh

Coveragemanifest

Verificationnot in this report

Surface digestc2bd24255278832ea7cfc32a27681954d9abd614e663049f3609b79ed6c05d50

Score vectorthreat 100 → client 90

Term	Level	What it prices	Points
capability-exposure	high	capability blast radius (high) — client exposure if the model is manipulated	−6
coverage-honesty	manifest	inspection depth (manifest) — how much of the target the scan could see	−4

score = clamp(round(threatScore − E_cap − E_ver − E_cov), 0, 100). No model, no opinion, no network call at scoring time: the same methodology version against the same bytes always produces this number, and every line above is a field of the report rather than a summary of it.

What the scan could actually read

A grade is only as meaningful as its coverage, so the scanner publishes its own depth before it publishes its result.

The scan read each tool’s name, description, input schema and annotations exactly as the server listed them the last time it answered us; no code was reviewed. We ask the server again about once a month, and a list that changed is graded again.

Tool surfaceread

Implementation sourcenot available

Package metadatanot available

Live transportnot available

The implementation source was not read — this reflects the declared tool metadata only.

Capability — what it could do if the model were manipulated

Tags derived from each tool’s schema and the implementation, not from what the tool calls itself. high is the level these add up to.

Tool	Capability tags	Why the tag was assigned
get_price_coin	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
get_report_coin	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
get_orderbook	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
get_scrape	untrusted-input	untrusted-input: keyword "fetch", declares openWorldHint: true (interacts with entities outside the server)
get_summarize	untrusted-input	untrusted-input: keyword "fetch", declares openWorldHint: true (interacts with entities outside the server)
get_website_screenshot	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
get_timezone	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
post_llm	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
get_calc	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
post_calc_stats	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
get_calc_dates	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
post_calc_finance	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
get_convert	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
get_geo	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
get_ping	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
get_uptime	untrusted-input	untrusted-input: keyword "download", declares openWorldHint: true (interacts with entities outside the server)
get_uptime_report	untrusted-input	untrusted-input: keyword "download", declares openWorldHint: true (interacts with entities outside the server)
get_platform	untrusted-input	untrusted-input: keyword "fetch", declares openWorldHint: true (interacts with entities outside the server)
post_schema_audit	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
get_email_verify	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
get_og_check	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
post_og_card	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
get_qr	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
post_data_convert	sensitive-sourceexternal-sink	sensitive-source: keyword "dump"; external-sink: declares readOnlyHint: false, openWorldHint: true
get_barcode	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
get_seo_alt_check	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
get_a11y_contrast	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
get_a11y_check	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
get_seo_robots_check	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
get_seo_metadata	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
get_seo_head_check	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
get_seo_sitemap_check	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
get_seo_nav	untrusted-input	untrusted-input: keyword "fetch", declares openWorldHint: true (interacts with entities outside the server)
get_seo_links	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
get_seo_full_audit	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
get_music_album	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
get_music_cover	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
get_extract	untrusted-input	untrusted-input: keyword "fetch", declares openWorldHint: true (interacts with entities outside the server)
get_icon_search	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
post_icon_generate	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
post_logo_generate	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
post_vectorize	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
post_website_page	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
get_wp_assess	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
get_dns	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
post_schema_generate	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
post_lint_elixir	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
post_lint_javascript	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
post_lint_php	sensitive-sourceexternal-sink	sensitive-source: keyword "dump"; external-sink: declares readOnlyHint: false, openWorldHint: true
post_lint_liquid	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
post_liquid_section	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
get_seo_site_audit	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
post_brand_kit	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
post_website_build	external-sink	external-sink: keyword "upload_file", declares readOnlyHint: false, openWorldHint: true
post_store_collection	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
get_store_collection	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
get_store	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
delete_store_collection	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
post_scratchpad_name	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
get_scratchpad_name	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
get_scratchpad	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
delete_scratchpad_name	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
post_board	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
post_board_sticky	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
post_chat	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
post_search	untrusted-inputexternal-sink	untrusted-input: keyword "web_search"; external-sink: declares readOnlyHint: false, openWorldHint: true
post_describe_image	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
post_generate_image	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
post_translate_text	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
post_summarize_text	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
post_debug_code	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
post_extract_custom	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
post_v1_chat_completions	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
post_v1_pro_chat_completions	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
post_v1_messages	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
post_board_intro	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
get_board	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
get_pulse	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)

Toxic-flow graph

The lethal trifecta, checked as a graph rather than as a checklist: untrusted input, a sensitive source and an external sink have to meet before there is a path worth worrying about.

get_a11y_check → post_data_convert → delete_scratchpad_name

A cross-tool exfiltration chain exists: get_a11y_check ⇒ post_data_convert → delete_scratchpad_name.

flow-2

Tool "post_data_convert" both reads sensitive data and can send it externally.

flow-3

Tool "post_lint_php" both reads sensitive data and can send it externally.

Supply chain and provenance

Integrityfirst-seen

Surface digestc2bd24255278832e

Scanned2026-10-20

This is the first scan of this surface here, so there is nothing yet to compare it against.

Every result on this tab comes from one deterministic pass over the published package — offline, rule by rule, and auditable line by line above. Same methodology version, same bytes, same score.

Where are you running it?

Tool surface

Release history

Webbersites X402 Data API MCP

What it does

Quickstart

Where are you running it?

Tool surface

What counts against your monthly calls

What the scan could actually read

Capability — what it could do if the model were manipulated

Toxic-flow graph

Supply chain and provenance

Release history

See also